Add Wireguard playbook and first commit

roles/homelab/wireguard/tasks/configure_bind9.yml

@@ -0,0 +1,20 @@
+---
+
+- name: "Import named.conf.local"
+  tags: bind9
+  ansible.builtin.template:
+    src: named.conf.local.j2
+    dest: /etc/bind/named.conf.local
+    owner: root
+    group: bind
+    mode: '0644'
+
+- name: "Import data base domain serti.fun"
+  tags: bind9
+  ansible.builtin.template:
+    src: db.serti.fun.j2
+    dest: /etc/bind/db.serti.fun
+    owner: root
+    group: bind
+    mode: '0644'
+  notify: "restart named"

roles/homelab/wireguard/tasks/configure_system.yml

@@ -0,0 +1,17 @@
+---
+
+- name: "Enable ipv4 forward"
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: 1
+    state: present
+    reload: yes
+
+- name: "Upload nftable"
+  ansible.builtin.template:
+    src: nftables.conf.j2
+    dest: /etc/nftables.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: "restart nftables"

roles/homelab/wireguard/tasks/configure_wireguard_server.yml

@@ -0,0 +1,39 @@
+---
+
+- name: "Generate private key"
+  ansible.builtin.command:
+    cmd: wg genkey
+  register: wg_server_privkey
+  args:
+    creates: "{{ wireguard_config_dir }}/server_private.key"
+  no_log: true
+
+- name: "Save private key"
+  ansible.builtin.copy:
+    content: "{{ wg_server_privkey.stdout }}"
+    dest: "{{ wireguard_config_dir }}/server_private.key"
+    owner: root
+    group: root
+    mode: "0600"
+  when: wg_server_privkey.changed
+  no_log: true
+
+- name: "Read private key"
+  ansible.builtin.slurp:
+    src: "{{ wireguard_config_dir }}/server_private.key"
+  register: wg_server_privkey_content
+  no_log: true
+
+- name: "Generate public key"
+  ansible.builtin.shell:
+    cmd: "cat {{ wireguard_config_dir }}/server_private.key | wg pubkey"
+  register:  wg_server_pubkey
+  changed_when: false
+
+- name: "Save public key"
+  ansible.builtin.copy:
+    content: "{{ wg_server_pubkey.stdout }}"
+    dest: "{{ wireguard_config_dir }}/server_public.key"
+    owner: root
+    group: root
+    mode: "0600"

roles/homelab/wireguard/tasks/install_package.yml

@@ -0,0 +1,14 @@
+---
+- name: "Install default packages"
+  ansible.builtin.apt:
+    name: "{{ default_packages }}"
+    state: present
+  become: true
+  register: deps_installed
+
+- name: "Install wireguard"
+  ansible.builtin.apt:
+    name: "{{ wireguard_packages }}"
+    state: present
+  become: true
+  register: deps_installed

roles/homelab/wireguard/tasks/main.yml

@@ -0,0 +1,73 @@
+---
+
+- name: "Change repos"
+  ansible.builtin.template:
+    src: mirror-yandex.ru.j2
+    dest: /etc/apt/sources.list
+    owner: root
+    group: root
+    mode: '0744'
+
+- name: "Update cache"
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: "Install packages"
+  ansible.builtin.include_tasks: install_package.yml
+
+- name: "Configure system"
+  ansible.builtin.include_tasks: configure_system.yml
+
+- name: "Configure wireguard server"
+  ansible.builtin.include_tasks: configure_wireguard_server.yml
+
+- name: "Create client dirrectory"
+  ansible.builtin.file:
+    path: "{{ wireguard_client_config_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: "Include peer management tasks"
+  tags: peers
+  ansible.builtin.include_tasks: peers.yml
+
+- name: "Deploy wireguard server configuration"
+  ansible.builtin.template:
+    src: wg0.conf.j2
+    dest: "{{ wireguard_config_dir }}/{{ wireguard_interface }}.conf"
+    owner: root
+    group: root
+    mode: '0600'
+  notify: "restart wireguard"
+  #notify: restart wireguard_client_config_dir
+
+- name: "Confiugre bind9"
+  tags: bind9
+  ansible.builtin.include_tasks: configure_bind9.yml
+
+- name: "Enable and start nftables"
+  ansible.builtin.systemd:
+    name: "nftables"
+    state: started
+    enabled: yes
+
+- name: "Enable and start wireguard"
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}"
+    state: started
+    enabled: yes
+
+- name: "Enable and start bind9"
+  ansible.builtin.systemd:
+    name: "bind9"
+    state: started
+    enabled: yes
+  
+- name: "Enable and start named"
+  ansible.builtin.systemd:
+    name: "named"
+    state: started
+    enabled: yes

roles/homelab/wireguard/tasks/peers.yml

@@ -0,0 +1,71 @@
+---
+
+- name: "Generate private keys"
+  ansible.builtin.shell:
+    cmd: wg genkey
+  register: "peer_keys"
+  loop: "{{ wireguard_clients }}"
+  loop_control:
+    label: "{{ item.name }}"
+  args:
+    creates: "{{ wireguard_config_dir }}/peer_{{ item.name }}_private.key"
+  no_log: true
+
+- name: "Save private keys"
+  ansible.builtin.copy:
+    content: "{{ item.stdout }}"
+    dest: "{{ wireguard_config_dir }}/peer_{{ item.item.name }}_private.key"
+    owner: root
+    group: root
+    mode: "0600"
+  loop: "{{ peer_keys.results }}"
+  loop_control:
+    label: "{{ item.item.name }}"
+  when: item.change | default(false)
+  no_log: true
+
+- name: "Read all private keys"
+  ansible.builtin.slurp:
+    src: "{{ wireguard_config_dir }}/peer_{{ item.name }}_private.key"
+  register: peer_privkey_contents
+  loop: "{{ wireguard_clients }}"
+  loop_control:
+    label: "{{ item.name }}"
+  no_log: true
+
+- name: "Generate public keys"
+  ansible.builtin.shell:
+    cmd: "cat {{ wireguard_config_dir }}/peer_{{ item.name }}_private.key | wg pubkey"
+  register: peer_pubkey
+  loop: "{{ wireguard_clients }}"
+  loop_control:
+    label: "{{ item.name }}"
+  changed_when: false
+
+- name: "Save public keys"
+  ansible.builtin.copy:
+    content: "{{ item.stdout }}"
+    dest: "{{ wireguard_config_dir }}/peer_{{ item.item.name }}_public.key"
+    mode: '0644'
+  loop: "{{ peer_pubkey.results }}"
+  loop_control:
+    label: "{{ item.item.name }}"
+
+- name: "Generate client configuration files"
+  ansible.builtin.template:
+    src: client.conf.j2
+    dest: "{{ wireguard_client_config_dir }}/{{ item.0.name }}.conf"
+    owner: root
+    group: root
+    mode: '0600'
+  loop: "{{ wireguard_clients | zip(peer_privkey_contents.results, peer_pubkey.results) | list }}"
+  loop_control:
+    label: "{{ item.0.name }}"
+
+- name: "Generate QR codes for moblie clients"
+  ansible.builtin.shell:
+    cmd: "qrencode -t ansiutf8 < {{ wireguard_client_config_dir }}/{{ item.name }}.conf > {{ wireguard_client_config_dir }}/{{ item.name }}_qr.txt"
+  loop: "{{ wireguard_clients }}"
+  loop_control:
+    label: "{{ item.name }}"
+  changed_when: false