Add Wireguard playbook and first commit

roles/homelab/wireguard/templates/nftables.conf.j2

@@ -0,0 +1,47 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+	set home_net {
+		type ipv4_addr
+		flags interval
+		comment "Home subnet"
+		elements = {100.222.5.0/24}
+	} 
+	set iot_net {
+		type ipv4_addr
+		flags interval
+		comment "iOT subnet"
+		elements = {100.222.6.0/24}
+	} 
+	set vpn_net {
+		type ipv4_addr
+		flags interval
+		comment "iOT subnet"
+		elements = {100.222.11.0/24}
+	} 
+
+	chain input {
+		type filter hook input priority filter; policy drop;
+
+		iif lo accept comment "Accept any localhost trafic"
+		ct state invalid drop comment "Drop invalid connection"
+		fib daddr . iif type != {local, broadcast, multicast} drop
+		ct state { established, related } accept
+
+		#meta l4proto { icmp, ipv6-icmp } accept comment "Accept ICMP"
+
+		tcp dport 22 accept comment "Allow ssh connection from home subnet"
+		ip saddr @vpn_net tcp dport 53 accept comment "Allow ssh connection from home subnet"
+
+		ip saddr @vpn_net udp dport 53 accept comment "Allow ssh connection from home subnet"
+		udp dport {{ wireguard_port }} accept comment "Wireguard port"
+	}
+	chain forward {
+		type filter hook forward priority filter;
+	}
+	chain output {
+		type filter hook output priority filter;
+	}
+}