From 19989e72d84e090b029404b54526bfcda87cd500 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:13:00 +0300 Subject: [PATCH 1/3] add wg_hub role with fixed ansible-lint errors --- roles/wg_hub/README.md | 43 +++++++++++++++++ roles/wg_hub/defaults/main.yml | 7 +++ roles/wg_hub/handlers/main.yml | 7 +++ roles/wg_hub/meta/main.yml | 17 +++++++ roles/wg_hub/molecule/default/converge.yml | 24 ++++++++++ roles/wg_hub/molecule/default/molecule.yml | 27 +++++++++++ roles/wg_hub/molecule/default/verify.yml | 13 ++++++ roles/wg_hub/tasks/main.yml | 54 ++++++++++++++++++++++ roles/wg_hub/vars/main.yml | 1 + 9 files changed, 193 insertions(+) create mode 100644 roles/wg_hub/README.md create mode 100644 roles/wg_hub/defaults/main.yml create mode 100644 roles/wg_hub/handlers/main.yml create mode 100644 roles/wg_hub/meta/main.yml create mode 100644 roles/wg_hub/molecule/default/converge.yml create mode 100644 roles/wg_hub/molecule/default/molecule.yml create mode 100644 roles/wg_hub/molecule/default/verify.yml create mode 100644 roles/wg_hub/tasks/main.yml create mode 100644 roles/wg_hub/vars/main.yml diff --git a/roles/wg_hub/README.md b/roles/wg_hub/README.md new file mode 100644 index 0000000..fe551c0 --- /dev/null +++ b/roles/wg_hub/README.md @@ -0,0 +1,43 @@ +template +========= + +Template for Ansible role monorepos. + +⚠️ Do not forget to update: + +- `meta/main.yml` +- Conda/Mamba manifests +- this README =) + +Requirements +------------ + +None + +Role Variables +-------------- + +None + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.template +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/wg_hub/defaults/main.yml b/roles/wg_hub/defaults/main.yml new file mode 100644 index 0000000..7bf9b28 --- /dev/null +++ b/roles/wg_hub/defaults/main.yml @@ -0,0 +1,7 @@ +--- +wg_hub_iface_name: wg0 +wg_hub_host_id: hub +wg_hub_ipv4_vpn_addr: 10.0.0.254 +wg_hub_ipv4_vpn_cidr: 24 +wg_hub_wg_port: 51820 +wg_hub_hide_secrets: true diff --git a/roles/wg_hub/handlers/main.yml b/roles/wg_hub/handlers/main.yml new file mode 100644 index 0000000..ff2cedb --- /dev/null +++ b/roles/wg_hub/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: "Run the Wireguard service" + ansible.builtin.systemd_service: + name: wg-quick@{{ wg_hub_iface_name | replace("-", "_") }} + state: restarted + enabled: true + daemon_reload: true diff --git a/roles/wg_hub/meta/main.yml b/roles/wg_hub/meta/main.yml new file mode 100644 index 0000000..e2da64a --- /dev/null +++ b/roles/wg_hub/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: "wg_hub" + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "" + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: ["jammy", "noble"] + + galaxy_tags: [] + +dependencies: [] diff --git a/roles/wg_hub/molecule/default/converge.yml b/roles/wg_hub/molecule/default/converge.yml new file mode 100644 index 0000000..e807dae --- /dev/null +++ b/roles/wg_hub/molecule/default/converge.yml @@ -0,0 +1,24 @@ +--- +- name: Converge + hosts: all + vars: + wg_hub_iface_name: adm + wg_hub_ipv4_vpn_addr: 10.0.0.254 + wg_hub_ipv4_vpn_cidr: 24 + wg_hub_wg_port: 51820 + wg_hub_wg_pkey: gABk6e/n3UDgudEVlUrEVcVdn0tc0YVDeCASsI10QFA= + wg_hub_wg_pubkey: EvcoZ21/p0AHz5y95jwjVIR9puljc2kXqh/f3U1A4nk= + wg_hub_hide_secrets: false + # dns_server: 127.0.0.1:5300 # doesn't work in Github Actions environment + peers: + - wg_hub_host_id: alpha + wg_hub_ipv4_vpn_addr: 10.0.0.1 + wg_hub_wg_pubkey: LfEJgNiJ05nx4nWB0Pj3wS3WRyFq567fsdDh4XZqRF0= + wg_psk: i3JCrQOfptZhgpL+BTm/65MPW/ljJexCgiuWMIqZJYo= + - wg_hub_host_id: beta + wg_hub_ipv4_vpn_addr: 10.0.0.2 + wg_hub_wg_pubkey: oq3Fcwwfxsi5f5UHcZKtxMwQ2aSeHOUe3r35soUUYzU= + wg_psk: Z/z7Qo8hW97UcImYE/ZbCxpNmizfVhvl0dzygtvtYYg= + + roles: + - role: genlab.common.wg_hub diff --git a/roles/wg_hub/molecule/default/molecule.yml b/roles/wg_hub/molecule/default/molecule.yml new file mode 100644 index 0000000..fd2f06d --- /dev/null +++ b/roles/wg_hub/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/wg_hub/molecule/default/verify.yml b/roles/wg_hub/molecule/default/verify.yml new file mode 100644 index 0000000..38f93ff --- /dev/null +++ b/roles/wg_hub/molecule/default/verify.yml @@ -0,0 +1,13 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + vars: + iface_name: adm + + tasks: + - name: "Check that the Wireguard service is running" + ansible.builtin.service: + name: wg-quick@{{ iface_name }} + state: started diff --git a/roles/wg_hub/tasks/main.yml b/roles/wg_hub/tasks/main.yml new file mode 100644 index 0000000..78551ea --- /dev/null +++ b/roles/wg_hub/tasks/main.yml @@ -0,0 +1,54 @@ +--- +- name: "Install wireguard system-wide" + ansible.builtin.apt: + name: wireguard + state: present + update_cache: true + cache_valid_time: 3600 + +- name: "Ensure no dashes in the interface name" + when: "'-' in wg_hub_iface_name" + ansible.builtin.fail: + msg: "The interface name must not contain dashes, got: '{{ wg_hub_iface_name }}'" + +- name: "Create the Hub configuration file" + no_log: "{{ wg_hub_hide_secrets }}" + notify: "Run the Wireguard service" + ansible.builtin.blockinfile: + path: "/etc/wireguard/{{ wg_hub_iface_name }}.conf" + create: true + owner: root + group: root + mode: "0600" + state: present + block: | + [Interface] + Address = {{ wg_hub_ipv4_vpn_addr }}/32 + ListenPort = {{ wg_hub_wg_port }} + PrivateKey = {{ wg_hub_wg_pkey }} + + PreUp = sysctl -w net.ipv4.ip_forward=1 + {% if dns_server is defined %} + PostUp = resolvectl dns %i {{ dns_server }}; resolvectl domain %i {{ wg_hub_iface_name }}.local + {% endif %} + PostDown = sysctl -w net.ipv4.ip_forward=0 + +- name: "Add [Peer] sections to the Hub configuration file" + no_log: "{{ wg_hub_hide_secrets }}" + notify: "Run the Wireguard service" + loop: "{{ peers }}" + vars: + domain_name: "{{ item.wg_hub_host_id }}.{{ wg_hub_iface_name }}.local" + ansible.builtin.blockinfile: + path: "/etc/wireguard/{{ wg_hub_iface_name }}.conf" + owner: root + group: root + mode: "0600" + marker: "# {mark} ANSIBLE MANAGED SPOKE BLOCK: {{ domain_name }}" + block: | + # + [Peer] # {{ domain_name }} + PublicKey = {{ item.wg_hub_wg_pubkey }} + PresharedKey = {{ item.wg_psk }} + AllowedIPs = {{ item.wg_hub_ipv4_vpn_addr }}/32 + # diff --git a/roles/wg_hub/vars/main.yml b/roles/wg_hub/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/wg_hub/vars/main.yml @@ -0,0 +1 @@ +--- From 6debe6fb7f530cfeafbf3451f345566aab454ecb Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:13:29 +0300 Subject: [PATCH 2/3] add wg_hub link to README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index eecffb1..241639d 100644 --- a/README.md +++ b/README.md @@ -7,3 +7,4 @@ - [mount_device](roles/mount_device/README.md) - [alertmanager](roles/alertmanager/README.md) +- [wg_hub](roles/wg_hub/README.md) \ No newline at end of file From 36fa1793247d89e726b9498cfc8377341723606d Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:13:40 +0300 Subject: [PATCH 3/3] update minor version --- galaxy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/galaxy.yml b/galaxy.yml index b17cb19..beac011 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -1,7 +1,7 @@ --- namespace: genlab name: common -version: 0.0.1 +version: 0.3.1 readme: README.md authors: - Alexander Gorelyshev (corvus-migratorius@proton.me)