Merge pull request #16 from corvus-migratorius/add-wg-hub

Add wg hub

README.md

@@ -7,3 +7,4 @@
 
 - [mount_device](roles/mount_device/README.md)
 - [alertmanager](roles/alertmanager/README.md)
+- [wg_hub](roles/wg_hub/README.md)

galaxy.yml

@@ -1,7 +1,7 @@
 ---
 namespace: genlab
 name: common
-version: 0.0.1
+version: 0.3.1
 readme: README.md
 authors:
   - Alexander Gorelyshev (corvus-migratorius@proton.me)

roles/wg_hub/README.md

@@ -0,0 +1,43 @@
+template
+=========
+
+Template for Ansible role monorepos.
+
+⚠️ Do not forget to update:
+
+- `meta/main.yml`
+- Conda/Mamba manifests
+- this README =)
+
+Requirements
+------------
+
+None
+
+Role Variables
+--------------
+
+None
+
+Dependencies
+------------
+
+None
+
+Example Playbook
+----------------
+
+```yaml
+roles:
+    - role: genlab.template
+```
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+corvus-migratorius@proton.me

roles/wg_hub/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+wg_hub_iface_name: wg0
+wg_hub_host_id: hub
+wg_hub_ipv4_vpn_addr: 10.0.0.254
+wg_hub_ipv4_vpn_cidr: 24
+wg_hub_wg_port: 51820
+wg_hub_hide_secrets: true

roles/wg_hub/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: "Run the Wireguard service"
+  ansible.builtin.systemd_service:
+    name: wg-quick@{{ wg_hub_iface_name | replace("-", "_") }}
+    state: restarted
+    enabled: true
+    daemon_reload: true

roles/wg_hub/meta/main.yml

@@ -0,0 +1,17 @@
+---
+galaxy_info:
+  role_name: "wg_hub"
+  namespace: genlab
+  author: "Alexander Gorelyshev"
+  company: "Genlab, LLC"
+  description: ""
+  license: "MIT"
+  min_ansible_version: "2.1"
+
+  platforms:
+    - name: "Ubuntu"
+      versions: ["jammy", "noble"]
+
+  galaxy_tags: []
+
+dependencies: []

roles/wg_hub/molecule/default/converge.yml

@@ -0,0 +1,24 @@
+---
+- name: Converge
+  hosts: all
+  vars:
+    wg_hub_iface_name: adm
+    wg_hub_ipv4_vpn_addr: 10.0.0.254
+    wg_hub_ipv4_vpn_cidr: 24
+    wg_hub_wg_port: 51820
+    wg_hub_wg_pkey: gABk6e/n3UDgudEVlUrEVcVdn0tc0YVDeCASsI10QFA=
+    wg_hub_wg_pubkey: EvcoZ21/p0AHz5y95jwjVIR9puljc2kXqh/f3U1A4nk=
+    wg_hub_hide_secrets: false
+    # dns_server: 127.0.0.1:5300  # doesn't work in Github Actions environment
+    peers:
+      - wg_hub_host_id: alpha
+        wg_hub_ipv4_vpn_addr: 10.0.0.1
+        wg_hub_wg_pubkey: LfEJgNiJ05nx4nWB0Pj3wS3WRyFq567fsdDh4XZqRF0=
+        wg_psk: i3JCrQOfptZhgpL+BTm/65MPW/ljJexCgiuWMIqZJYo=
+      - wg_hub_host_id: beta
+        wg_hub_ipv4_vpn_addr: 10.0.0.2
+        wg_hub_wg_pubkey: oq3Fcwwfxsi5f5UHcZKtxMwQ2aSeHOUe3r35soUUYzU=
+        wg_psk: Z/z7Qo8hW97UcImYE/ZbCxpNmizfVhvl0dzygtvtYYg=
+
+  roles:
+    - role: genlab.common.wg_hub

roles/wg_hub/molecule/default/molecule.yml

@@ -0,0 +1,27 @@
+---
+dependency:
+  name: galaxy
+
+driver:
+  name: docker
+
+platforms:
+  - name: ubuntu
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest
+    pre_build_image: true
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+
+provisioner:
+  name: ansible
+
+verifier:
+  name: ansible
+
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

roles/wg_hub/molecule/default/verify.yml

@@ -0,0 +1,13 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  any_errors_fatal: true
+  vars:
+    iface_name: adm
+
+  tasks:
+    - name: "Check that the Wireguard service is running"
+      ansible.builtin.service:
+        name: wg-quick@{{ iface_name }}
+        state: started

roles/wg_hub/tasks/main.yml

@@ -0,0 +1,54 @@
+---
+- name: "Install wireguard system-wide"
+  ansible.builtin.apt:
+    name: wireguard
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: "Ensure no dashes in the interface name"
+  when: "'-' in wg_hub_iface_name"
+  ansible.builtin.fail:
+    msg: "The interface name must not contain dashes, got: '{{ wg_hub_iface_name }}'"
+
+- name: "Create the Hub configuration file"
+  no_log: "{{ wg_hub_hide_secrets }}"
+  notify: "Run the Wireguard service"
+  ansible.builtin.blockinfile:
+    path: "/etc/wireguard/{{ wg_hub_iface_name }}.conf"
+    create: true
+    owner: root
+    group: root
+    mode: "0600"
+    state: present
+    block: |
+      [Interface]
+      Address = {{ wg_hub_ipv4_vpn_addr }}/32
+      ListenPort = {{ wg_hub_wg_port }}
+      PrivateKey = {{ wg_hub_wg_pkey }}
+
+      PreUp = sysctl -w net.ipv4.ip_forward=1
+      {% if dns_server is defined %}
+      PostUp = resolvectl dns %i {{ dns_server }}; resolvectl domain %i {{ wg_hub_iface_name }}.local
+      {% endif %}
+      PostDown = sysctl -w net.ipv4.ip_forward=0
+
+- name: "Add [Peer] sections to the Hub configuration file"
+  no_log: "{{ wg_hub_hide_secrets }}"
+  notify: "Run the Wireguard service"
+  loop: "{{ peers }}"
+  vars:
+    domain_name: "{{ item.wg_hub_host_id }}.{{ wg_hub_iface_name }}.local"
+  ansible.builtin.blockinfile:
+    path: "/etc/wireguard/{{ wg_hub_iface_name }}.conf"
+    owner: root
+    group: root
+    mode: "0600"
+    marker: "# {mark} ANSIBLE MANAGED SPOKE BLOCK: {{ domain_name }}"
+    block: |
+      #
+      [Peer]  # {{ domain_name }}
+      PublicKey = {{ item.wg_hub_wg_pubkey }}
+      PresharedKey = {{ item.wg_psk }}
+      AllowedIPs = {{ item.wg_hub_ipv4_vpn_addr }}/32
+      #

roles/wg_hub/vars/main.yml

@@ -0,0 +1 @@
+---