55 lines
1.7 KiB
YAML
55 lines
1.7 KiB
YAML
---
|
|
- name: "Install wireguard system-wide"
|
|
ansible.builtin.apt:
|
|
name: wireguard
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: "Ensure no dashes in the interface name"
|
|
when: "'-' in wg_hub_iface_name"
|
|
ansible.builtin.fail:
|
|
msg: "The interface name must not contain dashes, got: '{{ wg_hub_iface_name }}'"
|
|
|
|
- name: "Create the Hub configuration file"
|
|
no_log: "{{ wg_hub_hide_secrets }}"
|
|
notify: "Run the Wireguard service"
|
|
ansible.builtin.blockinfile:
|
|
path: "/etc/wireguard/{{ wg_hub_iface_name }}.conf"
|
|
create: true
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
state: present
|
|
block: |
|
|
[Interface]
|
|
Address = {{ wg_hub_ipv4_vpn_addr }}/32
|
|
ListenPort = {{ wg_hub_wg_port }}
|
|
PrivateKey = {{ wg_hub_wg_pkey }}
|
|
|
|
PreUp = sysctl -w net.ipv4.ip_forward=1
|
|
{% if dns_server is defined %}
|
|
PostUp = resolvectl dns %i {{ wg_hub_dns_server }}; resolvectl domain %i {{ wg_hub_iface_name }}.local
|
|
{% endif %}
|
|
PostDown = sysctl -w net.ipv4.ip_forward=0
|
|
|
|
- name: "Add [Peer] sections to the Hub configuration file"
|
|
no_log: "{{ wg_hub_hide_secrets }}"
|
|
notify: "Run the Wireguard service"
|
|
loop: "{{ peers }}"
|
|
vars:
|
|
domain_name: "{{ item.wg_hub_host_id }}.{{ wg_hub_iface_name }}.local"
|
|
ansible.builtin.blockinfile:
|
|
path: "/etc/wireguard/{{ wg_hub_iface_name }}.conf"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
marker: "# {mark} ANSIBLE MANAGED SPOKE BLOCK: {{ wg_hub_domain_name }}"
|
|
block: |
|
|
#
|
|
[Peer] # {{ wg_hub_domain_name }}
|
|
PublicKey = {{ item.wg_pubkey }}
|
|
PresharedKey = {{ item.wg_psk }}
|
|
AllowedIPs = {{ item.ipv4_vpn_addr }}/32
|
|
#
|