42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
---
|
|
- name: "Install Wireguard system-wide"
|
|
ansible.builtin.apt:
|
|
name: wireguard
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: "Ensure no dashes in the interface name"
|
|
when: "'-' in iface_name"
|
|
ansible.builtin.fail:
|
|
msg: "The interface name must not contain dashes, got: '{{ iface_name }}'"
|
|
|
|
- name: "Create a Spoke configuration file"
|
|
no_log: "{{ wg_spoke_hide_secrets }}"
|
|
notify: "Run the Wireguard service"
|
|
ansible.builtin.blockinfile:
|
|
path: "/etc/wireguard/{{ iface_name }}.conf"
|
|
create: true
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
state: present
|
|
block: |
|
|
[Interface] # Local settings for this node
|
|
Address = {{ spoke_ipv4_vpn }}/32
|
|
ListenPort = {{ spoke_port }}
|
|
PrivateKey = {{ spoke_pkey }}
|
|
|
|
{% if dns_server is defined and domain is defined %}
|
|
PostUp = resolvectl dns %i {{ dns_server }}; resolvectl domain %i {{ domain }}
|
|
{% endif %}
|
|
|
|
[Peer] # Settings for the Hub peer
|
|
PublicKey = {{ hub_pubkey }}
|
|
{% if spoke_psk is defined %}
|
|
PresharedKey = {{ spoke_psk }}
|
|
{% endif %}
|
|
AllowedIPs = {{ subnet }}/{{ netmask }}
|
|
Endpoint = {{ hub_ipv4_wan }}:{{ hub_port }}
|
|
PersistentKeepalive = 20
|