ansible-wireguard/templates/wireguard.conf.j2

[Interface]
Address = {{ wireguard.net.v4.addr }}.1/{{ wireguard.net.v4.range.serv }}, {{ wireguard.net.v6.addr }}:1/{{ wireguard.net.v6.range.serv }}
PostUp = iptables -A FORWARD -i {{ wireguard.interface }} -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -o {{ wireguard.interface }} -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -o {{ wireguard.interface }} -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i {{ wireguard.interface }} -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = {{ wireguard.port }}
PrivateKey = {{ vault_wireguard.privkey }}

{% for user in wireguard.peers %}
[Peer]
PublicKey = {{ user.pubkey }} 
AllowedIPs = {{ wireguard.net.v4.addr }}.{{ user.bit }}/{{ wireguard.net.v4.range.clnt }}, {{ wireguard.net.v6.addr}}:{{ user.bit }}/{{ wireguard.net.v6.range.clnt }}
{% endfor %}