Use built-in roles for tasks and fix config
This commit is contained in:
parent
01d272f052
commit
5cd12c15dc
|
@ -1,15 +0,0 @@
|
||||||
- name: Enable wg-quick
|
|
||||||
systemd:
|
|
||||||
name: 'wg-quick@{{ wireguard.interface }}'
|
|
||||||
enabled: yes
|
|
||||||
state: restarted
|
|
||||||
daemon_reload: yes
|
|
||||||
- name: Restart wg-quick
|
|
||||||
systemd:
|
|
||||||
name: 'wg-quick@{{ wireguard.interface }}'
|
|
||||||
state: restarted
|
|
||||||
- name: Save netfilter rules
|
|
||||||
command:
|
|
||||||
argv:
|
|
||||||
- '/usr/sbin/netfilter-persistent'
|
|
||||||
- 'save'
|
|
|
@ -1,54 +1,13 @@
|
||||||
- name: Include sensitive info
|
|
||||||
include_vars:
|
|
||||||
dir: '{{ role_path }}/vault'
|
|
||||||
tags:
|
|
||||||
- vault
|
|
||||||
- name: Create configuration directory
|
|
||||||
file:
|
|
||||||
path: '/etc/wireguard'
|
|
||||||
state: directory
|
|
||||||
tags:
|
|
||||||
- setup
|
|
||||||
- configs
|
|
||||||
- name: Copy configuration files
|
- name: Copy configuration files
|
||||||
|
loop:
|
||||||
|
- { src: "wireguard.conf.j2", dest: "/etc/wireguard/wg0.conf", mode: '600' }
|
||||||
template:
|
template:
|
||||||
follow: yes
|
follow: yes
|
||||||
src: 'wireguard.conf.j2'
|
src: '{{ item.src }}'
|
||||||
dest: '/etc/wireguard/wg0.conf'
|
dest: '{{ item.dest }}'
|
||||||
mode: '600'
|
mode: '{{ item.mode }}'
|
||||||
notify: Restart wg-quick
|
notify: Run service actions
|
||||||
tags:
|
tags:
|
||||||
- update
|
- update
|
||||||
- configs
|
- configs
|
||||||
- vault
|
- vault
|
||||||
- name: Install wireguard kernel module and tools
|
|
||||||
apt:
|
|
||||||
install_recommends: no
|
|
||||||
name:
|
|
||||||
- wireguard-tools
|
|
||||||
- wireguard # TODO: Check if kernel version > 5.6, it is included in the kernel following that
|
|
||||||
state: present
|
|
||||||
cache_valid_time: 3600
|
|
||||||
tags:
|
|
||||||
- setup
|
|
||||||
- packages
|
|
||||||
notify: Enable wg-quick
|
|
||||||
- name: Allow wireguard through the firewall
|
|
||||||
loop:
|
|
||||||
- { ipv: 'ipv4', proto: 'tcp' }
|
|
||||||
- { ipv: 'ipv6', proto: 'tcp' }
|
|
||||||
iptables:
|
|
||||||
chain: INPUT
|
|
||||||
ctstate:
|
|
||||||
- NEW
|
|
||||||
- ESTABLISHED
|
|
||||||
- RELATED
|
|
||||||
destination_port: "{{ services.wireguard.port }}"
|
|
||||||
jump: ACCEPT
|
|
||||||
ip_version: '{{ item.ipv }}'
|
|
||||||
protocol: '{{ item.proto }}'
|
|
||||||
notify:
|
|
||||||
- Save netfilter rules
|
|
||||||
tags:
|
|
||||||
- update
|
|
||||||
- firewall
|
|
||||||
|
|
|
@ -1,12 +1,12 @@
|
||||||
[Interface]
|
[Interface]
|
||||||
Address = {{ services.wireguard.net.v4.addr }}.1/{{ wireguard.net.v4.range.serv }}, {{ wireguard.net.v6.addr }}:1/{{ wireguard.net.v6.range.serv }}
|
Address = {{ services.wireguard.net.v4.addr }}.1/{{ services.wireguard.net.v4.range.serv }}, {{ services.wireguard.net.v6.addr }}:1/{{ services.wireguard.net.v6.range.serv }}
|
||||||
PostUp = iptables -A FORWARD -i {{ services.wireguard.interface }} -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i {{ wireguard.interface }} -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
PostUp = iptables -A FORWARD -i {{ services.wireguard.interface }} -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i {{ services.wireguard.interface }} -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||||
PostDown = iptables -D FORWARD -i {{ services.wireguard.interface }} -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i {{ wireguard.interface }} -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
|
PostDown = iptables -D FORWARD -i {{ services.wireguard.interface }} -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i {{ services.wireguard.interface }} -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
|
||||||
ListenPort = {{ services.wireguard.port }}
|
ListenPort = {{ services.wireguard.port }}
|
||||||
PrivateKey = {{ wg.privkey }}
|
PrivateKey = {{ wg.privkey }}
|
||||||
|
|
||||||
{% for user in services.wireguard.peers %}
|
{% for user in services.wireguard.peers %}
|
||||||
[Peer]
|
[Peer]
|
||||||
PublicKey = {{ user.pubkey }}
|
PublicKey = {{ user.pubkey }}
|
||||||
AllowedIPs = {{ services.wireguard.net.v4.addr }}.{{ user.bit }}/{{ wireguard.net.v4.range.clnt }}, {{ wireguard.net.v6.addr}}:{{ user.bit }}/{{ wireguard.net.v6.range.clnt }}
|
AllowedIPs = {{ services.wireguard.net.v4.addr }}.{{ user.bit }}/{{ services.wireguard.net.v4.range.clnt }}, {{ services.wireguard.net.v6.addr}}:{{ user.bit }}/{{ services.wireguard.net.v6.range.clnt }}
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
|
@ -0,0 +1,11 @@
|
||||||
|
file:
|
||||||
|
- { path: '/etc/wireguard', owner: 'root', group: 'root', mode: '600', state: directory }
|
||||||
|
apt_packages:
|
||||||
|
- { package: "wireguard-tools", state: present }
|
||||||
|
- { package: "wireguard", state: present }
|
||||||
|
systemd:
|
||||||
|
services:
|
||||||
|
- { name: "wg-quick@wg0", enabled: true, state: restarted }
|
||||||
|
firewall:
|
||||||
|
- { port: "{{ services.wireguard.port }}", ipv: "v4", proto: "tcp" }
|
||||||
|
- { port: "{{ services.wireguard.port }}", ipv: "v6", proto: "tcp" }
|
Reference in New Issue