Browse Source

Initial commit

master
Alex 1 year ago
commit
773137c9d3
Signed by: caskd GPG Key ID: F92BA85F61F4C173
  1. 1
      .gitignore
  2. 14
      handlers/main.yml
  3. 49
      tasks/main.yml
  4. 12
      templates/wireguard.conf.j2
  5. 20
      vars/main.yml

1
.gitignore

@ -0,0 +1 @@
vault/

14
handlers/main.yml

@ -0,0 +1,14 @@
- name: Enable wg-quick
systemd:
name: 'wg-quick@{{ wireguard.interface }}'
enabled: yes
state: started
- name: Restart wg-quick
systemd:
name: 'wg-quick@{{ wireguard.interface }}'
state: restarted
- name: Save netfilter rules
command:
argv:
- '/usr/sbin/netfilter-persistent'
- 'save'

49
tasks/main.yml

@ -0,0 +1,49 @@
- name: Create configuration directory
file:
path: '/etc/wireguard'
state: directory
tags:
- setup
- configs
- name: Copy configuration files
template:
follow: yes
src: 'wireguard.conf.j2'
dest: '/etc/wireguard/wg0.conf'
mode: '600'
notify: Restart wg-quick
tags:
- update
- configs
- vault
- name: Install wireguard kernel module and tools
apt:
install_recommends: no
name:
- wireguard-tools
- wireguard # TODO: Check if kernel version > 5.6, it is included in the kernel following that
state: present
cache_valid_time: 3600
tags:
- setup
- packages
notify: Enable wg-quick
- name: Allow wireguard through the firewall
loop:
- { ipv: 'ipv4', proto: 'tcp' }
- { ipv: 'ipv6', proto: 'tcp' }
iptables:
chain: INPUT
ctstate:
- NEW
- ESTABLISHED
- RELATED
destination_port: "{{ wireguard.port }}"
jump: ACCEPT
ip_version: '{{ item.ipv }}'
protocol: '{{ item.proto }}'
notify:
- Save netfilter rules
tags:
- update
- firewall

12
templates/wireguard.conf.j2

@ -0,0 +1,12 @@
[Interface]
Address = {{ wireguard.net.v4.addr }}.1/{{ wireguard.net.v4.range.serv }}, {{ wireguard.net.v6.addr }}:1/{{ wireguard.net.v6.range.serv }}
PostUp = iptables -A FORWARD -i {{ wireguard.interface }} -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i {{ wireguard.interface }} -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i {{ wireguard.interface }} -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i {{ wireguard.interface }} -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = {{ wireguard.port }}
PrivateKey = {{ wg.privkey }}
{% for user in wireguard.peers %}
[Peer]
PublicKey = {{ user.pubkey }}
AllowedIPs = {{ wireguard.net.v4.addr }}.{{ user.bit }}/{{ wireguard.net.v4.range.clnt }}, {{ wireguard.net.v6.addr}}:{{ user.bit }}/{{ wireguard.net.v6.range.clnt }}
{% endfor %}

20
vars/main.yml

@ -0,0 +1,20 @@
wireguard:
interface: 'wg0'
port: 51820
net:
v4:
addr: "172.22.12"
range:
serv: "24"
clnt: "32"
v6:
addr: "fd86:ea04:1115:"
range:
serv: "120"
clnt: "128"
peers:
- { bit: 2, pubkey: "Xb+ASR5NdnIB+dXWEA4H0V3d0LC0KocKeFeQDyqDqjk=" }
- { bit: 3, pubkey: "kz9vLMnPtfka11n1EJpzHb4966ieJSo4BU1P2joHLXo=" }
- { bit: 10, pubkey: "wpjMlhrcv173ER7rZ0KrmaqahcqZA/fm3ovpaGlRIRo=" }
- { bit: 12, pubkey: "2FRcncz/oSmqFQLrHqICi4fEkgxrCeS9P8TTv5gcfCw=" }
- { bit: 14, pubkey: "XYUXzDDXzo1uDadvJ8YW5X/ISCZSyu10d35i7mb0pAY=" }