wireguard: Rewrite.

19 files changed, 168 insertions, 136 deletions

diff --git a/ansible/files/akili/etc/wireguard/public.key b/ansible/files/akili/etc/wireguard/public-wg-net1.key
index 31725d2..31725d2 100644
--- a/ansible/files/akili/etc/wireguard/public.key
+++ b/ansible/files/akili/etc/wireguard/public-wg-net1.key
diff --git a/ansible/files/android-trygvis/etc/wireguard/public.key b/ansible/files/android-trygvis/etc/wireguard/public-wg1.key
index 4ab6833..4ab6833 100644
--- a/ansible/files/android-trygvis/etc/wireguard/public.key
+++ b/ansible/files/android-trygvis/etc/wireguard/public-wg1.key
diff --git a/ansible/files/arius/etc/wireguard/public.key b/ansible/files/arius/etc/wireguard/public-wg-net1.key
index 879fa3c..879fa3c 100644
--- a/ansible/files/arius/etc/wireguard/public.key
+++ b/ansible/files/arius/etc/wireguard/public-wg-net1.key
diff --git a/ansible/files/birgitte/etc/wireguard/public.key b/ansible/files/birgitte/etc/wireguard/public-wg-net1.key
index 22e2fe3..22e2fe3 100644
--- a/ansible/files/birgitte/etc/wireguard/public.key
+++ b/ansible/files/birgitte/etc/wireguard/public-wg-net1.key
diff --git a/ansible/files/conflatorio/etc/wireguard/public-wg0.key b/ansible/files/conflatorio/etc/wireguard/public-wg0.key
new file mode 100644
index 0000000..f4cc915
--- /dev/null
+++ b/ansible/files/conflatorio/etc/wireguard/public-wg0.key
@@ -0,0 +1 @@
+170TWFqJLCfkw48ddLLnx7zWAo1qpx/AQf8Dar8mSXY=
diff --git a/ansible/files/conflatorio/etc/wireguard/public.key b/ansible/files/conflatorio/etc/wireguard/public.key
deleted file mode 100644
index dc49595..0000000
--- a/ansible/files/conflatorio/etc/wireguard/public.key
+++ /dev/null
@@ -1 +0,0 @@
-Rdq2LKzVxDBuXhimgLA1ZW9qFKCypHhBSaBx+24w3gA=
diff --git a/ansible/files/fuckaduck/etc/borg/id_ed25519.pub b/ansible/files/fuckaduck/etc/borg/id_ed25519.pub
deleted file mode 100644
index 2b3cc69..0000000
--- a/ansible/files/fuckaduck/etc/borg/id_ed25519.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO+nB33MTjbXI5P5wpanz0M/OO+2fClfVfkEdKPQJ4n4 for borg @ fuckaduck
diff --git a/ansible/files/fuckaduck/etc/wireguard/public.key b/ansible/files/fuckaduck/etc/wireguard/public.key
deleted file mode 100644
index d8012b3..0000000
--- a/ansible/files/fuckaduck/etc/wireguard/public.key
+++ /dev/null
@@ -1 +0,0 @@
-1Fywv/wM2QrqpxlbX5ql5lJNZdmadUGGn7gkXlAnlgE=
diff --git a/ansible/files/knot/etc/wireguard/public-wg0.key b/ansible/files/knot/etc/wireguard/public-wg0.key
new file mode 100644
index 0000000..8caf3db
--- /dev/null
+++ b/ansible/files/knot/etc/wireguard/public-wg0.key
@@ -0,0 +1 @@
+cuUgTdFH1UEXpUH6V1nashdH7K/L+pl6dmJCpBWN+Xw=
diff --git a/ansible/files/knot/etc/wireguard/public-wg1.key b/ansible/files/knot/etc/wireguard/public-wg1.key
new file mode 100644
index 0000000..0b891d1
--- /dev/null
+++ b/ansible/files/knot/etc/wireguard/public-wg1.key
@@ -0,0 +1 @@
+LM3L40nY0FWMECG6oP8VWYDjWVkRLp3kK0fofP3W7S0=
diff --git a/ansible/files/knot/etc/wireguard/public.key b/ansible/files/knot/etc/wireguard/public.key
deleted file mode 100644
index 5d4a839..0000000
--- a/ansible/files/knot/etc/wireguard/public.key
+++ /dev/null
@@ -1 +0,0 @@
-TgWtNOhe1j1uF8/xkN+u7Sv5FtvXj5EYRcwjbHjKjRU=
diff --git a/ansible/group_vars/all/wireguard_wg-net1.yml b/ansible/group_vars/all/wireguard_wg-net1.yml
new file mode 100644
index 0000000..33044ab
--- /dev/null
+++ b/ansible/group_vars/all/wireguard_wg-net1.yml
@@ -0,0 +1,32 @@
+wireguard-wg-net1:
+  if: wg-net1
+  ipv4_prefix: 24
+  ipv6_prefix: 64
+  hosts:
+    knot:
+      endpoint: trygvis.io
+      listen_port: 51820
+      ipv4: 192.168.80.1
+      # Generated by https://www.ultratools.com/tools/rangeGenerator
+      ipv6: fdf3:aad9:a885:0b3a::1
+      peers: all
+    birgitte:
+      state: present
+      ipv4: 192.168.80.2
+      ipv6: fdf3:aad9:a885:0b3a::2
+    conflatorio:
+      state: present
+      ipv4: 192.168.80.3
+      ipv6: fdf3:aad9:a885:0b3a::3
+    fuckaduck:
+      state: absent
+      ipv4: 192.168.80.4
+      ipv6: fdf3:aad9:a885:0b3a::4
+    arius:
+      state: present
+      ipv4: 192.168.80.6
+      ipv6: fdf3:aad9:a885:0b3a::6
+    akili:
+      state: present
+      ipv4: 192.168.80.7
+      ipv6: fdf3:aad9:a885:0b3a::7
diff --git a/ansible/group_vars/all/wireguard_wg0.yml b/ansible/group_vars/all/wireguard_wg0.yml
new file mode 100644
index 0000000..4e8238b
--- /dev/null
+++ b/ansible/group_vars/all/wireguard_wg0.yml
@@ -0,0 +1,28 @@
+wireguard-wg0:
+  if: wg0
+  ipv4_prefix: 24
+  ipv6_prefix: 64
+  hosts:
+    knot:
+      endpoint: trygvis.io
+      listen_port: 51821
+      peers: all
+      ipv4: 192.168.60.1
+      # Generated by https://www.ultratools.com/tools/rangeGenerator
+      ipv6: fdf3:aad9:a885:0b3b::1
+#    birgitte:
+#      state: present
+#      ipv4: 192.168.60.2
+#      ipv6: fdf3:aad9:a885:0b3b::2
+    conflatorio:
+      state: present
+      ipv4: 192.168.60.3
+      ipv6: fdf3:aad9:a885:0b3b::3
+#    arius:
+#      state: present
+#      ipv4: 192.168.60.6
+#      ipv6: fdf3:aad9:a885:0b3b::6
+#    akili:
+#      state: present
+#      ipv4: 192.168.60.7
+#      ipv6: fdf3:aad9:a885:0b3b::7
diff --git a/ansible/group_vars/all/wireguard_wg1.yml b/ansible/group_vars/all/wireguard_wg1.yml
new file mode 100644
index 0000000..a053dca
--- /dev/null
+++ b/ansible/group_vars/all/wireguard_wg1.yml
@@ -0,0 +1,15 @@
+wireguard-wg1:
+  if: wg1
+  ipv4_prefix: 24
+  ipv6_prefix: 64
+  hosts:
+    knot:
+      endpoint: trygvis.io
+      listen_port: 51822
+      peers: all
+      ipv4: 192.168.110.1
+      ipv6: 2a01:7e00:e000:272::b00b::1
+    android-trygvis:
+      state: present
+      ipv4: 192.168.110.2
+      ipv6: 2a01:7e00:e000:272::b00b::2
diff --git a/ansible/group_vars/wireguard_net1.yml b/ansible/group_vars/wireguard_net1.yml
deleted file mode 100644
index deb330a..0000000
--- a/ansible/group_vars/wireguard_net1.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-wireguard__net_id: net1
-wireguard__listen_port: 51820
-wireguard__server:
-  ansible_hostname: knot
-  hostname: trygvis.io
-  ipv4:
-    address: 192.168.80.1
-    prefix: 24
-  # Generated by https://www.ultratools.com/tools/rangeGenerator
-  ipv6:
-    address: fdf3:aad9:a885:0b3a::1
-    prefix: 64
-wireguard__clients:
-  birgitte:
-    state: present
-    ipv4: 192.168.80.2
-    ipv6: fdf3:aad9:a885:0b3a::2
-  conflatorio:
-    state: present
-    ipv4: 192.168.80.3
-    ipv6: fdf3:aad9:a885:0b3a::3
-  fuckaduck:
-    state: present
-    ipv4: 192.168.80.4
-    ipv6: fdf3:aad9:a885:0b3a::4
-  android-trygvis:
-    state: present
-    ipv4: 192.168.80.5
-    ipv6: fdf3:aad9:a885:0b3a::5
-  arius:
-    state: present
-    ipv4: 192.168.80.6
-    ipv6: fdf3:aad9:a885:0b3a::6
-  akili:
-    state: present
-    ipv4: 192.168.80.7
-    ipv6: fdf3:aad9:a885:0b3a::7
diff --git a/ansible/inventory b/ansible/inventory
index db5d88a..d413177 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -18,8 +18,6 @@ all:
       ansible_host: conflatorio.trygvis.io
     nextcloud:
       ansible_host: 192.168.90.101
-    fuckaduck:
-      ansible_host: fuckaduck.local
     akili:
       ansible_host: akili.local
   children:
@@ -29,7 +27,6 @@ all:
         conflatorio:
         arius:
         akysis:
-        fuckaduck:
     sbcs:
       hosts:
         homepi:
@@ -100,7 +97,6 @@ all:
         borg_server__clients_ansible_group: borg_nas
     borg_nas:
       hosts:
-        fuckaduck:
         birgitte:
         conflatorio:
       vars:
@@ -110,13 +106,25 @@ all:
       children:
         borg_nas:
 
-    wireguard_net1:
+    wireguard_wg-net1:
       hosts:
         akili:
         arius:
         birgitte:
         conflatorio:
-        fuckaduck:
+        knot:
+
+    wireguard_wg0:
+      hosts:
+        akili:
+        arius:
+        birgitte:
+        conflatorio:
+        knot:
+
+    wireguard_wg1:
+      hosts:
+        android-trygvis:
         knot:
 
 # vim: set filetype=yaml:
diff --git a/ansible/roles/wireguard/defaults/main.yml b/ansible/roles/wireguard/defaults/main.yml
index 9b1bf59..824e765 100644
--- a/ansible/roles/wireguard/defaults/main.yml
+++ b/ansible/roles/wireguard/defaults/main.yml
@@ -1,2 +1 @@
 wireguard__state: present
-wireguard__role: client
diff --git a/ansible/roles/wireguard/tasks/main.yml b/ansible/roles/wireguard/tasks/main.yml
index 3590636..9c4cf24 100644
--- a/ansible/roles/wireguard/tasks/main.yml
+++ b/ansible/roles/wireguard/tasks/main.yml
@@ -1,11 +1,15 @@
+- debug: var=wireguard__state
+
 - tags:
     - wireguard
   become: yes
   when: wireguard__state == 'present'
   vars:
-    wg_if: "wg-{{ wireguard__net_id }}"
-    netdev_path: "/etc/systemd/network/60-{{ wg_if }}.netdev"
-    network_path: "/etc/systemd/network/61-{{ wg_if }}.network"
+    wg_net: "{{ hostvars[ansible_hostname][wireguard__name] }}"
+    wg_host: "{{ wg_net.hosts[ansible_hostname] }}"
+    all_peers: "{{ wg_host.peers is defined and wg_host.peers == 'all' }}"
+    netdev_path: "/etc/systemd/network/60-{{ wg_net.if }}.netdev"
+    network_path: "/etc/systemd/network/61-{{ wg_net.if }}.network"
   block:
     - name: Install packages
       tags: packages
@@ -28,110 +32,75 @@
         path: /etc/wireguard
         state: directory
 
-    - name: wg genkey /etc/wireguard/private.key
+    - name: "wg genkey /etc/wireguard/private-{{ wg_net.if }}.key"
       tags: wireguard-config
-      shell: wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key
+      shell: wg genkey | tee /etc/wireguard/private-{{ wg_net.if }}.key | wg pubkey > /etc/wireguard/public-{{ wg_net.if }}.key
       args:
-        creates: /etc/wireguard/private.key
+        creates: /etc/wireguard/private-{{ wg_net.if }}.key
       register: wg_private_key_gen
 
     - when: wg_private_key_gen.changed
       tags: wireguard-config
       fetch:
-        src: "/etc/wireguard/public.key"
+        src: "/etc/wireguard/public-{{ wg_net.if }}.key"
         dest: "files"
 
     - tags: wireguard-config
       slurp:
-        src: "/etc/wireguard/private.key"
+        src: "/etc/wireguard/private-{{ wg_net.if }}.key"
       register: wg_private_key
 
-    - name: Make /etc/systemd/network/60-wg-XXX.netdev (Client)
-      when: wireguard__role == 'client'
+    - name: "Make {{ netdev_path }}"
       notify: systemctl restart systemd-networkd
       tags: wireguard-config
       copy:
         dest: "{{ netdev_path }}"
         content: |
           [NetDev]
-          Name={{ wg_if }}
+          Name={{ wg_net.if }}
           Kind=wireguard
-          Description=Net id: {{ wireguard__net_id }}
+          Description=Wireguard VPN
 
           [WireGuard]
           PrivateKey={{ wg_private_key['content'] | b64decode }}
+          {% if wg_host.listen_port is defined %}
+          ListenPort={{ wg_host.listen_port }}
+          {% endif %}
+          {% for hostname in wg_net.hosts|sort %}
+          {% set host = wg_net.hosts[hostname] %}
+          {% set present = not (host.state is defined) or host.state == 'present' %}
+          {% if present and (all_peers or host.endpoint is defined) %}
 
           [WireGuardPeer]
-          PublicKey={{ lookup('file', wireguard__server.ansible_hostname + '/etc/wireguard/public.key') }}
-          AllowedIPs=0.0.0.0/0
-          AllowedIPs=::/0
-          Endpoint={{ wireguard__server.hostname }}:{{ wireguard__listen_port }}
+          PublicKey={{ lookup('file', hostname + '/etc/wireguard/public-{{ wg_net.if }}.key') }}
+          AllowedIPs={{ "0.0.0.0/0" if host.endpoint is defined else host.ipv4 }}
+          AllowedIPs={{ "::/0" if host.endpoint is defined else host.ipv6 }}
+          {% if host.endpoint is defined %}
+          Endpoint={{ host.endpoint }}:{{ host.listen_port }}
+          {% endif %}
           PersistentKeepalive=60
-
-    - name: Make /etc/systemd/network/60-wg-XXX.netdev (Server)
-      when: wireguard__role == 'server'
-      notify: systemctl restart systemd-networkd
-      tags: wireguard-config
-      copy:
-        dest: "{{ netdev_path }}"
-        content: |
-          [NetDev]
-          Name={{ wg_if }}
-          Kind=wireguard
-          Description=Net id: {{ wireguard__net_id }}
-
-          [WireGuard]
-          PrivateKey={{ wg_private_key['content'] | b64decode }}
-          ListenPort={{ wireguard__listen_port }}
-
-          {% for c in wireguard__clients|sort %}
-          {% set client = wireguard__clients[c] %}
-          # Client: {{ c }}
-          {% if client.state == 'present' %}
-          [WireGuardPeer]
-          PublicKey={{ lookup('file', c + '/etc/wireguard/public.key') }}
-          AllowedIPs={{ client.ipv4 }}
-          AllowedIPs={{ client.ipv6 }}
-          {% else %}
-          # absent
           {% endif %}
-
           {% endfor %}
 
-    - name: Make /etc/systemd/network/61-wg-XXX.network (Client)
-      when: wireguard__role == 'client'
-      tags: wireguard-config
-      notify: systemctl restart systemd-networkd
-      copy:
-        dest: "{{ network_path }}"
-        content: |
-          [Match]
-          Name={{ wg_if }}
-
-          [Network]
-          Address={{ wireguard__clients[ansible_hostname].ipv4 }}/{{ wireguard__server.ipv4.prefix }}
-          Address={{ wireguard__clients[ansible_hostname].ipv6 }}/{{ wireguard__server.ipv6.prefix }}
-
-    - name: Make /etc/systemd/network/61-wg-XXX.network (Server)
-      when: wireguard__role == 'server'
+    - name: "Make {{ network_path }}"
       tags: wireguard-config
       notify: systemctl restart systemd-networkd
       copy:
         dest: "{{ network_path }}"
         content: |
           [Match]
-          Name={{ wg_if }}
+          Name={{ wg_net.if }}
 
           [Network]
-          Address={{ wireguard__server.ipv4.address }}/{{ wireguard__server.ipv4.prefix }}
-          Address={{ wireguard__server.ipv6.address }}/{{ wireguard__server.ipv6.prefix }}
+          Address={{ wg_net.hosts[ansible_hostname].ipv4 }}/{{ wg_net.ipv4_prefix }}
+          Address={{ wg_net.hosts[ansible_hostname].ipv6 }}/{{ wg_net.ipv6_prefix }}
 
     - name: UFW allow port
-      when: wireguard__role == 'server'
+      when: wg_host.listen_port is defined
       tags: wireguard-config
       ufw:
         rule: allow
-        port: "{{ wireguard__listen_port }}"
+        port: "{{ wg_host.listen_port }}"
         proto: udp
 
 - tags:
@@ -139,31 +108,31 @@
   become: yes
   when: wireguard__state == 'absent'
   vars:
-    wg_if: "wg-{{ wireguard__net_id }}"
-    netdev_path: "/etc/systemd/network/60-{{ wg_if }}.netdev"
-    network_path: "/etc/systemd/network/61-{{ wg_if }}.network"
+    wg_net: "{{ hostvars[ansible_hostname][wireguard__name] }}"
+    netdev_path: "/etc/systemd/network/60-{{ wg_net.if }}.netdev"
+    network_path: "/etc/systemd/network/61-{{ wg_net.if }}.network"
   block:
-    - file:
-        path: /etc/wireguard
-        state: absent
-      notify: systemctl restart systemd-networkd
-
-    - file:
-        path: "{{ netdev_path }}"
-        state: absent
-      notify: systemctl restart systemd-networkd
-
-    - file:
-        path: "{{ network_path }}"
+    - name: Remove old files
+      file:
+        path: "{{ item }}"
         state: absent
       notify: systemctl restart systemd-networkd
-
-    - shell: "ip -j link show {{ wg_if }}"
+      with_items:
+        - /etc/wireguard/private-{{ wg_net.if }}.key
+        - /etc/wireguard/public-{{ wg_net.if }}.key
+        - "{{ netdev_path }}"
+        - "{{ network_path }}"
+
+    - name: Checking for interface
+      shell: "ip -j link show"
       changed_when: False
       register: ip_link
 
-    - shell: "ip -j link delete {{ wg_if }}"
-      when: ip_link.stdout_lines|length != "0"
+    - name: Removing interface
+      shell: "ip -j link delete {{ wg_net.if }}"
+      when: links[wg_net.if] is defined
+      vars:
+        links: "{{ ip_link.stdout | from_json | items2dict(key_name='ifname', value_name='ifname') }}"
 
 - name: generate dns records
   tags:
@@ -172,7 +141,7 @@
   local_action:
     module: copy
     content: |
-      wireguard_dns_records_{{ wireguard__net_id }}:
+      wireguard_dns_records_{{ wg_net.if }}:
       {% for c in wireguard__clients|sort %}
       {% set client = wireguard__clients[c] %}
         - type: A
@@ -184,4 +153,4 @@
           value: {{ client.ipv6 }}
           state: {{ client.state }}
       {% endfor %}
-    dest: "files/wireguard-dns-records-{{ wireguard__net_id }}.yml"
+    dest: "files/wireguard-dns-records-{{ wg_net.if }}.yml"
diff --git a/ansible/wireguard.yml b/ansible/wireguard.yml
index e5acba5..943b0d2 100644
--- a/ansible/wireguard.yml
+++ b/ansible/wireguard.yml
@@ -1,5 +1,24 @@
 - hosts:
-    - wireguard_net1
+    - wireguard_wg-net1
+  tags: wg-net1
   roles:
-    - wireguard
+    - role: wireguard
+      wireguard__state: absent
+      wireguard__name: wireguard-wg-net1
 
+- hosts:
+    - wireguard_wg0
+  tags: wg0
+  roles:
+    - role: wireguard
+      wireguard__name: wireguard-wg0
+  vars:
+    wg_net: "{{ hostvars[ansible_hostname][wireguard__name] }}"
+    wg_host: "{{ wg_net.hosts[ansible_hostname] }}"
+
+- hosts:
+    - wireguard_wg1
+  tags: wg1
+  roles:
+    - role: wireguard
+      wireguard__name: wireguard-wg1