aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ansible/files/akili/etc/wireguard/public-wg-net1.key (renamed from ansible/files/akili/etc/wireguard/public.key)0
-rw-r--r--ansible/files/android-trygvis/etc/wireguard/public-wg1.key (renamed from ansible/files/android-trygvis/etc/wireguard/public.key)0
-rw-r--r--ansible/files/arius/etc/wireguard/public-wg-net1.key (renamed from ansible/files/arius/etc/wireguard/public.key)0
-rw-r--r--ansible/files/birgitte/etc/wireguard/public-wg-net1.key (renamed from ansible/files/birgitte/etc/wireguard/public.key)0
-rw-r--r--ansible/files/conflatorio/etc/wireguard/public-wg0.key1
-rw-r--r--ansible/files/conflatorio/etc/wireguard/public.key1
-rw-r--r--ansible/files/fuckaduck/etc/borg/id_ed25519.pub1
-rw-r--r--ansible/files/fuckaduck/etc/wireguard/public.key1
-rw-r--r--ansible/files/knot/etc/wireguard/public-wg0.key1
-rw-r--r--ansible/files/knot/etc/wireguard/public-wg1.key1
-rw-r--r--ansible/files/knot/etc/wireguard/public.key1
-rw-r--r--ansible/group_vars/all/wireguard_wg-net1.yml32
-rw-r--r--ansible/group_vars/all/wireguard_wg0.yml28
-rw-r--r--ansible/group_vars/all/wireguard_wg1.yml15
-rw-r--r--ansible/group_vars/wireguard_net1.yml37
-rw-r--r--ansible/inventory20
-rw-r--r--ansible/roles/wireguard/defaults/main.yml1
-rw-r--r--ansible/roles/wireguard/tasks/main.yml141
-rw-r--r--ansible/wireguard.yml23
19 files changed, 168 insertions, 136 deletions
diff --git a/ansible/files/akili/etc/wireguard/public.key b/ansible/files/akili/etc/wireguard/public-wg-net1.key
index 31725d2..31725d2 100644
--- a/ansible/files/akili/etc/wireguard/public.key
+++ b/ansible/files/akili/etc/wireguard/public-wg-net1.key
diff --git a/ansible/files/android-trygvis/etc/wireguard/public.key b/ansible/files/android-trygvis/etc/wireguard/public-wg1.key
index 4ab6833..4ab6833 100644
--- a/ansible/files/android-trygvis/etc/wireguard/public.key
+++ b/ansible/files/android-trygvis/etc/wireguard/public-wg1.key
diff --git a/ansible/files/arius/etc/wireguard/public.key b/ansible/files/arius/etc/wireguard/public-wg-net1.key
index 879fa3c..879fa3c 100644
--- a/ansible/files/arius/etc/wireguard/public.key
+++ b/ansible/files/arius/etc/wireguard/public-wg-net1.key
diff --git a/ansible/files/birgitte/etc/wireguard/public.key b/ansible/files/birgitte/etc/wireguard/public-wg-net1.key
index 22e2fe3..22e2fe3 100644
--- a/ansible/files/birgitte/etc/wireguard/public.key
+++ b/ansible/files/birgitte/etc/wireguard/public-wg-net1.key
diff --git a/ansible/files/conflatorio/etc/wireguard/public-wg0.key b/ansible/files/conflatorio/etc/wireguard/public-wg0.key
new file mode 100644
index 0000000..f4cc915
--- /dev/null
+++ b/ansible/files/conflatorio/etc/wireguard/public-wg0.key
@@ -0,0 +1 @@
+170TWFqJLCfkw48ddLLnx7zWAo1qpx/AQf8Dar8mSXY=
diff --git a/ansible/files/conflatorio/etc/wireguard/public.key b/ansible/files/conflatorio/etc/wireguard/public.key
deleted file mode 100644
index dc49595..0000000
--- a/ansible/files/conflatorio/etc/wireguard/public.key
+++ /dev/null
@@ -1 +0,0 @@
-Rdq2LKzVxDBuXhimgLA1ZW9qFKCypHhBSaBx+24w3gA=
diff --git a/ansible/files/fuckaduck/etc/borg/id_ed25519.pub b/ansible/files/fuckaduck/etc/borg/id_ed25519.pub
deleted file mode 100644
index 2b3cc69..0000000
--- a/ansible/files/fuckaduck/etc/borg/id_ed25519.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO+nB33MTjbXI5P5wpanz0M/OO+2fClfVfkEdKPQJ4n4 for borg @ fuckaduck
diff --git a/ansible/files/fuckaduck/etc/wireguard/public.key b/ansible/files/fuckaduck/etc/wireguard/public.key
deleted file mode 100644
index d8012b3..0000000
--- a/ansible/files/fuckaduck/etc/wireguard/public.key
+++ /dev/null
@@ -1 +0,0 @@
-1Fywv/wM2QrqpxlbX5ql5lJNZdmadUGGn7gkXlAnlgE=
diff --git a/ansible/files/knot/etc/wireguard/public-wg0.key b/ansible/files/knot/etc/wireguard/public-wg0.key
new file mode 100644
index 0000000..8caf3db
--- /dev/null
+++ b/ansible/files/knot/etc/wireguard/public-wg0.key
@@ -0,0 +1 @@
+cuUgTdFH1UEXpUH6V1nashdH7K/L+pl6dmJCpBWN+Xw=
diff --git a/ansible/files/knot/etc/wireguard/public-wg1.key b/ansible/files/knot/etc/wireguard/public-wg1.key
new file mode 100644
index 0000000..0b891d1
--- /dev/null
+++ b/ansible/files/knot/etc/wireguard/public-wg1.key
@@ -0,0 +1 @@
+LM3L40nY0FWMECG6oP8VWYDjWVkRLp3kK0fofP3W7S0=
diff --git a/ansible/files/knot/etc/wireguard/public.key b/ansible/files/knot/etc/wireguard/public.key
deleted file mode 100644
index 5d4a839..0000000
--- a/ansible/files/knot/etc/wireguard/public.key
+++ /dev/null
@@ -1 +0,0 @@
-TgWtNOhe1j1uF8/xkN+u7Sv5FtvXj5EYRcwjbHjKjRU=
diff --git a/ansible/group_vars/all/wireguard_wg-net1.yml b/ansible/group_vars/all/wireguard_wg-net1.yml
new file mode 100644
index 0000000..33044ab
--- /dev/null
+++ b/ansible/group_vars/all/wireguard_wg-net1.yml
@@ -0,0 +1,32 @@
+wireguard-wg-net1:
+ if: wg-net1
+ ipv4_prefix: 24
+ ipv6_prefix: 64
+ hosts:
+ knot:
+ endpoint: trygvis.io
+ listen_port: 51820
+ ipv4: 192.168.80.1
+ # Generated by https://www.ultratools.com/tools/rangeGenerator
+ ipv6: fdf3:aad9:a885:0b3a::1
+ peers: all
+ birgitte:
+ state: present
+ ipv4: 192.168.80.2
+ ipv6: fdf3:aad9:a885:0b3a::2
+ conflatorio:
+ state: present
+ ipv4: 192.168.80.3
+ ipv6: fdf3:aad9:a885:0b3a::3
+ fuckaduck:
+ state: absent
+ ipv4: 192.168.80.4
+ ipv6: fdf3:aad9:a885:0b3a::4
+ arius:
+ state: present
+ ipv4: 192.168.80.6
+ ipv6: fdf3:aad9:a885:0b3a::6
+ akili:
+ state: present
+ ipv4: 192.168.80.7
+ ipv6: fdf3:aad9:a885:0b3a::7
diff --git a/ansible/group_vars/all/wireguard_wg0.yml b/ansible/group_vars/all/wireguard_wg0.yml
new file mode 100644
index 0000000..4e8238b
--- /dev/null
+++ b/ansible/group_vars/all/wireguard_wg0.yml
@@ -0,0 +1,28 @@
+wireguard-wg0:
+ if: wg0
+ ipv4_prefix: 24
+ ipv6_prefix: 64
+ hosts:
+ knot:
+ endpoint: trygvis.io
+ listen_port: 51821
+ peers: all
+ ipv4: 192.168.60.1
+ # Generated by https://www.ultratools.com/tools/rangeGenerator
+ ipv6: fdf3:aad9:a885:0b3b::1
+# birgitte:
+# state: present
+# ipv4: 192.168.60.2
+# ipv6: fdf3:aad9:a885:0b3b::2
+ conflatorio:
+ state: present
+ ipv4: 192.168.60.3
+ ipv6: fdf3:aad9:a885:0b3b::3
+# arius:
+# state: present
+# ipv4: 192.168.60.6
+# ipv6: fdf3:aad9:a885:0b3b::6
+# akili:
+# state: present
+# ipv4: 192.168.60.7
+# ipv6: fdf3:aad9:a885:0b3b::7
diff --git a/ansible/group_vars/all/wireguard_wg1.yml b/ansible/group_vars/all/wireguard_wg1.yml
new file mode 100644
index 0000000..a053dca
--- /dev/null
+++ b/ansible/group_vars/all/wireguard_wg1.yml
@@ -0,0 +1,15 @@
+wireguard-wg1:
+ if: wg1
+ ipv4_prefix: 24
+ ipv6_prefix: 64
+ hosts:
+ knot:
+ endpoint: trygvis.io
+ listen_port: 51822
+ peers: all
+ ipv4: 192.168.110.1
+ ipv6: 2a01:7e00:e000:272::b00b::1
+ android-trygvis:
+ state: present
+ ipv4: 192.168.110.2
+ ipv6: 2a01:7e00:e000:272::b00b::2
diff --git a/ansible/group_vars/wireguard_net1.yml b/ansible/group_vars/wireguard_net1.yml
deleted file mode 100644
index deb330a..0000000
--- a/ansible/group_vars/wireguard_net1.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-wireguard__net_id: net1
-wireguard__listen_port: 51820
-wireguard__server:
- ansible_hostname: knot
- hostname: trygvis.io
- ipv4:
- address: 192.168.80.1
- prefix: 24
- # Generated by https://www.ultratools.com/tools/rangeGenerator
- ipv6:
- address: fdf3:aad9:a885:0b3a::1
- prefix: 64
-wireguard__clients:
- birgitte:
- state: present
- ipv4: 192.168.80.2
- ipv6: fdf3:aad9:a885:0b3a::2
- conflatorio:
- state: present
- ipv4: 192.168.80.3
- ipv6: fdf3:aad9:a885:0b3a::3
- fuckaduck:
- state: present
- ipv4: 192.168.80.4
- ipv6: fdf3:aad9:a885:0b3a::4
- android-trygvis:
- state: present
- ipv4: 192.168.80.5
- ipv6: fdf3:aad9:a885:0b3a::5
- arius:
- state: present
- ipv4: 192.168.80.6
- ipv6: fdf3:aad9:a885:0b3a::6
- akili:
- state: present
- ipv4: 192.168.80.7
- ipv6: fdf3:aad9:a885:0b3a::7
diff --git a/ansible/inventory b/ansible/inventory
index db5d88a..d413177 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -18,8 +18,6 @@ all:
ansible_host: conflatorio.trygvis.io
nextcloud:
ansible_host: 192.168.90.101
- fuckaduck:
- ansible_host: fuckaduck.local
akili:
ansible_host: akili.local
children:
@@ -29,7 +27,6 @@ all:
conflatorio:
arius:
akysis:
- fuckaduck:
sbcs:
hosts:
homepi:
@@ -100,7 +97,6 @@ all:
borg_server__clients_ansible_group: borg_nas
borg_nas:
hosts:
- fuckaduck:
birgitte:
conflatorio:
vars:
@@ -110,13 +106,25 @@ all:
children:
borg_nas:
- wireguard_net1:
+ wireguard_wg-net1:
hosts:
akili:
arius:
birgitte:
conflatorio:
- fuckaduck:
+ knot:
+
+ wireguard_wg0:
+ hosts:
+ akili:
+ arius:
+ birgitte:
+ conflatorio:
+ knot:
+
+ wireguard_wg1:
+ hosts:
+ android-trygvis:
knot:
# vim: set filetype=yaml:
diff --git a/ansible/roles/wireguard/defaults/main.yml b/ansible/roles/wireguard/defaults/main.yml
index 9b1bf59..824e765 100644
--- a/ansible/roles/wireguard/defaults/main.yml
+++ b/ansible/roles/wireguard/defaults/main.yml
@@ -1,2 +1 @@
wireguard__state: present
-wireguard__role: client
diff --git a/ansible/roles/wireguard/tasks/main.yml b/ansible/roles/wireguard/tasks/main.yml
index 3590636..9c4cf24 100644
--- a/ansible/roles/wireguard/tasks/main.yml
+++ b/ansible/roles/wireguard/tasks/main.yml
@@ -1,11 +1,15 @@
+- debug: var=wireguard__state
+
- tags:
- wireguard
become: yes
when: wireguard__state == 'present'
vars:
- wg_if: "wg-{{ wireguard__net_id }}"
- netdev_path: "/etc/systemd/network/60-{{ wg_if }}.netdev"
- network_path: "/etc/systemd/network/61-{{ wg_if }}.network"
+ wg_net: "{{ hostvars[ansible_hostname][wireguard__name] }}"
+ wg_host: "{{ wg_net.hosts[ansible_hostname] }}"
+ all_peers: "{{ wg_host.peers is defined and wg_host.peers == 'all' }}"
+ netdev_path: "/etc/systemd/network/60-{{ wg_net.if }}.netdev"
+ network_path: "/etc/systemd/network/61-{{ wg_net.if }}.network"
block:
- name: Install packages
tags: packages
@@ -28,110 +32,75 @@
path: /etc/wireguard
state: directory
- - name: wg genkey /etc/wireguard/private.key
+ - name: "wg genkey /etc/wireguard/private-{{ wg_net.if }}.key"
tags: wireguard-config
- shell: wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key
+ shell: wg genkey | tee /etc/wireguard/private-{{ wg_net.if }}.key | wg pubkey > /etc/wireguard/public-{{ wg_net.if }}.key
args:
- creates: /etc/wireguard/private.key
+ creates: /etc/wireguard/private-{{ wg_net.if }}.key
register: wg_private_key_gen
- when: wg_private_key_gen.changed
tags: wireguard-config
fetch:
- src: "/etc/wireguard/public.key"
+ src: "/etc/wireguard/public-{{ wg_net.if }}.key"
dest: "files"
- tags: wireguard-config
slurp:
- src: "/etc/wireguard/private.key"
+ src: "/etc/wireguard/private-{{ wg_net.if }}.key"
register: wg_private_key
- - name: Make /etc/systemd/network/60-wg-XXX.netdev (Client)
- when: wireguard__role == 'client'
+ - name: "Make {{ netdev_path }}"
notify: systemctl restart systemd-networkd
tags: wireguard-config
copy:
dest: "{{ netdev_path }}"
content: |
[NetDev]
- Name={{ wg_if }}
+ Name={{ wg_net.if }}
Kind=wireguard
- Description=Net id: {{ wireguard__net_id }}
+ Description=Wireguard VPN
[WireGuard]
PrivateKey={{ wg_private_key['content'] | b64decode }}
+ {% if wg_host.listen_port is defined %}
+ ListenPort={{ wg_host.listen_port }}
+ {% endif %}
+ {% for hostname in wg_net.hosts|sort %}
+ {% set host = wg_net.hosts[hostname] %}
+ {% set present = not (host.state is defined) or host.state == 'present' %}
+ {% if present and (all_peers or host.endpoint is defined) %}
[WireGuardPeer]
- PublicKey={{ lookup('file', wireguard__server.ansible_hostname + '/etc/wireguard/public.key') }}
- AllowedIPs=0.0.0.0/0
- AllowedIPs=::/0
- Endpoint={{ wireguard__server.hostname }}:{{ wireguard__listen_port }}
+ PublicKey={{ lookup('file', hostname + '/etc/wireguard/public-{{ wg_net.if }}.key') }}
+ AllowedIPs={{ "0.0.0.0/0" if host.endpoint is defined else host.ipv4 }}
+ AllowedIPs={{ "::/0" if host.endpoint is defined else host.ipv6 }}
+ {% if host.endpoint is defined %}
+ Endpoint={{ host.endpoint }}:{{ host.listen_port }}
+ {% endif %}
PersistentKeepalive=60
-
- - name: Make /etc/systemd/network/60-wg-XXX.netdev (Server)
- when: wireguard__role == 'server'
- notify: systemctl restart systemd-networkd
- tags: wireguard-config
- copy:
- dest: "{{ netdev_path }}"
- content: |
- [NetDev]
- Name={{ wg_if }}
- Kind=wireguard
- Description=Net id: {{ wireguard__net_id }}
-
- [WireGuard]
- PrivateKey={{ wg_private_key['content'] | b64decode }}
- ListenPort={{ wireguard__listen_port }}
-
- {% for c in wireguard__clients|sort %}
- {% set client = wireguard__clients[c] %}
- # Client: {{ c }}
- {% if client.state == 'present' %}
- [WireGuardPeer]
- PublicKey={{ lookup('file', c + '/etc/wireguard/public.key') }}
- AllowedIPs={{ client.ipv4 }}
- AllowedIPs={{ client.ipv6 }}
- {% else %}
- # absent
{% endif %}
-
{% endfor %}
- - name: Make /etc/systemd/network/61-wg-XXX.network (Client)
- when: wireguard__role == 'client'
- tags: wireguard-config
- notify: systemctl restart systemd-networkd
- copy:
- dest: "{{ network_path }}"
- content: |
- [Match]
- Name={{ wg_if }}
-
- [Network]
- Address={{ wireguard__clients[ansible_hostname].ipv4 }}/{{ wireguard__server.ipv4.prefix }}
- Address={{ wireguard__clients[ansible_hostname].ipv6 }}/{{ wireguard__server.ipv6.prefix }}
-
- - name: Make /etc/systemd/network/61-wg-XXX.network (Server)
- when: wireguard__role == 'server'
+ - name: "Make {{ network_path }}"
tags: wireguard-config
notify: systemctl restart systemd-networkd
copy:
dest: "{{ network_path }}"
content: |
[Match]
- Name={{ wg_if }}
+ Name={{ wg_net.if }}
[Network]
- Address={{ wireguard__server.ipv4.address }}/{{ wireguard__server.ipv4.prefix }}
- Address={{ wireguard__server.ipv6.address }}/{{ wireguard__server.ipv6.prefix }}
+ Address={{ wg_net.hosts[ansible_hostname].ipv4 }}/{{ wg_net.ipv4_prefix }}
+ Address={{ wg_net.hosts[ansible_hostname].ipv6 }}/{{ wg_net.ipv6_prefix }}
- name: UFW allow port
- when: wireguard__role == 'server'
+ when: wg_host.listen_port is defined
tags: wireguard-config
ufw:
rule: allow
- port: "{{ wireguard__listen_port }}"
+ port: "{{ wg_host.listen_port }}"
proto: udp
- tags:
@@ -139,31 +108,31 @@
become: yes
when: wireguard__state == 'absent'
vars:
- wg_if: "wg-{{ wireguard__net_id }}"
- netdev_path: "/etc/systemd/network/60-{{ wg_if }}.netdev"
- network_path: "/etc/systemd/network/61-{{ wg_if }}.network"
+ wg_net: "{{ hostvars[ansible_hostname][wireguard__name] }}"
+ netdev_path: "/etc/systemd/network/60-{{ wg_net.if }}.netdev"
+ network_path: "/etc/systemd/network/61-{{ wg_net.if }}.network"
block:
- - file:
- path: /etc/wireguard
- state: absent
- notify: systemctl restart systemd-networkd
-
- - file:
- path: "{{ netdev_path }}"
- state: absent
- notify: systemctl restart systemd-networkd
-
- - file:
- path: "{{ network_path }}"
+ - name: Remove old files
+ file:
+ path: "{{ item }}"
state: absent
notify: systemctl restart systemd-networkd
-
- - shell: "ip -j link show {{ wg_if }}"
+ with_items:
+ - /etc/wireguard/private-{{ wg_net.if }}.key
+ - /etc/wireguard/public-{{ wg_net.if }}.key
+ - "{{ netdev_path }}"
+ - "{{ network_path }}"
+
+ - name: Checking for interface
+ shell: "ip -j link show"
changed_when: False
register: ip_link
- - shell: "ip -j link delete {{ wg_if }}"
- when: ip_link.stdout_lines|length != "0"
+ - name: Removing interface
+ shell: "ip -j link delete {{ wg_net.if }}"
+ when: links[wg_net.if] is defined
+ vars:
+ links: "{{ ip_link.stdout | from_json | items2dict(key_name='ifname', value_name='ifname') }}"
- name: generate dns records
tags:
@@ -172,7 +141,7 @@
local_action:
module: copy
content: |
- wireguard_dns_records_{{ wireguard__net_id }}:
+ wireguard_dns_records_{{ wg_net.if }}:
{% for c in wireguard__clients|sort %}
{% set client = wireguard__clients[c] %}
- type: A
@@ -184,4 +153,4 @@
value: {{ client.ipv6 }}
state: {{ client.state }}
{% endfor %}
- dest: "files/wireguard-dns-records-{{ wireguard__net_id }}.yml"
+ dest: "files/wireguard-dns-records-{{ wg_net.if }}.yml"
diff --git a/ansible/wireguard.yml b/ansible/wireguard.yml
index e5acba5..943b0d2 100644
--- a/ansible/wireguard.yml
+++ b/ansible/wireguard.yml
@@ -1,5 +1,24 @@
- hosts:
- - wireguard_net1
+ - wireguard_wg-net1
+ tags: wg-net1
roles:
- - wireguard
+ - role: wireguard
+ wireguard__state: absent
+ wireguard__name: wireguard-wg-net1
+- hosts:
+ - wireguard_wg0
+ tags: wg0
+ roles:
+ - role: wireguard
+ wireguard__name: wireguard-wg0
+ vars:
+ wg_net: "{{ hostvars[ansible_hostname][wireguard__name] }}"
+ wg_host: "{{ wg_net.hosts[ansible_hostname] }}"
+
+- hosts:
+ - wireguard_wg1
+ tags: wg1
+ roles:
+ - role: wireguard
+ wireguard__name: wireguard-wg1