- tags: - wireguard become: yes block: - name: Install packages apt: name: "{{ items }}" install_recommends: no vars: items: - wireguard - "{{ 'linux-headers-amd64' if ansible_architecture == 'x86_64' else 'linux-headers-686-pae' }}" - name: systemctl enable systemd-networkd systemd: name: systemd-networkd enabled: yes state: started - name: mkdir /etc/wireguard file: path: /etc/wireguard state: directory - name: wg genkey /etc/wireguard/private.key tags: wireguard-config shell: wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key args: creates: /etc/wireguard/private.key register: wg_private_key_gen - when: wg_private_key_gen.changed tags: wireguard-config fetch: src: "/etc/wireguard/public.key" dest: "files" - tags: wireguard-config slurp: src: "/etc/wireguard/private.key" register: wg_private_key - name: Make /etc/systemd/network/60-wg-XXX.netdev (Client) when: wireguard__role == 'client' notify: systemctl restart systemd-networkd tags: wireguard-config copy: dest: /etc/systemd/network/60-wg-{{ wireguard__net_id }}.netdev content: | [NetDev] Name=wg-{{ wireguard__net_id }} Kind=wireguard Description=Net id: {{ wireguard__net_id }} [WireGuard] PrivateKey={{ wg_private_key['content'] | b64decode }} PersistentKeepalive=60 [WireGuardPeer] PublicKey={{ lookup('file', wireguard__server.ansible_hostname + '/etc/wireguard/public.key') }} AllowedIPs=0.0.0.0/0 AllowedIPs=::/0 Endpoint={{ wireguard__server.hostname }}:{{ wireguard__listen_port }} - name: Make /etc/systemd/network/60-wg-XXX.netdev (Server) when: wireguard__role == 'server' notify: systemctl restart systemd-networkd tags: wireguard-config copy: dest: /etc/systemd/network/60-wg-{{ wireguard__net_id }}.netdev content: | [NetDev] Name=wg-{{ wireguard__net_id }} Kind=wireguard Description=Net id: {{ wireguard__net_id }} [WireGuard] PrivateKey={{ wg_private_key['content'] | b64decode }} ListenPort={{ wireguard__listen_port }} {% for c in wireguard__clients %} {% set client = wireguard__clients[c] %} # Client: {{ c }} {% if client.state == 'present' %} [WireGuardPeer] PublicKey={{ lookup('file', c + '/etc/wireguard/public.key') }} AllowedIPs={{ client.ipv4 }} AllowedIPs={{ client.ipv6 }} {% else %} # absent {% endif %} {% endfor %} - name: rm /etc/systemd/network/60-wg-XXX.network tags: wireguard-config file: path: /etc/systemd/network/60-wg-{{ wireguard__net_id }}.network state: absent - name: Make /etc/systemd/network/61-wg-XXX.network (Client) when: wireguard__role == 'client' tags: wireguard-config notify: systemctl restart systemd-networkd copy: dest: /etc/systemd/network/61-wg-{{ wireguard__net_id }}.network content: | [Match] Name=wg-{{ wireguard__net_id }} [Network] Address={{ wireguard__clients[ansible_hostname].ipv4 }}/{{ wireguard__server.ipv4.prefix }} Address={{ wireguard__clients[ansible_hostname].ipv6 }}/{{ wireguard__server.ipv6.prefix }} - name: Make /etc/systemd/network/61-wg-XXX.network (Server) when: wireguard__role == 'server' tags: wireguard-config notify: systemctl restart systemd-networkd copy: dest: /etc/systemd/network/61-wg-{{ wireguard__net_id }}.network content: | [Match] Name=wg-{{ wireguard__net_id }} [Network] Address={{ wireguard__server.ipv4.address }}/{{ wireguard__server.ipv4.prefix }} Address={{ wireguard__server.ipv6.address }}/{{ wireguard__server.ipv6.prefix }} - name: UFW allow port when: wireguard__role == 'server' tags: wireguard-config ufw: rule: allow port: "{{ wireguard__listen_port }}" proto: udp - name: generate dns records tags: wireguard-dns-records when: wireguard__role == 'server' local_action: module: copy content: | wireguard_dns_records_{{ wireguard__net_id }}: {% for c in wireguard__clients|sort %} {% set client = wireguard__clients[c] %} - type: A name: {{ c }} value: {{ client.ipv4 }} state: {{ client.state }} - type: AAAA name: {{ c }} value: {{ client.ipv6 }} state: {{ client.state }} {% endfor %} dest: "files/wireguard-dns-records-{{ wireguard__net_id }}.yml"