1
0
Fork 0
This repository has been archived on 2020-08-04. You can view files and clone it, but cannot push or open issues or pull requests.
ansible-role-wireguard/tasks/main.yml

161 lines
3.8 KiB
YAML
Raw Normal View History

---
- name: Gather instance facts
setup:
- include_tasks: "setup-{{ ansible_distribution|lower }}.yml"
- name: Install WireGuard
package:
name: "{{ packages }}"
state: present
vars:
packages:
- wireguard-dkms
- wireguard-tools
tags:
- wg-install
2019-01-07 21:56:20 +00:00
- skip_ansible_lint
- name: Enable WireGuard kernel module
modprobe:
name: wireguard
state: present
register: wireguard_module_enabled
until: wireguard_module_enabled is succeeded
retries: 10
delay: 10
failed_when: wireguard_module_enabled is failure
tags:
- wg-install
- name: Create WireGuard public key directory locally
file:
dest: "{{ wireguard_cert_directory }}"
state: directory
owner: "{{ wireguard_cert_owner }}"
group: "{{ wireguard_cert_group }}"
mode: 0755
run_once: true
delegate_to: localhost
tags:
wg-generate-keys
- name: Set WireGuard IP (without mask)
set_fact:
wireguard_ip: "{{ wireguard_address.split('/')[0] }}"
- name: Set path to public key file
set_fact:
public_key_file_path: "{{ wireguard_cert_directory }}/{{ inventory_hostname }}.public.key"
tags:
wg-generate-keys
- name: Register if config/private key already exists on target host
stat:
path: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
register: config_file_stat
tags:
- wg-generate-keys
- block:
- name: Generate WireGuard private key
shell: "wg genkey"
register: wg_private_key_result
tags:
- wg-generate-keys
- skip_ansible_lint
- name: Generate WireGuard public key
shell: "echo '{{ wg_private_key }}' | wg pubkey"
register: wg_public_key_result
tags:
- wg-generate-keys
- name: Set public key fact
set_fact:
wg_public_key: "{{ wg_public_key_result.results[0].stdout }}"
tags:
- wg-generate-keys
- name: Store hosts public key locally
template:
src: "wg-publickey.j2"
dest: "{{ public_key_file_path }}"
owner: "{{ wireguard_cert_owner }}"
group: "{{ wireguard_cert_group }}"
mode: 0644
delegate_to: localhost
tags:
- wg-generate-keys
when: not config_file_stat.stat.exists
- name: Read WireGuard config file
slurp:
src: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
register: wg_config
- name: Read private key
set_fact:
private_key: "{{ wg_config['content'] | b64decode | regex_findall('PrivateKey = (.*)') | first }}"
tags:
wg-config
- name: Read public key
set_fact:
public_key: "{{ lookup('file', public_key_file_path) }}"
tags:
wg-config
- name: Create WireGuard configuration directory
file:
dest: "{{ wireguard_remote_directory }}"
state: directory
mode: 0700
tags:
- wg-config
- name: Generate WireGuard configuration file
template:
src: wg.conf.j2
dest: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
owner: root
group: root
mode: 0600
tags:
- wg-config
notify:
- restart wireguard
- name: check if reload-module-on-update file exists
stat:
path: "{{ wireguard_remote_directory }}/.reload-module-on-update"
register: reload_module_on_update
- name: WireGuard reload-module-on-update
file:
dest: "{{ wireguard_remote_directory }}/.reload-module-on-update"
state: touch
when: not reload_module_on_update.stat.exists
- name: Start and enable WireGuard service
service:
name: "wg-quick@{{ wireguard_interface }}"
state: started
enabled: yes
2019-10-18 16:40:47 +00:00
- name: Look for local private key
find:
paths: "{{ wireguard_cert_directory }}"
patterns: "*.private.key"
register: local_private_key_to_delete
delegate_to: localhost
run_once: true
- name: Delete local private key
file:
path: "{{ item.path }}"
state: absent
with_items: "{{ local_private_key_to_delete.files }}"
delegate_to: localhost
run_once: true