1
0
Fork 0
This repository has been archived on 2020-08-04. You can view files and clone it, but cannot push or open issues or pull requests.
ansible-role-wireguard/tasks/main.yml

150 lines
3.4 KiB
YAML
Raw Normal View History

2018-07-16 22:26:00 +00:00
---
2018-07-23 21:50:53 +00:00
- name: Gather instance facts
setup:
- include_tasks: "setup-{{ansible_os_family|lower}}.yml"
2018-07-16 22:26:00 +00:00
- name: Install WireGuard
package:
name: "{{item}}"
state: present
with_items:
- wireguard-dkms
- wireguard-tools
tags:
- wg-install
2018-07-16 22:26:00 +00:00
- name: Enable WireGuard kernel module
modprobe:
name: wireguard
state: present
register: wireguard_module_enabled
until: wireguard_module_enabled is succeeded
retries: 10
delay: 10
failed_when: wireguard_module_enabled is failure
tags:
- wg-install
2018-07-16 22:26:00 +00:00
- name: Create WireGuard certificates directory
file:
dest: "{{wireguard_cert_directory}}"
state: directory
2018-07-30 19:51:58 +00:00
owner: "{{wireguard_cert_owner}}"
group: "{{wireguard_cert_group}}"
2018-07-16 22:26:00 +00:00
mode: 0700
run_once: true
delegate_to: localhost
tags:
wg-generate-keys
2018-07-16 22:26:00 +00:00
2018-07-18 21:57:27 +00:00
- name: Set path to private key file
set_fact:
private_key_file_path: "{{wireguard_cert_directory}}/{{inventory_hostname}}.private.key"
tags:
wg-generate-keys
2018-07-18 21:57:27 +00:00
- name: Set path to public key file
set_fact:
public_key_file_path: "{{wireguard_cert_directory}}/{{inventory_hostname}}.public.key"
tags:
wg-generate-keys
2018-07-18 21:57:27 +00:00
2018-07-16 22:26:00 +00:00
- name: Register if private key already exists
local_action:
module: stat
2018-07-18 21:57:27 +00:00
path: "{{private_key_file_path}}"
register: private_key_file_stat
2018-07-16 22:26:00 +00:00
tags:
- wg-generate-keys
- name: Generate WireGuard private key
shell: "wg genkey"
register: wg_private_key_result
with_inventory_hostnames:
- vpn
2018-07-18 21:57:27 +00:00
when: private_key_file_stat.stat.exists == False
2018-07-16 22:26:00 +00:00
tags:
- wg-generate-keys
- name: Set private key fact
set_fact:
wg_private_key: "{{wg_private_key_result.results[0].stdout}}"
2018-07-18 21:57:27 +00:00
when: private_key_file_stat.stat.exists == False
2018-07-16 22:26:00 +00:00
tags:
- wg-generate-keys
- name: Generate WireGuard public key
shell: "echo '{{wg_private_key}}' | wg pubkey"
register: wg_public_key_result
2018-07-18 21:57:27 +00:00
when: private_key_file_stat.stat.exists == False
2018-07-16 22:26:00 +00:00
with_inventory_hostnames:
- vpn
tags:
- wg-generate-keys
- name: Set public key fact
set_fact:
wg_public_key: "{{wg_public_key_result.results[0].stdout}}"
2018-07-18 21:57:27 +00:00
when: private_key_file_stat.stat.exists == False
2018-07-16 22:26:00 +00:00
tags:
- wg-generate-keys
- name: Store hosts private key locally
local_action:
module: template
src: "wg-privatekey.j2"
2018-07-18 21:57:27 +00:00
dest: "{{private_key_file_path}}"
2018-07-23 21:50:53 +00:00
mode: 0644
2018-07-18 21:57:27 +00:00
when: private_key_file_stat.stat.exists == False
2018-07-16 22:26:00 +00:00
tags:
- wg-generate-keys
- name: Store hosts public key locally
local_action:
module: template
src: "wg-publickey.j2"
2018-07-18 21:57:27 +00:00
dest: "{{public_key_file_path}}"
2018-07-23 21:50:53 +00:00
mode: 0644
2018-07-18 21:57:27 +00:00
when: private_key_file_stat.stat.exists == False
2018-07-16 22:26:00 +00:00
tags:
- wg-generate-keys
2018-07-23 21:50:53 +00:00
- name: Read private key
2018-07-18 21:57:27 +00:00
set_fact:
private_key: "{{lookup('file', private_key_file_path)}}"
tags:
wg-config
2018-07-23 21:50:53 +00:00
- name: Read public key
2018-07-18 21:57:27 +00:00
set_fact:
public_key: "{{lookup('file', public_key_file_path)}}"
tags:
wg-config
- name: Create WireGuard configuration directory
file:
dest: "{{wireguard_remote_directory}}"
state: directory
mode: 0700
tags:
- wg-config
- name: Generate WireGuard configuration file
template:
src: wg-fullmesh.conf.j2
2018-07-23 21:50:53 +00:00
dest: "{{wireguard_remote_directory}}/{{wireguard_interface}}.conf"
2018-07-18 21:57:27 +00:00
owner: root
group: root
mode: 0600
tags:
- wg-config
2018-07-23 21:50:53 +00:00
notify:
- restart wireguard
2018-07-18 21:57:27 +00:00
- name: Start and enable WireGuard service
service:
2018-07-19 21:53:16 +00:00
name: "wg-quick@{{wireguard_interface}}"
2018-07-18 21:57:27 +00:00
state: started
enabled: yes