merge stateless with no storage of local priv key
This commit is contained in:
parent
9a0e70ee25
commit
74312aecd2
|
@ -28,13 +28,13 @@
|
||||||
tags:
|
tags:
|
||||||
- wg-install
|
- wg-install
|
||||||
|
|
||||||
- name: Create WireGuard certificates directory
|
- name: Create WireGuard public key directory locally
|
||||||
file:
|
file:
|
||||||
dest: "{{ wireguard_cert_directory }}"
|
dest: "{{ wireguard_cert_directory }}"
|
||||||
state: directory
|
state: directory
|
||||||
owner: "{{ wireguard_cert_owner }}"
|
owner: "{{ wireguard_cert_owner }}"
|
||||||
group: "{{ wireguard_cert_group }}"
|
group: "{{ wireguard_cert_group }}"
|
||||||
mode: 0700
|
mode: 0755
|
||||||
run_once: true
|
run_once: true
|
||||||
delegate_to: localhost
|
delegate_to: localhost
|
||||||
tags:
|
tags:
|
||||||
|
@ -44,82 +44,59 @@
|
||||||
set_fact:
|
set_fact:
|
||||||
wireguard_ip: "{{ wireguard_address.split('/')[0] }}"
|
wireguard_ip: "{{ wireguard_address.split('/')[0] }}"
|
||||||
|
|
||||||
- name: Set path to private key file
|
|
||||||
set_fact:
|
|
||||||
private_key_file_path: "{{ wireguard_cert_directory }}/{{ inventory_hostname }}.private.key"
|
|
||||||
tags:
|
|
||||||
wg-generate-keys
|
|
||||||
|
|
||||||
- name: Set path to public key file
|
- name: Set path to public key file
|
||||||
set_fact:
|
set_fact:
|
||||||
public_key_file_path: "{{ wireguard_cert_directory }}/{{ inventory_hostname }}.public.key"
|
public_key_file_path: "{{ wireguard_cert_directory }}/{{ inventory_hostname }}.public.key"
|
||||||
tags:
|
tags:
|
||||||
wg-generate-keys
|
wg-generate-keys
|
||||||
|
|
||||||
- name: Register if private key already exists
|
- name: Register if config/private key already exists on target host
|
||||||
stat:
|
stat:
|
||||||
path: "{{ private_key_file_path }}"
|
path: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
|
||||||
register: private_key_file_stat
|
register: config_file_stat
|
||||||
delegate_to: localhost
|
|
||||||
tags:
|
tags:
|
||||||
- wg-generate-keys
|
- wg-generate-keys
|
||||||
|
|
||||||
- name: Generate WireGuard private key
|
- block:
|
||||||
shell: "wg genkey"
|
- name: Generate WireGuard private key
|
||||||
register: wg_private_key_result
|
shell: "wg genkey"
|
||||||
when: not private_key_file_stat.stat.exists
|
register: wg_private_key_result
|
||||||
tags:
|
tags:
|
||||||
- wg-generate-keys
|
- wg-generate-keys
|
||||||
- skip_ansible_lint
|
- skip_ansible_lint
|
||||||
|
|
||||||
- name: Set private key fact
|
- name: Generate WireGuard public key
|
||||||
set_fact:
|
shell: "echo '{{ wg_private_key }}' | wg pubkey"
|
||||||
wg_private_key: "{{ wg_private_key_result.stdout }}"
|
register: wg_public_key_result
|
||||||
when: not private_key_file_stat.stat.exists
|
tags:
|
||||||
tags:
|
- wg-generate-keys
|
||||||
- wg-generate-keys
|
|
||||||
|
|
||||||
- name: Generate WireGuard public key
|
- name: Set public key fact
|
||||||
shell: "echo '{{ wg_private_key }}' | wg pubkey"
|
set_fact:
|
||||||
register: wg_public_key_result
|
wg_public_key: "{{ wg_public_key_result.results[0].stdout }}"
|
||||||
when: not private_key_file_stat.stat.exists
|
tags:
|
||||||
tags:
|
- wg-generate-keys
|
||||||
- wg-generate-keys
|
|
||||||
|
|
||||||
- name: Set public key fact
|
- name: Store hosts public key locally
|
||||||
set_fact:
|
template:
|
||||||
wg_public_key: "{{ wg_public_key_result.stdout }}"
|
src: "wg-publickey.j2"
|
||||||
when: not private_key_file_stat.stat.exists
|
dest: "{{ public_key_file_path }}"
|
||||||
tags:
|
owner: "{{ wireguard_cert_owner }}"
|
||||||
- wg-generate-keys
|
group: "{{ wireguard_cert_group }}"
|
||||||
|
mode: 0644
|
||||||
|
delegate_to: localhost
|
||||||
|
tags:
|
||||||
|
- wg-generate-keys
|
||||||
|
when: not config_file_stat.stat.exists
|
||||||
|
|
||||||
- name: Store hosts private key locally
|
- name: Read WireGuard config file
|
||||||
template:
|
slurp:
|
||||||
src: "wg-privatekey.j2"
|
src: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
|
||||||
dest: "{{ private_key_file_path }}"
|
register: wg_config
|
||||||
owner: "{{ wireguard_cert_owner }}"
|
|
||||||
group: "{{ wireguard_cert_group }}"
|
|
||||||
mode: 0644
|
|
||||||
when: not private_key_file_stat.stat.exists
|
|
||||||
delegate_to: localhost
|
|
||||||
tags:
|
|
||||||
- wg-generate-keys
|
|
||||||
|
|
||||||
- name: Store hosts public key locally
|
|
||||||
template:
|
|
||||||
src: "wg-publickey.j2"
|
|
||||||
dest: "{{ public_key_file_path }}"
|
|
||||||
owner: "{{ wireguard_cert_owner }}"
|
|
||||||
group: "{{ wireguard_cert_group }}"
|
|
||||||
mode: 0644
|
|
||||||
when: not private_key_file_stat.stat.exists
|
|
||||||
delegate_to: localhost
|
|
||||||
tags:
|
|
||||||
- wg-generate-keys
|
|
||||||
|
|
||||||
- name: Read private key
|
- name: Read private key
|
||||||
set_fact:
|
set_fact:
|
||||||
private_key: "{{ lookup('file', private_key_file_path) }}"
|
private_key: "{{ wg_config['content'] | b64decode | regex_findall('PrivateKey = (.*)') | first }}"
|
||||||
tags:
|
tags:
|
||||||
wg-config
|
wg-config
|
||||||
|
|
||||||
|
|
Reference in a new issue