Makes the role stateless.
This commit is contained in:
parent
b108cc1818
commit
ae17b8f662
|
@ -1,16 +1,4 @@
|
||||||
---
|
---
|
||||||
# The LOCAL directory where the WireGuard certificates are stored after they
|
|
||||||
# were generated. By default this will expand to user's LOCAL ${HOME}
|
|
||||||
# (the user that run's "ansible-playbook" command) plus
|
|
||||||
# "/wireguard/certs". That means if the user's ${HOME} directory is e.g.
|
|
||||||
# "/home/da_user" then "wireguard_cert_directory" will have a value of
|
|
||||||
# "/home/da_user/wireguard/certs". If you change this make sure that
|
|
||||||
# the parent directory is writable by the user that runs "ansible-playbook"
|
|
||||||
# command.
|
|
||||||
wireguard_cert_directory: "{{ '~/wireguard/certs' | expanduser }}"
|
|
||||||
wireguard_cert_owner: "root"
|
|
||||||
wireguard_cert_group: "root"
|
|
||||||
|
|
||||||
# Directory to store WireGuard configuration on the remote hosts
|
# Directory to store WireGuard configuration on the remote hosts
|
||||||
wireguard_remote_directory: "/etc/wireguard"
|
wireguard_remote_directory: "/etc/wireguard"
|
||||||
|
|
||||||
|
@ -19,3 +7,6 @@ wireguard_port: "51820"
|
||||||
|
|
||||||
# The interface name that wireguard should use.
|
# The interface name that wireguard should use.
|
||||||
wireguard_interface: "wg0"
|
wireguard_interface: "wg0"
|
||||||
|
|
||||||
|
# Wireguard config file path
|
||||||
|
wg_conf_path: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
|
||||||
|
|
|
@ -28,46 +28,35 @@
|
||||||
tags:
|
tags:
|
||||||
- wg-install
|
- wg-install
|
||||||
|
|
||||||
- name: Create WireGuard certificates directory
|
|
||||||
file:
|
|
||||||
dest: "{{ wireguard_cert_directory }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ wireguard_cert_owner }}"
|
|
||||||
group: "{{ wireguard_cert_group }}"
|
|
||||||
mode: 0700
|
|
||||||
run_once: true
|
|
||||||
delegate_to: localhost
|
|
||||||
tags:
|
|
||||||
wg-generate-keys
|
|
||||||
|
|
||||||
- name: Set WireGuard IP (without mask)
|
- name: Set WireGuard IP (without mask)
|
||||||
set_fact:
|
set_fact:
|
||||||
wireguard_ip: "{{ wireguard_address.split('/')[0] }}"
|
wireguard_ip: "{{ wireguard_address.split('/')[0] }}"
|
||||||
|
|
||||||
- name: Set path to private key file
|
# lookup ini plugin doesn't work on remote hosts...
|
||||||
set_fact:
|
- name: Check if WireGuard file exists
|
||||||
private_key_file_path: "{{ wireguard_cert_directory }}/{{ inventory_hostname }}.private.key"
|
|
||||||
tags:
|
|
||||||
wg-generate-keys
|
|
||||||
|
|
||||||
- name: Set path to public key file
|
|
||||||
set_fact:
|
|
||||||
public_key_file_path: "{{ wireguard_cert_directory }}/{{ inventory_hostname }}.public.key"
|
|
||||||
tags:
|
|
||||||
wg-generate-keys
|
|
||||||
|
|
||||||
- name: Register if private key already exists
|
|
||||||
stat:
|
stat:
|
||||||
path: "{{ private_key_file_path }}"
|
path: "{{ wg_conf_path }}"
|
||||||
register: private_key_file_stat
|
register: wg_conf
|
||||||
delegate_to: localhost
|
|
||||||
|
- name: Read WireGuard private key
|
||||||
|
shell: "cat {{ wg_conf_path }} | grep PrivateKey | cut -d= -f2- | tr -d [:space:]"
|
||||||
|
register: wg_private_key_result
|
||||||
|
changed_when: false
|
||||||
|
when: wg_conf.stat.exists
|
||||||
|
tags:
|
||||||
|
- wg-generate-keys
|
||||||
|
|
||||||
|
- name: Set private key fact
|
||||||
|
set_fact:
|
||||||
|
wg_private_key: "{{ wg_private_key_result.stdout }}"
|
||||||
|
when: wg_conf.stat.exists
|
||||||
tags:
|
tags:
|
||||||
- wg-generate-keys
|
- wg-generate-keys
|
||||||
|
|
||||||
- name: Generate WireGuard private key
|
- name: Generate WireGuard private key
|
||||||
shell: "wg genkey"
|
shell: "wg genkey"
|
||||||
register: wg_private_key_result
|
register: wg_private_key_result
|
||||||
when: not private_key_file_stat.stat.exists
|
when: not wg_conf.stat.exists
|
||||||
changed_when: false
|
changed_when: false
|
||||||
tags:
|
tags:
|
||||||
- wg-generate-keys
|
- wg-generate-keys
|
||||||
|
@ -76,11 +65,11 @@
|
||||||
- name: Set private key fact
|
- name: Set private key fact
|
||||||
set_fact:
|
set_fact:
|
||||||
wg_private_key: "{{ wg_private_key_result.stdout }}"
|
wg_private_key: "{{ wg_private_key_result.stdout }}"
|
||||||
when: not private_key_file_stat.stat.exists
|
when: not wg_conf.stat.exists
|
||||||
tags:
|
tags:
|
||||||
- wg-generate-keys
|
- wg-generate-keys
|
||||||
|
|
||||||
- name: Generate WireGuard public key
|
- name: Derive WireGuard public key
|
||||||
shell: "echo '{{ wg_private_key }}' | wg pubkey"
|
shell: "echo '{{ wg_private_key }}' | wg pubkey"
|
||||||
register: wg_public_key_result
|
register: wg_public_key_result
|
||||||
when: not private_key_file_stat.stat.exists
|
when: not private_key_file_stat.stat.exists
|
||||||
|
@ -91,46 +80,9 @@
|
||||||
- name: Set public key fact
|
- name: Set public key fact
|
||||||
set_fact:
|
set_fact:
|
||||||
wg_public_key: "{{ wg_public_key_result.stdout }}"
|
wg_public_key: "{{ wg_public_key_result.stdout }}"
|
||||||
when: not private_key_file_stat.stat.exists
|
|
||||||
tags:
|
tags:
|
||||||
- wg-generate-keys
|
- wg-generate-keys
|
||||||
|
|
||||||
- name: Store hosts private key locally
|
|
||||||
template:
|
|
||||||
src: "wg-privatekey.j2"
|
|
||||||
dest: "{{ private_key_file_path }}"
|
|
||||||
owner: "{{ wireguard_cert_owner }}"
|
|
||||||
group: "{{ wireguard_cert_group }}"
|
|
||||||
mode: 0644
|
|
||||||
when: not private_key_file_stat.stat.exists
|
|
||||||
delegate_to: localhost
|
|
||||||
tags:
|
|
||||||
- wg-generate-keys
|
|
||||||
|
|
||||||
- name: Store hosts public key locally
|
|
||||||
template:
|
|
||||||
src: "wg-publickey.j2"
|
|
||||||
dest: "{{ public_key_file_path }}"
|
|
||||||
owner: "{{ wireguard_cert_owner }}"
|
|
||||||
group: "{{ wireguard_cert_group }}"
|
|
||||||
mode: 0644
|
|
||||||
when: not private_key_file_stat.stat.exists
|
|
||||||
delegate_to: localhost
|
|
||||||
tags:
|
|
||||||
- wg-generate-keys
|
|
||||||
|
|
||||||
- name: Read private key
|
|
||||||
set_fact:
|
|
||||||
private_key: "{{ lookup('file', private_key_file_path) }}"
|
|
||||||
tags:
|
|
||||||
wg-config
|
|
||||||
|
|
||||||
- name: Read public key
|
|
||||||
set_fact:
|
|
||||||
public_key: "{{ lookup('file', public_key_file_path) }}"
|
|
||||||
tags:
|
|
||||||
wg-config
|
|
||||||
|
|
||||||
- name: Create WireGuard configuration directory
|
- name: Create WireGuard configuration directory
|
||||||
file:
|
file:
|
||||||
dest: "{{ wireguard_remote_directory }}"
|
dest: "{{ wireguard_remote_directory }}"
|
||||||
|
@ -142,7 +94,7 @@
|
||||||
- name: Generate WireGuard configuration file
|
- name: Generate WireGuard configuration file
|
||||||
template:
|
template:
|
||||||
src: wg.conf.j2
|
src: wg.conf.j2
|
||||||
dest: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
|
dest: "{{ wg_conf_path }}"
|
||||||
owner: root
|
owner: root
|
||||||
group: root
|
group: root
|
||||||
mode: 0600
|
mode: 0600
|
||||||
|
|
|
@ -1 +0,0 @@
|
||||||
{{hostvars[inventory_hostname]['wg_private_key']}}
|
|
|
@ -1 +0,0 @@
|
||||||
{{hostvars[inventory_hostname]['wg_public_key']}}
|
|
|
@ -1,7 +1,7 @@
|
||||||
#jinja2: lstrip_blocks:"True",trim_blocks:"True"
|
#jinja2: lstrip_blocks:"True",trim_blocks:"True"
|
||||||
[Interface]
|
[Interface]
|
||||||
Address = {{hostvars[inventory_hostname].wireguard_address}}
|
Address = {{hostvars[inventory_hostname].wireguard_address}}
|
||||||
PrivateKey = {{private_key}}
|
PrivateKey = {{wg_private_key}}
|
||||||
ListenPort = {{wireguard_port}}
|
ListenPort = {{wireguard_port}}
|
||||||
{% if hostvars[inventory_hostname].wireguard_dns is defined %}
|
{% if hostvars[inventory_hostname].wireguard_dns is defined %}
|
||||||
DNS = {{hostvars[inventory_hostname].wireguard_dns}}
|
DNS = {{hostvars[inventory_hostname].wireguard_dns}}
|
||||||
|
@ -19,7 +19,7 @@ SaveConfig = true
|
||||||
{% for host in groups["vpn"] %}
|
{% for host in groups["vpn"] %}
|
||||||
{% if host != inventory_hostname %}
|
{% if host != inventory_hostname %}
|
||||||
[Peer]
|
[Peer]
|
||||||
PublicKey = {{hostvars[host].public_key}}
|
PublicKey = {{hostvars[host].wg_public_key}}
|
||||||
{% if hostvars[host].wireguard_allowed_ips is defined %}
|
{% if hostvars[host].wireguard_allowed_ips is defined %}
|
||||||
AllowedIPs = {{hostvars[host].wireguard_allowed_ips}}
|
AllowedIPs = {{hostvars[host].wireguard_allowed_ips}}
|
||||||
{% else %}
|
{% else %}
|
||||||
|
|
Reference in New Issue