PiFrame/ansible-role-wireguard
Archived
1
0
Fork 0
Code Pull requests Releases Activity

Merge branch 'devel' of github.com:juju4/ansible-role-wireguard into devel

Browse source
This commit is contained in:
juju4 2020-07-12 17:55:31 -04:00
parent fd428f528c 146c6436ae
commit bfcfbd8362
13 changed files with 295 additions and 99 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
CHANGELOG.md
View file

@ -1,9 +1,43 @@
Changelog
---------
**Unreleased**
**6.4.0**
- Allow to generate keys and configuration for non-ansible hosts like smartphones with `wireguard_unmanaged_hosts` (see `defaults/main.yml`) (contribution by @juju4)
**6.3.1**
- Support Openstack Debian images (contribution by @pallinger)
**6.3.0**
- Support Raspbian (contribution by @penguineer)
**6.2.0**
- Support Ubuntu 20.04 (Focal Fossa)
- Introduce `wireguard_ubuntu_update_cache` and `wireguard_ubuntu_cache_valid_time` variables to specifiy individual Ubuntu package cache settings. Default values are the same as before.
- As kernel >= 5.6 (and kernel 5.4 in Ubuntu 20.04) now have `wireguard` module included `wireguard-dkms` package is no longer needed in that case. That's why WireGuard package installation is now part of the includes for the specific OS to make it easier to handle various cases.
**6.1.0**
- Archlinux: Linux kernel >= 5.6 contains `wireguard` module now. No need to install `wireguard-dkms` anymore in this case. Installations with LTS kernel installs `wireguard-lts` package now instead of `wireguard-dkms`. Installations with kernel <= 5.6 will still install `wireguard-dkms` package.
**6.0.4**
- Use the buster-backports repository on Debian Buster (or older), use package standard repositories on sid/bullseye.
standard repositories on sid/bullseye.
The role no longer adds the unstable _repo_ nor the _apt preference_ for that repo. There is no need to clean the preference and unstable repository, since packages from your release have a higher priority.
If you remove the apt preference (`/etc/apt/preferences.d/limit-unstable`) updates from `unstable` are accepted by apt. This likely is not what you want and may lead to an unstable state.
If you want to clean up:
* remove `/etc/apt/preferences.d/limit-unstable` and
* remove `deb http://deb.debian.org/debian/ unstable main` from `/etc/apt/sources.list.d/deb_debian_org_debian.list`.
The backports repository has a lower priority and does not need an apt preference.
- Allow to generate keys and configuration for non-ansible hosts like smartphones with `wireguard_unmanaged_hosts` (contribution by @juju4)
**6.0.3**

15
README.md
View file

@ -7,7 +7,7 @@ I used [PeerVPN](https://peervpn.net/) before but that wasn't updated for a whil
In general WireGuard is a network tunnel (VPN) for IPv4 and IPv6 that uses UDP. If you need more information about [WireGuard](https://www.wireguard.io/) you can find a good introduction here: [Installing WireGuard, the Modern VPN](https://research.kudelskisecurity.com/2017/06/07/installing-wireguard-the-modern-vpn/).
This role was tested with Ubuntu 18.04 (Bionic Beaver), Debian 9 (Stretch), Archlinux, Fedora 31 and CentOS. It might also work with Ubuntu 16.04 (Xenial Xerus), Debian 10 (Buster) or other distributions but haven't tested it. If someone tested it let me please know if it works or send a pull request to make it work ;-)
This role is tested with Ubuntu 18.04 (Bionic Beaver), Ubuntu 20 (Focal Fossa) and Archlinux. Ubuntu 16.04 (Xenial Xerus), Debian 9 (Stretch), Debian 10 (Buster), Fedora 31 (or later) and CentOS 7 might also work or other distributions but haven't tested it (code for this operating systems was submitted by other contributors). If someone tested it let me please know if it works or send a pull request to make it work ;-)
Versions
--------
@ -257,9 +257,10 @@ Endpoint = server.at.home.p.domain.tld:51820
The other WireGuard config files (`wg0.conf` by default) looks similar but of course `[Interface]` includes the config of that specific host and the `[Peer]` entries lists the config of the other hosts.
Following variable allows to configure unmanaged hosts which are not configured by Ansible, typically smartphones and tablets.
In this case, private key and client configuration are generated on wireguard hub.
They can be shared through qrcode.
The following variable allows to configure unmanaged hosts which are not configured by Ansible, typically smartphones and tablets. In this case, private key and client configuration are generated on Wireguard hub. They can be shared through qrcode (also see https://fukuchi.org/works/qrencode/).
Example: `qrencode --type=ANSIUTF8 < /etc/wireguard/{{ item.item.host }}.conf`
```
wireguard_unmanaged_hosts:
- host: 'test'
@ -307,11 +308,13 @@ vpn1:
vpn2:
hosts:
# use a different name, and define ansible_host, to avoid mixing of vars without needing to prefix vars with interface name
# Use a different name, and define ansible_host, to avoid mixing of vars without
# needing to prefix vars with interface name.
multi-wg1:
ansible_host: multi
wireguard_interface: wg1
wireguard_port: 51821 # when using several interface on one host, we must use different ports
# when using several interface on one host, we must use different ports
wireguard_port: 51821
wireguard_address: 10.9.1.1/32
wireguard_endpoint: multi.exemple.com
another:

16
defaults/main.yml
View file

@ -1,4 +1,8 @@
---
#######################################
# General settings
#######################################
# Directory to store WireGuard configuration on the remote hosts
wireguard_remote_directory: "/etc/wireguard"
@ -9,9 +13,19 @@ wireguard_port: "51820"
wireguard_interface: "wg0"
#wireguard_unmanaged_hosts:
# - host: 'test'
# - host: 'test1'
# allowed_ips: 10.200.10.10/32
# dns: 10.200.10.1
# - host: 'test2'
# allowed_ips: 10.200.10.11/32
# dns: 10.200.10.1
#######################################
# Settings only relevant for Ubuntu
#######################################
# Set to "false" if package cache should not be updated
wireguard_ubuntu_update_cache: "true"
# Set package cache valid time
wireguard_ubuntu_cache_valid_time: "3600"

3
files/debian/etc/apt/preferences.d/limit-unstable
View file

@ -1,3 +0,0 @@
Package: *
Pin: release a=unstable
Pin-Priority: 90

2
meta/main.yml
View file

@ -8,9 +8,11 @@ galaxy_info:
- name: Ubuntu
versions:
- bionic
- focal
- name: Debian
versions:
- stretch
- buster
- name: EL
versions:
- 7

14
tasks/main.yml
View file

@ -4,17 +4,6 @@
- include_tasks: "setup-{{ ansible_distribution|lower }}.yml"
- name: Install WireGuard
package:
name: "{{ packages }}"
state: present
vars:
packages:
- wireguard-dkms
- wireguard-tools
tags:
- wg-install
- name: Enable WireGuard kernel module
modprobe:
name: wireguard
@ -59,8 +48,9 @@
- block:
- name: Generate WireGuard private key
shell: "wg genkey"
command: "wg genkey"
register: wg_private_key_result
changed_when: false
tags:
- wg-generate-keys

33
tasks/setup-archlinux.yml
View file

@ -1,11 +1,32 @@
---
- name: Install required packages
- name: (Archlinux) Install wireguard-lts package
pacman:
name: "{{ packages }}"
state: present
name: "{{ item.name }}"
state: "{{ item.state }}"
with_items:
- { name: wireguard-dkms, state: absent }
- { name: wireguard-lts, state: present }
become: yes
vars:
packages:
- linux-headers
tags:
- wg-install
when:
- ansible_kernel is match(".*-lts$")
- ansible_kernel is version('5.6', '<')
- name: (Archlinux) Install wireguard-dkms package
pacman:
name: wireguard-dkms
state: present
become: yes
tags:
- wg-install
when:
- not ansible_kernel is match(".*-lts$")
- ansible_kernel is version('5.6', '<')
- name: (Archlinux) Install wireguard-tools package
pacman:
name: wireguard-tools
state: present
tags:
- wg-install

14
tasks/setup-centos.yml
View file

@ -1,11 +1,19 @@
---
- name: Add WireGuard repository
- name: (CentOS) Add WireGuard repository
get_url:
url: https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
dest: /etc/yum.repos.d/wireguard.repo
- name: Install EPEL repository
- name: (CentOS) Install EPEL repository
yum:
name: epel-release
update_cache: yes
- name: (CentOS) Install wireguard packages
yum:
name:
- "wireguard-dkms"
- "wireguard-tools"
state: present
tags:
- wg-install

93
tasks/setup-debian-raspbian.yml Normal file
View file

@ -0,0 +1,93 @@
---
- name: (Raspbian) Install GPG - required to add wireguard key
apt:
name: gnupg
state: present
- name: (Raspbian) Add Debian repository key
apt_key:
keyserver: "keyserver.ubuntu.com"
id: "04EE7237B7D453EC"
state: present
when: ansible_lsb.id == "Raspbian"
tags:
- wg-install
- name: (Raspbian) Add Debian Unstable repository for WireGuard
apt_repository:
repo: "deb http://deb.debian.org/debian unstable main"
state: present
update_cache: yes
tags:
- wg-install
- name: (Raspbian) Install latest kernel
apt:
name:
- "raspberrypi-kernel"
state: latest
register: kernel_update
tags:
- wg-install
- name: (Raspbian) Reboot after kernel update (Ansible >= 2.8)
reboot:
search_paths: ['/lib/molly-guard', '/usr/sbin']
when:
- ansible_version.full is version('2.8.0', '>=')
- kernel_update is changed
tags:
- wg-install
- name: (Raspbian) Check if molly-guard is installed (Ansible < 2.8)
stat:
path: /lib/molly-guard/
register: molly_guard
- name: (Raspbian) Reboot after kernel update (Ansible < 2.8, no molly-guard)
reboot:
when:
- ansible_version.full is version('2.8.0', '<')
- kernel_update is changed
- not molly_guard.stat.exists
tags:
- wg-install
- name: (Raspbian) Reboot after kernel update (Ansible < 2.8, with molly-guard)
command: /lib/molly-guard/shutdown -r now
async: 1
poll: 0
ignore_unreachable: yes
when:
- ansible_version.full is version('2.8.0', '<')
- kernel_update is changed
- molly_guard.stat.exists
tags:
- wg-install
- name: (Raspbian) Waiting for host to be available (Ansible < 2.8, with molly-guard)
wait_for_connection:
when:
- ansible_version.full is version('2.8.0', '<')
- kernel_update is changed
- molly_guard.stat.exists
tags:
- wg-install
- name: (Raspbian) Install latest kernel headers to compile Wireguard with DKMS
apt:
name:
- "raspberrypi-kernel-headers"
state: latest
tags:
- wg-install
- name: (Raspbian) Install wireguard packages
apt:
name:
- "wireguard-dkms"
- "wireguard-tools"
state: present
tags:
- wg-install

37
tasks/setup-debian-vanilla.yml Normal file
View file

@ -0,0 +1,37 @@
---
- name: (Debian) Install GPG - required to add wireguard key
apt:
name: gnupg
state: present
- name: (Debian) Add WireGuard repository on buster or earlier
apt_repository:
repo: "deb http://deb.debian.org/debian buster-backports main"
state: present
update_cache: yes
when: ansible_distribution_version | int <= 10
tags:
- wg-install
- name: (Debian) Get architecture
command: "dpkg --print-architecture"
register: dpkg_arch
changed_when: False
- set_fact:
kernel_header_version: "{{ ('-cloud-' in ansible_kernel) | ternary(ansible_kernel,dpkg_arch.stdout) }}"
- name: (Debian) Install kernel headers to compile Wireguard with DKMS
apt:
name:
- "linux-headers-{{ kernel_header_version }}"
state: present
- name: (Debian) Install wireguard packages
apt:
name:
- "wireguard-dkms"
- "wireguard-tools"
state: present
tags:
- wg-install

44
tasks/setup-debian.yml
View file

@ -1,42 +1,8 @@
---
- name: Setup WireGuard preference
copy:
src: debian/etc/apt/preferences.d/limit-unstable
dest: /etc/apt/preferences.d/limit-unstable
owner: root
group: root
mode: 0644
tags:
- wg-install
- name: Install GPG - required to add wireguard key
apt:
name: gnupg
state: present
- include_tasks: "setup-debian-raspbian.yml"
when: ansible_lsb.id == "Raspbian"
register: raspbian_setup
- name: Add WireGuard key
apt_key:
keyserver: "keyserver.ubuntu.com"
id: "8B48AD6246925553"
state: present
tags:
- wg-install
- name: Add WireGuard repository
apt_repository:
repo: "deb http://deb.debian.org/debian/ unstable main"
state: present
update_cache: yes
tags:
- wg-install
- name: Get architecture
shell: dpkg --print-architecture
register: dpkg_arch
changed_when: False
- name: Install kernel headers to compile wireguard with DKMS
apt:
name:
- "linux-headers-{{ dpkg_arch.stdout }}"
state: present
- include_tasks: "setup-debian-vanilla.yml"
when: raspbian_setup is skipped

23
tasks/setup-fedora.yml
View file

@ -1,8 +1,17 @@
---
- name: Add wireguard COPR
yum_repository:
name: "jdoss-wireguard"
description: "Copr repo for wireguard owned by jdoss"
baseurl: "https://copr-be.cloud.fedoraproject.org/results/jdoss/wireguard/fedora-$releasever-$basearch/"
gpgkey: "https://copr-be.cloud.fedoraproject.org/results/jdoss/wireguard/pubkey.gpg"
gpgcheck: yes
- name: (Fedora) Add wireguard COPR
yum_repository:
name: "jdoss-wireguard"
description: "Copr repo for wireguard owned by jdoss"
baseurl: "https://copr-be.cloud.fedoraproject.org/results/jdoss/wireguard/fedora-$releasever-$basearch/"
gpgkey: "https://copr-be.cloud.fedoraproject.org/results/jdoss/wireguard/pubkey.gpg"
gpgcheck: yes
- name: (Fedora) Install wireguard packages
yum:
name:
- "wireguard-dkms"
- "wireguard-tools"
state: present
tags:
- wg-install

62
tasks/setup-ubuntu.yml
View file

@ -1,26 +1,48 @@
---
- name: Update APT package cache
- name: (Ubuntu) Update APT package cache
apt:
update_cache: true
cache_valid_time: 3600
update_cache: "{{ wireguard_ubuntu_update_cache }}"
cache_valid_time: "{{ wireguard_ubuntu_cache_valid_time }}"
tags:
- wg-install
- name: Install required packages
package:
name: "{{ packages }}"
state: present
vars:
packages:
- software-properties-common
- linux-headers-{{ ansible_kernel }}
tags:
- wg-install
- block:
- name: (Ubuntu) Install support packages needed for Wireguard (for Ubuntu < 19.10)
package:
name: "{{ packages }}"
state: present
vars:
packages:
- software-properties-common
- linux-headers-{{ ansible_kernel }}
tags:
- wg-install
- name: Add WireGuard repository
apt_repository:
repo: "ppa:wireguard/wireguard"
state: present
update_cache: yes
tags:
- wg-install
- name: (Ubuntu) Add WireGuard repository (for Ubuntu < 19.10)
apt_repository:
repo: "ppa:wireguard/wireguard"
state: present
update_cache: yes
tags:
- wg-install
- name: (Ubuntu) Install wireguard packages (for Ubuntu < 19.10)
apt:
name:
- "wireguard-dkms"
- "wireguard-tools"
state: present
tags:
- wg-install
when:
- ansible_lsb.major_release is version('19.10', '<')
- block:
- name: (Ubuntu) Install wireguard-tools package (for Ubuntu > 19.04)
apt:
name: "wireguard-tools"
state: present
tags:
- wg-install
when:
- ansible_lsb.major_release is version('19.04', '>')