ansible/roles/wireguard/tasks/main.yml

166 lines
3.9 KiB
YAML
Raw Normal View History

2020-08-04 22:17:13 +00:00
---
- name: Gather instance facts
setup:
- include_tasks: "setup-{{ ansible_distribution|lower }}.yml"
when: not wireguard_containerized
- name: Enable WireGuard kernel module
modprobe:
name: wireguard
state: present
register: wireguard_module_enabled
until: wireguard_module_enabled is succeeded
retries: 10
delay: 10
failed_when: wireguard_module_enabled is failure
tags:
- wg-install
- name: Set WireGuard IP (without mask)
set_fact:
wireguard_ip: "{{ wireguard_address.split('/')[0] }}"
- name: Register if config/private key already exists on target host
stat:
path: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
register: config_file_stat
tags:
- wg-generate-keys
- wg-config
- name: Get wg subcommands
command: "wg --help"
register: wg_subcommands
changed_when: false
- name: Set default value for wg_syncconf variable (assume wg syncconf subcommand not available)
set_fact:
wg_syncconf: false
- name: Check if wg syncconf subcommand is available
set_fact:
wg_syncconf: true
when: wg_subcommands.stdout | regex_search('syncconf:')
- name: Show syncconf subcommand status
debug:
var: wg_syncconf
- block:
- name: Generate WireGuard private key
command: "wg genkey"
register: wg_private_key_result
changed_when: false
tags:
- wg-generate-keys
- name: Set private key fact
set_fact:
private_key: "{{ wg_private_key_result.stdout }}"
tags:
- wg-generate-keys
when: not config_file_stat.stat.exists
- block:
- name: Read WireGuard config file
slurp:
src: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
register: wg_config
tags:
- wg-config
- name: Set private key fact
set_fact:
private_key: "{{ wg_config['content'] | b64decode | regex_findall('PrivateKey = (.*)') | first }}"
tags:
- wg-config
when: config_file_stat.stat.exists
- name: Derive WireGuard public key
shell: "echo '{{ private_key }}' | wg pubkey" # noqa 306
register: wg_public_key_result
changed_when: false
tags:
- wg-config
- name: Set public key fact
set_fact:
public_key: "{{ wg_public_key_result.stdout }}"
tags:
- wg-config
- name: Create WireGuard configuration directory
file:
dest: "{{ wireguard_remote_directory }}"
state: directory
mode: 0700
tags:
- wg-config
- name: Generate WireGuard configuration file
template:
src: wg.conf.j2
dest: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
owner: root
group: root
mode: 0600
tags:
- wg-config
notify:
- reconfigure wireguard
- name: Check if reload-module-on-update is set
stat:
path: "{{ wireguard_remote_directory }}/.reload-module-on-update"
register: reload_module_on_update
tags:
- wg-config
- name: Set WireGuard reload-module-on-update
file:
dest: "{{ wireguard_remote_directory }}/.reload-module-on-update"
state: touch
when: not reload_module_on_update.stat.exists
tags:
- wg-config
- name: Start and enable WireGuard service
service:
name: "wg-quick@{{ wireguard_interface }}"
state: started
enabled: yes
when: not wireguard_containerized
- name: Setup wg dns-reresolver service
template:
src: wireguard_reresolve-dns.service
dest: "/etc/systemd/system/wireguard_reresolve-dns.service"
owner: root
group: root
mode: 0644
tags:
- wg-config
when: not wireguard_containerized
- name: Setup wg dns-reresolver timer
template:
src: wireguard_reresolve-dns.timer
dest: "/etc/systemd/system/wireguard_reresolve-dns.timer"
owner: root
group: root
mode: 0644
tags:
- wg-config
when: not wireguard_containerized
- name: Enable wg dns-reresolver timer
systemd:
name: wireguard_reresolve-dns.timer
daemon_reload: yes
enabled: yes
state: restarted
when: not wireguard_containerized
2020-08-14 00:39:10 +00:00
tags:
- wg-config