134 lines
3.2 KiB
YAML
134 lines
3.2 KiB
YAML
|
---
|
||
|
|
- name: Gather instance facts
|
||
|
|
setup:
|
||
|
|
|
||
|
|
- include_tasks: "setup-{{ ansible_distribution|lower }}.yml"
|
||
|
|
when: not wireguard_containerized
|
||
|
|
|
||
|
|
- name: Enable WireGuard kernel module
|
||
|
|
modprobe:
|
||
|
|
name: wireguard
|
||
|
|
state: present
|
||
|
|
register: wireguard_module_enabled
|
||
|
|
until: wireguard_module_enabled is succeeded
|
||
|
|
retries: 10
|
||
|
|
delay: 10
|
||
|
|
failed_when: wireguard_module_enabled is failure
|
||
|
|
tags:
|
||
|
|
- wg-install
|
||
|
|
|
||
|
|
- name: Set WireGuard IP (without mask)
|
||
|
|
set_fact:
|
||
|
|
wireguard_ip: "{{ wireguard_address.split('/')[0] }}"
|
||
|
|
|
||
|
|
- name: Register if config/private key already exists on target host
|
||
|
|
stat:
|
||
|
|
path: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
|
||
|
|
register: config_file_stat
|
||
|
|
tags:
|
||
|
|
- wg-generate-keys
|
||
|
|
- wg-config
|
||
|
|
|
||
|
|
- name: Get wg subcommands
|
||
|
|
command: "wg --help"
|
||
|
|
register: wg_subcommands
|
||
|
|
changed_when: false
|
||
|
|
|
||
|
|
- name: Set default value for wg_syncconf variable (assume wg syncconf subcommand not available)
|
||
|
|
set_fact:
|
||
|
|
wg_syncconf: false
|
||
|
|
|
||
|
|
- name: Check if wg syncconf subcommand is available
|
||
|
|
set_fact:
|
||
|
|
wg_syncconf: true
|
||
|
|
when: wg_subcommands.stdout | regex_search('syncconf:')
|
||
|
|
|
||
|
|
- name: Show syncconf subcommand status
|
||
|
|
debug:
|
||
|
|
var: wg_syncconf
|
||
|
|
|
||
|
|
- block:
|
||
|
|
- name: Generate WireGuard private key
|
||
|
|
command: "wg genkey"
|
||
|
|
register: wg_private_key_result
|
||
|
|
changed_when: false
|
||
|
|
tags:
|
||
|
|
- wg-generate-keys
|
||
|
|
|
||
|
|
- name: Set private key fact
|
||
|
|
set_fact:
|
||
|
|
private_key: "{{ wg_private_key_result.stdout }}"
|
||
|
|
tags:
|
||
|
|
- wg-generate-keys
|
||
|
|
when: not config_file_stat.stat.exists
|
||
|
|
|
||
|
|
- block:
|
||
|
|
- name: Read WireGuard config file
|
||
|
|
slurp:
|
||
|
|
src: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
|
||
|
|
register: wg_config
|
||
|
|
tags:
|
||
|
|
- wg-config
|
||
|
|
|
||
|
|
- name: Set private key fact
|
||
|
|
set_fact:
|
||
|
|
private_key: "{{ wg_config['content'] | b64decode | regex_findall('PrivateKey = (.*)') | first }}"
|
||
|
|
tags:
|
||
|
|
- wg-config
|
||
|
|
when: config_file_stat.stat.exists
|
||
|
|
|
||
|
|
- name: Derive WireGuard public key
|
||
|
|
shell: "echo '{{ private_key }}' | wg pubkey" # noqa 306
|
||
|
|
register: wg_public_key_result
|
||
|
|
changed_when: false
|
||
|
|
tags:
|
||
|
|
- wg-config
|
||
|
|
|
||
|
|
- name: Set public key fact
|
||
|
|
set_fact:
|
||
|
|
public_key: "{{ wg_public_key_result.stdout }}"
|
||
|
|
tags:
|
||
|
|
- wg-config
|
||
|
|
|
||
|
|
- name: Create WireGuard configuration directory
|
||
|
|
file:
|
||
|
|
dest: "{{ wireguard_remote_directory }}"
|
||
|
|
state: directory
|
||
|
|
mode: 0700
|
||
|
|
tags:
|
||
|
|
- wg-config
|
||
|
|
|
||
|
|
- name: Generate WireGuard configuration file
|
||
|
|
template:
|
||
|
|
src: wg.conf.j2
|
||
|
|
dest: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: 0600
|
||
|
|
tags:
|
||
|
|
- wg-config
|
||
|
|
notify:
|
||
|
|
- reconfigure wireguard
|
||
|
|
|
||
|
|
- name: Check if reload-module-on-update is set
|
||
|
|
stat:
|
||
|
|
path: "{{ wireguard_remote_directory }}/.reload-module-on-update"
|
||
|
|
register: reload_module_on_update
|
||
|
|
tags:
|
||
|
|
- wg-config
|
||
|
|
|
||
|
|
- name: Set WireGuard reload-module-on-update
|
||
|
|
file:
|
||
|
|
dest: "{{ wireguard_remote_directory }}/.reload-module-on-update"
|
||
|
|
state: touch
|
||
|
|
when: not reload_module_on_update.stat.exists
|
||
|
|
tags:
|
||
|
|
- wg-config
|
||
|
|
|
||
|
|
- name: Start and enable WireGuard service
|
||
|
|
service:
|
||
|
|
name: "wg-quick@{{ wireguard_interface }}"
|
||
|
|
state: started
|
||
|
|
enabled: yes
|
||
|
|
when: not wireguard_containerized
|