chore: first commit

roles/wireguard/defaults/main.yml

@@ -0,0 +1,8 @@
+wireguard_primary_interface: "{{ network_interfaces.0.name }}"
+wireguard_port: 51820 # static port to receive input connections
+wireguard_server_mode: true # enables NAT and open port
+wireguard_interface: wg0
+wireguard_config_base_path: /etc/wireguard
+wireguard_address: 192.168.27.1/27
+wireguard_dns: 192.168.27.1
+wireguard_peers: []

roles/wireguard/tasks/main.yml

@@ -0,0 +1,60 @@
+- name: install wireguard
+  package:
+    name: "{{ (ansible_facts['os_family'] == 'Archlinux') | ternary('wireguard-tools', 'wireguard') }}"
+    state: present
+
+# to support "DNS=" if used in a "client way"
+- name: install openresolv/resolveconf
+  package:
+    name: "{{ (ansible_facts['os_family'] == 'Archlinux') | ternary('openresolv', 'resolvconf') }}"
+    state: present
+
+- name: ensure wireguard configuration is only owned by root
+  file:
+    path: "{{ wireguard_config_base_path }}"
+    owner: root
+    group: root
+    mode: 0700
+    recurse: yes
+
+- name: check if private key exists
+  stat:
+    path: "{{ wireguard_config_base_path }}/privatekey"
+  register: pkey_file
+
+- name: generate wireguard keys if not present
+  shell: wg genkey | tee {{ wireguard_config_base_path }}/privatekey | wg pubkey > {{ wireguard_config_base_path }}/publickey
+  when: not pkey_file.stat.exists
+
+- name: retrieve wireguard private key from file
+  slurp:
+    src: "{{ wireguard_config_base_path }}/privatekey"
+  register: private_key
+
+- name: set wireguard private key
+  set_fact:
+    wireguard_private_key: "{{ private_key['content'] | b64decode }}"
+
+- name: disable "dns=" instruction if unbound is used to avoid race conditions at startup
+  set_fact:
+    wireguard_dns:
+  when: unbound_custom_lan_records is defined
+
+- name: install wireguard config
+  template:
+    src: wireguard.conf.j2
+    dest: /etc/wireguard/{{ wireguard_interface }}.conf
+
+- name: start and enable service
+  service:
+    name: wg-quick@{{ wireguard_interface }}
+    state: started
+    enabled: yes
+    daemon_reload: yes
+
+- name: configure the firewall for wireguard
+  community.general.ufw:
+    rule: allow
+    port: "{{ wireguard_port }}"
+    proto: udp
+    direction: in

roles/wireguard/templates/wireguard.conf.j2

@@ -0,0 +1,16 @@
+[Interface]
+Address = {{ wireguard_address }}
+{% if wireguard_dns %}DNS = {{ wireguard_dns }}
+{% endif %}
+PrivateKey = {{ wireguard_private_key }}
+{% if wireguard_server_mode %}PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o {{ wireguard_primary_interface }} -j MASQUERADE
+PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o {{ wireguard_primary_interface }} -j MASQUERADE
+ListenPort = {{ wireguard_port }}
+{% endif %}
+
+{% for peer in wireguard_peers %}# {{ peer.name }}
+[Peer]
+PublicKey = {{ peer.public_key }}
+AllowedIPs = {{ peer.allowed_ips | join(',') }}
+{% if peer.endpoint is defined %}Endpoint = {{ peer.endpoint }}{% endif %}
+{% endfor %}