From ff3133f8e7666c6ab3eaa7dd64fee56412038b01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?= <1536672+cdesiles@users.noreply.github.com> Date: Fri, 29 May 2026 21:32:08 +0200 Subject: [PATCH] feat: wireguard role allow multiple endpoints --- roles/wireguard/defaults/main.yml | 20 ++++-- roles/wireguard/handlers/main.yml | 4 ++ roles/wireguard/tasks/main.yml | 77 +++------------------ roles/wireguard/templates/wireguard.conf.j2 | 25 ++++--- 4 files changed, 45 insertions(+), 81 deletions(-) diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml index e47582d..fc70ed0 100644 --- a/roles/wireguard/defaults/main.yml +++ b/roles/wireguard/defaults/main.yml @@ -1,9 +1,17 @@ --- wireguard_primary_interface: "{{ network_interfaces.0.name }}" -wireguard_port: 51820 -wireguard_interface: wg0 wireguard_config_base_path: /etc/wireguard -wireguard_server_mode: true # enables NAT and open port -# wireguard_address: 192.168.27.1/27 # Intentionally undefined - role will fail if not set -# wireguard_dns: 192.168.27.1 # Intentionally undefined - role will fail if not set -wireguard_peers: [] +# wireguard_tunnels: +# - interface: wg0 # required: maps to wgN interface name and config filename +# address: 10.0.0.1/24 # required: CIDR address for [Interface] Address +# port: 51820 # optional: ListenPort (required in server_mode) +# dns: 10.0.0.1 # optional: DNS= line; omit to suppress +# server_mode: true # optional (default: false): enables NAT masquerade + UFW rule +# primary_interface: eth0 # optional: overrides wireguard_primary_interface for this tunnel +# peers: # optional: list of [Peer] entries +# - name: peer_name # required: comment label +# public_key: ... # required: peer's public key +# allowed_ips: [10.0.0.0/24] # required: list of CIDRs +# endpoint: host:port # optional: peer's public endpoint +# persistent_keepalive: 25 # optional: keepalive interval (seconds) +wireguard_tunnels: [] diff --git a/roles/wireguard/handlers/main.yml b/roles/wireguard/handlers/main.yml index c28484f..80fb57c 100644 --- a/roles/wireguard/handlers/main.yml +++ b/roles/wireguard/handlers/main.yml @@ -2,3 +2,7 @@ - name: Reload systemd ansible.builtin.systemd: daemon_reload: true + +- name: Apply sysctl + ansible.builtin.command: sysctl --system + changed_when: true diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml index b18b2a4..0bf2003 100644 --- a/roles/wireguard/tasks/main.yml +++ b/roles/wireguard/tasks/main.yml @@ -1,15 +1,13 @@ --- -- name: Validate required variables are set +- name: Validate wireguard_tunnels is defined and non-empty ansible.builtin.assert: that: - - wireguard_address is defined - - wireguard_address | length > 0 - - wireguard_dns is defined - - wireguard_dns | length > 0 + - wireguard_tunnels is defined + - wireguard_tunnels | length > 0 fail_msg: | - wireguard_address and wireguard_dns are required. + wireguard_tunnels must be defined with at least one tunnel. See roles/wireguard/defaults/main.yml for configuration instructions. - success_msg: "Variable validation passed" + success_msg: "wireguard_tunnels validation passed" - name: Install wireguard ansible.builtin.package: @@ -39,63 +37,8 @@ mode: "0700" recurse: true -- name: Check if private key exists - ansible.builtin.stat: - path: "{{ wireguard_config_base_path }}/privatekey" - register: pkey_file - -- name: Generate wireguard keys if not present - ansible.builtin.shell: wg genkey | tee {{ wireguard_config_base_path }}/privatekey | wg pubkey > {{ wireguard_config_base_path }}/publickey - when: not pkey_file.stat.exists - -- name: Retrieve wireguard private key from file - ansible.builtin.slurp: - src: "{{ wireguard_config_base_path }}/privatekey" - register: private_key - -- name: Set wireguard private key - ansible.builtin.set_fact: - wireguard_private_key: "{{ private_key['content'] | b64decode }}" - -- name: Disable "dns=" instruction if unbound is used to avoid race conditions at startup - ansible.builtin.set_fact: - wireguard_dns: - when: unbound_custom_lan_records is defined - -- name: Install wireguard config - ansible.builtin.template: - src: wireguard.conf.j2 - dest: /etc/wireguard/{{ wireguard_interface }}.conf - -- name: Create systemd override directory for wg-quick - ansible.builtin.file: - path: /etc/systemd/system/wg-quick@{{ wireguard_interface }}.service.d - state: directory - mode: "0755" - -- name: Deploy systemd override for network dependency - ansible.builtin.template: - src: systemd-override.conf.j2 - dest: /etc/systemd/system/wg-quick@{{ wireguard_interface }}.service.d/network-dependency.conf - mode: "0644" - notify: Reload systemd - -- name: Configure the firewall for wireguard - community.general.ufw: - rule: allow - port: "{{ wireguard_port }}" - proto: udp - direction: in - comment: Wireguard VPN - retries: 5 - delay: 2 - register: ufw_result - until: ufw_result is succeeded - when: wireguard_server_mode | default(false) - -- name: Start and enable service - ansible.builtin.service: - name: wg-quick@{{ wireguard_interface }} - state: started - enabled: true - daemon_reload: true +- name: Configure tunnel + ansible.builtin.include_tasks: tunnel.yml + loop: "{{ wireguard_tunnels }}" + loop_control: + loop_var: _tunnel diff --git a/roles/wireguard/templates/wireguard.conf.j2 b/roles/wireguard/templates/wireguard.conf.j2 index db949e4..548f5c1 100644 --- a/roles/wireguard/templates/wireguard.conf.j2 +++ b/roles/wireguard/templates/wireguard.conf.j2 @@ -1,16 +1,25 @@ [Interface] -Address = {{ wireguard_address }} -{% if wireguard_dns %}DNS = {{ wireguard_dns }} +Address = {{ _tunnel.address }} +{% if _tunnel_effective_dns %}DNS = {{ _tunnel_effective_dns }} {% endif %} -PrivateKey = {{ wireguard_private_key }} -{% if wireguard_server_mode %}PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o {{ wireguard_primary_interface }} -j MASQUERADE -PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o {{ wireguard_primary_interface }} -j MASQUERADE -ListenPort = {{ wireguard_port }} +PrivateKey = {{ _tunnel_private_key }} +{% if _tunnel.server_mode | default(false) %} +{% if ansible_facts['os_family'] == 'Archlinux' %} +PostUp = nft add table inet wireguard_%i; nft add chain inet wireguard_%i forward '{ type filter hook forward priority 0; policy accept; }'; nft add rule inet wireguard_%i forward iifname %i accept; nft add chain inet wireguard_%i postrouting '{ type nat hook postrouting priority 100; }'; nft add rule inet wireguard_%i postrouting oifname {{ _tunnel.primary_interface | default(wireguard_primary_interface) }} masquerade +PostDown = nft delete table inet wireguard_%i +{% else %} +PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o {{ _tunnel.primary_interface | default(wireguard_primary_interface) }} -j MASQUERADE +PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o {{ _tunnel.primary_interface | default(wireguard_primary_interface) }} -j MASQUERADE +{% endif %} +ListenPort = {{ _tunnel.port }} {% endif %} -{% for peer in wireguard_peers %}# {{ peer.name }} +{% for peer in _tunnel.peers | default([]) %}# {{ peer.name }} [Peer] PublicKey = {{ peer.public_key }} AllowedIPs = {{ peer.allowed_ips | join(',') }} -{% if peer.endpoint is defined %}Endpoint = {{ peer.endpoint }}{% endif %} +{% if peer.endpoint is defined %}Endpoint = {{ peer.endpoint }} +{% endif %} +{% if peer.persistent_keepalive is defined %}PersistentKeepalive = {{ peer.persistent_keepalive }} +{% endif %} {% endfor %}