feat: wireguard role allow multiple endpoints

roles/wireguard/defaults/main.yml

@@ -1,9 +1,17 @@
 ---
 wireguard_primary_interface: "{{ network_interfaces.0.name }}"
-wireguard_port: 51820
-wireguard_interface: wg0
 wireguard_config_base_path: /etc/wireguard
-wireguard_server_mode: true # enables NAT and open port
+# wireguard_tunnels:
-# wireguard_address: 192.168.27.1/27  # Intentionally undefined - role will fail if not set
+#   - interface: wg0          # required: maps to wgN interface name and config filename
-# wireguard_dns: 192.168.27.1          # Intentionally undefined - role will fail if not set
+#     address: 10.0.0.1/24   # required: CIDR address for [Interface] Address
-wireguard_peers: []
+#     port: 51820             # optional: ListenPort (required in server_mode)
+#     dns: 10.0.0.1           # optional: DNS= line; omit to suppress
+#     server_mode: true       # optional (default: false): enables NAT masquerade + UFW rule
+#     primary_interface: eth0 # optional: overrides wireguard_primary_interface for this tunnel
+#     peers:                   # optional: list of [Peer] entries
+#       - name: peer_name               # required: comment label
+#         public_key: ...               # required: peer's public key
+#         allowed_ips: [10.0.0.0/24]    # required: list of CIDRs
+#         endpoint: host:port           # optional: peer's public endpoint
+#         persistent_keepalive: 25      # optional: keepalive interval (seconds)
+wireguard_tunnels: []

roles/wireguard/handlers/main.yml

@@ -2,3 +2,7 @@
 - name: Reload systemd
   ansible.builtin.systemd:
     daemon_reload: true
+
+- name: Apply sysctl
+  ansible.builtin.command: sysctl --system
+  changed_when: true

roles/wireguard/tasks/main.yml

@@ -1,15 +1,13 @@
 ---
-- name: Validate required variables are set
+- name: Validate wireguard_tunnels is defined and non-empty
   ansible.builtin.assert:
     that:
-      - wireguard_address is defined
+      - wireguard_tunnels is defined
-      - wireguard_address | length > 0
+      - wireguard_tunnels | length > 0
-      - wireguard_dns is defined
-      - wireguard_dns | length > 0
     fail_msg: |
-      wireguard_address and wireguard_dns are required.
+      wireguard_tunnels must be defined with at least one tunnel.
       See roles/wireguard/defaults/main.yml for configuration instructions.
-    success_msg: "Variable validation passed"
+    success_msg: "wireguard_tunnels validation passed"
 
 - name: Install wireguard
   ansible.builtin.package:
@@ -39,63 +37,8 @@
     mode: "0700"
     recurse: true
 
-- name: Check if private key exists
+- name: Configure tunnel
-  ansible.builtin.stat:
+  ansible.builtin.include_tasks: tunnel.yml
-    path: "{{ wireguard_config_base_path }}/privatekey"
+  loop: "{{ wireguard_tunnels }}"
-  register: pkey_file
+  loop_control:
-
+    loop_var: _tunnel
-- name: Generate wireguard keys if not present
-  ansible.builtin.shell: wg genkey | tee {{ wireguard_config_base_path }}/privatekey | wg pubkey > {{ wireguard_config_base_path }}/publickey
-  when: not pkey_file.stat.exists
-
-- name: Retrieve wireguard private key from file
-  ansible.builtin.slurp:
-    src: "{{ wireguard_config_base_path }}/privatekey"
-  register: private_key
-
-- name: Set wireguard private key
-  ansible.builtin.set_fact:
-    wireguard_private_key: "{{ private_key['content'] | b64decode }}"
-
-- name: Disable "dns=" instruction if unbound is used to avoid race conditions at startup
-  ansible.builtin.set_fact:
-    wireguard_dns:
-  when: unbound_custom_lan_records is defined
-
-- name: Install wireguard config
-  ansible.builtin.template:
-    src: wireguard.conf.j2
-    dest: /etc/wireguard/{{ wireguard_interface }}.conf
-
-- name: Create systemd override directory for wg-quick
-  ansible.builtin.file:
-    path: /etc/systemd/system/wg-quick@{{ wireguard_interface }}.service.d
-    state: directory
-    mode: "0755"
-
-- name: Deploy systemd override for network dependency
-  ansible.builtin.template:
-    src: systemd-override.conf.j2
-    dest: /etc/systemd/system/wg-quick@{{ wireguard_interface }}.service.d/network-dependency.conf
-    mode: "0644"
-  notify: Reload systemd
-
-- name: Configure the firewall for wireguard
-  community.general.ufw:
-    rule: allow
-    port: "{{ wireguard_port }}"
-    proto: udp
-    direction: in
-    comment: Wireguard VPN
-  retries: 5
-  delay: 2
-  register: ufw_result
-  until: ufw_result is succeeded
-  when: wireguard_server_mode | default(false)
-
-- name: Start and enable service
-  ansible.builtin.service:
-    name: wg-quick@{{ wireguard_interface }}
-    state: started
-    enabled: true
-    daemon_reload: true

roles/wireguard/templates/wireguard.conf.j2

@@ -1,16 +1,25 @@
 [Interface]
-Address = {{ wireguard_address }}
+Address = {{ _tunnel.address }}
-{% if wireguard_dns %}DNS = {{ wireguard_dns }}
+{% if _tunnel_effective_dns %}DNS = {{ _tunnel_effective_dns }}
 {% endif %}
-PrivateKey = {{ wireguard_private_key }}
+PrivateKey = {{ _tunnel_private_key }}
-{% if wireguard_server_mode %}PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o {{ wireguard_primary_interface }} -j MASQUERADE
+{% if _tunnel.server_mode | default(false) %}
-PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o {{ wireguard_primary_interface }} -j MASQUERADE
+{% if ansible_facts['os_family'] == 'Archlinux' %}
-ListenPort = {{ wireguard_port }}
+PostUp = nft add table inet wireguard_%i; nft add chain inet wireguard_%i forward '{ type filter hook forward priority 0; policy accept; }'; nft add rule inet wireguard_%i forward iifname %i accept; nft add chain inet wireguard_%i postrouting '{ type nat hook postrouting priority 100; }'; nft add rule inet wireguard_%i postrouting oifname {{ _tunnel.primary_interface | default(wireguard_primary_interface) }} masquerade
+PostDown = nft delete table inet wireguard_%i
+{% else %}
+PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o {{ _tunnel.primary_interface | default(wireguard_primary_interface) }} -j MASQUERADE
+PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o {{ _tunnel.primary_interface | default(wireguard_primary_interface) }} -j MASQUERADE
+{% endif %}
+ListenPort = {{ _tunnel.port }}
 {% endif %}
 
-{% for peer in wireguard_peers %}# {{ peer.name }}
+{% for peer in _tunnel.peers | default([]) %}# {{ peer.name }}
 [Peer]
 PublicKey = {{ peer.public_key }}
 AllowedIPs = {{ peer.allowed_ips | join(',') }}
-{% if peer.endpoint is defined %}Endpoint = {{ peer.endpoint }}{% endif %}
+{% if peer.endpoint is defined %}Endpoint = {{ peer.endpoint }}
+{% endif %}
+{% if peer.persistent_keepalive is defined %}PersistentKeepalive = {{ peer.persistent_keepalive }}
+{% endif %}
 {% endfor %}