71 lines
2.4 KiB
YAML
71 lines
2.4 KiB
YAML
---
|
|
- name: Validate wireguard_tunnels is defined and non-empty
|
|
ansible.builtin.assert:
|
|
that:
|
|
- wireguard_tunnels is defined
|
|
- wireguard_tunnels | length > 0
|
|
fail_msg: |
|
|
wireguard_tunnels must be defined with at least one tunnel.
|
|
See roles/wireguard/defaults/main.yml for configuration instructions.
|
|
success_msg: "wireguard_tunnels validation passed"
|
|
|
|
- name: Install wireguard (Linux)
|
|
ansible.builtin.package:
|
|
name: "{{ wireguard_package_name }}"
|
|
state: present
|
|
when: ansible_facts['os_family'] != 'Darwin'
|
|
|
|
# Homebrew refuses to run as root, so never become for this task even when the
|
|
# role is applied with become (needed later for /etc/wireguard and wg-quick).
|
|
- name: Install wireguard (macOS)
|
|
community.general.homebrew:
|
|
name: "{{ wireguard_package_name }}"
|
|
state: present
|
|
become: false
|
|
when: ansible_facts['os_family'] == 'Darwin'
|
|
|
|
- name: Install nftables (Arch server_mode PostUp dependency)
|
|
ansible.builtin.package:
|
|
name: nftables
|
|
state: present
|
|
when:
|
|
- ansible_facts['os_family'] == 'Archlinux'
|
|
- wireguard_tunnels | selectattr('server_mode', 'defined') | selectattr('server_mode', 'equalto', true) | list | length > 0
|
|
|
|
# Use systemd-resolved for DNS management (modern approach on all distributions)
|
|
# wg-quick calls `resolvconf` (not resolvectl) to apply DNS, so the
|
|
# systemd-resolvconf compat wrapper must be installed wherever wg-quick is
|
|
# used to push DNS to the local host. On Arch, tunnels that need this should
|
|
# set `dns:` and install openresolv/systemd-resolvconf explicitly.
|
|
- name: Install systemd-resolvconf (provides resolvconf wrapper for wg-quick)
|
|
ansible.builtin.package:
|
|
name: systemd-resolvconf
|
|
state: present
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
|
|
- name: Ensure systemd-resolved is enabled and started
|
|
ansible.builtin.systemd:
|
|
name: systemd-resolved
|
|
enabled: true
|
|
state: started
|
|
when: ansible_facts['os_family'] != 'Darwin'
|
|
|
|
- name: Ensure wireguard configuration is only owned by root
|
|
ansible.builtin.file:
|
|
path: "{{ wireguard_config_base_path }}"
|
|
owner: root
|
|
group: "{{ wireguard_config_group }}"
|
|
mode: "0700"
|
|
state: directory
|
|
recurse: true
|
|
|
|
- name: Configure tunnel
|
|
ansible.builtin.include_tasks: tunnel.yml
|
|
loop: "{{ wireguard_tunnels }}"
|
|
loop_control:
|
|
loop_var: _tunnel
|
|
|
|
- name: Deploy Prometheus wireguard exporter
|
|
ansible.builtin.include_tasks: exporter.yml
|
|
when: wireguard_exporter_enabled | bool
|