49 lines
2.9 KiB
YAML
49 lines
2.9 KiB
YAML
---
|
|
wireguard_primary_interface: "{{ network_interfaces.0.name }}"
|
|
wireguard_config_base_path: /etc/wireguard
|
|
# Group owning the config dir/files. macOS has no `root` group (gid 0 is `wheel`).
|
|
wireguard_config_group: >-
|
|
{{ (ansible_facts['os_family'] == 'Darwin') | ternary('wheel', 'root') }}
|
|
# macOS: Homebrew prefix (arm64: /opt/homebrew, Intel: /usr/local). sudo's
|
|
# secure_path omits it, so wg/wg-quick must be called by absolute path.
|
|
wireguard_darwin_brew_prefix: /opt/homebrew
|
|
wireguard_wg_bin: >-
|
|
{{ (ansible_facts['os_family'] == 'Darwin') | ternary(wireguard_darwin_brew_prefix + '/bin/wg', 'wg') }}
|
|
wireguard_wg_quick_bin: >-
|
|
{{ (ansible_facts['os_family'] == 'Darwin') | ternary(wireguard_darwin_brew_prefix + '/bin/wg-quick', 'wg-quick') }}
|
|
# wg-quick's shebang is `#!/usr/bin/env bash` and requires bash 4+, but sudo's
|
|
# secure_path resolves `bash` to macOS's /bin/bash 3.2. Run it through
|
|
# Homebrew's bash explicitly (wireguard-tools depends on it).
|
|
wireguard_darwin_bash: "{{ wireguard_darwin_brew_prefix }}/bin/bash"
|
|
# wireguard_tunnels:
|
|
# - interface: wg0 # required: maps to wgN interface name and config filename
|
|
# address: 10.0.0.1/24 # required: CIDR address for [Interface] Address
|
|
# port: 51820 # optional: ListenPort (required in server_mode)
|
|
# dns: 10.0.0.1 # optional: DNS= line; omit to suppress
|
|
# server_mode: true # optional (default: false): enables NAT masquerade + UFW rule
|
|
# primary_interface: eth0 # optional: overrides wireguard_primary_interface for this tunnel
|
|
# private_key: ... # optional: use a fixed (e.g. vaulted) private key instead
|
|
# # of generating one on the host. Recommended for clients
|
|
# # whose public key is already a server's peer.
|
|
# peers: # optional: list of [Peer] entries
|
|
# - name: peer_name # required: comment label
|
|
# public_key: ... # required: peer's public key
|
|
# allowed_ips: [10.0.0.0/24] # required: list of CIDRs
|
|
# endpoint: host:port # optional: peer's public endpoint
|
|
# persistent_keepalive: 25 # optional: keepalive interval (seconds)
|
|
wireguard_tunnels: []
|
|
|
|
# OS-dependent package name
|
|
wireguard_package_name: >-
|
|
{{ (ansible_facts['os_family'] == 'Archlinux' or ansible_facts['os_family'] == 'Darwin')
|
|
| ternary('wireguard-tools', 'wireguard') }}
|
|
|
|
# Prometheus exporter (optional, gated by wireguard_exporter_enabled).
|
|
# Exposes `wg show all dump` as Prometheus metrics (bytes per peer, last
|
|
# handshake). Arch Linux only: prometheus-wireguard-exporter is packaged in
|
|
# [extra]; no Debian/Ubuntu equivalent exists. Bind stays loopback-only:
|
|
# the host's local Prometheus scrapes it and is federated by the central one.
|
|
wireguard_exporter_enabled: false
|
|
wireguard_exporter_listen_address: "127.0.0.1"
|
|
wireguard_exporter_port: 9586
|