154 lines
4.5 KiB
YAML
154 lines
4.5 KiB
YAML
---
|
|
- name: WireGuard Host Setup
|
|
hosts: admin_host
|
|
become: true
|
|
tasks:
|
|
- name: Ensure wireguard and tools are installed
|
|
ansible.builtin.package:
|
|
name:
|
|
- wireguard-tools
|
|
- firewalld
|
|
state: present
|
|
|
|
- name: Ensure firewalld is running and enabled
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Open WG UDP port on public zone
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
port: "{{ wg_listen_port }}/udp"
|
|
permanent: true
|
|
state: enabled
|
|
notify: Reload firewalld
|
|
|
|
- name: Check if WG server private key exists in Secret Manager
|
|
delegate_to: localhost
|
|
become: false
|
|
ansible.builtin.command: >
|
|
gcloud secrets versions access latest --secret=admin-wg-server-key --project={{ lookup('env', 'GCP_PROJECT_ID') }}
|
|
register: wg_sm_check
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Generate WG server private key locally if not in Secret Manager
|
|
delegate_to: localhost
|
|
become: false
|
|
ansible.builtin.command: wg genkey
|
|
register: wg_local_gen
|
|
when: wg_sm_check.rc != 0
|
|
changed_when: true
|
|
|
|
- name: Create Secret in Secret Manager if missing
|
|
delegate_to: localhost
|
|
become: false
|
|
ansible.builtin.command: >
|
|
gcloud secrets create admin-wg-server-key --project={{ lookup('env', 'GCP_PROJECT_ID') }} --replication-policy="automatic"
|
|
when: wg_sm_check.rc != 0
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Push new WG server private key to Secret Manager
|
|
delegate_to: localhost
|
|
become: false
|
|
ansible.builtin.command: >
|
|
gcloud secrets versions add admin-wg-server-key
|
|
--data-file=-
|
|
--project={{ lookup('env', 'GCP_PROJECT_ID') }}
|
|
args:
|
|
stdin: "{{ wg_local_gen.stdout }}"
|
|
when: wg_sm_check.rc != 0
|
|
|
|
- name: Set server private key variable
|
|
ansible.builtin.set_fact:
|
|
wg_server_private_key: "{{ wg_sm_check.stdout if wg_sm_check.rc == 0 else wg_local_gen.stdout }}"
|
|
no_log: true
|
|
|
|
- name: Generate server public key
|
|
delegate_to: localhost
|
|
become: false
|
|
ansible.builtin.command: wg pubkey
|
|
args:
|
|
stdin: "{{ wg_server_private_key }}"
|
|
register: wg_server_pub_gen
|
|
changed_when: false
|
|
|
|
- name: Set server public key variable
|
|
ansible.builtin.set_fact:
|
|
wg_server_public_key: "{{ wg_server_pub_gen.stdout }}"
|
|
|
|
- name: Ensure /etc/wireguard directory exists
|
|
ansible.builtin.file:
|
|
path: /etc/wireguard
|
|
state: directory
|
|
mode: "0700"
|
|
|
|
- name: Generate client keys
|
|
delegate_to: localhost
|
|
become: false
|
|
ansible.builtin.shell: |
|
|
priv=$(wg genkey)
|
|
pub=$(echo "$priv" | wg pubkey)
|
|
psk=$(wg genpsk)
|
|
echo '{"private_key": "'$priv'", "public_key": "'$pub'", "psk": "'$psk'"}'
|
|
register: wg_client_keys_gen
|
|
with_items: "{{ wg_clients }}"
|
|
changed_when: true
|
|
no_log: true
|
|
|
|
- name: Enrich wg_clients with keys
|
|
ansible.builtin.set_fact:
|
|
wg_clients_enriched: >-
|
|
{{
|
|
wg_clients_enriched | default([]) +
|
|
[item.0 | combine(item.1.stdout | from_json)]
|
|
}}
|
|
loop: "{{ wg_clients | zip(wg_client_keys_gen.results) | list }}"
|
|
no_log: true
|
|
|
|
- name: Render server wg0.conf
|
|
ansible.builtin.template:
|
|
src: templates/wg0.conf.j2
|
|
dest: /etc/wireguard/wg0.conf
|
|
mode: "0600"
|
|
notify: Restart wg-quick
|
|
|
|
- name: Enable and start wg-quick@wg0
|
|
ansible.builtin.systemd:
|
|
name: wg-quick@wg0
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Ensure client config directory exists on control machine
|
|
delegate_to: localhost
|
|
become: false
|
|
ansible.builtin.file:
|
|
path: "{{ playbook_dir }}/../generated/clients"
|
|
state: directory
|
|
mode: "0700"
|
|
|
|
- name: Render client configs on control machine
|
|
delegate_to: localhost
|
|
become: false
|
|
ansible.builtin.template:
|
|
src: templates/client.conf.j2
|
|
dest: "{{ playbook_dir }}/../generated/clients/{{ item.name }}.conf"
|
|
mode: "0600"
|
|
loop: "{{ wg_clients_enriched }}"
|
|
vars:
|
|
client: "{{ item }}"
|
|
no_log: true
|
|
|
|
handlers:
|
|
- name: Reload firewalld
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
state: reloaded
|
|
|
|
- name: Restart wg-quick
|
|
ansible.builtin.systemd:
|
|
name: wg-quick@wg0
|
|
state: restarted
|