38 lines
865 B
YAML
38 lines
865 B
YAML
---
|
|
- name: Install wireguard-tools
|
|
ansible.builtin.package:
|
|
name: wireguard-tools
|
|
state: present
|
|
|
|
- name: Ensure /etc/wireguard exists
|
|
ansible.builtin.file:
|
|
path: /etc/wireguard
|
|
state: directory
|
|
mode: "0700"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Enable IPv4 forwarding
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: "1"
|
|
sysctl_set: true
|
|
state: present
|
|
reload: true
|
|
|
|
- name: Enable src_valid_mark (required for WireGuard routing)
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.conf.all.src_valid_mark
|
|
value: "1"
|
|
sysctl_set: true
|
|
state: present
|
|
reload: true
|
|
|
|
# wg-easy takes over wg0 management; ensure wg-quick is not competing.
|
|
- name: Disable and stop wg-quick
|
|
ansible.builtin.systemd:
|
|
name: "wg-quick@{{ wireguard_interface }}"
|
|
enabled: false
|
|
state: stopped
|
|
failed_when: false
|