Add wireguard configuration

tasks/network.yml

@@ -1,42 +1,109 @@
-- name: setup desktop systemd networkd
-  become: yes
-  template:
-    src: 'templates/desktop/network.j2'
-    dest: '/etc/systemd/network/20-wired.network'
+- name: create wireguard directories
+  become: true
+  file:
+    path: '{{ item | dirname }}'
     owner: root
-    group: root
+    group: systemd-network
     mode: '0644'
-  notify: restart systemd-networkd
+    state: directory
+  loop:
+    - '{{ vpn_private_key_path }}'
+    - '{{ vpn_public_key_path }}'
+
+- name: copy wireguard credentials
+  become: true
+  copy:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    group: systemd-network
+    mode: '0640'
+  loop:
+    - {
+        dest: '{{ vpn_public_key_path }}',
+        src: 'files/{{ platform }}/wireguard/{{ platform }}.pub',
+      }
+    - {
+        dest: '{{ vpn_private_key_path }}',
+        src: 'files/{{ platform }}/wireguard/{{ platform }}.key',
+      }
+
+- name: copy wireguard preshared keys
+  become: true
+  copy:
+    src: '{{ item.preshared_key_source_path }}'
+    dest: '{{ item.preshared_key_path }}'
+    owner: root
+    group: systemd-network
+    mode: '0640'
+  loop: '{{ vpn_peers }}'
+
+- name: setup desktop network configuration
+  become: true
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    group: systemd-network
+    mode: '0640'
+  loop:
+    - {
+        src: 'templates/desktop/network/enp.network.j2',
+        dest: '/etc/systemd/network/20-wired.network',
+      }
+    - {
+        src: 'templates/desktop/network/vmbr0.network.j2',
+        dest: '/etc/systemd/network/30-vmbr0.network',
+      }
+    - {
+        src: 'templates/desktop/network/vmbr0.netdev.j2',
+        dest: '/etc/systemd/network/30-vmbr0.netdev',
+      }
+    - {
+        src: 'templates/desktop/network/wg0.network.j2',
+        dest: '/etc/systemd/network/40-wg0.network',
+      }
+    - {
+        src: 'templates/desktop/network/wg0.netdev.j2',
+        dest: '/etc/systemd/network/40-wg0.netdev',
+      }
   when: platform == "desktop"
 
-- name: setup laptop systemd networkd
-  become: yes
+# TODO: update network configuration path
+- name: setup laptop network configuration
+  become: true
   template:
     src: 'templates/laptop/network.j2'
     dest: '/etc/systemd/network/20-wireless.network'
     owner: root
     group: root
     mode: '0644'
-  notify: restart systemd-networkd
   when: platform == "laptop"
 
+- name: restart systemd-networkd
+  become: true
+  systemd:
+    name: systemd-networkd
+    state: restarted
+    enabled: true
+
 - name: start systemd-resolved service
-  become: yes
+  become: true
   systemd:
     name: systemd-resolved
     state: started
-    enabled: yes
+    enabled: true
 
 - name: start iwd service
-  become: yes
+  become: true
   systemd:
     name: iwd
     state: started
-    enabled: yes
+    enabled: true
   when: platform == "laptop"
 
 - name: copy firewall template
-  become: yes
+  become: true
   template:
     src: 'templates/{{ platform }}/nftables.j2'
     dest: '/etc/nftables.conf'