Add wireguard configuration

templates/network/br0.netdev.j2

@@ -0,0 +1,6 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[NetDev]
+Name={{ bridge_interface }}
+Kind=bridge
+MACAddress={{ bridge_mac }}

templates/network/br0.network.j2

@@ -0,0 +1,7 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[Match]
+Name={{ bridge_source_interface }}
+
+[Network]
+Bridge={{ bridge_interface }}

templates/network/enp5s0.network.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[Match]
+Name={{ bridge_interface }}
+
+[Network]
+DHCP=ipv4
+Address={{ lan_ip_address }}/24
+Gateway={{ lan_ip_address[:-3] }}1
+DNS={{ lan_ip_address[:-3] }}1

templates/network/wg0.netdev.j2

@@ -0,0 +1,17 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[NetDev]
+Name={{ vpn_interface }}
+Kind=wireguard
+Description=WireGuard tunnel wg0
+
+[WireGuard]
+ListenPort={{ vpn_port }}
+PrivateKeyFile={{ vpn_server_key_path }}
+
+{% for peer in vpn_peers %}
+[WireGuardPeer]
+PublicKey={{ peer.public_key }}
+PresharedKeyFile={{ vpn_preshared_path }}
+AllowedIPs={{ peer.ip }}/32
+{% endfor %}

templates/network/wg0.network.j2

@@ -0,0 +1,7 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[Match]
+Name={{ vpn_interface }}
+
+[Network]
+Address={{ vpn_listen_address }}/24

templates/nftables.j2

@@ -19,14 +19,14 @@ table ip filter {
     # allow icmp
     ip protocol icmp accept
 
-    iifname 'br0' tcp dport {{ ssh_port }} accept comment 'SSH'
-    iifname 'br0' tcp dport { {{ http_port }}, {{ https_port }} } accept comment 'HTTP/HTTPS'
+    iifname "br0" tcp dport {{ ssh_port }} accept comment "SSH"
+    iifname "br0" tcp dport { {{ http_port }}, {{ https_port }} } accept comment "HTTP/HTTPS"
 
-    iifname 'br0' tcp dport {{ vpn_port }} accept comment 'Wireguard'
+    iifname "br0" tcp dport {{ vpn_port }} accept comment "Wireguard"
 
-    iifname '{{ vpn_interface }}' tcp dport { {{ http_port }}, {{ https_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'HTTP/HTTPS'
-    iifname '{{ vpn_interface }}' tcp dport {{ transmission_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'Transmission'
-    iifname '{{ vpn_interface }}' tcp dport { {{ syncthing_gui_port }}, {{ syncthing_protocol_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'Syncthing'
-    iifname '{{ vpn_interface }}' tcp dport {{ mpd_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'MPD'
+    iifname "{{ vpn_interface }}" tcp dport { {{ http_port }}, {{ https_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "HTTP/HTTPS"
+    iifname "{{ vpn_interface }}" tcp dport {{ transmission_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "Transmission"
+    iifname "{{ vpn_interface }}" tcp dport { {{ syncthing_gui_port }}, {{ syncthing_protocol_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "Syncthing"
+    iifname "{{ vpn_interface }}" tcp dport {{ mpd_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "MPD"
   }
 }

templates/transmission.j2

@@ -52,7 +52,7 @@
     "rpc-port": {{ transmission_port }},
     "rpc-url": "/transmission/",
     "rpc-username": "transmission",
-    "rpc-whitelist": "127.0.0.1, {{ vpn_listen_address:[-1] }}*",
+    "rpc-whitelist": "127.0.0.1, {{ vpn_listen_address[:-1] }}*",
     "rpc-whitelist-enabled": true,
     "scrape-paused-torrents-enabled": true,
     "script-torrent-done-enabled": false,