sonny/debian-setup
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactor default wireguard setup

Browse source 
- Replaced set_fact based setup with lookup plugin
- Replaced inline definition of credentials with alternative
  systemd file directives
This commit is contained in:
sonny 2025-03-01 14:21:36 +01:00
parent 02ed21405f
commit a777228013
4 changed files with 19 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

33
tasks/wireguard.yml
View file

@ -1,24 +1,3 @@
- name: Load private key into var
ansible.builtin.set_fact:
vpn_server_key: '{{ lookup("file", "files/wireguard/default/server.key") }}'
- name: Load public key into var
ansible.builtin.set_fact:
vpn_server_public_key: '{{ lookup("file", "files/wireguard/default/server.pub") }}'
# this should eventually be replaced with using the
# PrivateKeyFile/PresharedKeyFile options
- name: Load preshared keys into variables
ansible.builtin.set_fact:
vpn_peers: '{{ vpn_peers | combine({item.key: item.value | combine({"preshared_key": lookup("file", item.value.preshared_key_source_path)})}) }}'
with_dict: '{{ vpn_peers }}'
- name: Load mobile private_key
ansible.builtin.set_fact:
vpn_peers: '{{ vpn_peers | combine({item.key: item.value | combine({"private_key": lookup("file", item.value.private_key_source_path)})}) }}'
with_dict: '{{ vpn_peers }}'
when: item.key == "mobile"
- name: Copy wireguard configuration files
become: true
ansible.builtin.template:
@ -50,10 +29,11 @@
mode: '0640'
state: directory
loop:
- '{{ vpn_key_directory }}'
- '{{ vpn_server_key_path }}'
- '{{ vpn_server_public_key_path }}'
- name: Copy wireguard credentials
- name: Copy Wireguard server credentials
become: true
ansible.builtin.copy:
src: '{{ item.src }}'
@ -66,8 +46,9 @@
dest: '{{ vpn_server_public_key_path }}'
- src: 'files/wireguard/default/server.key'
dest: '{{ vpn_server_key_path }}'
notify: restart systemd-networkd
- name: Copy mobile wireguard credentials
- name: Copy Wireguard mobile credentials
become: true
ansible.builtin.copy:
src: '{{ item.src }}'
@ -77,9 +58,10 @@
mode: '0640'
loop:
- src: 'files/wireguard/default/mobile.pub'
dest: '{{ vpn_server_public_key_path | dirname }}/mobile.pub'
dest: '{{ vpn_key_directory }}/public/mobile.pub'
- src: 'files/wireguard/default/mobile.key'
dest: '{{ vpn_server_key_path | dirname }}/mobile.key'
dest: '{{ vpn_key_directory }}/private/mobile.key'
notify: restart systemd-networkd
- name: Copy wireguard preshared keys
become: true
@ -90,3 +72,4 @@
group: systemd-network
mode: '0640'
with_dict: '{{ vpn_peers }}'
notify: restart systemd-networkd

6
templates/network/wireguard/default/mobile.wireguard.j2
View file

@ -2,10 +2,10 @@
[Interface]
Address={{ vpn_peers.mobile.ip }}/24
PrivateKey={{ vpn_peers.mobile.private_key }}
PrivateKey={{ lookup("file", vpn_peers.mobile.private_key_source_path) }}
[Peer]
PublicKey={{ vpn_server_public_key }}
PresharedKey={{ vpn_peers.mobile.preshared_key }}
PublicKey={{ lookup("file", vpn_server_public_key_path) }}
PresharedKey={{ lookup("file", vpn_peers.mobile.preshared_key_path) }}
AllowedIPs={{ vpn_listen_address }}/32
Endpoint={{ domain_name }}:{{ vpn_port }}

4
templates/network/wireguard/default/wg0.netdev.j2
View file

@ -7,12 +7,12 @@ Description=WireGuard tunnel wg0
[WireGuard]
ListenPort={{ vpn_port }}
PrivateKey={{ vpn_server_key }}
PrivateKeyFile={{ vpn_server_key_path }}
{% for peer, properties in vpn_peers.items() %}
[WireGuardPeer]
PublicKey={{ properties.public_key }}
PresharedKey={{ properties.preshared_key }}
PresharedKeyFile={{ properties.preshared_key_path }}
AllowedIPs={{ properties.ip }}/32
{% if not loop.last %}

11
vars/vpn.yml
View file

@ -6,8 +6,9 @@ vpn_interface: 'wg0'
vpn_source_range: '10.0.0.0/24'
vpn_destination_range: '10.0.0.1/32'
vpn_server_public_key_path: '/etc/wireguard/keys/public/server.pub'
vpn_server_key_path: '/etc/wireguard/keys/private/server.key'
vpn_key_directory: '/etc/wireguard/keys'
vpn_server_public_key_path: '{{ vpn_key_directory }}/public/server.pub'
vpn_server_key_path: '{{ vpn_key_directory }}/private/server.key'
copy_vpn_configurations: false
@ -15,16 +16,16 @@ vpn_peers:
laptop:
ip: '10.0.0.2'
public_key: 'EbWLf2+7x/RymeeiVuX72nZOBqPvdhu2V9pYhszpQEw='
preshared_key_path: '/etc/wireguard/keys/private/preshared-laptop.psk'
preshared_key_path: '{{ vpn_key_directory }}/private/preshared-laptop.psk'
preshared_key_source_path: 'files/wireguard/default/preshared-laptop.psk'
desktop:
ip: '10.0.0.3'
public_key: 'izHzmRwh2yzICps6pFI2Bg3TnmTD66/8uH4loJpkuD4='
preshared_key_path: '/etc/wireguard/keys/private/preshared-desktop.psk'
preshared_key_path: '{{ vpn_key_directory }}/private/preshared-desktop.psk'
preshared_key_source_path: 'files/wireguard/default/preshared-desktop.psk'
mobile:
ip: '10.0.0.4'
public_key: '4aBHRiglCOE7qEDLqeFgQ5PMMsKczpPoL4bx4jyAEDY='
preshared_key_path: '/etc/wireguard/keys/private/preshared-mobile.psk'
preshared_key_path: '{{ vpn_key_directory }}/private/preshared-mobile.psk'
preshared_key_source_path: 'files/wireguard/default/preshared-mobile.psk'
private_key_source_path: 'files/wireguard/default/mobile.key'