Add media vpn peer for htpc

files/wireguard/media/htpc.pub

@@ -0,0 +1 @@
+XcWpmGrkSQJUEADrDTUmcA7/dm8HQffbdC03rQ/3fwg=

files/wireguard/media/preshared-htpc.psk

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+65643932623038396462633834313733373062316134353734626336616138343035363364396236
+3164323136653036323066396436616437623335363261310a353330396239393230333230376261
+65353262363466663364386264383564353738363033333436643434316466623461633562626634
+3763393036616536650a373236616632383465376464326138643836613732333665626166303739
+62313362376361316530613765313937346532643062613734663433313138366130383864356630
+3466323734333966383262613538366537623234616336613263

host_vars/fudiggity/vpn_media.yml

@@ -1,58 +1,69 @@
-vpn_media_server_public_key_path: '{{ vpn_config_dir }}/keys/public/media_server.pub'
+vpn_media_server_public_key_path: "{{ vpn_config_dir }}/keys/public/media_server.pub"
 vpn_media_server_public_key_source_path: files/wireguard/media/server.pub
-vpn_media_server_key_path: '{{ vpn_config_dir }}/keys/private/media_server.key'
+vpn_media_server_key_path: "{{ vpn_config_dir }}/keys/private/media_server.key"
 
 copy_vpn_media_configurations: false
 
+# private_key_source_path keys are required for clients which get their configuration
+# generated.
 vpn_media_peers:
   laptop:
     ip: 10.0.1.2
-    public_key: 'hI4rqlv2afs4RJkt5xR+dYxQODSd6lR0OqWJRlnQdjM='
+    public_key: "hI4rqlv2afs4RJkt5xR+dYxQODSd6lR0OqWJRlnQdjM="
-    preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-laptop.psk'
+    preshared_key_path: "{{ vpn_config_dir }}/keys/private/preshared-media-laptop.psk"
     preshared_key_source_path: files/wireguard/media/preshared-laptop.psk
 
   desktop:
     ip: 10.0.1.3
-    public_key: 'YDH5lZcxUHM4AU2ZxQrFqjDIV2Z7PSUQKMcYXLExV0E='
+    public_key: "YDH5lZcxUHM4AU2ZxQrFqjDIV2Z7PSUQKMcYXLExV0E="
-    preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-desktop.psk'
+    preshared_key_path: "{{ vpn_config_dir }}/keys/private/preshared-media-desktop.psk"
     preshared_key_source_path: files/wireguard/media/preshared-desktop.psk
 
   mobile_peer_1:
     ip: 10.0.1.4
     allowed_ips:
-      - '{{ vpn_media_subnet }}'
+      - "{{ vpn_media_subnet }}"
-      - '{{ jellyfin_subnet }}'
+      - "{{ jellyfin_subnet }}"
-    public_key: '6fj8FXvzT0IUlZLJjQ/+FhwwRDsJeQsUFHqKQcyXdwQ='
+    public_key: "6fj8FXvzT0IUlZLJjQ/+FhwwRDsJeQsUFHqKQcyXdwQ="
-    preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-mobile-1.psk'
+    preshared_key_path: "{{ vpn_config_dir }}/keys/private/preshared-media-mobile-1.psk"
     preshared_key_source_path: files/wireguard/media/preshared-mobile-1.psk
     private_key_source_path: files/wireguard/media/mobile-1.key
 
   mobile_peer_2:
     ip: 10.0.1.5
     allowed_ips:
-      - '{{ vpn_media_subnet }}'
+      - "{{ vpn_media_subnet }}"
-      - '{{ jellyfin_subnet }}'
+      - "{{ jellyfin_subnet }}"
-    public_key: 'w/pswNrAYFdEUoaLk3zSqOu4gg2s41BBCN02E//ai1c='
+    public_key: "w/pswNrAYFdEUoaLk3zSqOu4gg2s41BBCN02E//ai1c="
-    preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-mobile-2.psk'
+    preshared_key_path: "{{ vpn_config_dir }}/keys/private/preshared-media-mobile-2.psk"
     preshared_key_source_path: files/wireguard/media/preshared-mobile-2.psk
     private_key_source_path: files/wireguard/media/mobile-2.key
 
   tv_peer_1:
     ip: 10.0.1.6
     allowed_ips:
-      - '{{ vpn_media_subnet }}'
+      - "{{ vpn_media_subnet }}"
-      - '{{ jellyfin_subnet }}'
+      - "{{ jellyfin_subnet }}"
-    public_key: '5+yz9C9PhaLhsvAZ1e3mDsTQpMZVrPZnSQa6ERJIKU0='
+    public_key: "5+yz9C9PhaLhsvAZ1e3mDsTQpMZVrPZnSQa6ERJIKU0="
-    preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-tv-1.psk'
+    preshared_key_path: "{{ vpn_config_dir }}/keys/private/preshared-media-tv-1.psk"
     preshared_key_source_path: files/wireguard/media/preshared-tv-1.psk
     private_key_source_path: files/wireguard/media/tv-1.key
 
   tv_peer_2:
     ip: 10.0.1.7
     allowed_ips:
-      - '{{ vpn_media_subnet }}'
+      - "{{ vpn_media_subnet }}"
-      - '{{ jellyfin_subnet }}'
+      - "{{ jellyfin_subnet }}"
-    public_key: 'NSuRDGI1AStpoKhIVvGSW+ORgSdHCZgfiAi+2d7uLww='
+    public_key: "NSuRDGI1AStpoKhIVvGSW+ORgSdHCZgfiAi+2d7uLww="
-    preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-tv-2.psk'
+    preshared_key_path: "{{ vpn_config_dir }}/keys/private/preshared-media-tv-2.psk"
     preshared_key_source_path: files/wireguard/media/preshared-tv-2.psk
     private_key_source_path: files/wireguard/media/tv-2.key
+
+  htpc:
+    ip: 10.0.1.8
+    allowed_ips:
+      - "{{ vpn_media_subnet }}"
+      - "{{ jellyfin_subnet }}"
+    public_key: "XcWpmGrkSQJUEADrDTUmcA7/dm8HQffbdC03rQ/3fwg="
+    preshared_key_path: "{{ vpn_config_dir }}/keys/private/preshared-htpc.psk"
+    preshared_key_source_path: files/wireguard/media/preshared-htpc.psk

tasks/wireguard.yml

@@ -1,78 +1,78 @@
 - name: Copy Wireguard configuration files
   become: true
   ansible.builtin.template:
-    src: '{{ item.src }}'
+    src: "{{ item.src }}"
-    dest: '{{ item.dest }}'
+    dest: "{{ item.dest }}"
     owner: root
     group: systemd-network
-    mode: '0640'
+    mode: "0640"
   loop:
-    - src: 'templates/network/wireguard/default/wg0.netdev.j2'
+    - src: "templates/network/wireguard/default/wg0.netdev.j2"
-      dest: '/etc/systemd/network/wg0.netdev'
+      dest: "/etc/systemd/network/wg0.netdev"
-    - src: 'templates/network/wireguard/default/wg0.network.j2'
+    - src: "templates/network/wireguard/default/wg0.network.j2"
-      dest: '/etc/systemd/network/wg0.network'
+      dest: "/etc/systemd/network/wg0.network"
   notify: restart systemd-networkd
 
 - name: Create Wireguard directories
   become: true
   ansible.builtin.file:
-    path: '{{ item }}'
+    path: "{{ item }}"
     owner: root
     group: systemd-network
-    mode: '0750'
+    mode: "0750"
     state: directory
     recurse: true
   loop:
-    - '{{ vpn_config_dir }}'
+    - "{{ vpn_config_dir }}"
-    - '{{ vpn_server_public_key_path | dirname }}'
+    - "{{ vpn_server_public_key_path | dirname }}"
-    - '{{ vpn_server_key_path | dirname }}'
+    - "{{ vpn_server_key_path | dirname }}"
 
 - name: Copy Wireguard server credentials
   become: true
   ansible.builtin.copy:
-    src: '{{ item.src }}'
+    src: "{{ item.src }}"
-    dest: '{{ item.dest }}'
+    dest: "{{ item.dest }}"
     owner: root
     group: systemd-network
-    mode: '0640'
+    mode: "0640"
   loop:
-    - src: 'files/wireguard/default/server.pub'
+    - src: "files/wireguard/default/server.pub"
-      dest: '{{ vpn_server_public_key_path }}'
+      dest: "{{ vpn_server_public_key_path }}"
-    - src: 'files/wireguard/default/server.key'
+    - src: "files/wireguard/default/server.key"
-      dest: '{{ vpn_server_key_path }}'
+      dest: "{{ vpn_server_key_path }}"
   notify: restart systemd-networkd
 
 - name: Copy Wireguard mobile credentials
   become: true
   ansible.builtin.copy:
-    src: '{{ item.src }}'
+    src: "{{ item.src }}"
-    dest: '{{ item.dest }}'
+    dest: "{{ item.dest }}"
     owner: root
     group: systemd-network
-    mode: '0640'
+    mode: "0640"
   loop:
-    - src: 'files/wireguard/default/mobile.pub'
+    - src: "files/wireguard/default/mobile.pub"
-      dest: '{{ vpn_config_dir }}/keys/public/mobile.pub'
+      dest: "{{ vpn_config_dir }}/keys/public/mobile.pub"
-    - src: 'files/wireguard/default/mobile.key'
+    - src: "files/wireguard/default/mobile.key"
-      dest: '{{ vpn_config_dir }}/keys/private/mobile.key'
+      dest: "{{ vpn_config_dir }}/keys/private/mobile.key"
   notify: restart systemd-networkd
 
 - name: Copy Wireguard preshared keys
   become: true
   ansible.builtin.copy:
-    src: '{{ item.value.preshared_key_source_path }}'
+    src: "{{ item.value.preshared_key_source_path }}"
-    dest: '{{ item.value.preshared_key_path }}'
+    dest: "{{ item.value.preshared_key_path }}"
     owner: root
     group: systemd-network
-    mode: '0640'
+    mode: "0640"
-  with_dict: '{{ vpn_peers }}'
+  with_dict: "{{ vpn_peers }}"
   notify: restart systemd-networkd
 
 - name: Copy Wireguard mobile configuration
   become: true
   ansible.builtin.template:
-    src: 'templates/network/wireguard/default/mobile.wireguard.j2'
+    src: "templates/network/wireguard/default/mobile.wireguard.j2"
-    dest: '/tmp/mobile.conf'
+    dest: "/tmp/mobile.conf"
-    mode: '0600'
+    mode: "0600"
-    owner: '{{ ansible_user_id }}'
+    owner: "{{ ansible_user_id }}"
   when: copy_vpn_configurations