62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
- name: Install WireGuard
|
|
ansible.builtin.apt:
|
|
name: wireguard
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Generate WireGuard keys
|
|
ansible.builtin.shell: |
|
|
set -o pipefail
|
|
wg genkey | tee privatekey | wg pubkey > publickey
|
|
args:
|
|
chdir: /etc/wireguard/
|
|
creates: /etc/wireguard/privatekey
|
|
executable: /usr/bin/bash
|
|
|
|
- name: Grab WireGuard private key for configuration
|
|
ansible.builtin.slurp:
|
|
src: /etc/wireguard/privatekey
|
|
register: wgkey
|
|
|
|
- name: Check if WireGuard preshared key file exists
|
|
ansible.builtin.stat:
|
|
path: /etc/wireguard/presharedkey-{{ item.name }}
|
|
loop: "{{ wireguard.peers }}"
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
register: presharedkey_files
|
|
|
|
- name: Grab WireGuard preshared key for configuration
|
|
ansible.builtin.slurp:
|
|
src: /etc/wireguard/presharedkey-{{ item.item.name }}
|
|
register: wgshared
|
|
loop: "{{ presharedkey_files.results }}"
|
|
loop_control:
|
|
label: "{{ item.item.name }}"
|
|
when: item.stat.exists
|
|
|
|
- name: Grab WireGuard private key for configuration
|
|
ansible.builtin.slurp:
|
|
src: /etc/wireguard/privatekey
|
|
register: wgkey
|
|
|
|
- name: Install WireGuard configuration
|
|
ansible.builtin.template:
|
|
src: wireguard.j2
|
|
dest: /etc/wireguard/wg0.conf
|
|
mode: "400"
|
|
notify: restart_wireguard
|
|
|
|
- name: Start WireGuard interface
|
|
ansible.builtin.service:
|
|
name: wg-quick@wg0
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Add WireGuard firewall rule
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ wireguard.listenport }}"
|
|
proto: udp
|
|
when: wireguard.listenport is defined
|