Initial commit

ansible/roles/openwrt-wireguard/tasks/main.yml

@@ -0,0 +1,86 @@
+---
+- name: Set WireGuard interface name
+  set_fact:
+    wg_if: "wg_{{ gateway_config.lab_name }}"
+    wg_port: "{{ gateway_config.wg_listen_port }}"
+
+- name: Remove existing WireGuard interface configuration
+  shell: |
+    uci delete network.{{ wg_if }} 2>/dev/null || true
+    uci commit network
+  changed_when: true
+
+- name: Create WireGuard interface
+  shell: |
+    uci set network.{{ wg_if }}=interface
+    uci set network.{{ wg_if }}.proto='wireguard'
+    uci set network.{{ wg_if }}.private_key='{{ gateway_config.wg_private_key }}'
+    uci set network.{{ wg_if }}.listen_port='{{ wg_port }}'
+    uci add_list network.{{ wg_if }}.addresses='{{ gateway_config.wg_ip }}/{{ gateway_config.wg_net | ipaddr("prefix") }}'
+    uci commit network
+  changed_when: true
+
+- name: Remove existing WireGuard peers
+  shell: |
+    for peer in $(uci show network | grep "={{ wg_if }}_peer" | cut -d. -f2 | cut -d= -f1); do
+      uci delete network.$peer
+    done
+    uci commit network
+  changed_when: true
+  ignore_errors: yes
+
+- name: Configure WireGuard gateway peers
+  shell: |
+    peer_name="{{ wg_if }}_peer{{ idx }}"
+    uci set network.$peer_name=wireguard_{{ wg_if }}
+    uci set network.$peer_name.public_key='{{ peer.public_key }}'
+    uci set network.$peer_name.endpoint_host='{{ peer.endpoint }}'
+    uci set network.$peer_name.endpoint_port='{{ wg_port }}'
+    uci set network.$peer_name.persistent_keepalive='25'
+    uci add_list network.$peer_name.allowed_ips='{{ peer.wg_ip }}/32'
+    uci set network.$peer_name.route_allowed_ips='0'
+    uci commit network
+  loop: "{{ gateway_config.peers }}"
+  loop_control:
+    index_var: idx
+    loop_var: peer
+    label: "{{ peer.to }}"
+  changed_when: true
+
+- name: Configure WireGuard road warrior peers
+  shell: |
+    peer_name="{{ wg_if }}_rw{{ idx }}"
+    uci set network.$peer_name=wireguard_{{ wg_if }}
+    uci set network.$peer_name.public_key='{{ client.public_key }}'
+    uci add_list network.$peer_name.allowed_ips='{{ client.wg_ip }}/32'
+    uci set network.$peer_name.route_allowed_ips='0'
+    uci set network.$peer_name.description='{{ client.email }}'
+    uci commit network
+  loop: "{{ gateway_config.rw_clients }}"
+  loop_control:
+    index_var: idx
+    loop_var: client
+    label: "{{ client.email }}"
+  when: gateway_config.road_warrior and gateway_config.rw_clients | length > 0
+  changed_when: true
+
+- name: Reload network configuration
+  shell: /etc/init.d/network reload
+  changed_when: true
+
+- name: Wait for WireGuard interface to come up
+  shell: ip link show {{ wg_if }}
+  register: wg_link_check
+  retries: 10
+  delay: 2
+  until: wg_link_check.rc == 0
+  changed_when: false
+
+- name: Verify WireGuard is running
+  shell: wg show {{ wg_if }}
+  register: wg_status
+  changed_when: false
+
+- name: Display WireGuard status
+  debug:
+    var: wg_status.stdout_lines