Initial commit

ansible/roles/wireguard/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart wireguard
+  systemd:
+    name: "wg-quick@wg-{{ gateway_config.lab_name }}"
+    state: restarted

ansible/roles/wireguard/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+- name: Create WireGuard config directory
+  file:
+    path: "{{ wireguard_config_dir }}"
+    state: directory
+    mode: '0700'
+
+- name: Generate WireGuard configuration
+  template:
+    src: wg-interface.conf.j2
+    dest: "{{ wireguard_config_dir }}/wg-{{ gateway_config.lab_name }}.conf"
+    mode: '0600'
+  notify: restart wireguard
+
+- name: Enable WireGuard interface
+  systemd:
+    name: "wg-quick@wg-{{ gateway_config.lab_name }}"
+    enabled: yes
+    state: started

ansible/roles/wireguard/templates/wg-interface.conf.j2

@@ -0,0 +1,31 @@
+[Interface]
+Address = {{ gateway_config.wg_ip }}/{{ gateway_config.wg_net | ipaddr('prefix') }}
+ListenPort = {{ gateway_config.wg_listen_port }}
+PrivateKey = {{ gateway_config.wg_private_key }}
+
+# Disable default route
+Table = off
+
+# Post-up: Add route for WireGuard mesh network only
+PostUp = ip route add {{ gateway_config.wg_net }} dev wg-{{ gateway_config.lab_name }}
+
+{% for peer in gateway_config.peers %}
+[Peer]
+# {{ peer.to }}
+PublicKey = {{ peer.public_key }}
+Endpoint = {{ peer.endpoint }}:{{ gateway_config.wg_listen_port }}
+AllowedIPs = {{ peer.wg_ip }}/32
+PersistentKeepalive = {{ wireguard_persistent_keepalive }}
+
+{% endfor %}
+
+{% if gateway_config.road_warrior and gateway_config.rw_clients | length > 0 %}
+# Road Warrior Clients
+{% for client in gateway_config.rw_clients %}
+[Peer]
+# {{ client.email }}
+PublicKey = {{ client.public_key }}
+AllowedIPs = {{ client.wg_ip }}/32
+
+{% endfor %}
+{% endif %}