87 lines
2.8 KiB
YAML
87 lines
2.8 KiB
YAML
---
|
|
- name: Set WireGuard interface name
|
|
set_fact:
|
|
wg_if: "wg_{{ gateway_config.lab_name }}"
|
|
wg_port: "{{ gateway_config.wg_listen_port }}"
|
|
|
|
- name: Remove existing WireGuard interface configuration
|
|
shell: |
|
|
uci delete network.{{ wg_if }} 2>/dev/null || true
|
|
uci commit network
|
|
changed_when: true
|
|
|
|
- name: Create WireGuard interface
|
|
shell: |
|
|
uci set network.{{ wg_if }}=interface
|
|
uci set network.{{ wg_if }}.proto='wireguard'
|
|
uci set network.{{ wg_if }}.private_key='{{ gateway_config.wg_private_key }}'
|
|
uci set network.{{ wg_if }}.listen_port='{{ wg_port }}'
|
|
uci add_list network.{{ wg_if }}.addresses='{{ gateway_config.wg_ip }}/{{ gateway_config.wg_net | ipaddr("prefix") }}'
|
|
uci commit network
|
|
changed_when: true
|
|
|
|
- name: Remove existing WireGuard peers
|
|
shell: |
|
|
for peer in $(uci show network | grep "={{ wg_if }}_peer" | cut -d. -f2 | cut -d= -f1); do
|
|
uci delete network.$peer
|
|
done
|
|
uci commit network
|
|
changed_when: true
|
|
ignore_errors: yes
|
|
|
|
- name: Configure WireGuard gateway peers
|
|
shell: |
|
|
peer_name="{{ wg_if }}_peer{{ idx }}"
|
|
uci set network.$peer_name=wireguard_{{ wg_if }}
|
|
uci set network.$peer_name.public_key='{{ peer.public_key }}'
|
|
uci set network.$peer_name.endpoint_host='{{ peer.endpoint }}'
|
|
uci set network.$peer_name.endpoint_port='{{ wg_port }}'
|
|
uci set network.$peer_name.persistent_keepalive='25'
|
|
uci add_list network.$peer_name.allowed_ips='{{ peer.wg_ip }}/32'
|
|
uci set network.$peer_name.route_allowed_ips='0'
|
|
uci commit network
|
|
loop: "{{ gateway_config.peers }}"
|
|
loop_control:
|
|
index_var: idx
|
|
loop_var: peer
|
|
label: "{{ peer.to }}"
|
|
changed_when: true
|
|
|
|
- name: Configure WireGuard road warrior peers
|
|
shell: |
|
|
peer_name="{{ wg_if }}_rw{{ idx }}"
|
|
uci set network.$peer_name=wireguard_{{ wg_if }}
|
|
uci set network.$peer_name.public_key='{{ client.public_key }}'
|
|
uci add_list network.$peer_name.allowed_ips='{{ client.wg_ip }}/32'
|
|
uci set network.$peer_name.route_allowed_ips='0'
|
|
uci set network.$peer_name.description='{{ client.email }}'
|
|
uci commit network
|
|
loop: "{{ gateway_config.rw_clients }}"
|
|
loop_control:
|
|
index_var: idx
|
|
loop_var: client
|
|
label: "{{ client.email }}"
|
|
when: gateway_config.road_warrior and gateway_config.rw_clients | length > 0
|
|
changed_when: true
|
|
|
|
- name: Reload network configuration
|
|
shell: /etc/init.d/network reload
|
|
changed_when: true
|
|
|
|
- name: Wait for WireGuard interface to come up
|
|
shell: ip link show {{ wg_if }}
|
|
register: wg_link_check
|
|
retries: 10
|
|
delay: 2
|
|
until: wg_link_check.rc == 0
|
|
changed_when: false
|
|
|
|
- name: Verify WireGuard is running
|
|
shell: wg show {{ wg_if }}
|
|
register: wg_status
|
|
changed_when: false
|
|
|
|
- name: Display WireGuard status
|
|
debug:
|
|
var: wg_status.stdout_lines
|