initial commit

4 files changed, 64 insertions, 0 deletions

diff --git a/roles/wireguard/defaults/main.yaml b/roles/wireguard/defaults/main.yaml
new file mode 100644
index 0000000..9a163d4
--- /dev/null
+++ b/roles/wireguard/defaults/main.yaml
@@ -0,0 +1,2 @@
+# Default Values
+---
diff --git a/roles/wireguard/handlers/main.yaml b/roles/wireguard/handlers/main.yaml
new file mode 100644
index 0000000..bd5fc0d
--- /dev/null
+++ b/roles/wireguard/handlers/main.yaml
@@ -0,0 +1,7 @@
+---
+
+- name: 'Restart wireguard'
+  systemd:
+    name: 'wg-quick@wg0'
+    state: 'restarted'
+  listen: 'restart wireguard'
diff --git a/roles/wireguard/tasks/main.yaml b/roles/wireguard/tasks/main.yaml
new file mode 100644
index 0000000..d7e1e51
--- /dev/null
+++ b/roles/wireguard/tasks/main.yaml
@@ -0,0 +1,38 @@
+# https://dev.to/tangramvision/exploring-ansible-via-setting-up-a-wireguard-vpn-3389
+---
+
+- name: 'install wireguard package'
+  apt:
+    name: 'wireguard'
+    state: 'present'
+    update_cache: true
+
+- name: 'create server wireguard config'
+  template:
+    dest: '/etc/wireguard/wg0.conf'
+    src: 'wg0.conf.j2'
+    owner: 'root'
+    group: 'root'
+    mode: '600'
+  notify: 'restart wireguard'
+
+- name: 'Enable IP Forwarding'
+  sysctl:
+    name: '{{ item.sysctl_key }}'
+    reload: true
+    state: 'present'
+    sysctl_set: true
+    value: '{{ item.sysctl_val }}'
+  loop:
+    - sysctl_key: 'net.ipv4.ip_forward'
+      sysctl_val: "1"
+    - sysctl_key: 'net.ipv6.conf.all.disable_ipv6'
+      sysctl_val: "0"
+    - sysctl_key: 'net.ipv6.conf.all.forwarding'
+      sysctl_val: "1"
+
+- name: 'start wireguard and enable on boot'
+  systemd:
+    name: 'wg-quick@wg0'
+    state: 'started'
+    enabled: true
diff --git a/roles/wireguard/templates/wg0.conf.j2 b/roles/wireguard/templates/wg0.conf.j2
new file mode 100644
index 0000000..6e7bcc1
--- /dev/null
+++ b/roles/wireguard/templates/wg0.conf.j2
@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+
+[Interface]
+Address = {{ wireguard_server_ip }}
+ListenPort = {{ wireguard_server_listen_port }}
+PrivateKey = {{ wireguard_server_priv_key }}
+PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
+PostUp = iptables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+
+
+{% for peer in wireguard_peers %}
+[Peer]
+PublicKey = {{ peer.peer_key }}
+AllowedIPs = {{ peer.peer_ip}}
+
+{% endfor %}