initial commit

4 files changed, 61 insertions, 0 deletions

diff --git a/roles/wireguard_client/defaults/main.yaml b/roles/wireguard_client/defaults/main.yaml
new file mode 100644
index 0000000..9a163d4
--- /dev/null
+++ b/roles/wireguard_client/defaults/main.yaml
@@ -0,0 +1,2 @@
+# Default Values
+---
diff --git a/roles/wireguard_client/handlers/main.yaml b/roles/wireguard_client/handlers/main.yaml
new file mode 100644
index 0000000..bd5fc0d
--- /dev/null
+++ b/roles/wireguard_client/handlers/main.yaml
@@ -0,0 +1,7 @@
+---
+
+- name: 'Restart wireguard'
+  systemd:
+    name: 'wg-quick@wg0'
+    state: 'restarted'
+  listen: 'restart wireguard'
diff --git a/roles/wireguard_client/tasks/main.yaml b/roles/wireguard_client/tasks/main.yaml
new file mode 100644
index 0000000..04814ba
--- /dev/null
+++ b/roles/wireguard_client/tasks/main.yaml
@@ -0,0 +1,36 @@
+# https://dev.to/tangramvision/exploring-ansible-via-setting-up-a-wireguard-vpn-3389
+---
+
+- name: 'Enable Debian 10 buster backports repo'
+  shell:
+    cmd: 'echo "deb http://deb.debian.org/debian buster-backports main contrib non-free" > /etc/apt/sources.list.d/buster-backports.list'
+    creates: '/etc/apt/sources.list.d/buster-backports.list'
+
+- name: 'Install Wireguard'
+  apt:
+    name: 'wireguard'
+    state: 'present'
+    update_cache: true
+
+- name: 'enable and persist ip forwarding'
+  sysctl:
+    name: 'net.ipv4.ip_forward'
+    value: "1"
+    state: 'present'
+    sysctl_set: true
+    reload: true
+
+- name: 'generate private key'
+  shell:
+    cmd: 'umask 077 && wg genkey | tee privatekey | wg pubkey > publickey'
+    chdir: '/etc/wireguard'
+    creates: '/etc/wireguard/publickey'
+
+- name: 'create client wireguard config'
+  template:
+    dest: '/etc/wireguard/wg0.conf'
+    src: 'wg0.conf.j2'
+    owner: 'root'
+    group: 'root'
+    mode: '600'
+  notify: 'restart wireguard'
diff --git a/roles/wireguard_client/templates/wg0.conf.j2 b/roles/wireguard_client/templates/wg0.conf.j2
new file mode 100644
index 0000000..d667d8a
--- /dev/null
+++ b/roles/wireguard_client/templates/wg0.conf.j2
@@ -0,0 +1,16 @@
+# {{ ansible_managed }}
+
+[Interface]
+Address = {{ wireguard_client_peer_ip }}
+PostUp = wg set %i private-key /etc/wireguard/privatekey
+PostUp = ping -c1 192.168.10.1
+{% for port in wireguard_client_port_forwards %}
+PostUp = iptables -t nat -A PREROUTING -p tcp --dport {{ port }} -j DNAT --to-destination 192.168.10.1:{{ port }}
+{% endfor %}
+PostUp = iptables -t nat -A POSTROUTING -j MASQUERADE
+
+[Peer]
+PublicKey = {{ wireguard_client_server_pub_key }}
+AllowedIPs = {{ wireguard_client_server_allowed_ips }}
+Endpoint = {{ wireguard_client_server_endpoint }}:{{ wireguard_client_server_listen_port }}
+PersistentKeepalive = 20