# https://dev.to/tangramvision/exploring-ansible-via-setting-up-a-wireguard-vpn-3389
---

- block:
    - name: 'Install necessary pkgs for Alpine'
      apk:
        name: '{{ item }}'
        state: 'latest'
      loop:
        - 'iptables'
        - 'wireguard-tools'

    - name: 'Enable iptables'
      service:
        name: 'iptables'
        enabled: true
  when: 'ansible_os_family == "Alpine"'

- name: 'Install wireguard package for Debian'
  apt:
    name: 'wireguard'
    state: 'present'
    update_cache: true
  when: 'ansible_os_family == "Debian"'

- name: 'Create server wireguard config'
  template:
    dest: '/etc/wireguard/wg0.conf'
    src: 'wg0.conf.j2'
    owner: 'root'
    group: 'root'
    mode: '600'

- name: 'Enable IP Forwarding'
  sysctl:
    name: '{{ item.sysctl_key }}'
    reload: true
    state: 'present'
    sysctl_set: true
    value: '{{ item.sysctl_val }}'
  loop:
    - sysctl_key: 'net.ipv4.ip_forward'
      sysctl_val: "1"
    - sysctl_key: 'net.ipv6.conf.all.disable_ipv6'
      sysctl_val: "0"
    - sysctl_key: 'net.ipv6.conf.all.forwarding'
      sysctl_val: "1"

- name: 'Start wireguard and enable on boot in Debian'
  systemd:
    name: 'wg-quick@wg0'
    state: 'started'
    enabled: true
  when: 'ansible_os_family == "Debian"'

- name: 'Ensure that wireguard interface starts on boot in Alpine'
  blockinfile:
    path: '/etc/network/interfaces'
    block: |
      auto wg0
      iface wg0 inet static
          requires eth0
          address 192.168.10.1
          pre-up ip link add dev wg0 type wireguard
          pre-up wg setconf wg0 <(wg-quick strip wg0)
          post-up iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o wg0 -j ACCEPT
          post-down iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o wg0 -j ACCEPT
  when: 'ansible_os_family == "Alpine"'