mmt-infra/playbooks/roles/wireguard-mesh/tasks/main.yml
2024-05-04 13:19:48 -07:00

82 lines
2.2 KiB
YAML

---
- name: Install wireguard
ansible.builtin.apt:
name:
- wireguard
- ufw
state: present
- name: Get node ips from dns records
command: "dig +short {{ item }}"
register: wireguard_node_ip
delegate_to: localhost
with_items: "{{ groups['wireguard-mesh'] }}"
- name: Massage node ips
ansible.builtin.set_fact: >
wireguard_node_ips={{ wireguard_node_ips|default({})
| combine( {item.item: item.stdout} ) }}
with_items: "{{ wireguard_node_ip.results }}"
- name: Allow wireguard endpoint ufw
ansible.builtin.ufw:
rule: allow
port: "{{ wireguard_listen_port }}"
proto: 'udp'
- name: Generate Wireguard keypair
ansible.builtin.shell: >
wg genkey | tee /etc/wireguard/privatekey
| wg pubkey | tee /etc/wireguard/publickey
args:
creates: /etc/wireguard/privatekey
- name: Register private key
ansible.builtin.shell: cat /etc/wireguard/privatekey
register: wireguard_private_key
changed_when: false
- name: Register public key
ansible.builtin.shell: cat /etc/wireguard/publickey
register: wireguard_public_key
changed_when: false
- name: Generate Preshared keyskeypair
ansible.builtin.shell: "wg genpsk > /etc/wireguard/psk-{{ item }}"
args:
creates: "/etc/wireguard/psk-{{ item }}"
when: inventory_hostname < item
with_items: "{{ groups['wireguard-mesh'] }}"
- name: Register preshared key
ansible.builtin.shell: "cat /etc/wireguard/psk-{{ item }}"
register: wireguard_preshared_key
changed_when: false
when: inventory_hostname < item
with_items: "{{ groups['wireguard-mesh'] }}"
- name: Massage preshared keys
ansible.builtin.set_fact: >
wireguard_preshared_keys={{ wireguard_preshared_keys|default({})
| combine( {item.item: item.stdout} ) }}
when: item.skipped is not defined
with_items: "{{ wireguard_preshared_key.results }}"
- name: Build config
ansible.builtin.template:
src: mmtmesh.conf.j2
dest: /etc/wireguard/mmtmesh.conf
owner: root
mode: 0640
- name: Enable wireguard
ansible.builtin.systemd:
name: wg-quick@mmtmesh
enabled: true
- name: Hotreload wireguard
ansible.builtin.shell: >
bash -c
"wg syncconf mmtmesh <(wg-quick strip mmtmesh)"