wireguard, stash, docker debian, jellyfin

tasks/wireguard.yml

@@ -0,0 +1,211 @@
+- name: Load WireGuard keys from vault
+  include_vars:
+    file: vault/wireguard.yml
+
+- name: Validate wireguard configuration
+  assert:
+    that:
+      - wireguard_server is defined
+      - wireguard_clients is defined
+      - wireguard_clients | length > 0
+    fail_msg: "wireguard_server and wireguard_clients must be defined in vault/wireguard.yml"
+
+- name: Install WireGuard packages
+  apt:
+    name:
+      - wireguard
+      - wireguard-tools
+      - qrencode
+    state: present
+    update_cache: yes
+
+- name: Create WireGuard directory structure
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  loop:
+    - /etc/wireguard
+    - /etc/wireguard/clients
+    - /etc/wireguard/keys
+
+- name: Generate key generation script
+  copy:
+    dest: /etc/wireguard/generate_key.sh
+    mode: "0700"
+    content: |
+      #!/bin/bash
+      # Generate a WireGuard keypair
+      # Usage: ./generate_key.sh <output_prefix>
+
+      OUTPUT_PREFIX="$1"
+
+      if [ -z "$OUTPUT_PREFIX" ]; then
+        echo "Usage: $0 <output_file_prefix>"
+        exit 1
+      fi
+
+      echo "Generating WireGuard keypair..."
+      umask 077
+      wg genkey | tee "${OUTPUT_PREFIX}.key" | wg pubkey > "${OUTPUT_PREFIX}.pub"
+      chmod 600 "${OUTPUT_PREFIX}.key"
+      chmod 644 "${OUTPUT_PREFIX}.pub"
+      echo "Keys generated: ${OUTPUT_PREFIX}.key and ${OUTPUT_PREFIX}.pub"
+
+- name: Deploy add_client.sh script
+  copy:
+    src: wireguard/add_client.sh
+    dest: /etc/wireguard/add_client.sh
+    mode: "0755"
+    owner: root
+    group: root
+
+- name: Create server private key file
+  copy:
+    content: "{{ wireguard_server.private_key }}"
+    dest: "/etc/wireguard/keys/server.key"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+
+- name: Create server public key file
+  copy:
+    content: "{{ wireguard_server.public_key }}"
+    dest: "/etc/wireguard/keys/server.pub"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Create client private key files
+  copy:
+    content: "{{ item.private_key }}"
+    dest: "/etc/wireguard/keys/{{ item.name }}.key"
+    owner: root
+    group: root
+    mode: "0600"
+  loop: "{{ wireguard_clients }}"
+  loop_control:
+    label: "{{ item.name }}"
+  no_log: true
+
+- name: Create client public key files
+  copy:
+    content: "{{ item.public_key }}"
+    dest: "/etc/wireguard/keys/{{ item.name }}.pub"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ wireguard_clients }}"
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Create systemd-networkd WireGuard netdev configuration
+  template:
+    src: wireguard/wg0.netdev.j2
+    dest: /etc/systemd/network/99-wg0.netdev
+    owner: root
+    group: systemd-network
+    mode: "0640"
+  notify: reload systemd-networkd
+  no_log: true
+
+- name: Create systemd-networkd WireGuard network configuration
+  template:
+    src: wireguard/wg0.network.j2
+    dest: /etc/systemd/network/99-wg0.network
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload systemd-networkd
+
+- name: Enable IP forwarding
+  sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    sysctl_set: yes
+    reload: yes
+
+- name: Install iptables-persistent for firewall rules
+  apt:
+    name: iptables-persistent
+    state: present
+
+- name: Configure iptables masquerading for WireGuard
+  iptables:
+    table: nat
+    chain: POSTROUTING
+    out_interface: "{{ ansible_default_ipv4.interface }}"
+    source: 10.8.0.0/24
+    jump: MASQUERADE
+    comment: WireGuard masquerading
+  notify: save iptables
+
+- name: Configure iptables forwarding for WireGuard
+  iptables:
+    chain: FORWARD
+    in_interface: wg0
+    jump: ACCEPT
+    comment: WireGuard forward in
+  notify: save iptables
+
+- name: Configure iptables forwarding from WireGuard
+  iptables:
+    chain: FORWARD
+    out_interface: wg0
+    jump: ACCEPT
+    comment: WireGuard forward out
+  notify: save iptables
+
+- name: Enable and start systemd-networkd
+  systemd:
+    name: systemd-networkd
+    enabled: yes
+    state: started
+
+- name: Generate client configuration files
+  template:
+    src: wireguard/client.conf.j2
+    dest: "/etc/wireguard/clients/{{ item.name }}.conf"
+    owner: root
+    group: root
+    mode: "0600"
+  loop: "{{ wireguard_clients }}"
+  loop_control:
+    label: "{{ item.name }}"
+  no_log: true
+
+- name: Generate QR codes for client configurations
+  shell: |
+    qrencode -t ansiutf8 -r /etc/wireguard/clients/{{ item.name }}.conf > /etc/wireguard/clients/{{ item.name }}.qr.txt
+    qrencode -t png -r /etc/wireguard/clients/{{ item.name }}.conf -o /etc/wireguard/clients/{{ item.name }}.qr.png
+  loop: "{{ wireguard_clients }}"
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Display WireGuard setup information
+  debug:
+    msg:
+      - "=============================================="
+      - "WireGuard Server Setup Complete!"
+      - "=============================================="
+      - "Server public key: {{ wireguard_server.public_key }}"
+      - "Server endpoint: {{ ansible_host }}:51820"
+      - "WireGuard network: 10.8.0.0/24"
+      - "Server IP: 10.8.0.1"
+      - ""
+      - "Configured clients ({{ wireguard_clients | length }}):"
+      - "{% for client in wireguard_clients %}  - {{ client.name }} ({{ client.ip_address }}) - {{ client.description }}{% endfor %}"
+      - ""
+      - "Client configurations:"
+      - "{% for client in wireguard_clients %}  - /etc/wireguard/clients/{{ client.name }}.conf{% endfor %}"
+      - ""
+      - "To view QR code in terminal, run:"
+      - "  cat /etc/wireguard/clients/<client_name>.qr.txt"
+      - ""
+      - "To generate additional client keys:"
+      - "  /etc/wireguard/generate_key.sh /etc/wireguard/keys/<clientname>"
+      - "=============================================="