aurbis/tasks/wireguard/README.md

WireGuard VPN Server

Configures Talos as a WireGuard VPN server providing access to home network (192.168.178.0/24).

Configuration

Clients are defined in vault/wireguard.yml:

wireguard_server:
  private_key: "..."
  public_key: "..."

wireguard_clients:
  - name: masser
    private_key: "..."
    public_key: "..."
    ip_address: "10.8.0.2/24"
    description: "Masser phone"

Adding a Client

1. Generate vanity key:

   timeout 120 wireguard-vanity-address --in 4 newc 2>&1 | grep "^private" | head -1
   

2. Edit vault:

   ansible-vault edit vault/wireguard.yml
   

3. Add to wireguard_clients list:

   - name: newclient
     private_key: "paste_from_step_1"
     public_key: "paste_from_step_1"
     ip_address: "10.8.0.X/24"
     description: "Description"
   

4. Deploy:

   ansible-playbook -i inventory.yml playbook.yml --limit talos --tags leaf
   

5. Get client config from server:

   ssh nerevar@192.168.178.64 'sudo cat /etc/wireguard/clients/newclient.qr.txt'
   

Network Details

• WireGuard network: 10.8.0.0/24
• Server IP: 10.8.0.1
• Server endpoint: home.hoekveen.net:51820
• Server public key stored in vault
• Port forwarding required: UDP 51820 -> 192.168.178.64