aurbis/tasks/wireguard.yml

- name: Load WireGuard keys from vault
  include_vars:
    file: vault/wireguard.yml

- name: Validate wireguard configuration
  assert:
    that:
      - wireguard_server is defined
      - wireguard_clients is defined
      - wireguard_clients | length > 0
    fail_msg: "wireguard_server and wireguard_clients must be defined in vault/wireguard.yml"

- name: Install WireGuard packages
  apt:
    name:
      - wireguard
      - wireguard-tools
      - qrencode
    state: present
    update_cache: yes

- name: Create WireGuard directory structure
  file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0700"
  loop:
    - /etc/wireguard
    - /etc/wireguard/clients
    - /etc/wireguard/keys

- name: Generate key generation script
  copy:
    dest: /etc/wireguard/generate_key.sh
    mode: "0700"
    content: |
      #!/bin/bash
      # Generate a WireGuard keypair
      # Usage: ./generate_key.sh <output_prefix>

      OUTPUT_PREFIX="$1"

      if [ -z "$OUTPUT_PREFIX" ]; then
        echo "Usage: $0 <output_file_prefix>"
        exit 1
      fi

      echo "Generating WireGuard keypair..."
      umask 077
      wg genkey | tee "${OUTPUT_PREFIX}.key" | wg pubkey > "${OUTPUT_PREFIX}.pub"
      chmod 600 "${OUTPUT_PREFIX}.key"
      chmod 644 "${OUTPUT_PREFIX}.pub"
      echo "Keys generated: ${OUTPUT_PREFIX}.key and ${OUTPUT_PREFIX}.pub"

- name: Deploy add_client.sh script
  copy:
    src: wireguard/add_client.sh
    dest: /etc/wireguard/add_client.sh
    mode: "0755"
    owner: root
    group: root

- name: Create server private key file
  copy:
    content: "{{ wireguard_server.private_key }}"
    dest: "/etc/wireguard/keys/server.key"
    owner: root
    group: root
    mode: "0600"
  no_log: true

- name: Create server public key file
  copy:
    content: "{{ wireguard_server.public_key }}"
    dest: "/etc/wireguard/keys/server.pub"
    owner: root
    group: root
    mode: "0644"

- name: Create client private key files
  copy:
    content: "{{ item.private_key }}"
    dest: "/etc/wireguard/keys/{{ item.name }}.key"
    owner: root
    group: root
    mode: "0600"
  loop: "{{ wireguard_clients }}"
  loop_control:
    label: "{{ item.name }}"
  no_log: true

- name: Create client public key files
  copy:
    content: "{{ item.public_key }}"
    dest: "/etc/wireguard/keys/{{ item.name }}.pub"
    owner: root
    group: root
    mode: "0644"
  loop: "{{ wireguard_clients }}"
  loop_control:
    label: "{{ item.name }}"

- name: Create systemd-networkd WireGuard netdev configuration
  template:
    src: wireguard/wg0.netdev.j2
    dest: /etc/systemd/network/99-wg0.netdev
    owner: root
    group: systemd-network
    mode: "0640"
  notify: reload systemd-networkd
  no_log: true

- name: Create systemd-networkd WireGuard network configuration
  template:
    src: wireguard/wg0.network.j2
    dest: /etc/systemd/network/99-wg0.network
    owner: root
    group: root
    mode: "0644"
  notify: reload systemd-networkd

- name: Enable IP forwarding
  sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    state: present
    sysctl_set: yes
    reload: yes

- name: Install iptables-persistent for firewall rules
  apt:
    name: iptables-persistent
    state: present

- name: Configure iptables masquerading for WireGuard
  iptables:
    table: nat
    chain: POSTROUTING
    out_interface: "{{ ansible_default_ipv4.interface }}"
    source: 10.8.0.0/24
    jump: MASQUERADE
    comment: WireGuard masquerading
  notify: save iptables

- name: Configure iptables forwarding for WireGuard
  iptables:
    chain: FORWARD
    in_interface: wg0
    jump: ACCEPT
    comment: WireGuard forward in
  notify: save iptables

- name: Configure iptables forwarding from WireGuard
  iptables:
    chain: FORWARD
    out_interface: wg0
    jump: ACCEPT
    comment: WireGuard forward out
  notify: save iptables

- name: Enable and start systemd-networkd
  systemd:
    name: systemd-networkd
    enabled: yes
    state: started

- name: Generate client configuration files
  template:
    src: wireguard/client.conf.j2
    dest: "/etc/wireguard/clients/{{ item.name }}.conf"
    owner: root
    group: root
    mode: "0600"
  loop: "{{ wireguard_clients }}"
  loop_control:
    label: "{{ item.name }}"
  no_log: true

- name: Generate QR codes for client configurations
  shell: |
    qrencode -t ansiutf8 -r /etc/wireguard/clients/{{ item.name }}.conf > /etc/wireguard/clients/{{ item.name }}.qr.txt
    qrencode -t png -r /etc/wireguard/clients/{{ item.name }}.conf -o /etc/wireguard/clients/{{ item.name }}.qr.png
  loop: "{{ wireguard_clients }}"
  loop_control:
    label: "{{ item.name }}"

- name: Display WireGuard setup information
  debug:
    msg:
      - "=============================================="
      - "WireGuard Server Setup Complete!"
      - "=============================================="
      - "Server public key: {{ wireguard_server.public_key }}"
      - "Server endpoint: {{ ansible_host }}:51820"
      - "WireGuard network: 10.8.0.0/24"
      - "Server IP: 10.8.0.1"
      - ""
      - "Configured clients ({{ wireguard_clients | length }}):"
      - "{% for client in wireguard_clients %}  - {{ client.name }} ({{ client.ip_address }}) - {{ client.description }}{% endfor %}"
      - ""
      - "Client configurations:"
      - "{% for client in wireguard_clients %}  - /etc/wireguard/clients/{{ client.name }}.conf{% endfor %}"
      - ""
      - "To view QR code in terminal, run:"
      - "  cat /etc/wireguard/clients/<client_name>.qr.txt"
      - ""
      - "To generate additional client keys:"
      - "  /etc/wireguard/generate_key.sh /etc/wireguard/keys/<clientname>"
      - "=============================================="