Archive Legacy Setup And Add Ansible Control Plane

2026-07-08 12:47:37 +03:00
parent 841d56380b
commit 4bafa7d09e
203 changed files with 1663 additions and 11 deletions
@@ -0,0 +1,12 @@
+---
+wireguard_interface: wg0
+wireguard_listen_port: 3422
+wireguard_private_key_path: /etc/wireguard/privatekey
+wireguard_public_key_path: /etc/wireguard/publickey
+wireguard_home_routes:
+  - 192.168.1.5/32
+  - 192.168.1.6/31
+  - 192.168.1.8/29
+  - 192.168.1.16/28
+  - 192.168.1.32/29
+  - 192.168.1.40/32
@@ -0,0 +1,6 @@
+---
+- name: restart wireguard
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}"
+    state: restarted
+    enabled: true
@@ -0,0 +1,75 @@
+---
+- name: Install WireGuard packages
+  ansible.builtin.apt:
+    name:
+      - wireguard-tools
+      - iptables
+      - iproute2
+      - netcat-openbsd
+    state: present
+    update_cache: true
+
+- name: Ensure WireGuard config directory exists
+  ansible.builtin.file:
+    path: /etc/wireguard
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Generate private key if missing
+  ansible.builtin.shell: umask 077 && wg genkey > {{ wireguard_private_key_path }}
+  args:
+    creates: "{{ wireguard_private_key_path }}"
+
+- name: Generate public key
+  ansible.builtin.shell: wg pubkey < {{ wireguard_private_key_path }} > {{ wireguard_public_key_path }}
+  args:
+    creates: "{{ wireguard_public_key_path }}"
+
+- name: Read private key
+  ansible.builtin.slurp:
+    src: "{{ wireguard_private_key_path }}"
+  register: wireguard_private_key_raw
+  no_log: true
+
+- name: Read public key
+  ansible.builtin.slurp:
+    src: "{{ wireguard_public_key_path }}"
+  register: wireguard_public_key_raw
+
+- name: Store WireGuard keys as facts
+  ansible.builtin.set_fact:
+    wireguard_private_key: "{{ wireguard_private_key_raw.content | b64decode | trim }}"
+    wireguard_public_key: "{{ wireguard_public_key_raw.content | b64decode | trim }}"
+  no_log: true
+
+- name: Enable IPv4 forwarding on gateway
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    reload: true
+  when: wireguard_role == 'gateway'
+
+- name: Allow WireGuard UDP in UFW on server
+  ansible.builtin.command: "ufw allow {{ wireguard_listen_port }}/udp"
+  register: ufw_allow_wireguard
+  changed_when: "'Rule added' in ufw_allow_wireguard.stdout or 'Rules updated' in ufw_allow_wireguard.stdout"
+  failed_when: false
+  when: wireguard_role == 'server'
+
+- name: Render WireGuard config
+  ansible.builtin.template:
+    src: "wg0.conf.j2"
+    dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart wireguard
+
+- name: Enable and start WireGuard
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}"
+    state: started
+    enabled: true
@@ -0,0 +1,26 @@
+[Interface]
+Address = {{ wireguard_address }}
+PrivateKey = {{ wireguard_private_key }}
+{% if wireguard_role == 'server' %}
+ListenPort = {{ wireguard_listen_port }}
+{% for route in wireguard_home_routes %}
+PostUp = ip route replace {{ route }} dev {{ wireguard_interface }}
+PostDown = ip route del {{ route }} dev {{ wireguard_interface }} || true
+{% endfor %}
+{% endif %}
+{% if wireguard_role == 'gateway' %}
+PostUp = iptables -t nat -A POSTROUTING -s {{ wireguard_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE
+PostDown = iptables -t nat -D POSTROUTING -s {{ wireguard_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE || true
+{% endif %}
+
+[Peer]
+{% if wireguard_role == 'server' %}
+PublicKey = {{ hostvars['wg-mini'].wireguard_public_key }}
+AllowedIPs = {{ wireguard_peer_address }}/32, {{ wireguard_home_routes | join(', ') }}
+{% endif %}
+{% if wireguard_role == 'gateway' %}
+PublicKey = {{ hostvars['ru-vps'].wireguard_public_key }}
+Endpoint = 157.22.231.198:{{ wireguard_listen_port }}
+AllowedIPs = {{ wireguard_peer_address }}/32
+PersistentKeepalive = 25
+{% endif %}