Archive Legacy Setup And Add Ansible Control Plane

2026-07-08 12:47:37 +03:00
parent 841d56380b
commit 4bafa7d09e
203 changed files with 1663 additions and 11 deletions
@@ -0,0 +1,75 @@
+---
+- name: Install WireGuard packages
+  ansible.builtin.apt:
+    name:
+      - wireguard-tools
+      - iptables
+      - iproute2
+      - netcat-openbsd
+    state: present
+    update_cache: true
+
+- name: Ensure WireGuard config directory exists
+  ansible.builtin.file:
+    path: /etc/wireguard
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Generate private key if missing
+  ansible.builtin.shell: umask 077 && wg genkey > {{ wireguard_private_key_path }}
+  args:
+    creates: "{{ wireguard_private_key_path }}"
+
+- name: Generate public key
+  ansible.builtin.shell: wg pubkey < {{ wireguard_private_key_path }} > {{ wireguard_public_key_path }}
+  args:
+    creates: "{{ wireguard_public_key_path }}"
+
+- name: Read private key
+  ansible.builtin.slurp:
+    src: "{{ wireguard_private_key_path }}"
+  register: wireguard_private_key_raw
+  no_log: true
+
+- name: Read public key
+  ansible.builtin.slurp:
+    src: "{{ wireguard_public_key_path }}"
+  register: wireguard_public_key_raw
+
+- name: Store WireGuard keys as facts
+  ansible.builtin.set_fact:
+    wireguard_private_key: "{{ wireguard_private_key_raw.content | b64decode | trim }}"
+    wireguard_public_key: "{{ wireguard_public_key_raw.content | b64decode | trim }}"
+  no_log: true
+
+- name: Enable IPv4 forwarding on gateway
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    reload: true
+  when: wireguard_role == 'gateway'
+
+- name: Allow WireGuard UDP in UFW on server
+  ansible.builtin.command: "ufw allow {{ wireguard_listen_port }}/udp"
+  register: ufw_allow_wireguard
+  changed_when: "'Rule added' in ufw_allow_wireguard.stdout or 'Rules updated' in ufw_allow_wireguard.stdout"
+  failed_when: false
+  when: wireguard_role == 'server'
+
+- name: Render WireGuard config
+  ansible.builtin.template:
+    src: "wg0.conf.j2"
+    dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart wireguard
+
+- name: Enable and start WireGuard
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}"
+    state: started
+    enabled: true