stuff

playbooks/wireguard-ingress/wireguard-ingress.yml

@@ -10,23 +10,163 @@
               3239666637326337650a636433616264386162326535306461326233323961643664373134363634
               35633238393933386231373535353635646462383763613362363761363935363965383836366431
               3766343166643632306162343761613030653631353361373936
+
+    wireguard_ingress_address: 10.10.1.1/24
+    wireguard_ingress_port: 41194
+    wireguard_ingress_endpoint: 192.3.44.243
+    wireguard_server_public_key: r0XaxIE3AVud9Z42UPZF3mwoh2R0B0M1EUDY9cvuyDA=
+
+    wireguard_beepi_ip: 10.10.1.2
+    wireguard_beepi_public_key: oI69uWkbkwtpuIYxDNGmzg4nRjY1BIZFVFjZwguIvwE=
+
+    wireguard_dnat_ports:
+      - 25    # mail
+      - 80
+      - 443
+      - 465   # mail
+      - 587   # mail
+      - 993   # mail
+      - 4444  # backup ssh
+      - 8448  # matrix federation
+
+    wireguard_clients:
+      - name: phone
+        ip: 10.10.1.3
+
+    wireguard_client_allowed_ips: 10.10.1.2/32
+
+    wireguard_client_dir: "{{ playbook_dir }}/clients"
+
+    # Changes to Address, ListenPort or wireguard_dnat_ports = -e wireguard_full_restart=true
+    wireguard_full_restart: false
+
   tasks:
     - name: Install wireguard
       ansible.builtin.apt:
         name: wireguard
         state: present
 
-    - name: Down wg0
-      changed_when: true
-      failed_when: false
-      ansible.builtin.command: wg-quick down wg0
+    - name: Create local client key directory
+      ansible.builtin.file:
+        path: "{{ wireguard_client_dir }}"
+        state: directory
+        mode: '0700'
+      delegate_to: localhost
+      become: false
+
+    - name: Generate client private keys
+      ansible.builtin.shell:
+        cmd: "umask 077 && wg genkey > {{ wireguard_client_dir }}/{{ item.name }}.private"
+        creates: "{{ wireguard_client_dir }}/{{ item.name }}.private"
+      loop: "{{ wireguard_clients }}"
+      loop_control:
+        label: "{{ item.name }}"
+      delegate_to: localhost
+      become: false
+
+    - name: Generate client preshared keys
+      ansible.builtin.shell:
+        cmd: "umask 077 && wg genpsk > {{ wireguard_client_dir }}/{{ item.name }}.psk.private"
+        creates: "{{ wireguard_client_dir }}/{{ item.name }}.psk.private"
+      loop: "{{ wireguard_clients }}"
+      loop_control:
+        label: "{{ item.name }}"
+      delegate_to: localhost
+      become: false
+
+    - name: Derive client public keys
+      ansible.builtin.command:
+        cmd: "wg pubkey"
+        stdin: "{{ lookup('file', wireguard_client_dir ~ '/' ~ item.name ~ '.private') }}"
+      loop: "{{ wireguard_clients }}"
+      loop_control:
+        label: "{{ item.name }}"
+      register: client_public_keys
+      changed_when: false
+      delegate_to: localhost
+      become: false
 
     - name: Copy wg0.conf
       ansible.builtin.template:
         src: wg0.conf.j2
         dest: /etc/wireguard/wg0.conf
         mode: '0600'
+      register: wg0_config
 
-    - name: Up wg0
+    - name: Check whether wg0 is up
+      ansible.builtin.command:
+        cmd: wg show wg0
+      register: wg0_state
+      failed_when: false
+      changed_when: false
+
+    - name: Sync peers without dropping the tunnel
+      ansible.builtin.shell:
+        cmd: "wg syncconf wg0 <(wg-quick strip wg0)"
+        executable: /bin/bash
       changed_when: true
-      ansible.builtin.command: wg-quick up wg0
+      when:
+        - wg0_config.changed
+        - wg0_state.rc == 0
+        - not wireguard_full_restart | bool
+
+    - name: Bounce wg0
+      ansible.builtin.shell:
+        cmd: "wg-quick down wg0 || true; wg-quick up wg0"
+      changed_when: true
+      when: wg0_state.rc != 0 or wireguard_full_restart | bool
+
+    - name: Enable wg-quick@wg0 on boot
+      ansible.builtin.service:
+        name: wg-quick@wg0
+        enabled: true
+
+    - name: Render client configs
+      ansible.builtin.template:
+        src: client.conf.j2
+        dest: "{{ wireguard_client_dir }}/{{ item.item.name }}.conf"
+        mode: '0600'
+      loop: "{{ client_public_keys.results }}"
+      loop_control:
+        label: "{{ item.item.name }}"
+      delegate_to: localhost
+      become: false
+
+    - name: Check for qrencode
+      ansible.builtin.command:
+        cmd: "which qrencode"
+      register: qrencode_check
+      failed_when: false
+      changed_when: false
+      delegate_to: localhost
+      become: false
+
+    - name: Render QR codes for mobile enrolment
+      ansible.builtin.command:
+        cmd: "qrencode -t ansiutf8 -r {{ wireguard_client_dir }}/{{ item.item.name }}.conf"
+      loop: "{{ client_public_keys.results }}"
+      loop_control:
+        label: "{{ item.item.name }}"
+      register: client_qr
+      changed_when: false
+      when: qrencode_check.rc == 0
+      delegate_to: localhost
+      become: false
+
+    - name: Show QR codes
+      ansible.builtin.debug:
+        msg: "{{ (item.stdout | default('')).split('\n') }}"
+      loop: "{{ client_qr.results | default([]) }}"
+      loop_control:
+        label: "{{ item.item.item.name | default('') }}"
+      when: qrencode_check.rc == 0
+
+    - name: Show peer status
+      ansible.builtin.command:
+        cmd: wg show wg0
+      register: wg0_final
+      changed_when: false
+
+    - name: Report
+      ansible.builtin.debug:
+        msg: "{{ wg0_final.stdout_lines }}"