- name: Wireguard-ingress
  hosts: animeistrash
  become: true
  vars:
    wireguard_server_private_key: !vault |
              $ANSIBLE_VAULT;1.1;AES256
              34313837363964633333373936636462666138386538653939663435376666626230393564366630
              6637333264303638383938326132336130343833393466370a623633623163303762616333663135
              61666433393939303938623735666439663361633638613466393361626439326465303966303266
              3239666637326337650a636433616264386162326535306461326233323961643664373134363634
              35633238393933386231373535353635646462383763613362363761363935363965383836366431
              3766343166643632306162343761613030653631353361373936

    wireguard_ingress_address: 10.10.1.1/24
    wireguard_ingress_port: 41194
    wireguard_ingress_endpoint: 192.3.44.243
    wireguard_server_public_key: r0XaxIE3AVud9Z42UPZF3mwoh2R0B0M1EUDY9cvuyDA=

    wireguard_beepi_ip: 10.10.1.2
    wireguard_beepi_public_key: oI69uWkbkwtpuIYxDNGmzg4nRjY1BIZFVFjZwguIvwE=

    wireguard_dnat_ports:
      - 25    # mail
      - 80
      - 443
      - 465   # mail
      - 587   # mail
      - 993   # mail
      - 4444  # backup ssh
      - 8448  # matrix federation

    wireguard_clients:
      - name: phone
        ip: 10.10.1.3

    wireguard_client_allowed_ips: 10.10.1.2/32

    wireguard_client_dir: "{{ playbook_dir }}/clients"

    # Changes to Address, ListenPort or wireguard_dnat_ports = -e wireguard_full_restart=true
    wireguard_full_restart: false

  tasks:
    - name: Install wireguard
      ansible.builtin.apt:
        name: wireguard
        state: present

    - name: Create local client key directory
      ansible.builtin.file:
        path: "{{ wireguard_client_dir }}"
        state: directory
        mode: '0700'
      delegate_to: localhost
      become: false

    - name: Generate client private keys
      ansible.builtin.shell:
        cmd: "umask 077 && wg genkey > {{ wireguard_client_dir }}/{{ item.name }}.private"
        creates: "{{ wireguard_client_dir }}/{{ item.name }}.private"
      loop: "{{ wireguard_clients }}"
      loop_control:
        label: "{{ item.name }}"
      delegate_to: localhost
      become: false

    - name: Generate client preshared keys
      ansible.builtin.shell:
        cmd: "umask 077 && wg genpsk > {{ wireguard_client_dir }}/{{ item.name }}.psk.private"
        creates: "{{ wireguard_client_dir }}/{{ item.name }}.psk.private"
      loop: "{{ wireguard_clients }}"
      loop_control:
        label: "{{ item.name }}"
      delegate_to: localhost
      become: false

    - name: Derive client public keys
      ansible.builtin.command:
        cmd: "wg pubkey"
        stdin: "{{ lookup('file', wireguard_client_dir ~ '/' ~ item.name ~ '.private') }}"
      loop: "{{ wireguard_clients }}"
      loop_control:
        label: "{{ item.name }}"
      register: client_public_keys
      changed_when: false
      delegate_to: localhost
      become: false

    - name: Copy wg0.conf
      ansible.builtin.template:
        src: wg0.conf.j2
        dest: /etc/wireguard/wg0.conf
        mode: '0600'
      register: wg0_config

    - name: Check whether wg0 is up
      ansible.builtin.command:
        cmd: wg show wg0
      register: wg0_state
      failed_when: false
      changed_when: false

    - name: Sync peers without dropping the tunnel
      ansible.builtin.shell:
        cmd: "wg syncconf wg0 <(wg-quick strip wg0)"
        executable: /bin/bash
      changed_when: true
      when:
        - wg0_config.changed
        - wg0_state.rc == 0
        - not wireguard_full_restart | bool

    - name: Bounce wg0
      ansible.builtin.shell:
        cmd: "wg-quick down wg0 || true; wg-quick up wg0"
      changed_when: true
      when: wg0_state.rc != 0 or wireguard_full_restart | bool

    - name: Enable wg-quick@wg0 on boot
      ansible.builtin.service:
        name: wg-quick@wg0
        enabled: true

    - name: Render client configs
      ansible.builtin.template:
        src: client.conf.j2
        dest: "{{ wireguard_client_dir }}/{{ item.item.name }}.conf"
        mode: '0600'
      loop: "{{ client_public_keys.results }}"
      loop_control:
        label: "{{ item.item.name }}"
      delegate_to: localhost
      become: false

    - name: Check for qrencode
      ansible.builtin.command:
        cmd: "which qrencode"
      register: qrencode_check
      failed_when: false
      changed_when: false
      delegate_to: localhost
      become: false

    - name: Render QR codes for mobile enrolment
      ansible.builtin.command:
        cmd: "qrencode -t ansiutf8 -r {{ wireguard_client_dir }}/{{ item.item.name }}.conf"
      loop: "{{ client_public_keys.results }}"
      loop_control:
        label: "{{ item.item.name }}"
      register: client_qr
      changed_when: false
      when: qrencode_check.rc == 0
      delegate_to: localhost
      become: false

    - name: Show QR codes
      ansible.builtin.debug:
        msg: "{{ (item.stdout | default('')).split('\n') }}"
      loop: "{{ client_qr.results | default([]) }}"
      loop_control:
        label: "{{ item.item.item.name | default('') }}"
      when: qrencode_check.rc == 0

    - name: Show peer status
      ansible.builtin.command:
        cmd: wg show wg0
      register: wg0_final
      changed_when: false

    - name: Report
      ansible.builtin.debug:
        msg: "{{ wg0_final.stdout_lines }}"