diff options
Diffstat (limited to 'personal_infra')
| -rw-r--r-- | personal_infra/playbooks/setup_wireguard.yaml | 28 |
1 files changed, 26 insertions, 2 deletions
diff --git a/personal_infra/playbooks/setup_wireguard.yaml b/personal_infra/playbooks/setup_wireguard.yaml index 7e1e73ac..9bed8607 100644 --- a/personal_infra/playbooks/setup_wireguard.yaml +++ b/personal_infra/playbooks/setup_wireguard.yaml @@ -20,7 +20,7 @@ slurp: src: /etc/wireguard/privatekey register: privatekey - - name: configure + - name: configure (no netplan) copy: content: | [Interface] @@ -43,11 +43,35 @@ {% endif %} {% endfor %} dest: /etc/wireguard/wg0.conf - - name: enable wireguard + when: inventory_hostname not in groups['netplan'] + - name: configure (netplan) + copy: + content: | + network: + tunnels: + wg0: + mode: wireguard + port: 51820 + key: {{ privatekey['content'] | b64decode }} + addresses: + - {{ network.self_internal_ip }}/24 + peers: + {% for host in groups['tinc'] %} + {% if host != inventory_hostname %} + - allowed-ips: [{{ hostvars[host].network.self_internal_network }}] + endpoint: {{ hostvars[host].network.public_hostname }}:51820 + keys: + public: {{ lookup('file', '/tmp/wireguard-publickeys/{}/etc/wireguard/publickey'.format(host)) }} + {% endif %} + {% endfor %} + dest: /etc/netplan/wireguard.yaml + when: inventory_hostname in groups['netplan'] + - name: enable wireguard (no netplan) service: name: wg-quick@wg0 state: restarted enabled: yes + when: inventory_hostname not in groups['netplan'] - name: set congestion control copy: content: | |