From 6007177a882b59ee1be35434c186ca80454bf51c Mon Sep 17 00:00:00 2001
From: alex <alex@pdp7.net>
Date: Fri, 4 Sep 2026 20:43:22 +0200
Subject: Add Wireguard route hack, remove failed netplan experiment

---
 personal_infra/playbooks/setup_wireguard.yaml | 30 +++------------------------
 1 file changed, 3 insertions(+), 27 deletions(-)

diff --git a/personal_infra/playbooks/setup_wireguard.yaml b/personal_infra/playbooks/setup_wireguard.yaml
index 9bed8607..2f28d5e4 100644
--- a/personal_infra/playbooks/setup_wireguard.yaml
+++ b/personal_infra/playbooks/setup_wireguard.yaml
@@ -20,13 +20,13 @@
     slurp:
       src: /etc/wireguard/privatekey
     register: privatekey
-  - name: configure (no netplan)
+  - name: configure
     copy:
       content: |
         [Interface]
         Address = {{ network.self_internal_ip }}/24
         SaveConfig = true
-        PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+        PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE {% if inventory_hostname in groups['wg-route-hack'] %}; ip route del {{ network.self_internal_network }} dev wg0{% endif %}{{ '' }}
         PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
         ListenPort = 51820
         PrivateKey = {{ privatekey['content'] | b64decode }}
@@ -43,35 +43,11 @@
         {% endif %}
         {% endfor %}
       dest: /etc/wireguard/wg0.conf
-    when: inventory_hostname not in groups['netplan']
-  - name: configure (netplan)
-    copy:
-      content: |
-        network:
-          tunnels:
-            wg0:
-              mode: wireguard
-              port: 51820
-              key: {{ privatekey['content'] | b64decode }}
-              addresses:
-                - {{ network.self_internal_ip }}/24
-              peers:
-        {% for host in groups['tinc'] %}
-        {% if host != inventory_hostname %}
-                - allowed-ips: [{{ hostvars[host].network.self_internal_network }}]
-                  endpoint: {{ hostvars[host].network.public_hostname }}:51820
-                  keys:
-                    public: {{ lookup('file', '/tmp/wireguard-publickeys/{}/etc/wireguard/publickey'.format(host)) }}
-        {% endif %}
-        {% endfor %}
-      dest: /etc/netplan/wireguard.yaml
-    when: inventory_hostname in groups['netplan']
-  - name: enable wireguard (no netplan)
+  - name: enable wireguard
     service:
       name: wg-quick@wg0
       state: restarted
       enabled: yes
-    when: inventory_hostname not in groups['netplan']
   - name: set congestion control
     copy:
       content: |
-- 
cgit v1.2.3