blob: 9bed8607326a0a55805cacad62675364e76cb423 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
---
- hosts: tinc
tasks:
- name: install wireguard
package:
name: wireguard-tools
- name: install iptables
package:
name: iptables
- name: generate keypair
shell:
cmd: umask 0077 && wg genkey | tee privatekey | wg pubkey > publickey
chdir: /etc/wireguard
creates: /etc/wireguard/publickey
- name: fetch public keys
fetch:
src: /etc/wireguard/publickey
dest: /tmp/wireguard-publickeys
- name: slurp private keys
slurp:
src: /etc/wireguard/privatekey
register: privatekey
- name: configure (no netplan)
copy:
content: |
[Interface]
Address = {{ network.self_internal_ip }}/24
SaveConfig = true
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = {{ privatekey['content'] | b64decode }}
# The default of SaveConfig = true overwrites the config when stopping the daemon, replacing hostnames with IP addresses
SaveConfig = false
{% for host in groups['tinc'] %}
{% if host != inventory_hostname %}
[Peer]
PublicKey = {{ lookup('file', '/tmp/wireguard-publickeys/{}/etc/wireguard/publickey'.format(host)) }}
AllowedIPs = {{ hostvars[host].network.self_internal_network }}
Endpoint = {{ hostvars[host].network.public_hostname }}:51820
{% endif %}
{% endfor %}
dest: /etc/wireguard/wg0.conf
when: inventory_hostname not in groups['netplan']
- name: configure (netplan)
copy:
content: |
network:
tunnels:
wg0:
mode: wireguard
port: 51820
key: {{ privatekey['content'] | b64decode }}
addresses:
- {{ network.self_internal_ip }}/24
peers:
{% for host in groups['tinc'] %}
{% if host != inventory_hostname %}
- allowed-ips: [{{ hostvars[host].network.self_internal_network }}]
endpoint: {{ hostvars[host].network.public_hostname }}:51820
keys:
public: {{ lookup('file', '/tmp/wireguard-publickeys/{}/etc/wireguard/publickey'.format(host)) }}
{% endif %}
{% endfor %}
dest: /etc/netplan/wireguard.yaml
when: inventory_hostname in groups['netplan']
- name: enable wireguard (no netplan)
service:
name: wg-quick@wg0
state: restarted
enabled: yes
when: inventory_hostname not in groups['netplan']
- name: set congestion control
copy:
content: |
net.ipv4.tcp_congestion_control = bbr
dest: /etc/sysctl.d/wireguard.conf
|
