first_commit

roles/wireguard/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart WireGuard
+  systemd:
+    name: wg-quick@wg0
+    state: restarted

roles/wireguard/tasks/main.yml

@@ -0,0 +1,34 @@
+---
+- name: Remove any broken Docker repository files to prevent apt errors
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_fileglob:
+    - "/etc/apt/sources.list.d/*docker*"
+  ignore_errors: yes
+
+- name: Install WireGuard
+  apt:
+    name: wireguard
+    state: present
+    update_cache: yes
+  ignore_errors: yes
+
+- name: Ensure WireGuard directory exists
+  file:
+    path: /etc/wireguard
+    state: directory
+    mode: '0700'
+
+- name: Deploy WireGuard configuration
+  template:
+    src: wg0.conf.j2
+    dest: /etc/wireguard/wg0.conf
+    mode: '0600'
+  notify: Restart WireGuard
+
+- name: Enable and start WireGuard service
+  systemd:
+    name: wg-quick@wg0
+    enabled: yes
+    state: started

roles/wireguard/templates/wg0.conf.j2

@@ -0,0 +1,17 @@
+[Interface]
+PrivateKey = {{ wireguard_private_key }}
+Address = {{ wireguard_ip }}/24
+ListenPort = {{ wireguard_port }}
+
+{% for peer in wireguard_peers %}
+{% if peer.ip != wireguard_ip %}
+[Peer]
+# {{ peer.name }}
+PublicKey = {{ peer.pubkey }}
+AllowedIPs = {{ peer.ip }}/32
+{% if peer.endpoint %}
+Endpoint = {{ peer.endpoint }}
+PersistentKeepalive = 25
+{% endif %}
+{% endif %}
+{% endfor %}

roles/wireguard/wg0.conf.j2

@@ -0,0 +1,16 @@
+[Interface]
+PrivateKey = {{ host_private_key }}
+Address = {{ wg_ip }}/24
+ListenPort = {{ wg_port }}
+
+{% for peer in wireguard_peers %}
+{% if peer.ip != wg_ip %}
+[Peer]
+PublicKey = {{ peer.pubkey }}
+AllowedIPs = {{ peer.ip }}/32
+{% if peer.endpoint %}
+Endpoint = {{ peer.endpoint }}
+PersistentKeepalive = 25
+{% endif %}
+{% endif %}
+{% endfor %}