Add wireguard

infrastructure/create-resources/ansible/roles/wireguard/mesh/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: systemd network restart
+  service:
+    name: systemd-networkd
+    state: restarted
+    enabled: yes
+  become: yes

infrastructure/create-resources/ansible/roles/wireguard/mesh/tasks/main.yml

@@ -0,0 +1,128 @@
+---
+- name: update packages
+  apt:
+    update_cache: yes
+    cache_valid_time: 3600
+  become: yes
+
+
+- name: install ufw
+  apt:
+    name: ufw
+    state: present
+  become: yes
+  when: ufw_enabled
+
+- name: Allow SSH in UFW
+  ufw:
+    rule: allow
+    port: "{{ ansible_ssh_port }}"
+    proto: tcp
+  become: yes
+  when: ufw_enabled
+
+- name: Set ufw logging
+  ufw:
+    logging: "on"
+  become: yes
+  when: ufw_enabled
+
+- name: inter-node Wireguard UFW connectivity
+  ufw:
+    rule: allow
+    src: "{{ hostvars[item].wireguard_ip }}"
+  with_items: "{{ groups['all'] }}"
+  become: yes
+  when: ufw_enabled and item != inventory_hostname
+
+- name: Reject everything and enable UFW
+  ufw:
+    state: enabled
+    policy: reject
+    log: yes
+  become: yes
+  when: ufw_enabled
+
+- name: enable and persist ip forwarding
+  sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    sysctl_set: yes
+    reload: yes
+
+- name: install wireguard
+  apt:
+    name: wireguard
+    state: present
+  become: yes
+
+- name: generate wireguard keypair
+  shell: wg genkey | tee /etc/wireguard/privatekey | wg pubkey | tee /etc/wireguard/publickey
+  args:
+    creates: /etc/wireguard/privatekey
+  become: yes
+
+- name: register private key
+  shell: cat /etc/wireguard/privatekey
+  register: wireguard_private_key
+  changed_when: false
+  become: yes
+
+- name: register public key
+  shell: cat /etc/wireguard/publickey
+  register: wireguard_public_key
+  changed_when: false
+  become: yes
+
+- name: generate preshared keypair
+  shell: "wg genpsk > /etc/wireguard/psk-{{item}}"
+  args:
+    creates: "/etc/wireguard/psk-{{item}}"
+  when: inventory_hostname < item
+  with_items: "{{groups['serverctl_mesh_nodes']}}"
+  become: yes
+
+- name: register preshared key
+  shell: "cat /etc/wireguard/psk-{{item}}"
+  register: wireguard_preshared_key
+  changed_when: false
+  when: inventory_hostname < item
+  with_items: "{{groups['serverctl_mesh_nodes']}}"
+  become: yes
+
+- name: message preshared keys
+  set_fact: "wireguard_preshared_keys={{wireguard_preshared_keys|default({}) | combine({item.item: item.stdout})}}"
+  when: item.skipped is not defined
+  with_items: "{{wireguard_preshared_key.results}}"
+  become: yes
+
+- name: Setup wgserverctl0 device
+  template:
+    src: 'systemd.netdev'
+    dest: '{{systemd_network_dir}}/99-wg0.netdev'
+    owner: root
+    group: systemd-network
+    mode: 0640
+  become: yes
+  notify: systemd network restart
+
+- name: Setup wgserverctl0 network
+  template:
+    src: 'systemd.network'
+    dest: "{{systemd_network_dir}}/99-wg0.network"
+    owner: root
+    group: systemd-network
+    mode: 0640
+  become: yes
+  notify: systemd network restart
+
+#- name: Start and enalbe wireguard on book
+#  systemd:
+#    name: wg-quick@wgserverctl0
+#    enabled: yes
+#    state: started
+
+#- debug: msg="{{item.1}} - {{ (wireguard_base_ipv4|ipaddr(item.0 + 1)) }}"
+#  with_indexed_items: "{{groups.serverctl_mesh_nodes}}"
+

infrastructure/create-resources/ansible/roles/wireguard/mesh/templates/systemd.netdev

@@ -0,0 +1,20 @@
+[NetDev]
+Name=wg0
+Kind=wireguard
+Description=WireGuard tunnel wg0
+
+[WireGuard]
+ListenPort={{ wireguard_port }}
+PrivateKey={{ wireguard_private_key.stdout }}
+
+{% for peer in groups['serverctl_mesh_nodes'] %}
+{% if peer != inventory_hostname %}
+
+[WireGuardPeer]
+PublicKey={{ hostvars[peer].wireguard_public_key.stdout }}
+PresharedKey={{ wireguard_preshared_keys[peer] if inventory_hostname < peer else hostvars[peer].wireguard_preshared_keys[inventory_hostname] }}
+AllowedIPs={{ hostvars[peer].wireguard_ip }}/32
+Endpoint={{ hostvars[peer].ansible_host }}:{{ wireguard_port }}
+PersistentKeepalive=25
+{% endif %}
+{% endfor %}

infrastructure/create-resources/ansible/roles/wireguard/mesh/templates/systemd.network

@@ -0,0 +1,5 @@
+[Match]
+Name=wg0
+
+[Network]
+Address={{ wireguard_ip }}/{{ wireguard_mask_bits }}