Add wireguard

2022-02-24 13:57:19 +01:00
parent 5f301ce32a
commit 1663a469c2
11 changed files with 264 additions and 19 deletions
--- a/infrastructure/create-resources/ansible/roles/wireguard/mesh/templates/systemd.netdev
+++ b/infrastructure/create-resources/ansible/roles/wireguard/mesh/templates/systemd.netdev
@@ -0,0 +1,20 @@
+[NetDev]
+Name=wg0
+Kind=wireguard
+Description=WireGuard tunnel wg0
+
+[WireGuard]
+ListenPort={{ wireguard_port }}
+PrivateKey={{ wireguard_private_key.stdout }}
+
+{% for peer in groups['serverctl_mesh_nodes'] %}
+{% if peer != inventory_hostname %}
+
+[WireGuardPeer]
+PublicKey={{ hostvars[peer].wireguard_public_key.stdout }}
+PresharedKey={{ wireguard_preshared_keys[peer] if inventory_hostname < peer else hostvars[peer].wireguard_preshared_keys[inventory_hostname] }}
+AllowedIPs={{ hostvars[peer].wireguard_ip }}/32
+Endpoint={{ hostvars[peer].ansible_host }}:{{ wireguard_port }}
+PersistentKeepalive=25
+{% endif %}
+{% endfor %}
--- a/infrastructure/create-resources/ansible/roles/wireguard/mesh/templates/systemd.network
+++ b/infrastructure/create-resources/ansible/roles/wireguard/mesh/templates/systemd.network
@@ -0,0 +1,5 @@
+[Match]
+Name=wg0
+
+[Network]
+Address={{ wireguard_ip }}/{{ wireguard_mask_bits }}