Add mechanism to clean up wireguard configurations

When a wireguard configuration gets removed from the group/host
variables, the role now removes them and make sure only the files found
in the vars are the ones to be configured on the hosts

4 files changed, 34 insertions, 10 deletions

diff --git a/group_vars/all.yml b/group_vars/all.yml
index 450653bf..381f3c1a 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example
index 0e9dd8c9..a4e90f14 100644
--- a/group_vars/all.yml.example
+++ b/group_vars/all.yml.example
@@ -58,7 +58,9 @@ vimrc_setup_script: |
 
 wireguard_autostart_connection: "wg-vpn0"
 wireguard_connections:
-  wg-vpn0: |
+  # All wireguard config files are prefixed with wg-
+  # The following connection will be named wg-vpn0
+  vpn0: |
     [Interface]
     PrivateKey = your_private_key_here
     Address = 10.2.0.2/32
diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example
index 9361aae3..49fcc3ba 100644
--- a/host_vars/rpi5.local.yml.example
+++ b/host_vars/rpi5.local.yml.example
@@ -17,9 +17,11 @@ pihole_dhcp_hosts:
   - "ff:ff:ff:ff:ff:fe, 10.0.0.252,TV"
   - "ff:ff:ff:ff:ff:ff, 10.0.0.253,Printer"
 
-wireguard_autostart_connection: "wg-vpn2"
+wireguard_autostart_connection: "vpn2"
 wireguard_connections:
-  wg-vpn2: |
+  # All wireguard config files are prefixed (internally) with wg-
+  # The following connection/interface will be named wg-vpn2
+  vpn2: |
     [Interface]
     PrivateKey = your_private_key_here
     Address = 10.2.0.2/32
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
index 318b9c10..9a69f0d9 100644
--- a/roles/wireguard/tasks/main.yml
+++ b/roles/wireguard/tasks/main.yml
@@ -8,18 +8,38 @@
     name: "{{ wireguard_packages }}"
     state: "present"
 
-- name: "Deploy WireGuard configurations"
+- name: "Find existing WireGuard connections"
+  become: true
+  ansible.builtin.shell: |
+    set -euo pipefail
+    ls /etc/wireguard/wg-*.conf | xargs -n1 basename | sed 's/^wg-//;s/\.conf$//'
+  args:
+    executable: /bin/bash
+  register: wireguard_existing_connections
+  changed_when: false
+  failed_when: false
+
+- name: "Remove extra WireGuard connections"
+  become: true
+  ansible.builtin.file:
+    path: "/etc/wireguard/wg-{{ item }}.conf"
+    state: "absent"
+  loop: "{{ wireguard_existing_connections.stdout_lines }}"
+  when:
+    - wireguard_existing_connections.stdout_lines is defined
+    - wireguard_existing_connections.stdout_lines | length > 0
+    - item not in wireguard_connections.keys()
+
+- name: "Deploy WireGuard connections"
   become: true
   ansible.builtin.copy:
     content: "{{ wireguard_connections[item] }}"
-    dest: "/etc/wireguard/{{ item }}.conf"
+    dest: "/etc/wireguard/wg-{{ item }}.conf"
     owner: "root"
     group: "root"
     mode: "0600"
   loop: "{{ wireguard_connections.keys() }}"
   when: wireguard_connections | length > 0
-  tags:
-    - molecule-idempotence-notest
 
 - name: "Configure autostart connection"
   become: true
@@ -27,20 +47,20 @@
   block:
     - name: "Ensure all wireguard connections are stopped"
       ansible.builtin.systemd_service:
-        name: "wg-quick@{{ item }}"
+        name: "wg-quick@wg-{{ item }}"
         enabled: false
         state: "stopped"
       loop: "{{ wireguard_connections.keys() | list }}"
 
     - name: "Ensure all wireguard interfaces are down"
       ansible.builtin.command:
-        cmd: "wg-quick down {{ item }}"
+        cmd: "wg-quick down wg-{{ item }}"
       loop: "{{ wireguard_connections.keys() | list }}"
       changed_when: false
       failed_when: false
 
     - name: "Enable and start wg-quick service for connection {{ wireguard_autostart_connection }}"
       ansible.builtin.systemd_service:
-        name: "wg-quick@{{ wireguard_autostart_connection }}"
+        name: "wg-quick@wg-{{ wireguard_autostart_connection }}"
         enabled: true
         state: "started"