Add wg_portal role to install vpn web interface manager

7 files changed, 72 insertions, 0 deletions

diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml
index fb15c394..1fdf56fa 100644
--- a/host_vars/rpi5.local.yml
+++ b/host_vars/rpi5.local.yml
diff --git a/molecule/raspberrypi/converge.yml b/molecule/raspberrypi/converge.yml
index 275c91d6..baed9413 100644
--- a/molecule/raspberrypi/converge.yml
+++ b/molecule/raspberrypi/converge.yml
@@ -25,4 +25,5 @@
     - role: "timezone"
     - role: "wireguard"
     - role: "wireguard_gateway"
+    - role: "wg_portal"
     - role: "pihole"
diff --git a/roles/wg_portal/defaults/main.yml b/roles/wg_portal/defaults/main.yml
new file mode 100644
index 00000000..7cf7d861
--- /dev/null
+++ b/roles/wg_portal/defaults/main.yml
@@ -0,0 +1,4 @@
+---
+wg_portal_version: "latest"
+wg_portal_port: "8080"
+wg_portal_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}"
diff --git a/roles/wg_portal/handlers/main.yml b/roles/wg_portal/handlers/main.yml
new file mode 100644
index 00000000..86148648
--- /dev/null
+++ b/roles/wg_portal/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+- name: "Restart wg-portal"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "wg-portal.service"
+    state: "restarted"
diff --git a/roles/wg_portal/tasks/main.yml b/roles/wg_portal/tasks/main.yml
new file mode 100644
index 00000000..87c234e1
--- /dev/null
+++ b/roles/wg_portal/tasks/main.yml
@@ -0,0 +1,56 @@
+---
+- name: "Ensure wg-portal dependencies are installed"
+  become: true
+  ansible.builtin.package:
+    name:
+      - curl
+      - sudo
+      - acl
+
+- name: "Create wg-portal user"
+  become: true
+  ansible.builtin.user:
+    name: "wg-portal"
+    system: true
+    shell: "/usr/sbin/nologin"
+
+- name: "Check if wg-portal is already installed"
+  become: true
+  ansible.builtin.stat:
+    path: "/etc/wg-portal/wg-portal"
+  register: wg_portal_binary_check
+
+- name: "Create wg-portal directories"
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: "directory"
+    owner: "root"
+    group: "wg-portal"
+    mode: "0755"
+  with_items:
+    - "/etc/wg-portal"
+
+- name: "Install wg-portal"
+  become: true
+  when: not wg_portal_binary_check.stat.exists
+  block:
+    - name: "Download wg-portal installer"
+      ansible.builtin.get_url:
+        url: "https://git.sr.ht/~a14m/wg-portal/blob/main/deployment/install.sh"
+        dest: "/tmp/install_wg-portal.sh"
+        mode: "0755"
+
+    - name: "Run wg-portal installer"
+      ansible.builtin.command:
+        cmd: "/tmp/install_wg-portal.sh {{ wg_portal_version }}"
+      args:
+        creates: "/etc/wg-portal/wg-portal"
+
+- name: "Create wg-portal configuration file"
+  become: true
+  ansible.builtin.template:
+    src: "config.yml.j2"
+    dest: "/etc/wg-portal/config.yml"
+    mode: "0644"
+  notify: "Restart wg-portal"
diff --git a/roles/wg_portal/templates/config.yml.j2 b/roles/wg_portal/templates/config.yml.j2
new file mode 100644
index 00000000..cbab462e
--- /dev/null
+++ b/roles/wg_portal/templates/config.yml.j2
@@ -0,0 +1,4 @@
+---
+host: "0.0.0.0"
+port: "{{ wg_portal_port }}"
+password_hash: "{{ wg_portal_password }}"
diff --git a/site.yml b/site.yml
index 413ac3d7..dd693a82 100644
--- a/site.yml
+++ b/site.yml
@@ -47,4 +47,5 @@
     - role: "timezone"
     - role: "wireguard"
     - role: "wireguard_gateway"
+    - role: "wg_portal"
     - role: "pihole"