diff options
| author | Ahmed Abdelhalim <[email protected]> | 2025-09-03 03:46:34 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2025-09-03 03:46:34 +0200 |
| commit | ec12de4bc29476f7733a2e5abec91687ee8985ad (patch) | |
| tree | 65deeb4cc9e073b8e04ed348cc8b16ff5c7dba6b | |
| parent | db73cdace9c30550902025db362530aec6982a9b (diff) | |
Revert "Refactor: rename wireguard_gateway to gateway"
This reverts commit fdd0b5b58f0ebd39ad05e2dcb17faa6603145f97.
| -rw-r--r-- | group_vars/all.yml | bin | 1601 -> 1605 bytes | |||
| -rw-r--r-- | host_vars/rpi5.local.yml | bin | 718 -> 717 bytes | |||
| -rw-r--r-- | host_vars/rpi5.local.yml.example | 2 | ||||
| -rw-r--r-- | host_vars/ubuntu.local.yml | bin | 203 -> 528 bytes | |||
| -rw-r--r-- | molecule/default/converge.yml | 2 | ||||
| -rw-r--r-- | roles/gateway/defaults/main.yml | 2 | ||||
| -rw-r--r-- | roles/wireguard_gateway/README.md (renamed from roles/gateway/README.md) | 20 | ||||
| -rw-r--r-- | roles/wireguard_gateway/defaults/main.yml | 2 | ||||
| -rw-r--r-- | roles/wireguard_gateway/handlers/main.yml (renamed from roles/gateway/handlers/main.yml) | 0 | ||||
| -rw-r--r-- | roles/wireguard_gateway/meta/argument_specs.yml (renamed from roles/gateway/meta/argument_specs.yml) | 4 | ||||
| -rw-r--r-- | roles/wireguard_gateway/meta/main.yml (renamed from roles/gateway/meta/main.yml) | 0 | ||||
| -rw-r--r-- | roles/wireguard_gateway/tasks/main.yml (renamed from roles/gateway/tasks/main.yml) | 16 | ||||
| -rw-r--r-- | site.yml | 2 |
13 files changed, 25 insertions, 25 deletions
diff --git a/group_vars/all.yml b/group_vars/all.yml Binary files differindex 711e9028..9260503e 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml Binary files differindex 4a1dcc5c..80e6dc4d 100644 --- a/host_vars/rpi5.local.yml +++ b/host_vars/rpi5.local.yml diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index 435307ca..1fc19dd1 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -16,7 +16,7 @@ pihole_dhcp_hosts: - "ff:ff:ff:ff:ff:fe, 10.0.0.252,TV" - "ff:ff:ff:ff:ff:ff, 10.0.0.253,Printer" -gateway_enabled: true +wireguard_gateway_enabled: true wireguard_autostart_connection: "protonvpn-us-1" wireguard_connections: protonvpn-us-1: | diff --git a/host_vars/ubuntu.local.yml b/host_vars/ubuntu.local.yml Binary files differindex 4b3a00d2..8fc0e6f0 100644 --- a/host_vars/ubuntu.local.yml +++ b/host_vars/ubuntu.local.yml diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index 36eead7b..039fc920 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -44,7 +44,7 @@ - role: "docker" - role: "podman" - role: "wireguard" - - role: "gateway" + - role: "wireguard_gateway" - role: "pihole" when: - lookup('ansible.builtin.env', 'MOLECULE_DISTRO') == 'ubuntu' or diff --git a/roles/gateway/defaults/main.yml b/roles/gateway/defaults/main.yml deleted file mode 100644 index 8cddb272..00000000 --- a/roles/gateway/defaults/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -gateway_enabled: false diff --git a/roles/gateway/README.md b/roles/wireguard_gateway/README.md index 54c45430..06c3ceb7 100644 --- a/roles/gateway/README.md +++ b/roles/wireguard_gateway/README.md @@ -1,22 +1,22 @@ -# Ansible Role: gateway +# Ansible Role: wireguard_gateway -This role configures a Linux host as a gateway, -routing all traffic from local network clients through. +This role configures a Linux host as a WireGuard VPN gateway, +routing all traffic from local network clients through the VPN connection. ## Role Variables -- `gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`) +- `wireguard_gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`) ## What This Role Does -When `gateway_enabled` is `true`, the role: +When `wireguard_gateway_enabled` is `true`, the role: - Sets `net.ipv4.ip_forward=1` and `net.ipv6.conf.all.forwarding=1` in `/etc/sysctl.conf` - Creates custom routing table (100) to route traffic through VPN - Routes IPv4 and IPv6 traffic from local subnet through VPN interface - Allows traffic forwarding and established connections -When `gateway_enabled` is `false`, the role: +When `wireguard_gateway_enabled` is `false`, the role: - Removes all routing rules and iptables configurations - Disables IP forwarding in sysctl configuration @@ -25,13 +25,13 @@ When `gateway_enabled` is `false`, the role: ## Example Configuration ```yaml -# In host_vars/rpi5.local.yml -gateway_enabled: true -wireguard_autostart_connection: "protonvpn-us1" +# In host_vars/gateway.yml +wireguard_gateway_enabled: true +wireguard_autostart_connection: "protonvpn-us-1" # WireGuard connection configuration wireguard_connections: - protonvpn-us1: | + protonvpn-us-1: | [Interface] PrivateKey = your_private_key_here Address = 10.2.0.2/32 diff --git a/roles/wireguard_gateway/defaults/main.yml b/roles/wireguard_gateway/defaults/main.yml new file mode 100644 index 00000000..0086e118 --- /dev/null +++ b/roles/wireguard_gateway/defaults/main.yml @@ -0,0 +1,2 @@ +--- +wireguard_gateway_enabled: false diff --git a/roles/gateway/handlers/main.yml b/roles/wireguard_gateway/handlers/main.yml index 4b7cb2f2..4b7cb2f2 100644 --- a/roles/gateway/handlers/main.yml +++ b/roles/wireguard_gateway/handlers/main.yml diff --git a/roles/gateway/meta/argument_specs.yml b/roles/wireguard_gateway/meta/argument_specs.yml index d6520641..23f755b9 100644 --- a/roles/gateway/meta/argument_specs.yml +++ b/roles/wireguard_gateway/meta/argument_specs.yml @@ -1,10 +1,10 @@ --- argument_specs: main: - description: "Configure the PI as a network gateway forcing all traffic through it (or through active VPN on it)" + description: "Configure WireGuard VPN as a network gateway" author: "a14m" options: - gateway_enabled: + wireguard_gateway_enabled: description: "Toggle flag for enabling/disabling network gateway configurations" type: "bool" default: false diff --git a/roles/gateway/meta/main.yml b/roles/wireguard_gateway/meta/main.yml index 36df4aad..36df4aad 100644 --- a/roles/gateway/meta/main.yml +++ b/roles/wireguard_gateway/meta/main.yml diff --git a/roles/gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml index f9ccd4cb..c33a49bf 100644 --- a/roles/gateway/tasks/main.yml +++ b/roles/wireguard_gateway/tasks/main.yml @@ -9,10 +9,10 @@ become: true ansible.builtin.blockinfile: path: "/etc/sysctl.conf" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" prepend_newline: true append_newline: true - marker: "# ==== {mark} ANSIBLE GATEWAY CONFIG" + marker: "# ==== {mark} ANSIBLE WIREGUARD GATEWAY CONFIG" create: true mode: "0644" block: | @@ -41,7 +41,7 @@ out_interface: "{{ item }}" jump: "MASQUERADE" comment: "NAT local subnet traffic through VPN" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" with_items: "{{ wireguard_connections }}" - name: "Add IPv4 FORWARD rule to accept traffic from local subnet" @@ -51,7 +51,7 @@ source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24" jump: "ACCEPT" comment: "Allow forwarding from local subnet" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - name: "Add IPv4 FORWARD rule to accept established connections" become: true @@ -61,7 +61,7 @@ ctstate: "RELATED,ESTABLISHED" jump: "ACCEPT" comment: "Allow established connections" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" # IPv6 iptables rules - name: "Add IPv6 NAT masquerading for traffic through internet" @@ -87,7 +87,7 @@ jump: "MASQUERADE" comment: "NAT IPv6 local subnet traffic through VPN" ip_version: "ipv6" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" with_items: "{{ wireguard_connections }}" - name: "Add IPv6 FORWARD rule to accept traffic from local subnet" @@ -98,7 +98,7 @@ jump: "ACCEPT" comment: "Allow IPv6 forwarding from local subnet" ip_version: "ipv6" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - name: "Add IPv6 FORWARD rule to accept established connections" become: true @@ -109,4 +109,4 @@ jump: "ACCEPT" comment: "Allow IPv6 established connections" ip_version: "ipv6" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" @@ -45,5 +45,5 @@ - role: "locales" - role: "timezone" - role: "wireguard" - - role: "gateway" + - role: "wireguard_gateway" - role: "pihole" |
