summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAhmed Abdelhalim <[email protected]>2025-09-03 03:46:34 +0200
committerAhmed Abdelhalim <[email protected]>2025-09-03 03:46:34 +0200
commitec12de4bc29476f7733a2e5abec91687ee8985ad (patch)
tree65deeb4cc9e073b8e04ed348cc8b16ff5c7dba6b
parentdb73cdace9c30550902025db362530aec6982a9b (diff)
Revert "Refactor: rename wireguard_gateway to gateway"
This reverts commit fdd0b5b58f0ebd39ad05e2dcb17faa6603145f97.
-rw-r--r--group_vars/all.ymlbin1601 -> 1605 bytes
-rw-r--r--host_vars/rpi5.local.ymlbin718 -> 717 bytes
-rw-r--r--host_vars/rpi5.local.yml.example2
-rw-r--r--host_vars/ubuntu.local.ymlbin203 -> 528 bytes
-rw-r--r--molecule/default/converge.yml2
-rw-r--r--roles/gateway/defaults/main.yml2
-rw-r--r--roles/wireguard_gateway/README.md (renamed from roles/gateway/README.md)20
-rw-r--r--roles/wireguard_gateway/defaults/main.yml2
-rw-r--r--roles/wireguard_gateway/handlers/main.yml (renamed from roles/gateway/handlers/main.yml)0
-rw-r--r--roles/wireguard_gateway/meta/argument_specs.yml (renamed from roles/gateway/meta/argument_specs.yml)4
-rw-r--r--roles/wireguard_gateway/meta/main.yml (renamed from roles/gateway/meta/main.yml)0
-rw-r--r--roles/wireguard_gateway/tasks/main.yml (renamed from roles/gateway/tasks/main.yml)16
-rw-r--r--site.yml2
13 files changed, 25 insertions, 25 deletions
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 711e9028..9260503e 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
Binary files differ
diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml
index 4a1dcc5c..80e6dc4d 100644
--- a/host_vars/rpi5.local.yml
+++ b/host_vars/rpi5.local.yml
Binary files differ
diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example
index 435307ca..1fc19dd1 100644
--- a/host_vars/rpi5.local.yml.example
+++ b/host_vars/rpi5.local.yml.example
@@ -16,7 +16,7 @@ pihole_dhcp_hosts:
- "ff:ff:ff:ff:ff:fe, 10.0.0.252,TV"
- "ff:ff:ff:ff:ff:ff, 10.0.0.253,Printer"
-gateway_enabled: true
+wireguard_gateway_enabled: true
wireguard_autostart_connection: "protonvpn-us-1"
wireguard_connections:
protonvpn-us-1: |
diff --git a/host_vars/ubuntu.local.yml b/host_vars/ubuntu.local.yml
index 4b3a00d2..8fc0e6f0 100644
--- a/host_vars/ubuntu.local.yml
+++ b/host_vars/ubuntu.local.yml
Binary files differ
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
index 36eead7b..039fc920 100644
--- a/molecule/default/converge.yml
+++ b/molecule/default/converge.yml
@@ -44,7 +44,7 @@
- role: "docker"
- role: "podman"
- role: "wireguard"
- - role: "gateway"
+ - role: "wireguard_gateway"
- role: "pihole"
when:
- lookup('ansible.builtin.env', 'MOLECULE_DISTRO') == 'ubuntu' or
diff --git a/roles/gateway/defaults/main.yml b/roles/gateway/defaults/main.yml
deleted file mode 100644
index 8cddb272..00000000
--- a/roles/gateway/defaults/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-gateway_enabled: false
diff --git a/roles/gateway/README.md b/roles/wireguard_gateway/README.md
index 54c45430..06c3ceb7 100644
--- a/roles/gateway/README.md
+++ b/roles/wireguard_gateway/README.md
@@ -1,22 +1,22 @@
-# Ansible Role: gateway
+# Ansible Role: wireguard_gateway
-This role configures a Linux host as a gateway,
-routing all traffic from local network clients through.
+This role configures a Linux host as a WireGuard VPN gateway,
+routing all traffic from local network clients through the VPN connection.
## Role Variables
-- `gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`)
+- `wireguard_gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`)
## What This Role Does
-When `gateway_enabled` is `true`, the role:
+When `wireguard_gateway_enabled` is `true`, the role:
- Sets `net.ipv4.ip_forward=1` and `net.ipv6.conf.all.forwarding=1` in `/etc/sysctl.conf`
- Creates custom routing table (100) to route traffic through VPN
- Routes IPv4 and IPv6 traffic from local subnet through VPN interface
- Allows traffic forwarding and established connections
-When `gateway_enabled` is `false`, the role:
+When `wireguard_gateway_enabled` is `false`, the role:
- Removes all routing rules and iptables configurations
- Disables IP forwarding in sysctl configuration
@@ -25,13 +25,13 @@ When `gateway_enabled` is `false`, the role:
## Example Configuration
```yaml
-# In host_vars/rpi5.local.yml
-gateway_enabled: true
-wireguard_autostart_connection: "protonvpn-us1"
+# In host_vars/gateway.yml
+wireguard_gateway_enabled: true
+wireguard_autostart_connection: "protonvpn-us-1"
# WireGuard connection configuration
wireguard_connections:
- protonvpn-us1: |
+ protonvpn-us-1: |
[Interface]
PrivateKey = your_private_key_here
Address = 10.2.0.2/32
diff --git a/roles/wireguard_gateway/defaults/main.yml b/roles/wireguard_gateway/defaults/main.yml
new file mode 100644
index 00000000..0086e118
--- /dev/null
+++ b/roles/wireguard_gateway/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+wireguard_gateway_enabled: false
diff --git a/roles/gateway/handlers/main.yml b/roles/wireguard_gateway/handlers/main.yml
index 4b7cb2f2..4b7cb2f2 100644
--- a/roles/gateway/handlers/main.yml
+++ b/roles/wireguard_gateway/handlers/main.yml
diff --git a/roles/gateway/meta/argument_specs.yml b/roles/wireguard_gateway/meta/argument_specs.yml
index d6520641..23f755b9 100644
--- a/roles/gateway/meta/argument_specs.yml
+++ b/roles/wireguard_gateway/meta/argument_specs.yml
@@ -1,10 +1,10 @@
---
argument_specs:
main:
- description: "Configure the PI as a network gateway forcing all traffic through it (or through active VPN on it)"
+ description: "Configure WireGuard VPN as a network gateway"
author: "a14m"
options:
- gateway_enabled:
+ wireguard_gateway_enabled:
description: "Toggle flag for enabling/disabling network gateway configurations"
type: "bool"
default: false
diff --git a/roles/gateway/meta/main.yml b/roles/wireguard_gateway/meta/main.yml
index 36df4aad..36df4aad 100644
--- a/roles/gateway/meta/main.yml
+++ b/roles/wireguard_gateway/meta/main.yml
diff --git a/roles/gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml
index f9ccd4cb..c33a49bf 100644
--- a/roles/gateway/tasks/main.yml
+++ b/roles/wireguard_gateway/tasks/main.yml
@@ -9,10 +9,10 @@
become: true
ansible.builtin.blockinfile:
path: "/etc/sysctl.conf"
- state: "{{ 'present' if gateway_enabled else 'absent' }}"
+ state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
prepend_newline: true
append_newline: true
- marker: "# ==== {mark} ANSIBLE GATEWAY CONFIG"
+ marker: "# ==== {mark} ANSIBLE WIREGUARD GATEWAY CONFIG"
create: true
mode: "0644"
block: |
@@ -41,7 +41,7 @@
out_interface: "{{ item }}"
jump: "MASQUERADE"
comment: "NAT local subnet traffic through VPN"
- state: "{{ 'present' if gateway_enabled else 'absent' }}"
+ state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
with_items: "{{ wireguard_connections }}"
- name: "Add IPv4 FORWARD rule to accept traffic from local subnet"
@@ -51,7 +51,7 @@
source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
jump: "ACCEPT"
comment: "Allow forwarding from local subnet"
- state: "{{ 'present' if gateway_enabled else 'absent' }}"
+ state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
- name: "Add IPv4 FORWARD rule to accept established connections"
become: true
@@ -61,7 +61,7 @@
ctstate: "RELATED,ESTABLISHED"
jump: "ACCEPT"
comment: "Allow established connections"
- state: "{{ 'present' if gateway_enabled else 'absent' }}"
+ state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
# IPv6 iptables rules
- name: "Add IPv6 NAT masquerading for traffic through internet"
@@ -87,7 +87,7 @@
jump: "MASQUERADE"
comment: "NAT IPv6 local subnet traffic through VPN"
ip_version: "ipv6"
- state: "{{ 'present' if gateway_enabled else 'absent' }}"
+ state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
with_items: "{{ wireguard_connections }}"
- name: "Add IPv6 FORWARD rule to accept traffic from local subnet"
@@ -98,7 +98,7 @@
jump: "ACCEPT"
comment: "Allow IPv6 forwarding from local subnet"
ip_version: "ipv6"
- state: "{{ 'present' if gateway_enabled else 'absent' }}"
+ state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
- name: "Add IPv6 FORWARD rule to accept established connections"
become: true
@@ -109,4 +109,4 @@
jump: "ACCEPT"
comment: "Allow IPv6 established connections"
ip_version: "ipv6"
- state: "{{ 'present' if gateway_enabled else 'absent' }}"
+ state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
diff --git a/site.yml b/site.yml
index 42006b04..0ced1e0b 100644
--- a/site.yml
+++ b/site.yml
@@ -45,5 +45,5 @@
- role: "locales"
- role: "timezone"
- role: "wireguard"
- - role: "gateway"
+ - role: "wireguard_gateway"
- role: "pihole"