Implement the gateway role (replacing old wireguard-gateway)

1 files changed, 73 insertions, 0 deletions

diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml
new file mode 100644
index 00000000..f0bdb4d4
--- /dev/null
+++ b/roles/gateway/tasks/main.yml
@@ -0,0 +1,73 @@
+---
+- name: "Ensure iptables and iproute2 are installed"
+  become: true
+  ansible.builtin.package:
+    name:
+      - "iptables"
+      - "iproute2"
+    state: "present"
+
+- name: "Configure IP forwarding"
+  become: true
+  ansible.builtin.blockinfile:
+    path: "/etc/sysctl.conf"
+    state: "{{ 'present' if gateway_enabled else 'absent' }}"
+    prepend_newline: true
+    append_newline: true
+    marker: "# ==== {mark} ANSIBLE GATEWAY CONFIG"
+    create: true
+    mode: "0644"
+    block: |
+      net.ipv4.ip_forward=1
+      net.ipv6.conf.all.forwarding=1
+  notify: "Reload sysctl"
+
+- name: "Deploy gateway apply rules script"
+  become: true
+  ansible.builtin.template:
+    src: "gateway-apply-rules.sh.j2"
+    dest: "/usr/local/bin/gateway-apply-rules"
+    mode: "0755"
+    owner: "root"
+    group: "root"
+
+- name: "Deploy udev rules for WireGuard interface events"
+  become: true
+  ansible.builtin.template:
+    src: "99-wireguard-gateway.rules.j2"
+    dest: "/etc/udev/rules.d/99-wireguard-gateway.rules"
+    mode: "0644"
+    owner: "root"
+    group: "root"
+  notify: "Reload udev"
+
+- name: "Deploy gateway VPN mode systemd service"
+  become: true
+  ansible.builtin.template:
+    src: "gateway-vpn-mode.service.j2"
+    dest: "/etc/systemd/system/gateway-vpn-mode.service"
+    mode: "0644"
+  notify: "Reload systemd"
+
+- name: "Deploy gateway direct mode systemd service"
+  become: true
+  ansible.builtin.template:
+    src: "gateway-direct-mode.service.j2"
+    dest: "/etc/systemd/system/gateway-direct-mode.service"
+    mode: "0644"
+  notify: "Reload systemd"
+
+- name: "Deploy gateway init systemd service"
+  become: true
+  ansible.builtin.template:
+    src: "gateway-init.service.j2"
+    dest: "/etc/systemd/system/gateway-init.service"
+    mode: "0644"
+  notify: "Reload systemd"
+
+- name: "Enable gateway init service"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "gateway-init.service"
+    enabled: "{{ gateway_enabled }}"
+    daemon_reload: true