Remove wireguard_gateway

This implementation doesn't work properly after testing.
The iptable configuration didn't allow for changing the VPN state
without running into networking issues.

Either have to change the VPN by running the role, which is inconvenient
or reimplement the role differently to allow for control over
network/interfaces

1 files changed, 0 insertions, 97 deletions

diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml
deleted file mode 100644
index 1c2887dc..00000000
--- a/roles/wireguard_gateway/tasks/main.yml
+++ /dev/null
@@ -1,97 +0,0 @@
----
-- name: "Ensure iptables are installed"
-  become: true
-  ansible.builtin.package:
-    name: "iptables"
-    state: "present"
-
-- name: "Configure IP forwarding"
-  become: true
-  ansible.builtin.blockinfile:
-    path: "/etc/sysctl.conf"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-    prepend_newline: true
-    append_newline: true
-    marker: "# ==== {mark} ANSIBLE WIREGUARD GATEWAY CONFIG"
-    create: true
-    mode: "0644"
-    block: |
-      net.ipv4.ip_forward=1
-      net.ipv6.conf.all.forwarding=1
-  notify: "Reload sysctl"
-
-# IPv4 iptables rules
-- name: "Add IPv4 NAT masquerading for traffic through VPN"
-  become: true
-  ansible.builtin.iptables:
-    table: "nat"
-    chain: "POSTROUTING"
-    source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
-    out_interface: "{{ item }}"
-    jump: "MASQUERADE"
-    comment: "NAT local subnet traffic through VPN"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  with_items: "{{ wireguard_connections }}"
-
-- name: "Add IPv4 FORWARD rule to accept traffic from local subnet"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
-    jump: "ACCEPT"
-    comment: "Allow forwarding from local subnet"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-
-- name: "Add IPv4 FORWARD rule to accept established connections"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    match: "conntrack"
-    ctstate: "RELATED,ESTABLISHED"
-    jump: "ACCEPT"
-    comment: "Allow established connections"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-
-# IPv6 iptables rules
-- name: "Add IPv6 NAT masquerading for traffic through VPN"
-  become: true
-  ansible.builtin.iptables:
-    table: "nat"
-    chain: "POSTROUTING"
-    source: "{{ (ansible_default_ipv6.address.split(':')[:4] | join(':')) + '::/64' }}"
-    out_interface: "{{ item }}"
-    jump: "MASQUERADE"
-    comment: "NAT IPv6 local subnet traffic through VPN"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  with_items: "{{ wireguard_connections }}"
-  failed_when: false
-  # NOTE: on github the 'IPv6 default: {}' and that makes the task fails
-  tags:
-    - molecule-idempotence-notest
-
-- name: "Add IPv6 FORWARD rule to accept traffic from local subnet"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    source: "{{ (ansible_default_ipv6.address.split(':')[:4] | join(':')) + '::/64' }}"
-    jump: "ACCEPT"
-    comment: "Allow IPv6 forwarding from local subnet"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  failed_when: false
-  # NOTE: on github the 'IPv6 default: {}' and that makes the task fails
-  tags:
-    - molecule-idempotence-notest
-
-- name: "Add IPv6 FORWARD rule to accept established connections"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    match: "conntrack"
-    ctstate: "RELATED,ESTABLISHED"
-    jump: "ACCEPT"
-    comment: "Allow IPv6 established connections"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  failed_when: false