diff options
| author | Ahmed Abdelhalim <[email protected]> | 2025-09-03 03:46:34 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2025-09-03 03:46:34 +0200 |
| commit | ec12de4bc29476f7733a2e5abec91687ee8985ad (patch) | |
| tree | 65deeb4cc9e073b8e04ed348cc8b16ff5c7dba6b /roles | |
| parent | db73cdace9c30550902025db362530aec6982a9b (diff) | |
Revert "Refactor: rename wireguard_gateway to gateway"
This reverts commit fdd0b5b58f0ebd39ad05e2dcb17faa6603145f97.
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/gateway/defaults/main.yml | 2 | ||||
| -rw-r--r-- | roles/wireguard_gateway/README.md (renamed from roles/gateway/README.md) | 20 | ||||
| -rw-r--r-- | roles/wireguard_gateway/defaults/main.yml | 2 | ||||
| -rw-r--r-- | roles/wireguard_gateway/handlers/main.yml (renamed from roles/gateway/handlers/main.yml) | 0 | ||||
| -rw-r--r-- | roles/wireguard_gateway/meta/argument_specs.yml (renamed from roles/gateway/meta/argument_specs.yml) | 4 | ||||
| -rw-r--r-- | roles/wireguard_gateway/meta/main.yml (renamed from roles/gateway/meta/main.yml) | 0 | ||||
| -rw-r--r-- | roles/wireguard_gateway/tasks/main.yml (renamed from roles/gateway/tasks/main.yml) | 16 |
7 files changed, 22 insertions, 22 deletions
diff --git a/roles/gateway/defaults/main.yml b/roles/gateway/defaults/main.yml deleted file mode 100644 index 8cddb272..00000000 --- a/roles/gateway/defaults/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -gateway_enabled: false diff --git a/roles/gateway/README.md b/roles/wireguard_gateway/README.md index 54c45430..06c3ceb7 100644 --- a/roles/gateway/README.md +++ b/roles/wireguard_gateway/README.md @@ -1,22 +1,22 @@ -# Ansible Role: gateway +# Ansible Role: wireguard_gateway -This role configures a Linux host as a gateway, -routing all traffic from local network clients through. +This role configures a Linux host as a WireGuard VPN gateway, +routing all traffic from local network clients through the VPN connection. ## Role Variables -- `gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`) +- `wireguard_gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`) ## What This Role Does -When `gateway_enabled` is `true`, the role: +When `wireguard_gateway_enabled` is `true`, the role: - Sets `net.ipv4.ip_forward=1` and `net.ipv6.conf.all.forwarding=1` in `/etc/sysctl.conf` - Creates custom routing table (100) to route traffic through VPN - Routes IPv4 and IPv6 traffic from local subnet through VPN interface - Allows traffic forwarding and established connections -When `gateway_enabled` is `false`, the role: +When `wireguard_gateway_enabled` is `false`, the role: - Removes all routing rules and iptables configurations - Disables IP forwarding in sysctl configuration @@ -25,13 +25,13 @@ When `gateway_enabled` is `false`, the role: ## Example Configuration ```yaml -# In host_vars/rpi5.local.yml -gateway_enabled: true -wireguard_autostart_connection: "protonvpn-us1" +# In host_vars/gateway.yml +wireguard_gateway_enabled: true +wireguard_autostart_connection: "protonvpn-us-1" # WireGuard connection configuration wireguard_connections: - protonvpn-us1: | + protonvpn-us-1: | [Interface] PrivateKey = your_private_key_here Address = 10.2.0.2/32 diff --git a/roles/wireguard_gateway/defaults/main.yml b/roles/wireguard_gateway/defaults/main.yml new file mode 100644 index 00000000..0086e118 --- /dev/null +++ b/roles/wireguard_gateway/defaults/main.yml @@ -0,0 +1,2 @@ +--- +wireguard_gateway_enabled: false diff --git a/roles/gateway/handlers/main.yml b/roles/wireguard_gateway/handlers/main.yml index 4b7cb2f2..4b7cb2f2 100644 --- a/roles/gateway/handlers/main.yml +++ b/roles/wireguard_gateway/handlers/main.yml diff --git a/roles/gateway/meta/argument_specs.yml b/roles/wireguard_gateway/meta/argument_specs.yml index d6520641..23f755b9 100644 --- a/roles/gateway/meta/argument_specs.yml +++ b/roles/wireguard_gateway/meta/argument_specs.yml @@ -1,10 +1,10 @@ --- argument_specs: main: - description: "Configure the PI as a network gateway forcing all traffic through it (or through active VPN on it)" + description: "Configure WireGuard VPN as a network gateway" author: "a14m" options: - gateway_enabled: + wireguard_gateway_enabled: description: "Toggle flag for enabling/disabling network gateway configurations" type: "bool" default: false diff --git a/roles/gateway/meta/main.yml b/roles/wireguard_gateway/meta/main.yml index 36df4aad..36df4aad 100644 --- a/roles/gateway/meta/main.yml +++ b/roles/wireguard_gateway/meta/main.yml diff --git a/roles/gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml index f9ccd4cb..c33a49bf 100644 --- a/roles/gateway/tasks/main.yml +++ b/roles/wireguard_gateway/tasks/main.yml @@ -9,10 +9,10 @@ become: true ansible.builtin.blockinfile: path: "/etc/sysctl.conf" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" prepend_newline: true append_newline: true - marker: "# ==== {mark} ANSIBLE GATEWAY CONFIG" + marker: "# ==== {mark} ANSIBLE WIREGUARD GATEWAY CONFIG" create: true mode: "0644" block: | @@ -41,7 +41,7 @@ out_interface: "{{ item }}" jump: "MASQUERADE" comment: "NAT local subnet traffic through VPN" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" with_items: "{{ wireguard_connections }}" - name: "Add IPv4 FORWARD rule to accept traffic from local subnet" @@ -51,7 +51,7 @@ source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24" jump: "ACCEPT" comment: "Allow forwarding from local subnet" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - name: "Add IPv4 FORWARD rule to accept established connections" become: true @@ -61,7 +61,7 @@ ctstate: "RELATED,ESTABLISHED" jump: "ACCEPT" comment: "Allow established connections" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" # IPv6 iptables rules - name: "Add IPv6 NAT masquerading for traffic through internet" @@ -87,7 +87,7 @@ jump: "MASQUERADE" comment: "NAT IPv6 local subnet traffic through VPN" ip_version: "ipv6" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" with_items: "{{ wireguard_connections }}" - name: "Add IPv6 FORWARD rule to accept traffic from local subnet" @@ -98,7 +98,7 @@ jump: "ACCEPT" comment: "Allow IPv6 forwarding from local subnet" ip_version: "ipv6" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" - name: "Add IPv6 FORWARD rule to accept established connections" become: true @@ -109,4 +109,4 @@ jump: "ACCEPT" comment: "Allow IPv6 established connections" ip_version: "ipv6" - state: "{{ 'present' if gateway_enabled else 'absent' }}" + state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}" |
