10 files changed, 0 insertions, 237 deletions
diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example
index 1fc19dd1..28212037 100644
--- a/host_vars/rpi5.local.yml.example
+++ b/host_vars/rpi5.local.yml.example
@@ -16,7 +16,6 @@ pihole_dhcp_hosts:
   - "ff:ff:ff:ff:ff:fe, 10.0.0.252,TV"
   - "ff:ff:ff:ff:ff:ff, 10.0.0.253,Printer"
 
-wireguard_gateway_enabled: true
 wireguard_autostart_connection: "protonvpn-us-1"
 wireguard_connections:
   protonvpn-us-1: |
diff --git a/molecule/archlinux/converge.yml b/molecule/archlinux/converge.yml
index 36ad820b..f6559a37 100644
--- a/molecule/archlinux/converge.yml
+++ b/molecule/archlinux/converge.yml
@@ -25,7 +25,6 @@
     - role: "locales"
     - role: "timezone"
     - role: "wireguard"
-    - role: "wireguard_gateway"
     - role: "homebrew"
     - role: "python"
     - role: "go"
diff --git a/molecule/debian/converge.yml b/molecule/debian/converge.yml
index b957bb97..cfe2cff0 100644
--- a/molecule/debian/converge.yml
+++ b/molecule/debian/converge.yml
@@ -25,7 +25,6 @@
     - role: "locales"
     - role: "timezone"
     - role: "wireguard"
-    - role: "wireguard_gateway"
     - role: "homebrew"
     - role: "python"
     - role: "go"
diff --git a/molecule/raspberrypi/converge.yml b/molecule/raspberrypi/converge.yml
index baed9413..99a19d8b 100644
--- a/molecule/raspberrypi/converge.yml
+++ b/molecule/raspberrypi/converge.yml
@@ -24,6 +24,5 @@
     - role: "locales"
     - role: "timezone"
     - role: "wireguard"
-    - role: "wireguard_gateway"
     - role: "wg_portal"
     - role: "pihole"
diff --git a/roles/wireguard_gateway/README.md b/roles/wireguard_gateway/README.md
deleted file mode 100644
index 06c3ceb7..00000000
--- a/roles/wireguard_gateway/README.md
+++ /dev/null
@@ -1,98 +0,0 @@
-# Ansible Role: wireguard_gateway
-
-This role configures a Linux host as a WireGuard VPN gateway,
-routing all traffic from local network clients through the VPN connection.
-
-## Role Variables
-
-- `wireguard_gateway_enabled`: Boolean flag to enable/disable gateway functionality (default: `false`)
-
-## What This Role Does
-
-When `wireguard_gateway_enabled` is `true`, the role:
-
-- Sets `net.ipv4.ip_forward=1` and `net.ipv6.conf.all.forwarding=1` in `/etc/sysctl.conf`
-- Creates custom routing table (100) to route traffic through VPN
-- Routes IPv4 and IPv6 traffic from local subnet through VPN interface
-- Allows traffic forwarding and established connections
-
-When `wireguard_gateway_enabled` is `false`, the role:
-
-- Removes all routing rules and iptables configurations
-- Disables IP forwarding in sysctl configuration
-- Cleans up custom routing tables
-
-## Example Configuration
-
-```yaml
-# In host_vars/gateway.yml
-wireguard_gateway_enabled: true
-wireguard_autostart_connection: "protonvpn-us-1"
-
-# WireGuard connection configuration
-wireguard_connections:
-  protonvpn-us-1: |
-    [Interface]
-    PrivateKey = your_private_key_here
-    Address = 10.2.0.2/32
-    DNS = 10.2.0.1
-
-    [Peer]
-    PublicKey = server_public_key
-    AllowedIPs = 0.0.0.0/0, ::/0
-    Endpoint = vpn.example.com:51820
-```
-
-## Client Configuration
-
-For client machines to route through the VPN gateway:
-
-1. **IPv4**: Set gateway to VPN gateway host's IP
-2. **IPv6**: Set IPv6 gateway to VPN gateway host's IPv6 address
-3. **Manual network config**: Disable auto-configuration to use custom gateway
-
-Example client network configuration:
-
-```yaml
-network_ipv4_address: "192.168.1.100"
-network_ipv4_gateway: "192.168.1.254"  # VPN gateway host
-network_ipv6_address: "2001:db8::100/64"
-network_ipv6_gateway: "2001:db8::254"   # VPN gateway host
-```
-
-## Technical Details
-
-### Routing Rules Created
-
-```bash
-# Policy routing rules (priority 200)
-ip rule add iif eth0 table 100 priority 200
-ip -6 rule add iif eth0 table 100 priority 200
-
-# Custom routing table (table 100)
-ip route add default dev wg-connection table 100
-ip -6 route add default dev wg-connection table 100
-```
-
-### iptables Rules Created
-
-```bash
-# IPv4 NAT masquerading
-iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o wg-connection -j MASQUERADE
-
-# IPv4 FORWARD rules
-iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT
-iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-
-# IPv6 equivalent rules
-ip6tables -t nat -A POSTROUTING -s 2001:db8::/64 -o wg-connection -j MASQUERADE
-ip6tables -A FORWARD -s 2001:db8::/64 -j ACCEPT
-ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-```
-
-## Troubleshooting
-
-- **Check VPN connection**: `sudo wg show` should show active connection
-- **Verify routing**: `ip rule show` and `ip route show table 100`
-- **Test connectivity**: `curl ip.me` should show VPN IP from client machines
-- **Check iptables**: `sudo iptables -t nat -L -n -v` should show masquerading rules
diff --git a/roles/wireguard_gateway/defaults/main.yml b/roles/wireguard_gateway/defaults/main.yml
deleted file mode 100644
index 0086e118..00000000
--- a/roles/wireguard_gateway/defaults/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-wireguard_gateway_enabled: false
diff --git a/roles/wireguard_gateway/handlers/main.yml b/roles/wireguard_gateway/handlers/main.yml
deleted file mode 100644
index 4b7cb2f2..00000000
--- a/roles/wireguard_gateway/handlers/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-- name: "Reload sysctl"
-  become: true
-  ansible.builtin.command:
-    cmd: "sysctl -p"
-  changed_when: false
diff --git a/roles/wireguard_gateway/meta/argument_specs.yml b/roles/wireguard_gateway/meta/argument_specs.yml
deleted file mode 100644
index 23f755b9..00000000
--- a/roles/wireguard_gateway/meta/argument_specs.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-argument_specs:
-  main:
-    description: "Configure WireGuard VPN as a network gateway"
-    author: "a14m"
-    options:
-      wireguard_gateway_enabled:
-        description: "Toggle flag for enabling/disabling network gateway configurations"
-        type: "bool"
-        default: false
diff --git a/roles/wireguard_gateway/meta/main.yml b/roles/wireguard_gateway/meta/main.yml
deleted file mode 100644
index 36df4aad..00000000
--- a/roles/wireguard_gateway/meta/main.yml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-dependencies:
-  - "wireguard"
-
-galaxy_info:
-  author: "a14m"
-  description: "Install and configure WireGuard VPN as a network gateway"
-  company: "kartoffeln.work GmbH."
-  license: "MIT"
-  min_ansible_version: "2.18"
-  platforms:
-    - name: "ArchLinux"
-      versions:
-        - "all"
-    - name: "Ubuntu"
-      versions:
-        - "noble"
-    - name: "Debian"
-      versions:
-        - "bookworm"
diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml
deleted file mode 100644
index 1c2887dc..00000000
--- a/roles/wireguard_gateway/tasks/main.yml
+++ /dev/null
@@ -1,97 +0,0 @@
----
-- name: "Ensure iptables are installed"
-  become: true
-  ansible.builtin.package:
-    name: "iptables"
-    state: "present"
-
-- name: "Configure IP forwarding"
-  become: true
-  ansible.builtin.blockinfile:
-    path: "/etc/sysctl.conf"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-    prepend_newline: true
-    append_newline: true
-    marker: "# ==== {mark} ANSIBLE WIREGUARD GATEWAY CONFIG"
-    create: true
-    mode: "0644"
-    block: |
-      net.ipv4.ip_forward=1
-      net.ipv6.conf.all.forwarding=1
-  notify: "Reload sysctl"
-
-# IPv4 iptables rules
-- name: "Add IPv4 NAT masquerading for traffic through VPN"
-  become: true
-  ansible.builtin.iptables:
-    table: "nat"
-    chain: "POSTROUTING"
-    source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
-    out_interface: "{{ item }}"
-    jump: "MASQUERADE"
-    comment: "NAT local subnet traffic through VPN"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  with_items: "{{ wireguard_connections }}"
-
-- name: "Add IPv4 FORWARD rule to accept traffic from local subnet"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
-    jump: "ACCEPT"
-    comment: "Allow forwarding from local subnet"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-
-- name: "Add IPv4 FORWARD rule to accept established connections"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    match: "conntrack"
-    ctstate: "RELATED,ESTABLISHED"
-    jump: "ACCEPT"
-    comment: "Allow established connections"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-
-# IPv6 iptables rules
-- name: "Add IPv6 NAT masquerading for traffic through VPN"
-  become: true
-  ansible.builtin.iptables:
-    table: "nat"
-    chain: "POSTROUTING"
-    source: "{{ (ansible_default_ipv6.address.split(':')[:4] | join(':')) + '::/64' }}"
-    out_interface: "{{ item }}"
-    jump: "MASQUERADE"
-    comment: "NAT IPv6 local subnet traffic through VPN"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  with_items: "{{ wireguard_connections }}"
-  failed_when: false
-  # NOTE: on github the 'IPv6 default: {}' and that makes the task fails
-  tags:
-    - molecule-idempotence-notest
-
-- name: "Add IPv6 FORWARD rule to accept traffic from local subnet"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    source: "{{ (ansible_default_ipv6.address.split(':')[:4] | join(':')) + '::/64' }}"
-    jump: "ACCEPT"
-    comment: "Allow IPv6 forwarding from local subnet"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  failed_when: false
-  # NOTE: on github the 'IPv6 default: {}' and that makes the task fails
-  tags:
-    - molecule-idempotence-notest
-
-- name: "Add IPv6 FORWARD rule to accept established connections"
-  become: true
-  ansible.builtin.iptables:
-    chain: "FORWARD"
-    match: "conntrack"
-    ctstate: "RELATED,ESTABLISHED"
-    jump: "ACCEPT"
-    comment: "Allow IPv6 established connections"
-    ip_version: "ipv6"
-    state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"
-  failed_when: false