7 files changed, 104 insertions, 0 deletions
diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2
index c94e9c1a..c083a214 100644
--- a/roles/network/templates/resolved.conf.j2
+++ b/roles/network/templates/resolved.conf.j2
@@ -3,6 +3,8 @@ DNS=9.9.9.9 2620:fe::fe#quad9.net
 FallbackDNS=1.1.1.1 2606:4700:4700::1111#cloudflare-dns.com 8.8.8.8 2001:4860:4860::8888#dns.google
 DNSSEC=yes
 DNSOverTLS=yes
+# use interface-specific DNS when available but fall back to global (required for VPN DNS to work)
+Domains=~.
 
 # Enable multicast DNS for .local domain resolution (replaces avahi functionality)
 MulticastDNS=yes
diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml
new file mode 100644
index 00000000..7b1d98b9
--- /dev/null
+++ b/roles/wireguard/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+wireguard_connections: {}
+wireguard_autostart_connection: ""
diff --git a/roles/wireguard/meta/argument_specs.yml b/roles/wireguard/meta/argument_specs.yml
new file mode 100644
index 00000000..68e0e821
--- /dev/null
+++ b/roles/wireguard/meta/argument_specs.yml
@@ -0,0 +1,18 @@
+---
+argument_specs:
+  main:
+    short_description: "Install and configure WireGuard VPN connections"
+    description:
+      - "Installs WireGuard package and tools"
+      - "Deploys WireGuard configuration files from dictionary"
+      - "Optionally auto-starts a specific connection on boot"
+    author: "a14m"
+    options:
+      wireguard_connections:
+        description: "Dictionary of WireGuard connection configurations"
+        type: "dict"
+        default: {}
+      wireguard_autostart_connection:
+        description: "Name of connection to automatically start on boot"
+        type: "str"
+        default: ""
diff --git a/roles/wireguard/meta/main.yml b/roles/wireguard/meta/main.yml
new file mode 100644
index 00000000..22da6ddd
--- /dev/null
+++ b/roles/wireguard/meta/main.yml
@@ -0,0 +1,19 @@
+---
+dependencies: []
+
+galaxy_info:
+  author: "a14m"
+  description: "Install and configure WireGuard VPN connections"
+  company: "kartoffeln.work GmbH."
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
new file mode 100644
index 00000000..45011ea1
--- /dev/null
+++ b/roles/wireguard/tasks/main.yml
@@ -0,0 +1,54 @@
+---
+- name: "Include OS-specific variables"
+  ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
+
+- name: "Ensure wireguard is installed"
+  become: true
+  ansible.builtin.package:
+    name: "{{ wireguard_pkgs }}"
+    state: "present"
+
+- name: "Create wireguard configuration directory"
+  become: true
+  ansible.builtin.file:
+    path: "/etc/wireguard"
+    state: "directory"
+    owner: "root"
+    group: "root"
+    mode: "0700"
+
+- name: "Deploy WireGuard configurations"
+  become: true
+  ansible.builtin.copy:
+    content: "{{ wireguard_connections[item] }}"
+    dest: "/etc/wireguard/{{ item }}.conf"
+    owner: "root"
+    group: "root"
+    mode: "0600"
+    backup: true
+  with_items: "{{ wireguard_connections }}"
+  when: wireguard_connections | length > 0
+
+- name: "Configure autostart connection"
+  become: true
+  block:
+    - name: "Ensure all wireguard connections are stopped"
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ item }}"
+        enabled: false
+        state: "stopped"
+      with_items: "{{ wireguard_connections.keys() | list }}"
+
+    - name: "Ensure all wireguard interfaces are down"
+      ansible.builtin.command:
+        cmd: "wg-quick down {{ item }}"
+      with_items: "{{ wireguard_connections.keys() | list }}"
+      changed_when: true
+      failed_when: false
+
+    - name: "Enable and start wg-quick service for connection {{ wireguard_autostart_connection }}"
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ wireguard_autostart_connection }}"
+        enabled: true
+        state: "started"
+      when: wireguard_autostart_connection != ""
diff --git a/roles/wireguard/vars/archlinux.yml b/roles/wireguard/vars/archlinux.yml
new file mode 100644
index 00000000..9afa94e4
--- /dev/null
+++ b/roles/wireguard/vars/archlinux.yml
@@ -0,0 +1,4 @@
+---
+wireguard_pkgs:
+  - "wireguard-tools"
+  - "systemd-resolvconf"
diff --git a/roles/wireguard/vars/debian.yml b/roles/wireguard/vars/debian.yml
new file mode 100644
index 00000000..f9c5f5f7
--- /dev/null
+++ b/roles/wireguard/vars/debian.yml
@@ -0,0 +1,4 @@
+---
+wireguard_pkgs:
+  - "wireguard"
+  - "resolvconf"