From a5983fd890fc94650e9cc0b890220931ad3b3a88 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Wed, 10 Sep 2025 17:09:53 +0200
Subject: Add wg_portal role to install vpn web interface manager

---
 roles/wg_portal/defaults/main.yml       |  4 +++
 roles/wg_portal/handlers/main.yml       |  6 ++++
 roles/wg_portal/tasks/main.yml          | 56 +++++++++++++++++++++++++++++++++
 roles/wg_portal/templates/config.yml.j2 |  4 +++
 4 files changed, 70 insertions(+)
 create mode 100644 roles/wg_portal/defaults/main.yml
 create mode 100644 roles/wg_portal/handlers/main.yml
 create mode 100644 roles/wg_portal/tasks/main.yml
 create mode 100644 roles/wg_portal/templates/config.yml.j2

(limited to 'roles')

diff --git a/roles/wg_portal/defaults/main.yml b/roles/wg_portal/defaults/main.yml
new file mode 100644
index 00000000..7cf7d861
--- /dev/null
+++ b/roles/wg_portal/defaults/main.yml
@@ -0,0 +1,4 @@
+---
+wg_portal_version: "latest"
+wg_portal_port: "8080"
+wg_portal_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}"
diff --git a/roles/wg_portal/handlers/main.yml b/roles/wg_portal/handlers/main.yml
new file mode 100644
index 00000000..86148648
--- /dev/null
+++ b/roles/wg_portal/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+- name: "Restart wg-portal"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "wg-portal.service"
+    state: "restarted"
diff --git a/roles/wg_portal/tasks/main.yml b/roles/wg_portal/tasks/main.yml
new file mode 100644
index 00000000..87c234e1
--- /dev/null
+++ b/roles/wg_portal/tasks/main.yml
@@ -0,0 +1,56 @@
+---
+- name: "Ensure wg-portal dependencies are installed"
+  become: true
+  ansible.builtin.package:
+    name:
+      - curl
+      - sudo
+      - acl
+
+- name: "Create wg-portal user"
+  become: true
+  ansible.builtin.user:
+    name: "wg-portal"
+    system: true
+    shell: "/usr/sbin/nologin"
+
+- name: "Check if wg-portal is already installed"
+  become: true
+  ansible.builtin.stat:
+    path: "/etc/wg-portal/wg-portal"
+  register: wg_portal_binary_check
+
+- name: "Create wg-portal directories"
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: "directory"
+    owner: "root"
+    group: "wg-portal"
+    mode: "0755"
+  with_items:
+    - "/etc/wg-portal"
+
+- name: "Install wg-portal"
+  become: true
+  when: not wg_portal_binary_check.stat.exists
+  block:
+    - name: "Download wg-portal installer"
+      ansible.builtin.get_url:
+        url: "https://git.sr.ht/~a14m/wg-portal/blob/main/deployment/install.sh"
+        dest: "/tmp/install_wg-portal.sh"
+        mode: "0755"
+
+    - name: "Run wg-portal installer"
+      ansible.builtin.command:
+        cmd: "/tmp/install_wg-portal.sh {{ wg_portal_version }}"
+      args:
+        creates: "/etc/wg-portal/wg-portal"
+
+- name: "Create wg-portal configuration file"
+  become: true
+  ansible.builtin.template:
+    src: "config.yml.j2"
+    dest: "/etc/wg-portal/config.yml"
+    mode: "0644"
+  notify: "Restart wg-portal"
diff --git a/roles/wg_portal/templates/config.yml.j2 b/roles/wg_portal/templates/config.yml.j2
new file mode 100644
index 00000000..cbab462e
--- /dev/null
+++ b/roles/wg_portal/templates/config.yml.j2
@@ -0,0 +1,4 @@
+---
+host: "0.0.0.0"
+port: "{{ wg_portal_port }}"
+password_hash: "{{ wg_portal_password }}"
-- 
cgit v1.2.3