From b8be9cf4e3203490f73835c04c9b97814a61a3d6 Mon Sep 17 00:00:00 2001
From: Ahmed AbdelHalim <pm@a14m.me>
Date: Wed, 20 Aug 2025 23:37:21 +0200
Subject: Add wireguard role and fix testing

The testing was failing because the use of the example files with the
same domain names, resulted in the files and the molecule variable were
being merged and therefore running tasks that would fail on test
(example, setting a fake VPN connection that wouldn't start).
---
 roles/network/templates/resolved.conf.j2 |  2 ++
 roles/wireguard/defaults/main.yml        |  3 ++
 roles/wireguard/meta/argument_specs.yml  | 18 +++++++++++
 roles/wireguard/meta/main.yml            | 19 +++++++++++
 roles/wireguard/tasks/main.yml           | 54 ++++++++++++++++++++++++++++++++
 roles/wireguard/vars/archlinux.yml       |  4 +++
 roles/wireguard/vars/debian.yml          |  4 +++
 7 files changed, 104 insertions(+)
 create mode 100644 roles/wireguard/defaults/main.yml
 create mode 100644 roles/wireguard/meta/argument_specs.yml
 create mode 100644 roles/wireguard/meta/main.yml
 create mode 100644 roles/wireguard/tasks/main.yml
 create mode 100644 roles/wireguard/vars/archlinux.yml
 create mode 100644 roles/wireguard/vars/debian.yml

(limited to 'roles')

diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2
index c94e9c1a..c083a214 100644
--- a/roles/network/templates/resolved.conf.j2
+++ b/roles/network/templates/resolved.conf.j2
@@ -3,6 +3,8 @@ DNS=9.9.9.9 2620:fe::fe#quad9.net
 FallbackDNS=1.1.1.1 2606:4700:4700::1111#cloudflare-dns.com 8.8.8.8 2001:4860:4860::8888#dns.google
 DNSSEC=yes
 DNSOverTLS=yes
+# use interface-specific DNS when available but fall back to global (required for VPN DNS to work)
+Domains=~.
 
 # Enable multicast DNS for .local domain resolution (replaces avahi functionality)
 MulticastDNS=yes
diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml
new file mode 100644
index 00000000..7b1d98b9
--- /dev/null
+++ b/roles/wireguard/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+wireguard_connections: {}
+wireguard_autostart_connection: ""
diff --git a/roles/wireguard/meta/argument_specs.yml b/roles/wireguard/meta/argument_specs.yml
new file mode 100644
index 00000000..68e0e821
--- /dev/null
+++ b/roles/wireguard/meta/argument_specs.yml
@@ -0,0 +1,18 @@
+---
+argument_specs:
+  main:
+    short_description: "Install and configure WireGuard VPN connections"
+    description:
+      - "Installs WireGuard package and tools"
+      - "Deploys WireGuard configuration files from dictionary"
+      - "Optionally auto-starts a specific connection on boot"
+    author: "a14m"
+    options:
+      wireguard_connections:
+        description: "Dictionary of WireGuard connection configurations"
+        type: "dict"
+        default: {}
+      wireguard_autostart_connection:
+        description: "Name of connection to automatically start on boot"
+        type: "str"
+        default: ""
diff --git a/roles/wireguard/meta/main.yml b/roles/wireguard/meta/main.yml
new file mode 100644
index 00000000..22da6ddd
--- /dev/null
+++ b/roles/wireguard/meta/main.yml
@@ -0,0 +1,19 @@
+---
+dependencies: []
+
+galaxy_info:
+  author: "a14m"
+  description: "Install and configure WireGuard VPN connections"
+  company: "kartoffeln.work GmbH."
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
new file mode 100644
index 00000000..45011ea1
--- /dev/null
+++ b/roles/wireguard/tasks/main.yml
@@ -0,0 +1,54 @@
+---
+- name: "Include OS-specific variables"
+  ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
+
+- name: "Ensure wireguard is installed"
+  become: true
+  ansible.builtin.package:
+    name: "{{ wireguard_pkgs }}"
+    state: "present"
+
+- name: "Create wireguard configuration directory"
+  become: true
+  ansible.builtin.file:
+    path: "/etc/wireguard"
+    state: "directory"
+    owner: "root"
+    group: "root"
+    mode: "0700"
+
+- name: "Deploy WireGuard configurations"
+  become: true
+  ansible.builtin.copy:
+    content: "{{ wireguard_connections[item] }}"
+    dest: "/etc/wireguard/{{ item }}.conf"
+    owner: "root"
+    group: "root"
+    mode: "0600"
+    backup: true
+  with_items: "{{ wireguard_connections }}"
+  when: wireguard_connections | length > 0
+
+- name: "Configure autostart connection"
+  become: true
+  block:
+    - name: "Ensure all wireguard connections are stopped"
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ item }}"
+        enabled: false
+        state: "stopped"
+      with_items: "{{ wireguard_connections.keys() | list }}"
+
+    - name: "Ensure all wireguard interfaces are down"
+      ansible.builtin.command:
+        cmd: "wg-quick down {{ item }}"
+      with_items: "{{ wireguard_connections.keys() | list }}"
+      changed_when: true
+      failed_when: false
+
+    - name: "Enable and start wg-quick service for connection {{ wireguard_autostart_connection }}"
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ wireguard_autostart_connection }}"
+        enabled: true
+        state: "started"
+      when: wireguard_autostart_connection != ""
diff --git a/roles/wireguard/vars/archlinux.yml b/roles/wireguard/vars/archlinux.yml
new file mode 100644
index 00000000..9afa94e4
--- /dev/null
+++ b/roles/wireguard/vars/archlinux.yml
@@ -0,0 +1,4 @@
+---
+wireguard_pkgs:
+  - "wireguard-tools"
+  - "systemd-resolvconf"
diff --git a/roles/wireguard/vars/debian.yml b/roles/wireguard/vars/debian.yml
new file mode 100644
index 00000000..f9c5f5f7
--- /dev/null
+++ b/roles/wireguard/vars/debian.yml
@@ -0,0 +1,4 @@
+---
+wireguard_pkgs:
+  - "wireguard"
+  - "resolvconf"
-- 
cgit v1.2.3