blob: dc24f8921091f399f8a6f814a0878a46023848f9 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
---
- name: "Create wg-portal group"
become: true
ansible.builtin.group:
name: "wg-portal"
system: true
- name: "Create wg-portal user"
become: true
ansible.builtin.user:
name: "wg-portal"
group: "wg-portal"
system: true
shell: "/usr/sbin/nologin"
create_home: false
- name: "Check if wg-portal is already installed"
become: true
ansible.builtin.stat:
path: "/etc/wg-portal/wg-portal"
register: wg_portal_binary_check
- name: "Create wg-portal directories"
become: true
ansible.builtin.file:
path: "/etc/wg-portal"
state: "directory"
owner: "root"
group: "wg-portal"
mode: "0750"
- name: "Install wg-portal"
become: true
when: not wg_portal_binary_check.stat.exists
block:
- name: "Download wg-portal installer"
ansible.builtin.get_url:
url: "https://git.sr.ht/~a14m/wg-portal/blob/main/deployment/install.sh"
dest: "/tmp/install_wg-portal.sh"
mode: "0755"
- name: "Run wg-portal installer"
ansible.builtin.command:
cmd: "/tmp/install_wg-portal.sh {{ wg_portal_version }}"
args:
creates: "/etc/wg-portal/wg-portal"
- name: "Set ACL for wg-portal group on /etc/wireguard"
become: true
ansible.posix.acl:
path: "/etc/wireguard"
entity: "wg-portal"
etype: "group"
permissions: "rx"
recursive: true
default: true
state: "present"
- name: "Set ACL mask for /etc/wireguard"
become: true
ansible.posix.acl:
path: "/etc/wireguard"
etype: "mask"
permissions: "rx"
recursive: true
default: true
state: "present"
- name: "Create wg-portal sudoers file"
become: true
ansible.builtin.copy:
content: |
%wg-portal ALL=(ALL) NOPASSWD: /usr/bin/wg-quick up *, /usr/bin/wg-quick down *
%wg-portal ALL=(ALL) NOPASSWD: /usr/bin/wg show
dest: "/etc/sudoers.d/wg-portal"
mode: "0440"
validate: "visudo -cf %s"
- name: "Create wg-portal configuration file"
become: true
ansible.builtin.template:
src: "config.yml.j2"
dest: "/etc/wg-portal/config.yml"
owner: "root"
group: "wg-portal"
mode: "0640"
notify: "Restart wg-portal"
no_log: true
- name: "Start and enable wg-portal"
become: true
ansible.builtin.systemd_service:
name: "wg-portal"
state: "started"
enabled: true
- name: "Create wg-portal nginx vhost configuration"
become: true
when: proxy_type == "nginx" and wg_portal_hostname | length > 0
ansible.builtin.template:
src: "wg_portal.nginx.conf.j2"
dest: "/etc/nginx/vhosts.d/wg-portal.conf"
owner: "root"
group: "root"
mode: "0644"
backup: true
validate: >
bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
notify: "Restart proxy"
- name: "Create wg-portal caddy configuration"
become: true
when: proxy_type == "caddy" and wg_portal_hostname | length > 0
ansible.builtin.template:
src: "wg_portal.caddy.j2"
dest: "/etc/caddy/sites/wg-portal.caddy"
owner: "root"
group: "caddy"
mode: "0640"
notify: "Restart proxy"
|
