blob: 3e5543b387ebca7f4a220f326d4a5f1723109521 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
---
- name: "Include OS-specific variables"
ansible.builtin.include_vars: "{{ ansible_facts['os_family'] | lower }}.yml"
- name: "Ensure wireguard is installed"
become: true
ansible.builtin.package:
name: "{{ wireguard_packages }}"
state: "present"
- name: "Find existing WireGuard connections"
become: true
ansible.builtin.shell: |
set -euo pipefail
ls /etc/wireguard/wg-*.conf | xargs -n1 basename | sed 's/^wg-//;s/\.conf$//'
args:
executable: /bin/bash
register: wireguard_existing_connections
changed_when: false
failed_when: false
- name: "Remove extra WireGuard connections"
become: true
ansible.builtin.file:
path: "/etc/wireguard/wg-{{ item }}.conf"
state: "absent"
loop: "{{ wireguard_existing_connections.stdout_lines }}"
when:
- wireguard_existing_connections.stdout_lines is defined
- wireguard_existing_connections.stdout_lines | length > 0
- item not in wireguard_connections.keys()
- name: "Deploy WireGuard connections"
become: true
ansible.builtin.copy:
content: "{{ wireguard_connections[item] }}"
dest: "/etc/wireguard/wg-{{ item }}.conf"
owner: "root"
group: "root"
mode: "0600"
loop: "{{ wireguard_connections.keys() }}"
when: wireguard_connections | length > 0
tags:
# The reason the test is ignored is the following:
# 1st run: wireguard role deploys all the configured VPN connections
# 1st run: wg_portal updates the (ACL) file permissions /etc/wireguard
# 2nd run: wireguard sees the file changed, deploys again (changed)
- molecule-idempotence-notest
- name: "Ensure all wireguard interfaces are disabled on startup"
become: true
ansible.builtin.systemd_service:
name: "wg-quick@wg-{{ item }}"
enabled: false
state: "stopped"
when: wireguard_autostart_connection == ""
loop: "{{ wireguard_connections.keys() | list }}"
- name: "Configure autostart connection"
become: true
when: wireguard_autostart_connection != ""
block:
- name: "Validate wireguard_autostart_connection"
ansible.builtin.assert:
that:
- wireguard_autostart_connection in wireguard_connections.keys()
fail_msg: "wireguard_autostart_connection '{{ wireguard_autostart_connection }}'
is not defined in wireguard_connections"
- name: "Ensure all wireguard interfaces are down"
ansible.builtin.command:
cmd: "wg-quick down wg-{{ item }}"
loop: "{{ wireguard_connections.keys() | list }}"
changed_when: false
failed_when: false
- name: "Enable and start wg-quick service for connection {{ wireguard_autostart_connection }}"
ansible.builtin.systemd_service:
name: "wg-quick@wg-{{ wireguard_autostart_connection }}"
enabled: true
state: "started"
|
