134 lines
3.9 KiB
YAML
134 lines
3.9 KiB
YAML
# --------------------------------------------------------
|
|
# WireGuard installieren
|
|
# --------------------------------------------------------
|
|
|
|
- name: Stelle sicher, dass WireGuard installiert ist
|
|
apt:
|
|
name: wireguard
|
|
state: present
|
|
update_cache: yes
|
|
become: true
|
|
when: ansible_connection != "local"
|
|
|
|
# --------------------------------------------------------
|
|
# Server-Schlüssel erzeugen und speichern
|
|
# --------------------------------------------------------
|
|
|
|
- name: Prüfe ob privater Server-Schlüssel existiert
|
|
stat:
|
|
path: /etc/wireguard/privatekey
|
|
register: privkey_file
|
|
become: true
|
|
when: ansible_connection != "local"
|
|
|
|
- name: Erstelle Schlüsselpaar für Server (wenn nicht vorhanden)
|
|
command: wg genkey
|
|
register: server_private_key
|
|
when: ansible_connection != "local" and (not privkey_file.stat.exists | default(true))
|
|
|
|
- name: Speichere privaten Schlüssel
|
|
copy:
|
|
content: "{{ server_private_key.stdout }}"
|
|
dest: /etc/wireguard/privatekey
|
|
mode: "0600"
|
|
when: server_private_key.stdout is defined and server_private_key.stdout is defined
|
|
|
|
- name: Lies privaten Schlüssel ein
|
|
slurp:
|
|
src: /etc/wireguard/privatekey
|
|
become: true
|
|
when: ansible_connection != "local"
|
|
|
|
- name: Erzeuge öffentlichen Server-Schlüssel
|
|
command: "echo '{{ wg_privkey }}' | wg pubkey"
|
|
register: wg_pubkey
|
|
when: ansible_connection != "local"
|
|
|
|
- name: Privaten Server-Schlüssel anzeigen
|
|
debug:
|
|
msg: "{{ server_private_key }}"
|
|
when: ansible_connection != "local"
|
|
|
|
# --------------------------------------------------------
|
|
# Client-Key-Erzeugung lokal (einmalig pro Client)
|
|
# --------------------------------------------------------
|
|
|
|
- name: Generiere privaten Schlüssel für Clients (auf dem Server)
|
|
command: wg genkey
|
|
args:
|
|
creates: "/etc/wireguard/client-{{ item.name }}.key"
|
|
loop: "{{ wireguard_clients }}"
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
register: client_private_keys
|
|
when: ansible_connection != "local"
|
|
|
|
|
|
- name: Erzeuge öffentlichen Schlüssel für Clients
|
|
command: "echo '{{ client_privkey_result.stdout }}' | wg pubkey"
|
|
register: client_pubkey_result
|
|
when:
|
|
- ansible_connection != "local"
|
|
- client_privkey_result is defined
|
|
- client_privkey_result.stdout is defined
|
|
|
|
- name: wireguard_clients mit public_key anreichern
|
|
set_fact:
|
|
wireguard_clients: "{{ wireguard_clients_with_pubkey | default([]) + [ item.0 | combine({'public_key': item.1.stdout|trim }) ] }}"
|
|
loop: "{{ wireguard_clients | zip(client_public_keys.results) | list }}"
|
|
when: client_public_keys is defined
|
|
|
|
- name: Aktuelles wireguard_clients-Set überschreiben
|
|
set_fact:
|
|
wireguard_clients: "{{ wireguard_clients_with_pubkey }}"
|
|
when: wireguard_clients_with_pubkey is defined
|
|
|
|
# --------------------------------------------------------
|
|
# Konfigurationsdatei erzeugen
|
|
# --------------------------------------------------------
|
|
|
|
#- debug:
|
|
# var: wireguard_clients
|
|
|
|
- name: Render wg0.conf
|
|
template:
|
|
src: wg0.conf.j2
|
|
dest: /etc/wireguard/wg0.conf
|
|
when: wg_privkey is defined and wg_privkey != ""
|
|
|
|
# --------------------------------------------------------
|
|
# IP Forwarding & WireGuard aktivieren
|
|
# --------------------------------------------------------
|
|
|
|
- name: Aktiviere IP-Forwarding
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: 1
|
|
state: present
|
|
sysctl_set: yes
|
|
reload: yes
|
|
become: true
|
|
when: ansible_connection != "local"
|
|
|
|
- name: Starte und aktiviere WireGuard
|
|
systemd:
|
|
name: wg-quick@wg0
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: yes
|
|
become: true
|
|
when: ansible_connection != "local"
|
|
|
|
- name: Verteilt für jeden Client die Client-Config
|
|
template:
|
|
src: client.conf.j2
|
|
dest: "/etc/wireguard/clients/{{ item.name }}.conf"
|
|
owner: root
|
|
group: root
|
|
mode: 0600
|
|
loop: "{{ wireguard_clients }}"
|
|
#delegate_to: localhost
|
|
run_once: true
|
|
become: true
|
|
when: ansible_connection != "local"
|