Initial commit

roles/wireguard/defaults/main.yml

@@ -0,0 +1,23 @@
+#SPDX-License-Identifier: MIT-0
+---
+wireguard_port: 51820
+wireguard_interface: wg0
+
+# Server private key — store in Ansible Vault in host_vars
+# wireguard_private_key: "YOUR_PRIVATE_KEY"
+
+# Server address in the WireGuard subnet, e.g. "10.0.0.1/24"
+# wireguard_address: "10.0.0.1/24"
+
+# Optional: DNS server pushed to clients
+# wireguard_dns: "1.1.1.1"
+
+# Peers — defined per host in host_vars
+# wireguard_peers:
+#   - name: client1
+#     public_key: "CLIENT_PUBLIC_KEY"
+#     allowed_ips: "10.0.0.2/32"
+#   - name: client2
+#     public_key: "CLIENT_PUBLIC_KEY"
+#     allowed_ips: "10.0.0.3/32"
+wireguard_peers: []

roles/wireguard/handlers/main.yml

@@ -0,0 +1,7 @@
+#SPDX-License-Identifier: MIT-0
+---
+- name: Restart wg0
+  ansible.builtin.systemd:
+    name: wg-quick@wg0
+    state: restarted
+  become: true

roles/wireguard/tasks/main.yml

@@ -0,0 +1,33 @@
+#SPDX-License-Identifier: MIT-0
+---
+- name: Install wireguard-tools
+  ansible.builtin.package:
+    name: wireguard-tools
+    state: present
+  become: true
+
+- name: Ensure /etc/wireguard directory exists
+  ansible.builtin.file:
+    path: /etc/wireguard
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  become: true
+
+- name: Deploy wg0 config
+  ansible.builtin.template:
+    src: wg0.conf.j2
+    dest: /etc/wireguard/wg0.conf
+    owner: root
+    group: root
+    mode: "0600"
+  become: true
+  notify: Restart wg0
+
+- name: Enable and start wg-quick@wg0
+  ansible.builtin.systemd:
+    name: wg-quick@wg0
+    enabled: yes
+    state: started
+  become: true

roles/wireguard/templates/wg0.conf.j2

@@ -0,0 +1,22 @@
+# Managed by Ansible — do not edit manually
+[Interface]
+Address = {{ wireguard_address }}
+ListenPort = {{ wireguard_port }}
+PrivateKey = {{ wireguard_private_key }}
+{% if wireguard_dns is defined %}
+DNS = {{ wireguard_dns }}
+{% endif %}
+
+{% for peer in wireguard_peers %}
+# {{ peer.name }}
+[Peer]
+PublicKey = {{ peer.public_key }}
+AllowedIPs = {{ peer.allowed_ips }}
+{% if peer.preshared_key is defined %}
+PresharedKey = {{ peer.preshared_key }}
+{% endif %}
+{% if peer.keepalive is defined %}
+PersistentKeepalive = {{ peer.keepalive }}
+{% endif %}
+
+{% endfor %}