diff options
| author | Egor Tensin <egor@tensin.name> | 2026-10-23 13:52:24 +0300 |
|---|---|---|
| committer | Egor Tensin <egor@tensin.name> | 2026-10-23 13:52:24 +0300 |
| commit | 9a81377c28a0e3f3d171c1b45b0ade1d0e895c98 (patch) | |
| tree | a737e48c6fae684c19d6ec6b262e1e1e8194d7d8 | |
| parent | wireguard: update README (diff) | |
| download | infra-ansible-9a81377c28a0e3f3d171c1b45b0ade1d0e895c98.tar.gz infra-ansible-9a81377c28a0e3f3d171c1b45b0ade1d0e895c98.zip | |
wireguard: linting: proper variable prefix
| -rw-r--r-- | roles/wireguard/defaults/main.yml | 22 | ||||
| -rw-r--r-- | roles/wireguard/meta/main.yml | 2 | ||||
| -rw-r--r-- | roles/wireguard/tasks/NetworkManager.yml | 10 | ||||
| -rw-r--r-- | roles/wireguard/tasks/main.yml | 8 | ||||
| -rw-r--r-- | roles/wireguard/tasks/wg-quick.yml | 20 | ||||
| -rw-r--r-- | roles/wireguard/templates/NetworkManager.nmconnection.j2 | 22 | ||||
| -rw-r--r-- | roles/wireguard/templates/depend_service_wg-quick.conf.j2 | 2 | ||||
| -rw-r--r-- | roles/wireguard/templates/wg-quick.conf.j2 | 32 |
8 files changed, 59 insertions, 59 deletions
diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml index 0bedef7..accda23 100644 --- a/roles/wireguard/defaults/main.yml +++ b/roles/wireguard/defaults/main.yml @@ -1,16 +1,16 @@ # Must be one of wg-quick, NetworkManager -wg_backend: wg-quick +wireguard_backend: wg-quick -wg_name: wg0 -wg_listen_port: 51280 -#wg_private_key: -#wg_addr4: -#wg_addr6: -#wg_peers: -wg_server: false +wireguard_name: wg0 +wireguard_listen_port: 51280 +#wireguard_private_key: +#wireguard_addr4: +#wireguard_addr6: +#wireguard_peers: +wireguard_server: false -wg_autoconnect: false +wireguard_autoconnect: false -wg_tunnel_everything: false +wireguard_tunnel_everything: false -wg_dependent_services: [] +wireguard_dependent_services: [] diff --git a/roles/wireguard/meta/main.yml b/roles/wireguard/meta/main.yml index 1631ace..a7cb961 100644 --- a/roles/wireguard/meta/main.yml +++ b/roles/wireguard/meta/main.yml @@ -1,3 +1,3 @@ dependencies: - role: router - when: wg_server + when: wireguard_server diff --git a/roles/wireguard/tasks/NetworkManager.yml b/roles/wireguard/tasks/NetworkManager.yml index 30942a3..6259fec 100644 --- a/roles/wireguard/tasks/NetworkManager.yml +++ b/roles/wireguard/tasks/NetworkManager.yml @@ -2,7 +2,7 @@ become: true ansible.builtin.template: src: NetworkManager.nmconnection.j2 - dest: '/etc/NetworkManager/system-connections/{{ wg_name }}.nmconnection' + dest: '/etc/NetworkManager/system-connections/{{ wireguard_name }}.nmconnection' owner: root group: root mode: '600' @@ -18,8 +18,8 @@ ansible.builtin.include_role: name: systemd_depend_iface vars: - systemd_depend_iface_name: '{{ wg_name }}' - systemd_depend_iface_services: '{{ wg_dependent_services }}' + systemd_depend_iface_name: '{{ wireguard_name }}' + systemd_depend_iface_services: '{{ wireguard_dependent_services }}' - name: Create override directory for services become: true @@ -29,7 +29,7 @@ owner: root group: root mode: '755' - loop: '{{ wg_dependent_services }}' + loop: '{{ wireguard_dependent_services }}' loop_control: loop_var: service @@ -42,7 +42,7 @@ group: root mode: '644' notify: wireguard_reload - loop: '{{ wg_dependent_services }}' + loop: '{{ wireguard_dependent_services }}' loop_control: loop_var: service diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml index e6d2ab4..cc0121a 100644 --- a/roles/wireguard/tasks/main.yml +++ b/roles/wireguard/tasks/main.yml @@ -1,9 +1,9 @@ - name: Validate backend ansible.builtin.fail: msg: | - Unknown Wireguard backend: {{ wg_backend }} + Unknown Wireguard backend: {{ wireguard_backend }} when: | - wg_backend not in ['wg-quick', 'NetworkManager'] + wireguard_backend not in ['wg-quick', 'NetworkManager'] -- name: 'Set up using backend {{ wg_backend }}' - ansible.builtin.include_tasks: '{{ wg_backend }}.yml' +- name: 'Set up using backend {{ wireguard_backend }}' + ansible.builtin.include_tasks: '{{ wireguard_backend }}.yml' diff --git a/roles/wireguard/tasks/wg-quick.yml b/roles/wireguard/tasks/wg-quick.yml index 68df72a..c7f9a24 100644 --- a/roles/wireguard/tasks/wg-quick.yml +++ b/roles/wireguard/tasks/wg-quick.yml @@ -8,7 +8,7 @@ become: true ansible.builtin.template: src: wg-quick.conf.j2 - dest: '/etc/wireguard/{{ wg_name }}.conf' + dest: '/etc/wireguard/{{ wireguard_name }}.conf' owner: root group: root mode: '600' @@ -17,23 +17,23 @@ - name: Enable wg-quick service become: true ansible.builtin.systemd_service: - name: 'wg-quick@{{ wg_name }}' - enabled: '{{ wg_autoconnect }}' + name: 'wg-quick@{{ wireguard_name }}' + enabled: '{{ wireguard_autoconnect }}' when: wireguard_config.changed - name: Restart wg-quick service become: true ansible.builtin.systemd_service: - name: 'wg-quick@{{ wg_name }}' + name: 'wg-quick@{{ wireguard_name }}' state: restarted - when: wireguard_config.changed and wg_autoconnect + when: wireguard_config.changed and wireguard_autoconnect - name: Set up service dependencies for the interface ansible.builtin.include_role: name: systemd_depend_iface vars: - systemd_depend_iface_name: '{{ wg_name }}' - systemd_depend_iface_services: '{{ wg_dependent_services }}' + systemd_depend_iface_name: '{{ wireguard_name }}' + systemd_depend_iface_services: '{{ wireguard_dependent_services }}' - name: Create override directory for services become: true @@ -43,7 +43,7 @@ owner: root group: root mode: '755' - loop: '{{ wg_dependent_services }}' + loop: '{{ wireguard_dependent_services }}' loop_control: loop_var: service @@ -51,12 +51,12 @@ become: true ansible.builtin.template: src: depend_service_wg-quick.conf.j2 - dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_wg-quick@{{ wg_name }}.conf' + dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_wg-quick@{{ wireguard_name }}.conf' owner: root group: root mode: '644' notify: wireguard_reload - loop: '{{ wg_dependent_services }}' + loop: '{{ wireguard_dependent_services }}' loop_control: loop_var: service diff --git a/roles/wireguard/templates/NetworkManager.nmconnection.j2 b/roles/wireguard/templates/NetworkManager.nmconnection.j2 index 49b44ec..95e3226 100644 --- a/roles/wireguard/templates/NetworkManager.nmconnection.j2 +++ b/roles/wireguard/templates/NetworkManager.nmconnection.j2 @@ -1,17 +1,17 @@ {{ ansible_managed | comment }} [connection] -id={{ wg_name }} +id={{ wireguard_name }} type=wireguard -interface-name={{ wg_name }} -autoconnect={{ wg_autoconnect | ternary('true', 'false') }} +interface-name={{ wireguard_name }} +autoconnect={{ wireguard_autoconnect | ternary('true', 'false') }} [wireguard] -private-key={{ wg_private_key }} +private-key={{ wireguard_private_key }} private-key-flags=0 -{% if wg_peers is defined %} -{% for peer in wg_peers %} +{% if wireguard_peers is defined %} +{% for peer in wireguard_peers %} [wireguard-peer.{{ peer.public_key }}] {% if peer.endpoint is defined %} endpoint={{ peer.endpoint }} @@ -20,7 +20,7 @@ endpoint={{ peer.endpoint }} preshared-key={{ peer.preshared_key }} preshared-key-flags=0 {% endif %} -{% if wg_tunnel_everything %} +{% if wireguard_tunnel_everything %} allowed-ips=0.0.0.0/0;::/0; {% elif peer.allowed_ips is defined %} allowed-ips={{ (peer.allowed_ips | join(';')) + ';' }} @@ -32,9 +32,9 @@ persistent-keepalive=25 {% endif %} [ipv4] -address1={{ wg_addr4 }} +address1={{ wireguard_addr4 }} method=manual -{% if wg_tunnel_everything %} +{% if wireguard_tunnel_everything %} dns=1.1.1.1;1.0.0.1; dns-priority=-10 dns-search=~; @@ -42,9 +42,9 @@ dns-search=~; [ipv6] addr-gen-mode=stable-privacy -address1={{ wg_addr6 }} +address1={{ wireguard_addr6 }} method=manual -{% if wg_tunnel_everything %} +{% if wireguard_tunnel_everything %} dns=2606:4700:4700::1111;2606:4700:4700::1001; dns-priority=-10 dns-search=~; diff --git a/roles/wireguard/templates/depend_service_wg-quick.conf.j2 b/roles/wireguard/templates/depend_service_wg-quick.conf.j2 index b40e6eb..c9543d0 100644 --- a/roles/wireguard/templates/depend_service_wg-quick.conf.j2 +++ b/roles/wireguard/templates/depend_service_wg-quick.conf.j2 @@ -4,4 +4,4 @@ # This is required so that systemd actually starts the wg-quick service before # the dependants. We also set up the actual dependency on the interface so that # the dependants actually start after the interface is up. -After=wg-quick@{{ wg_name }}.service +After=wg-quick@{{ wireguard_name }}.service diff --git a/roles/wireguard/templates/wg-quick.conf.j2 b/roles/wireguard/templates/wg-quick.conf.j2 index d2d1b69..f9304c8 100644 --- a/roles/wireguard/templates/wg-quick.conf.j2 +++ b/roles/wireguard/templates/wg-quick.conf.j2 @@ -1,34 +1,34 @@ {{ ansible_managed | comment }} [Interface] -PrivateKey = {{ wg_private_key }} -Address = {{ wg_addr4 }}, {{ wg_addr6 }} -ListenPort = {{ wg_listen_port }} +PrivateKey = {{ wireguard_private_key }} +Address = {{ wireguard_addr4 }}, {{ wireguard_addr6 }} +ListenPort = {{ wireguard_listen_port }} SaveConfig = false -{% if wg_tunnel_everything %} +{% if wireguard_tunnel_everything %} DNS = 1.1.1.1, 1.0.0.1, 2606:4700:4700::1111, 2606:4700:4700::1001 {% endif %} -{% if wg_server %} -PostUp = iptables -t nat -A POSTROUTING -s {{ wg_addr4 }} -m policy --pol none --dir out -j MASQUERADE -PostUp = iptables -A FORWARD -s {{ wg_addr4 }} -j ACCEPT -PostUp = ip6tables -t nat -A POSTROUTING -s {{ wg_addr6 }} -m policy --pol none --dir out -j MASQUERADE -PostUp = ip6tables -A FORWARD -s {{ wg_addr6 }} -j ACCEPT -PostDown = iptables -t nat -D POSTROUTING -s {{ wg_addr4 }} -m policy --pol none --dir out -j MASQUERADE -PostDown = iptables -D FORWARD -s {{ wg_addr4 }} -j ACCEPT -PostDown = ip6tables -t nat -A POSTROUTING -s {{ wg_addr6 }} -m policy --pol none --dir out -j MASQUERADE -PostDown = ip6tables -D FORWARD -s {{ wg_addr6 }} -j ACCEPT +{% if wireguard_server %} +PostUp = iptables -t nat -A POSTROUTING -s {{ wireguard_addr4 }} -m policy --pol none --dir out -j MASQUERADE +PostUp = iptables -A FORWARD -s {{ wireguard_addr4 }} -j ACCEPT +PostUp = ip6tables -t nat -A POSTROUTING -s {{ wireguard_addr6 }} -m policy --pol none --dir out -j MASQUERADE +PostUp = ip6tables -A FORWARD -s {{ wireguard_addr6 }} -j ACCEPT +PostDown = iptables -t nat -D POSTROUTING -s {{ wireguard_addr4 }} -m policy --pol none --dir out -j MASQUERADE +PostDown = iptables -D FORWARD -s {{ wireguard_addr4 }} -j ACCEPT +PostDown = ip6tables -t nat -A POSTROUTING -s {{ wireguard_addr6 }} -m policy --pol none --dir out -j MASQUERADE +PostDown = ip6tables -D FORWARD -s {{ wireguard_addr6 }} -j ACCEPT {% endif %} -{% if wg_peers is defined %} -{% for peer in wg_peers %} +{% if wireguard_peers is defined %} +{% for peer in wireguard_peers %} [Peer] PublicKey = {{ peer.public_key }} {% if peer.preshared_key is defined %} PresharedKey = {{ peer.preshared_key }} {% endif %} -{% if wg_tunnel_everything %} +{% if wireguard_tunnel_everything %} AllowedIPs = 0.0.0.0/0, ::/0 {% elif peer.allowed_ips is defined %} AllowedIPs = {{ peer.allowed_ips | join(', ') }} |
