summaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
authorEgor Tensin <egor@tensin.name>2026-10-23 13:52:24 +0300
committerEgor Tensin <egor@tensin.name>2026-10-23 13:52:24 +0300
commit9a81377c28a0e3f3d171c1b45b0ade1d0e895c98 (patch)
treea737e48c6fae684c19d6ec6b262e1e1e8194d7d8
parentwireguard: update README (diff)
downloadinfra-ansible-9a81377c28a0e3f3d171c1b45b0ade1d0e895c98.tar.gz
infra-ansible-9a81377c28a0e3f3d171c1b45b0ade1d0e895c98.zip
wireguard: linting: proper variable prefix
-rw-r--r--roles/wireguard/defaults/main.yml22
-rw-r--r--roles/wireguard/meta/main.yml2
-rw-r--r--roles/wireguard/tasks/NetworkManager.yml10
-rw-r--r--roles/wireguard/tasks/main.yml8
-rw-r--r--roles/wireguard/tasks/wg-quick.yml20
-rw-r--r--roles/wireguard/templates/NetworkManager.nmconnection.j222
-rw-r--r--roles/wireguard/templates/depend_service_wg-quick.conf.j22
-rw-r--r--roles/wireguard/templates/wg-quick.conf.j232
8 files changed, 59 insertions, 59 deletions
diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml
index 0bedef7..accda23 100644
--- a/roles/wireguard/defaults/main.yml
+++ b/roles/wireguard/defaults/main.yml
@@ -1,16 +1,16 @@
# Must be one of wg-quick, NetworkManager
-wg_backend: wg-quick
+wireguard_backend: wg-quick
-wg_name: wg0
-wg_listen_port: 51280
-#wg_private_key:
-#wg_addr4:
-#wg_addr6:
-#wg_peers:
-wg_server: false
+wireguard_name: wg0
+wireguard_listen_port: 51280
+#wireguard_private_key:
+#wireguard_addr4:
+#wireguard_addr6:
+#wireguard_peers:
+wireguard_server: false
-wg_autoconnect: false
+wireguard_autoconnect: false
-wg_tunnel_everything: false
+wireguard_tunnel_everything: false
-wg_dependent_services: []
+wireguard_dependent_services: []
diff --git a/roles/wireguard/meta/main.yml b/roles/wireguard/meta/main.yml
index 1631ace..a7cb961 100644
--- a/roles/wireguard/meta/main.yml
+++ b/roles/wireguard/meta/main.yml
@@ -1,3 +1,3 @@
dependencies:
- role: router
- when: wg_server
+ when: wireguard_server
diff --git a/roles/wireguard/tasks/NetworkManager.yml b/roles/wireguard/tasks/NetworkManager.yml
index 30942a3..6259fec 100644
--- a/roles/wireguard/tasks/NetworkManager.yml
+++ b/roles/wireguard/tasks/NetworkManager.yml
@@ -2,7 +2,7 @@
become: true
ansible.builtin.template:
src: NetworkManager.nmconnection.j2
- dest: '/etc/NetworkManager/system-connections/{{ wg_name }}.nmconnection'
+ dest: '/etc/NetworkManager/system-connections/{{ wireguard_name }}.nmconnection'
owner: root
group: root
mode: '600'
@@ -18,8 +18,8 @@
ansible.builtin.include_role:
name: systemd_depend_iface
vars:
- systemd_depend_iface_name: '{{ wg_name }}'
- systemd_depend_iface_services: '{{ wg_dependent_services }}'
+ systemd_depend_iface_name: '{{ wireguard_name }}'
+ systemd_depend_iface_services: '{{ wireguard_dependent_services }}'
- name: Create override directory for services
become: true
@@ -29,7 +29,7 @@
owner: root
group: root
mode: '755'
- loop: '{{ wg_dependent_services }}'
+ loop: '{{ wireguard_dependent_services }}'
loop_control:
loop_var: service
@@ -42,7 +42,7 @@
group: root
mode: '644'
notify: wireguard_reload
- loop: '{{ wg_dependent_services }}'
+ loop: '{{ wireguard_dependent_services }}'
loop_control:
loop_var: service
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
index e6d2ab4..cc0121a 100644
--- a/roles/wireguard/tasks/main.yml
+++ b/roles/wireguard/tasks/main.yml
@@ -1,9 +1,9 @@
- name: Validate backend
ansible.builtin.fail:
msg: |
- Unknown Wireguard backend: {{ wg_backend }}
+ Unknown Wireguard backend: {{ wireguard_backend }}
when: |
- wg_backend not in ['wg-quick', 'NetworkManager']
+ wireguard_backend not in ['wg-quick', 'NetworkManager']
-- name: 'Set up using backend {{ wg_backend }}'
- ansible.builtin.include_tasks: '{{ wg_backend }}.yml'
+- name: 'Set up using backend {{ wireguard_backend }}'
+ ansible.builtin.include_tasks: '{{ wireguard_backend }}.yml'
diff --git a/roles/wireguard/tasks/wg-quick.yml b/roles/wireguard/tasks/wg-quick.yml
index 68df72a..c7f9a24 100644
--- a/roles/wireguard/tasks/wg-quick.yml
+++ b/roles/wireguard/tasks/wg-quick.yml
@@ -8,7 +8,7 @@
become: true
ansible.builtin.template:
src: wg-quick.conf.j2
- dest: '/etc/wireguard/{{ wg_name }}.conf'
+ dest: '/etc/wireguard/{{ wireguard_name }}.conf'
owner: root
group: root
mode: '600'
@@ -17,23 +17,23 @@
- name: Enable wg-quick service
become: true
ansible.builtin.systemd_service:
- name: 'wg-quick@{{ wg_name }}'
- enabled: '{{ wg_autoconnect }}'
+ name: 'wg-quick@{{ wireguard_name }}'
+ enabled: '{{ wireguard_autoconnect }}'
when: wireguard_config.changed
- name: Restart wg-quick service
become: true
ansible.builtin.systemd_service:
- name: 'wg-quick@{{ wg_name }}'
+ name: 'wg-quick@{{ wireguard_name }}'
state: restarted
- when: wireguard_config.changed and wg_autoconnect
+ when: wireguard_config.changed and wireguard_autoconnect
- name: Set up service dependencies for the interface
ansible.builtin.include_role:
name: systemd_depend_iface
vars:
- systemd_depend_iface_name: '{{ wg_name }}'
- systemd_depend_iface_services: '{{ wg_dependent_services }}'
+ systemd_depend_iface_name: '{{ wireguard_name }}'
+ systemd_depend_iface_services: '{{ wireguard_dependent_services }}'
- name: Create override directory for services
become: true
@@ -43,7 +43,7 @@
owner: root
group: root
mode: '755'
- loop: '{{ wg_dependent_services }}'
+ loop: '{{ wireguard_dependent_services }}'
loop_control:
loop_var: service
@@ -51,12 +51,12 @@
become: true
ansible.builtin.template:
src: depend_service_wg-quick.conf.j2
- dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_wg-quick@{{ wg_name }}.conf'
+ dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_wg-quick@{{ wireguard_name }}.conf'
owner: root
group: root
mode: '644'
notify: wireguard_reload
- loop: '{{ wg_dependent_services }}'
+ loop: '{{ wireguard_dependent_services }}'
loop_control:
loop_var: service
diff --git a/roles/wireguard/templates/NetworkManager.nmconnection.j2 b/roles/wireguard/templates/NetworkManager.nmconnection.j2
index 49b44ec..95e3226 100644
--- a/roles/wireguard/templates/NetworkManager.nmconnection.j2
+++ b/roles/wireguard/templates/NetworkManager.nmconnection.j2
@@ -1,17 +1,17 @@
{{ ansible_managed | comment }}
[connection]
-id={{ wg_name }}
+id={{ wireguard_name }}
type=wireguard
-interface-name={{ wg_name }}
-autoconnect={{ wg_autoconnect | ternary('true', 'false') }}
+interface-name={{ wireguard_name }}
+autoconnect={{ wireguard_autoconnect | ternary('true', 'false') }}
[wireguard]
-private-key={{ wg_private_key }}
+private-key={{ wireguard_private_key }}
private-key-flags=0
-{% if wg_peers is defined %}
-{% for peer in wg_peers %}
+{% if wireguard_peers is defined %}
+{% for peer in wireguard_peers %}
[wireguard-peer.{{ peer.public_key }}]
{% if peer.endpoint is defined %}
endpoint={{ peer.endpoint }}
@@ -20,7 +20,7 @@ endpoint={{ peer.endpoint }}
preshared-key={{ peer.preshared_key }}
preshared-key-flags=0
{% endif %}
-{% if wg_tunnel_everything %}
+{% if wireguard_tunnel_everything %}
allowed-ips=0.0.0.0/0;::/0;
{% elif peer.allowed_ips is defined %}
allowed-ips={{ (peer.allowed_ips | join(';')) + ';' }}
@@ -32,9 +32,9 @@ persistent-keepalive=25
{% endif %}
[ipv4]
-address1={{ wg_addr4 }}
+address1={{ wireguard_addr4 }}
method=manual
-{% if wg_tunnel_everything %}
+{% if wireguard_tunnel_everything %}
dns=1.1.1.1;1.0.0.1;
dns-priority=-10
dns-search=~;
@@ -42,9 +42,9 @@ dns-search=~;
[ipv6]
addr-gen-mode=stable-privacy
-address1={{ wg_addr6 }}
+address1={{ wireguard_addr6 }}
method=manual
-{% if wg_tunnel_everything %}
+{% if wireguard_tunnel_everything %}
dns=2606:4700:4700::1111;2606:4700:4700::1001;
dns-priority=-10
dns-search=~;
diff --git a/roles/wireguard/templates/depend_service_wg-quick.conf.j2 b/roles/wireguard/templates/depend_service_wg-quick.conf.j2
index b40e6eb..c9543d0 100644
--- a/roles/wireguard/templates/depend_service_wg-quick.conf.j2
+++ b/roles/wireguard/templates/depend_service_wg-quick.conf.j2
@@ -4,4 +4,4 @@
# This is required so that systemd actually starts the wg-quick service before
# the dependants. We also set up the actual dependency on the interface so that
# the dependants actually start after the interface is up.
-After=wg-quick@{{ wg_name }}.service
+After=wg-quick@{{ wireguard_name }}.service
diff --git a/roles/wireguard/templates/wg-quick.conf.j2 b/roles/wireguard/templates/wg-quick.conf.j2
index d2d1b69..f9304c8 100644
--- a/roles/wireguard/templates/wg-quick.conf.j2
+++ b/roles/wireguard/templates/wg-quick.conf.j2
@@ -1,34 +1,34 @@
{{ ansible_managed | comment }}
[Interface]
-PrivateKey = {{ wg_private_key }}
-Address = {{ wg_addr4 }}, {{ wg_addr6 }}
-ListenPort = {{ wg_listen_port }}
+PrivateKey = {{ wireguard_private_key }}
+Address = {{ wireguard_addr4 }}, {{ wireguard_addr6 }}
+ListenPort = {{ wireguard_listen_port }}
SaveConfig = false
-{% if wg_tunnel_everything %}
+{% if wireguard_tunnel_everything %}
DNS = 1.1.1.1, 1.0.0.1, 2606:4700:4700::1111, 2606:4700:4700::1001
{% endif %}
-{% if wg_server %}
-PostUp = iptables -t nat -A POSTROUTING -s {{ wg_addr4 }} -m policy --pol none --dir out -j MASQUERADE
-PostUp = iptables -A FORWARD -s {{ wg_addr4 }} -j ACCEPT
-PostUp = ip6tables -t nat -A POSTROUTING -s {{ wg_addr6 }} -m policy --pol none --dir out -j MASQUERADE
-PostUp = ip6tables -A FORWARD -s {{ wg_addr6 }} -j ACCEPT
-PostDown = iptables -t nat -D POSTROUTING -s {{ wg_addr4 }} -m policy --pol none --dir out -j MASQUERADE
-PostDown = iptables -D FORWARD -s {{ wg_addr4 }} -j ACCEPT
-PostDown = ip6tables -t nat -A POSTROUTING -s {{ wg_addr6 }} -m policy --pol none --dir out -j MASQUERADE
-PostDown = ip6tables -D FORWARD -s {{ wg_addr6 }} -j ACCEPT
+{% if wireguard_server %}
+PostUp = iptables -t nat -A POSTROUTING -s {{ wireguard_addr4 }} -m policy --pol none --dir out -j MASQUERADE
+PostUp = iptables -A FORWARD -s {{ wireguard_addr4 }} -j ACCEPT
+PostUp = ip6tables -t nat -A POSTROUTING -s {{ wireguard_addr6 }} -m policy --pol none --dir out -j MASQUERADE
+PostUp = ip6tables -A FORWARD -s {{ wireguard_addr6 }} -j ACCEPT
+PostDown = iptables -t nat -D POSTROUTING -s {{ wireguard_addr4 }} -m policy --pol none --dir out -j MASQUERADE
+PostDown = iptables -D FORWARD -s {{ wireguard_addr4 }} -j ACCEPT
+PostDown = ip6tables -t nat -A POSTROUTING -s {{ wireguard_addr6 }} -m policy --pol none --dir out -j MASQUERADE
+PostDown = ip6tables -D FORWARD -s {{ wireguard_addr6 }} -j ACCEPT
{% endif %}
-{% if wg_peers is defined %}
-{% for peer in wg_peers %}
+{% if wireguard_peers is defined %}
+{% for peer in wireguard_peers %}
[Peer]
PublicKey = {{ peer.public_key }}
{% if peer.preshared_key is defined %}
PresharedKey = {{ peer.preshared_key }}
{% endif %}
-{% if wg_tunnel_everything %}
+{% if wireguard_tunnel_everything %}
AllowedIPs = 0.0.0.0/0, ::/0
{% elif peer.allowed_ips is defined %}
AllowedIPs = {{ peer.allowed_ips | join(', ') }}