wireguard: support NetworkManager as well

7 files changed, 179 insertions, 57 deletions

diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml
index 10af15c..4511a10 100644
--- a/roles/wireguard/defaults/main.yml
+++ b/roles/wireguard/defaults/main.yml
@@ -1,3 +1,6 @@
+# Must be one of wg-quick, NetworkManager
+wg_backend: wg-quick
+
 wg_name: wg0
 wg_listen_port: 51280
 #wg_private_key:
@@ -6,4 +9,6 @@ wg_listen_port: 51280
 #wg_peers:
 wg_router: false
 
+wg_autoconnect: true
+
 wg_dependent_services: []
diff --git a/roles/wireguard/tasks/NetworkManager.yml b/roles/wireguard/tasks/NetworkManager.yml
new file mode 100644
index 0000000..dd205f3
--- /dev/null
+++ b/roles/wireguard/tasks/NetworkManager.yml
@@ -0,0 +1,49 @@
+- name: Write NetworkManager config file
+  become: true
+  ansible.builtin.template:
+    src: NetworkManager.nmconnection.j2
+    dest: '/etc/NetworkManager/system-connections/{{ wg_name }}.nmconnection'
+    owner: root
+    group: root
+    mode: '600'
+  register: config
+
+- name: Reload NetworkManager connections
+  become: true
+  ansible.builtin.command: nmcli connection reload
+  when: config.changed
+
+- name: Set up service dependencies for the interface
+  ansible.builtin.include_role:
+    name: systemd_depend_iface
+  vars:
+    systemd_depend_iface_name: '{{ wg_name }}'
+    systemd_depend_iface_services: '{{ wg_dependent_services }}'
+
+- name: Create override directory for services
+  become: true
+  ansible.builtin.file:
+    path: '/etc/systemd/system/{{ service }}.service.d'
+    state: directory
+    owner: root
+    group: root
+    mode: '755'
+  loop: '{{ wg_dependent_services }}'
+  loop_control:
+    loop_var: service
+
+- name: Set up service dependencies for wg-quick
+  become: true
+  ansible.builtin.template:
+    src: depend_service_NetworkManager.conf.j2
+    dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_NetworkManager.conf'
+    owner: root
+    group: root
+    mode: '644'
+  notify: wireguard_reload
+  loop: '{{ wg_dependent_services }}'
+  loop_control:
+    loop_var: service
+
+- name: Reload systemd services if necessary
+  ansible.builtin.meta: flush_handlers
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
index f48f8cb..018196a 100644
--- a/roles/wireguard/tasks/main.yml
+++ b/roles/wireguard/tasks/main.yml
@@ -1,58 +1,14 @@
-- name: Set up Wireguard
-  become: true
-  block:
-    - name: Install wireguard-tools
-      ansible.builtin.package:
-        name: wireguard-tools
-        state: present
+- name: Validate backend
+  ansible.builtin.fail:
+    msg: |
+      Unknown Wireguard backend: {{ wg_backend }}
+  when: |
+    wg_backend not in ['wg-quick', 'NetworkManager']
 
-    - name: Write wg-quick config file
-      ansible.builtin.template:
-        src: wg0.conf.j2
-        dest: '/etc/wireguard/{{ wg_name }}.conf'
-        owner: root
-        group: root
-        mode: '600'
-      register: config
+- name: Set up using wg-quick
+  ansible.builtin.include_tasks: wg-quick.yml
+  when: wg_backend == 'wg-quick'
 
-    - name: Restart wg-quick service
-      ansible.builtin.systemd_service:
-        name: 'wg-quick@{{ wg_name }}'
-        enabled: true
-        state: restarted
-      when: config.changed
-
-- name: Set up service dependencies for the interface
-  ansible.builtin.include_role:
-    name: systemd_depend_iface
-  vars:
-    systemd_depend_iface_name: '{{ wg_name }}'
-    systemd_depend_iface_services: '{{ wg_dependent_services }}'
-
-- name: Create override directory for services
-  become: true
-  ansible.builtin.file:
-    path: '/etc/systemd/system/{{ service }}.service.d'
-    state: directory
-    owner: root
-    group: root
-    mode: '755'
-  loop: '{{ wg_dependent_services }}'
-  loop_control:
-    loop_var: service
-
-- name: Set up service dependencies for wg-quick
-  become: true
-  ansible.builtin.template:
-    src: depend_service_wg-quick.conf.j2
-    dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_wg-quick@{{ wg_name }}.conf'
-    owner: root
-    group: root
-    mode: '644'
-  notify: wireguard_reload
-  loop: '{{ wg_dependent_services }}'
-  loop_control:
-    loop_var: service
-
-- name: Reload systemd services if necessary
-  ansible.builtin.meta: flush_handlers
+- name: Set up using NetworkManager
+  ansible.builtin.include_tasks: NetworkManager.yml
+  when: wg_backend == 'NetworkManager'
diff --git a/roles/wireguard/tasks/wg-quick.yml b/roles/wireguard/tasks/wg-quick.yml
new file mode 100644
index 0000000..218cd1a
--- /dev/null
+++ b/roles/wireguard/tasks/wg-quick.yml
@@ -0,0 +1,64 @@
+- name: Install wireguard-tools
+  become: true
+  ansible.builtin.package:
+    name: wireguard-tools
+    state: present
+
+- name: Write wg-quick config file
+  become: true
+  ansible.builtin.template:
+    src: wg-quick.conf.j2
+    dest: '/etc/wireguard/{{ wg_name }}.conf'
+    owner: root
+    group: root
+    mode: '600'
+  register: config
+
+- name: Enable wg-quick service
+  become: true
+  ansible.builtin.systemd_service:
+    name: 'wg-quick@{{ wg_name }}'
+    enabled: '{{ wg_autoconnect }}'
+  when: config.changed
+
+- name: Restart wg-quick service
+  become: true
+  ansible.builtin.systemd_service:
+    name: 'wg-quick@{{ wg_name }}'
+    state: restarted
+  when: config.changed and wg_autoconnect
+
+- name: Set up service dependencies for the interface
+  ansible.builtin.include_role:
+    name: systemd_depend_iface
+  vars:
+    systemd_depend_iface_name: '{{ wg_name }}'
+    systemd_depend_iface_services: '{{ wg_dependent_services }}'
+
+- name: Create override directory for services
+  become: true
+  ansible.builtin.file:
+    path: '/etc/systemd/system/{{ service }}.service.d'
+    state: directory
+    owner: root
+    group: root
+    mode: '755'
+  loop: '{{ wg_dependent_services }}'
+  loop_control:
+    loop_var: service
+
+- name: Set up service dependencies for wg-quick
+  become: true
+  ansible.builtin.template:
+    src: depend_service_wg-quick.conf.j2
+    dest: '/etc/systemd/system/{{ service }}.service.d/depend_service_wg-quick@{{ wg_name }}.conf'
+    owner: root
+    group: root
+    mode: '644'
+  notify: wireguard_reload
+  loop: '{{ wg_dependent_services }}'
+  loop_control:
+    loop_var: service
+
+- name: Reload systemd services if necessary
+  ansible.builtin.meta: flush_handlers
diff --git a/roles/wireguard/templates/NetworkManager.nmconnection.j2 b/roles/wireguard/templates/NetworkManager.nmconnection.j2
new file mode 100644
index 0000000..8564f6f
--- /dev/null
+++ b/roles/wireguard/templates/NetworkManager.nmconnection.j2
@@ -0,0 +1,39 @@
+{{ ansible_managed | comment }}
+
+[connection]
+id={{ wg_name }}
+type=wireguard
+interface-name={{ wg_name }}
+autoconnect={{ wg_autoconnect | ternary('true', 'false') }}
+
+[wireguard]
+private-key={{ wg_private_key }}
+private-key-flags=0
+
+{% if wg_peers is defined %}
+{% for peer in wg_peers %}
+[wireguard-peer.{{ peer.public_key }}]
+{% if peer.endpoint is defined %}
+endpoint={{ peer.endpoint }}
+{% endif %}
+{% if peer.preshared_key is defined %}
+preshared-key={{ peer.preshared_key }}
+preshared-key-flags=0
+{% endif %}
+{% if peer.allowed_ips is defined %}
+allowed-ips={{ (peer.allowed_ips | join(';')) + ';' }}
+{% endif %}
+{% if peer.persistent_keepalive is defined and peer.persistent_keepalive %}
+persistent-keepalive=25
+{% endif %}
+{% endfor %}
+{% endif %}
+
+[ipv4]
+address1={{ wg_addr4 }}
+method=manual
+
+[ipv6]
+addr-gen-mode=stable-privacy
+address1={{ wg_addr6 }}
+method=manual
diff --git a/roles/wireguard/templates/depend_service_wg-NetworkManager.conf.j2 b/roles/wireguard/templates/depend_service_wg-NetworkManager.conf.j2
new file mode 100644
index 0000000..aded1ac
--- /dev/null
+++ b/roles/wireguard/templates/depend_service_wg-NetworkManager.conf.j2
@@ -0,0 +1,7 @@
+{{ ansible_managed | comment }}
+
+[Unit]
+# This is required so that systemd actually starts the NetworkManager service
+# before the dependants. We also set up the actual dependency on the interface
+# so that the dependants actually start after the interface is up.
+After=NetworkManager.service
diff --git a/roles/wireguard/templates/wg0.conf.j2 b/roles/wireguard/templates/wg-quick.conf.j2
index 7dae2ff..bdfdce1 100644
--- a/roles/wireguard/templates/wg0.conf.j2
+++ b/roles/wireguard/templates/wg-quick.conf.j2
@@ -24,7 +24,9 @@ PublicKey = {{ peer.public_key }}
 {% if peer.preshared_key is defined %}
 PresharedKey = {{ peer.preshared_key }}
 {% endif %}
-AllowedIPs = {{ peer.allowed_ips }}
+{% if peer.allowed_ips is defined %}
+AllowedIPs = {{ peer.allowed_ips | join(', ') }}
+{% endif %}
 {% if peer.endpoint is defined %}
 Endpoint = {{ peer.endpoint }}
 {% endif %}