diff --git a/.gitignore b/.gitignore index 496ee2c..5bcca5c 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -.DS_Store \ No newline at end of file +.DS_Store +ansible/playbooks/wg_clients \ No newline at end of file diff --git a/ansible/inventories/group_vars/wireguard_server/sifi.yaml b/ansible/inventories/group_vars/wireguard_server/sifi.yaml index f9c694f..24d5ce3 100644 --- a/ansible/inventories/group_vars/wireguard_server/sifi.yaml +++ b/ansible/inventories/group_vars/wireguard_server/sifi.yaml @@ -9,7 +9,13 @@ wg_server_address: 192.168.99.1/32 wg_peers: - name: fabio_test publicKey: "byR/8T9AZK2t1cxDCLVzdLXsxcUPRXA06CnfI8gwQyY=" - allowedIP: "192.168.99.4/32" + ip: "192.168.99.4/32" + allowedIPs : + - "192.168.99.0/24" + - "10.22.0.0.0/16" - name: lucio publicKey: "IifwTYaBMoL3IhAHHplyuVMCir7PHNT57cP57RvEIwg=" - allowedIP: "192.168.99.3/32" \ No newline at end of file + ip: "192.168.99.3/32" + allowedIPs : + - "192.168.99.0/24" + - "10.22.0.0.0/16" \ No newline at end of file diff --git a/ansible/inventories/group_vars/wireguard_server/vlab1.yaml b/ansible/inventories/group_vars/wireguard_server/vlab1.yaml new file mode 100644 index 0000000..49d6dd5 --- /dev/null +++ b/ansible/inventories/group_vars/wireguard_server/vlab1.yaml @@ -0,0 +1,25 @@ +--- +wg_interface: wg0 +wg_port: 51820 +#wg_server_public_interface: eth0 +wg_server_address: 192.168.99.1/32 +#wg_server_private_key: "{{ wg_server_private_key }}" + + +wg_peers: + - name: fabio_test + publicKey: "9a3tgXpF5CAOffbHZdW1QBEJgSLFnBDVbD1JaMPgzkM=" + ip: "192.168.99.4/32" + allowedIPs : + - "192.168.99.0/24" + - "10.22.0.0/16" + - name: missing_key_test + ip: "192.168.99.5/32" + allowedIPs : + - "192.168.99.0/24" + - "10.22.0.0/16" + - name: second_missing_key_test + ip: "192.168.99.6/32" + allowedIPs : + - "192.168.99.0/24" + - "10.22.0.0/16" diff --git a/ansible/inventories/vlab1.yaml b/ansible/inventories/vlab1.yaml index 3908729..ecae69a 100644 --- a/ansible/inventories/vlab1.yaml +++ b/ansible/inventories/vlab1.yaml @@ -1,6 +1,9 @@ --- vlab-1: children: + yuno: + hosts: + yuno.sse.cloud.isti.cnr.it: wireguard_server: hosts: vpn-1.sse.cloud.isti.cnr.it: diff --git a/ansible/playbooks/roles/wireguard_server/tasks/generate_client_configs.yaml b/ansible/playbooks/roles/wireguard_server/tasks/generate_client_configs.yaml new file mode 100644 index 0000000..12b896b --- /dev/null +++ b/ansible/playbooks/roles/wireguard_server/tasks/generate_client_configs.yaml @@ -0,0 +1,57 @@ +--- +- name: Create local configs directory + become: false + local_action : ansible.builtin.file + args: + path: "{{ playbook_dir }}/wg_clients/{{ inventory_hostname }}" + state: directory + mode: '0700' + +- name: Init generated Keys dict + set_fact: + generated_keys: [] + +- name : Gather needed key generation + set_fact: + generated_keys: "{{ generated_keys + [{'name': item.name}] }}" + when : item.publicKey is not defined + loop: "{{ wg_peers }}" + +- name : Generate private keys + command : wg genkey + register: privateKeyObjects + loop : "{{ generated_keys }}" + + +- name : Generate public keys + shell : echo "{{privateKeyObjects.results[ansible_loop.index0].stdout}}" | wg pubkey + register: publicKeyObjects + loop : "{{ generated_keys }}" + loop_control: + extended: true + +- name: Registering generated keys + set_fact: + generated_keys: "{{ generated_keys | community.general.lists_mergeby ([{'privateKey' : privateKeyObjects.results[ansible_loop.index0].stdout, 'publicKey' : publicKeyObjects.results[ansible_loop.index0].stdout, 'name':item.name }],'name') }}" + loop: "{{ generated_keys }}" + loop_control: + extended: true + +- name: Updating client configs info + set_fact: + wg_peers: "{{ wg_peers | community.general.lists_mergeby(generated_keys,'name')}}" + + +- name : Generate client config file + become: false + local_action : ansible.builtin.template + args: + src: templates/wireguard_client.jinja + dest: "{{ playbook_dir }}/wg_clients/{{ inventory_hostname }}/{{ item.name }}.conf" + vars: + wg_client_public_key: "{{ item.publicKey }}" + wg_client_private_key: "{{ item.privateKey | default('')}}" + wg_client_address: "{{ item.ip }}" + allowed_ips : "{{ item.allowedIPs }}" + wg_server : "{{ inventory_hostname }}" + loop: "{{ wg_peers }}" diff --git a/ansible/playbooks/roles/wireguard_server/tasks/generate_keys.yaml b/ansible/playbooks/roles/wireguard_server/tasks/generate_server_keys.yaml similarity index 62% rename from ansible/playbooks/roles/wireguard_server/tasks/generate_keys.yaml rename to ansible/playbooks/roles/wireguard_server/tasks/generate_server_keys.yaml index f6c14a0..27b11d5 100644 --- a/ansible/playbooks/roles/wireguard_server/tasks/generate_keys.yaml +++ b/ansible/playbooks/roles/wireguard_server/tasks/generate_server_keys.yaml @@ -6,39 +6,39 @@ state: directory mode: '0700' -- name: Check if private key already exists +- name: Check if server private key already exists ansible.builtin.stat: path: /etc/wireguard/privatekey - register: privkey_file + register: privatekey_file -- name: Generate private key +- name: Generate server private key ansible.builtin.command: wg genkey register: wg_private_key - when: not privkey_file.stat.exists + when: not privatekey_file.stat.exists changed_when: true -- name: Save private key +- name: Save server private key ansible.builtin.copy: content: "{{ wg_private_key.stdout }}" dest: /etc/wireguard/privatekey owner: root group: root mode: '0600' - when: not privkey_file.stat.exists + when: not privatekey_file.stat.exists -- name: Read private key +- name: Read server private key ansible.builtin.slurp: src: /etc/wireguard/privatekey register: private_key_content -- name: Generate public key from private key +- name: Generate server public key from private key ansible.builtin.shell: echo "{{ private_key_content.content | b64decode | trim }}" | wg pubkey - register: wg_public_key + register: wg_server_public_key changed_when: false -- name: Save public key +- name: Save server public key ansible.builtin.copy: - content: "{{ wg_public_key.stdout }}" + content: "{{ wg_server_public_key.stdout }}" dest: /etc/wireguard/publickey owner: root group: root @@ -46,4 +46,4 @@ - name: Display public key for reference ansible.builtin.debug: - msg: "Public key for {{ inventory_hostname }}: {{ wg_public_key.stdout }}" \ No newline at end of file + msg: "Public key for {{ inventory_hostname }}: {{ wg_server_public_key.stdout }}" \ No newline at end of file diff --git a/ansible/playbooks/roles/wireguard_server/tasks/main.yaml b/ansible/playbooks/roles/wireguard_server/tasks/main.yaml index 0b2489d..05c05c9 100644 --- a/ansible/playbooks/roles/wireguard_server/tasks/main.yaml +++ b/ansible/playbooks/roles/wireguard_server/tasks/main.yaml @@ -1,4 +1,5 @@ --- - include_tasks: install_wireguard.yaml -- include_tasks: generate_keys.yaml +- include_tasks: generate_server_keys.yaml +- include_tasks: generate_client_configs.yaml - include_tasks: configure_server.yaml diff --git a/ansible/playbooks/roles/wireguard_server/templates/wireguard_client.jinja b/ansible/playbooks/roles/wireguard_server/templates/wireguard_client.jinja index e69de29..7a7b20c 100644 --- a/ansible/playbooks/roles/wireguard_server/templates/wireguard_client.jinja +++ b/ansible/playbooks/roles/wireguard_server/templates/wireguard_client.jinja @@ -0,0 +1,18 @@ +[Interface] +{% if wg_client_private_key is defined and wg_client_private_key != None and wg_client_private_key != ''%} +PrivateKey = {{wg_client_private_key}} +{% else%} + +# Public and private keys were pre generated by client +# Insert private key below and uncomment in order to use the present configuration +# PrivateKey = + +{% endif %} + +Address = {{wg_client_address}} + +[Peer] +PublicKey = {{wg_server_public_key.stdout}} +AllowedIPs = {{ allowed_ips | join(', ') }} +Endpoint = {{ wg_server }}:{{ wg_port }} +PersistentKeepalive = 25 \ No newline at end of file diff --git a/ansible/playbooks/roles/wireguard_server/templates/wireguard_server.jinja b/ansible/playbooks/roles/wireguard_server/templates/wireguard_server.jinja index 73c01d9..cb8c9e3 100644 --- a/ansible/playbooks/roles/wireguard_server/templates/wireguard_server.jinja +++ b/ansible/playbooks/roles/wireguard_server/templates/wireguard_server.jinja @@ -19,7 +19,7 @@ PostDown = iptables -t nat -D POSTROUTING ! -o {{wg_interface}} -m mark --mark 0 # {{ peer.name }} [Peer] PublicKey = {{ peer.publicKey }} -AllowedIPs = {{ peer.allowedIP }} +AllowedIPs = {{ peer.ip }} {% if peer.persistent_keepalive is defined %} PersistentKeepalive = {{ peer.persistent_keepalive }} {% endif %}