ansible

ansible/playbooks/wireguard-client.yaml

@@ -0,0 +1,59 @@
+---
+- name: Deploy WireGuard client configuration
+  hosts: services_servers
+  become: true
+  vars:
+    # Map each server to its client config name
+    wireguard_client_configs:
+      asxpio-services: asxpio-services
+  tasks:
+    - name: Get client config name for this host
+      ansible.builtin.set_fact:
+        client_config_name: "{{ wireguard_client_configs[inventory_hostname] }}"
+      when: inventory_hostname in wireguard_client_configs
+
+    - name: Install WireGuard
+      ansible.builtin.apt:
+        name:
+          - wireguard
+          - wireguard-tools
+        state: present
+        update_cache: true
+
+    - name: Create WireGuard config directory
+      ansible.builtin.file:
+        path: /etc/wireguard
+        state: directory
+        mode: '0700'
+        owner: root
+        group: root
+
+    - name: Copy WireGuard client configuration
+      ansible.builtin.copy:
+        src: "../playbooks/wireguard-configs/asxpio-ops/{{ client_config_name }}.conf"
+        dest: "/etc/wireguard/{{ client_config_name }}.conf"
+        mode: '0600'
+        owner: root
+        group: root
+      when: client_config_name is defined
+      notify: restart wireguard client
+
+    - name: Enable WireGuard interface
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ client_config_name }}"
+        enabled: true
+      when: client_config_name is defined
+
+    - name: Start WireGuard interface
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ client_config_name }}"
+        state: started
+      when: client_config_name is defined
+
+  handlers:
+    - name: restart wireguard client
+      ansible.builtin.shell: |
+        wg-quick down {{ client_config_name }} || true
+        wg-quick up {{ client_config_name }}
+      args:
+        executable: /bin/bash