asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ansible

Browse source
This commit is contained in:
Sergei Poljanski 2025-11-01 17:15:42 +02:00
commit b81f7e15b2
41 changed files with 1632 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

39
ansible/roles/wireguard/templates/wg0.conf.j2 Normal file
View file

@ -0,0 +1,39 @@
# WireGuard Server Configuration - {{ wireguard_interface }}
# Generated by Ansible on {{ ansible_date_time.iso8601 }}
[Interface]
Address = {{ wireguard_ipv4 }}/{{ wireguard_ipv4_network.split('/')[-1] }},{{ wireguard_ipv6 }}/{{ wireguard_ipv6_network.split('/')[-1] }}
ListenPort = {{ wireguard_port }}
PrivateKey = {{ wireguard_server_private_key }}
{% if wireguard_enable_ufw %}
# UFW handles firewall rules
{% else %}
# Firewall rules for iptables
PostUp = iptables -I INPUT -p udp --dport {{ wireguard_port }} -j ACCEPT
PostUp = iptables -I FORWARD -i {{ wireguard_default_interface }} -o {{ wireguard_interface }} -j ACCEPT
PostUp = iptables -I FORWARD -i {{ wireguard_interface }} -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o {{ wireguard_default_interface }} -j MASQUERADE
PostUp = ip6tables -I FORWARD -i {{ wireguard_interface }} -j ACCEPT
PostUp = ip6tables -t nat -A POSTROUTING -o {{ wireguard_default_interface }} -j MASQUERADE
PostDown = iptables -D INPUT -p udp --dport {{ wireguard_port }} -j ACCEPT
PostDown = iptables -D FORWARD -i {{ wireguard_default_interface }} -o {{ wireguard_interface }} -j ACCEPT
PostDown = iptables -D FORWARD -i {{ wireguard_interface }} -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o {{ wireguard_default_interface }} -j MASQUERADE
PostDown = ip6tables -D FORWARD -i {{ wireguard_interface }} -j ACCEPT
PostDown = ip6tables -t nat -D POSTROUTING -o {{ wireguard_default_interface }} -j MASQUERADE
{% endif %}
{% for client in wireguard_client_configs | default([]) %}
### Client {{ client.name }}
[Peer]
PublicKey = {{ client.public_key }}
{% if client.preshared_key %}
PresharedKey = {{ client.preshared_key }}
{% endif %}
AllowedIPs = {{ client.ipv4 }}/32,{{ client.ipv6 }}/128
{% if client.persistent_keepalive | default(25) %}
PersistentKeepalive = {{ client.persistent_keepalive }}
{% endif %}
{% endfor %}