ansible rework

ansible/playbooks/01-wireguard-setup.yaml

@@ -0,0 +1,191 @@
+---
+# Stage 1: WireGuard VPN Setup
+#
+# This playbook must be run FIRST to establish the WireGuard VPN network.
+# After this playbook completes:
+# 1. WireGuard will be running on all hosts
+# 2. Client configs will be generated in playbooks/wireguard-configs/
+# 3. You MUST manually update inventory/hosts.yaml to use WireGuard IPs (10.20.0.x)
+# 4. Then you can run playbook 02-full-deployment.yaml
+#
+# Usage:
+#   ansible-playbook playbooks/01-wireguard-setup.yaml
+#
+
+- name: Deploy WireGuard VPN Server
+  hosts: ops_servers
+  become: true
+  gather_facts: true
+
+  pre_tasks:
+    - name: Validate required variables
+      ansible.builtin.assert:
+        that:
+          - wireguard_network is defined
+          - vpc_network is defined
+          - ansible_host is defined
+        fail_msg: "Required network variables are missing. Check group_vars/all/"
+        success_msg: "Network variables validated successfully"
+
+    - name: Display pre-deployment information
+      ansible.builtin.debug:
+        msg: |
+          ========================================
+          WireGuard VPN Server Deployment
+          ========================================
+          Target: {{ inventory_hostname }} (VPN Hub)
+          WireGuard network: {{ wireguard_network }}
+          VPC network: {{ vpc_network }}
+
+          This will deploy WireGuard VPN server and generate client configs.
+          ========================================
+
+  roles:
+    - role: wireguard
+
+- name: Deploy WireGuard VPN Client
+  hosts: services_servers
+  become: true
+  gather_facts: true
+
+  vars:
+    # Map each server to its client config name
+    wireguard_client_configs:
+      asxpio-services: asxpio-services
+
+  tasks:
+    - name: Display client deployment information
+      ansible.builtin.debug:
+        msg: |
+          ========================================
+          WireGuard VPN Client Deployment
+          ========================================
+          Target: {{ inventory_hostname }} (VPN Client)
+          Will connect to: {{ asxpio_ops_wireguard_ip }} (asxpio-ops)
+          ========================================
+
+    - name: Get client config name for this host
+      ansible.builtin.set_fact:
+        client_config_name: "{{ wireguard_client_configs[inventory_hostname] }}"
+      when: inventory_hostname in wireguard_client_configs
+
+    - name: Install WireGuard
+      ansible.builtin.apt:
+        name:
+          - wireguard
+          - wireguard-tools
+        state: present
+        update_cache: true
+
+    - name: Create WireGuard config directory
+      ansible.builtin.file:
+        path: /etc/wireguard
+        state: directory
+        mode: '0700'
+        owner: root
+        group: root
+
+    - name: Copy WireGuard client configuration
+      ansible.builtin.copy:
+        src: "{{ playbook_dir }}/wireguard-configs/asxpio-ops/{{ client_config_name }}.conf"
+        dest: "/etc/wireguard/{{ client_config_name }}.conf"
+        mode: '0600'
+        owner: root
+        group: root
+      when: client_config_name is defined
+
+    - name: Enable and start WireGuard interface
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ client_config_name }}"
+        enabled: true
+        state: started
+      when: client_config_name is defined
+      register: wg_client_start
+
+    - name: Display client status
+      ansible.builtin.debug:
+        msg: |
+          ✅ WireGuard client configured on {{ inventory_hostname }}
+          Interface: wg-quick@{{ client_config_name }}
+          Status: {{ 'Started' if wg_client_start.changed else 'Already running' }}
+      when: client_config_name is defined
+
+- name: Post-deployment verification
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Display post-deployment instructions
+      ansible.builtin.debug:
+        msg: |
+          ========================================
+          WireGuard VPN Deployment Complete!
+          ========================================
+
+          Infrastructure deployed:
+          ✅ asxpio-ops: WireGuard VPN Server (hub)
+          ✅ asxpio-services: WireGuard VPN Client (connected to ops)
+
+          Server-to-server connectivity:
+          - asxpio-ops ↔ asxpio-services via WireGuard (10.20.0.0/24)
+
+          IMPORTANT NEXT STEPS FOR YOUR WORKSTATION:
+
+          1. Client configurations for your machine are in:
+             playbooks/wireguard-configs/asxpio-ops/
+
+          2. Import a client config to connect your workstation:
+             - Linux/Mac: sudo wg-quick up ./playbooks/wireguard-configs/asxpio-ops/<client>.conf
+             - Windows: Import the .conf file in WireGuard GUI
+
+          3. Test connectivity from your workstation:
+             ping {{ asxpio_ops_wireguard_ip }}
+             ping {{ asxpio_services_wireguard_ip }}
+
+          4. After connecting to WireGuard, run Stage 2:
+             ansible-playbook playbooks/02-full-deployment.yaml
+
+          NOTE: Stage 2 automatically uses WireGuard IPs.
+                No manual configuration changes needed!
+
+          ========================================
+
+    - name: Test WireGuard connectivity from controller
+      ansible.builtin.wait_for:
+        host: "{{ asxpio_ops_wireguard_ip }}"
+        port: 22
+        timeout: 5
+        state: started
+      register: wg_connectivity_test
+      failed_when: false
+
+    - name: Display connectivity test results
+      ansible.builtin.debug:
+        msg: |
+          ========================================
+          WireGuard Connectivity Test
+          ========================================
+
+          {% if wg_connectivity_test.failed %}
+          ❌ Cannot reach servers via WireGuard from your workstation yet
+
+          This is NORMAL if you haven't connected your workstation to WireGuard.
+
+          To connect:
+          1. Import client config: playbooks/wireguard-configs/asxpio-ops/<client>.conf
+          2. Start WireGuard connection on your workstation
+          3. Verify with: ping {{ asxpio_ops_wireguard_ip }}
+          4. Run Stage 2: ansible-playbook playbooks/02-full-deployment.yaml
+
+          {% else %}
+          ✅ WireGuard is reachable from your workstation!
+
+          Server-to-server VPN: Connected
+          Workstation-to-server VPN: Connected
+
+          You can now run Stage 2:
+            ansible-playbook playbooks/02-full-deployment.yaml
+
+          Stage 2 automatically uses WireGuard IPs - no manual configuration needed!
+          {% endif %}
+
+          ========================================