iac/ansible/playbooks/01-wireguard-setup.yaml

---
# Stage 1: WireGuard VPN Setup
#
# This playbook must be run FIRST to establish the WireGuard VPN network.
# After this playbook completes:
# 1. WireGuard will be running on all hosts
# 2. Client configs will be generated in playbooks/wireguard-configs/
# 3. You MUST manually update inventory/hosts.yaml to use WireGuard IPs (10.20.0.x)
# 4. Then you can run playbook 02-full-deployment.yaml
#
# Usage:
#   ansible-playbook playbooks/01-wireguard-setup.yaml
#

- name: Deploy WireGuard VPN Server
  hosts: ops_servers
  become: true
  gather_facts: true

  pre_tasks:
    - name: Validate required variables
      ansible.builtin.assert:
        that:
          - wireguard_network is defined
          - vpc_network is defined
          - ansible_host is defined
        fail_msg: "Required network variables are missing. Check group_vars/all/"
        success_msg: "Network variables validated successfully"

    - name: Display pre-deployment information
      ansible.builtin.debug:
        msg: |
          ========================================
          WireGuard VPN Server Deployment
          ========================================
          Target: {{ inventory_hostname }} (VPN Hub)
          WireGuard network: {{ wireguard_network }}
          VPC network: {{ vpc_network }}

          This will deploy WireGuard VPN server and generate client configs.
          ========================================

  roles:
    - role: wireguard

- name: Deploy WireGuard VPN Client
  hosts: services_servers
  become: true
  gather_facts: true

  vars:
    # Map each server to its client config name
    wireguard_client_configs:
      asxpio-services: asxpio-services

  tasks:
    - name: Display client deployment information
      ansible.builtin.debug:
        msg: |
          ========================================
          WireGuard VPN Client Deployment
          ========================================
          Target: {{ inventory_hostname }} (VPN Client)
          Will connect to: {{ asxpio_ops_wireguard_ip }} (asxpio-ops)
          ========================================

    - name: Get client config name for this host
      ansible.builtin.set_fact:
        client_config_name: "{{ wireguard_client_configs[inventory_hostname] }}"
      when: inventory_hostname in wireguard_client_configs

    - name: Install WireGuard
      ansible.builtin.apt:
        name:
          - wireguard
          - wireguard-tools
        state: present
        update_cache: true

    - name: Create WireGuard config directory
      ansible.builtin.file:
        path: /etc/wireguard
        state: directory
        mode: '0700'
        owner: root
        group: root

    - name: Copy WireGuard client configuration
      ansible.builtin.copy:
        src: "{{ playbook_dir }}/wireguard-configs/asxpio-ops/{{ client_config_name }}.conf"
        dest: "/etc/wireguard/{{ client_config_name }}.conf"
        mode: '0600'
        owner: root
        group: root
      when: client_config_name is defined

    - name: Enable and start WireGuard interface
      ansible.builtin.systemd:
        name: "wg-quick@{{ client_config_name }}"
        enabled: true
        state: started
      when: client_config_name is defined
      register: wg_client_start

    - name: Display client status
      ansible.builtin.debug:
        msg: |
          ✅ WireGuard client configured on {{ inventory_hostname }}
          Interface: wg-quick@{{ client_config_name }}
          Status: {{ 'Started' if wg_client_start.changed else 'Already running' }}
      when: client_config_name is defined

- name: Post-deployment verification
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Display post-deployment instructions
      ansible.builtin.debug:
        msg: |
          ========================================
          WireGuard VPN Deployment Complete!
          ========================================

          Infrastructure deployed:
          ✅ asxpio-ops: WireGuard VPN Server (hub)
          ✅ asxpio-services: WireGuard VPN Client (connected to ops)

          Server-to-server connectivity:
          - asxpio-ops ↔ asxpio-services via WireGuard (10.20.0.0/24)

          IMPORTANT NEXT STEPS FOR YOUR WORKSTATION:

          1. Client configurations for your machine are in:
             playbooks/wireguard-configs/asxpio-ops/

          2. Import a client config to connect your workstation:
             - Linux/Mac: sudo wg-quick up ./playbooks/wireguard-configs/asxpio-ops/<client>.conf
             - Windows: Import the .conf file in WireGuard GUI

          3. Test connectivity from your workstation:
             ping {{ asxpio_ops_wireguard_ip }}
             ping {{ asxpio_services_wireguard_ip }}

          4. After connecting to WireGuard, run Stage 2:
             ansible-playbook playbooks/02-full-deployment.yaml

          NOTE: Stage 2 automatically uses WireGuard IPs.
                No manual configuration changes needed!

          ========================================

    - name: Test WireGuard connectivity from controller
      ansible.builtin.wait_for:
        host: "{{ asxpio_ops_wireguard_ip }}"
        port: 22
        timeout: 5
        state: started
      register: wg_connectivity_test
      failed_when: false

    - name: Display connectivity test results
      ansible.builtin.debug:
        msg: |
          ========================================
          WireGuard Connectivity Test
          ========================================

          {% if wg_connectivity_test.failed %}
          ❌ Cannot reach servers via WireGuard from your workstation yet

          This is NORMAL if you haven't connected your workstation to WireGuard.

          To connect:
          1. Import client config: playbooks/wireguard-configs/asxpio-ops/<client>.conf
          2. Start WireGuard connection on your workstation
          3. Verify with: ping {{ asxpio_ops_wireguard_ip }}
          4. Run Stage 2: ansible-playbook playbooks/02-full-deployment.yaml

          {% else %}
          ✅ WireGuard is reachable from your workstation!

          Server-to-server VPN: Connected
          Workstation-to-server VPN: Connected

          You can now run Stage 2:
            ansible-playbook playbooks/02-full-deployment.yaml

          Stage 2 automatically uses WireGuard IPs - no manual configuration needed!
          {% endif %}

          ========================================