Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
---
|
|
# Part of role: pia-gateway
|
|
# Called by: ansible/playbooks/pia-gateway.yaml
|
|
# Description: Orchestrates minisforum's PIA WireGuard egress gateway for
|
|
# VPN VLAN 50 — registration, boot-ordered kill switch + policy routing,
|
|
# the WireGuard interface itself, and health checks. Split into included
|
|
# files because each stage has a distinct idempotency/ordering concern;
|
|
# see the comment at the top of each included file.
|
|
|
|
- name: Install WireGuard tooling and iproute2
|
|
ansible.builtin.apt:
|
|
name:
|
|
- wireguard
|
|
- wireguard-tools
|
|
- iproute2
|
|
- python3-requests
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Pin reverse-path filtering for {{ pia_wg_interface }}
|
|
ansible.posix.sysctl:
|
|
name: "net.ipv4.conf.{{ pia_wg_interface }}.rp_filter"
|
|
value: "{{ pia_rp_filter_mode | string }}"
|
|
sysctl_file: /etc/sysctl.d/60-pia-gateway.conf
|
|
reload: false # interface does not exist yet on a first run; applied for real after the WG interface comes up (handlers/main.yaml)
|
|
register: pia_rp_filter_pinned
|
|
|
|
- name: Confirm host default route and ip_forward are untouched
|
|
ansible.builtin.include_tasks: assert-baseline.yaml
|
|
|
|
- name: Register minisforum with PIA and obtain WireGuard peer config
|
|
ansible.builtin.include_tasks: register.yaml
|
|
no_log: true # PIA credentials and the derived private key pass through this include
|
|
|
|
- name: Configure boot-ordered kill switch and policy routing
|
|
ansible.builtin.include_tasks: routing.yaml
|
|
|
|
- name: Configure firewall-layer kill switch and Technitium access
|
|
ansible.builtin.include_tasks: firewall.yaml
|
|
|
|
- name: Write and enable the pia-wg WireGuard interface
|
|
ansible.builtin.include_tasks: interface.yaml
|
|
|
|
- name: Install gateway health checks
|
|
ansible.builtin.include_tasks: healthcheck.yaml
|
|
|
|
- name: Re-apply rp_filter now that {{ pia_wg_interface }} exists
|
|
ansible.posix.sysctl:
|
|
name: "net.ipv4.conf.{{ pia_wg_interface }}.rp_filter"
|
|
value: "{{ pia_rp_filter_mode | string }}"
|
|
sysctl_file: /etc/sysctl.d/60-pia-gateway.conf
|
|
reload: true
|
|
when: pia_rp_filter_pinned is succeeded
|