Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
33 lines
1.3 KiB
YAML
33 lines
1.3 KiB
YAML
---
|
|
# Part of role: pia-gateway
|
|
# Included by: tasks/main.yaml
|
|
# Description: Enables and starts the pia-wg WireGuard interface itself.
|
|
# The config file was already written by tasks/register.yaml (only on
|
|
# first run / forced re-registration); this task just makes sure the
|
|
# systemd unit is enabled and running, and that pia-killswitch.service
|
|
# (tasks/routing.yaml) has already run first — both are WantedBy
|
|
# multi-user.target with an explicit Before= from the kill switch, so a
|
|
# normal boot orders them correctly without help here, but a first
|
|
# Ansible run on an already-booted host needs the same ordering applied
|
|
# explicitly since neither unit was part of a boot transaction yet.
|
|
|
|
- name: Confirm the kill switch is active before bringing up pia-wg
|
|
ansible.builtin.systemd:
|
|
name: pia-killswitch.service
|
|
register: pia_killswitch_status
|
|
failed_when: false
|
|
|
|
- name: Assert the kill switch is active
|
|
ansible.builtin.assert:
|
|
that:
|
|
- pia_killswitch_status.status.ActiveState == "active"
|
|
fail_msg: >-
|
|
pia-killswitch.service is not active — refusing to start
|
|
{{ pia_wg_interface }} without the kill switch already seeded.
|
|
|
|
- name: Enable and start wg-quick@{{ pia_wg_interface }}
|
|
ansible.builtin.systemd:
|
|
name: "wg-quick@{{ pia_wg_interface }}"
|
|
enabled: true
|
|
state: started
|