homelab/ansible/roles/wireguard/tasks/main.yaml

---
- name: Install WireGuard and tools
  ansible.builtin.apt:
    name:
      - wireguard
      - wireguard-tools
      - qrencode
    state: present
    update_cache: true

- name: Allow WireGuard port through UFW
  community.general.ufw:
    rule: allow
    port: "51820"
    proto: udp

- name: Enable IP forwarding
  ansible.posix.sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    sysctl_set: true
    state: present
    reload: true

- name: Create WireGuard config directory
  ansible.builtin.file:
    path: /etc/wireguard
    state: directory
    mode: "0700"
    owner: root
    group: root

# --- Server keypair ---
- name: Check if server private key exists
  ansible.builtin.stat:
    path: /etc/wireguard/server.key
  register: server_key_stat

- name: Generate server private key
  ansible.builtin.shell: wg genkey > /etc/wireguard/server.key
  when: not server_key_stat.stat.exists

- name: Set permissions on server private key
  ansible.builtin.file:
    path: /etc/wireguard/server.key
    mode: "0600"
    owner: root
    group: root

- name: Read server private key
  ansible.builtin.slurp:
    src: /etc/wireguard/server.key
  register: server_private_key

- name: Derive server public key
  ansible.builtin.shell: wg pubkey < /etc/wireguard/server.key
  register: server_public_key
  changed_when: false

# --- Phone keypair ---
- name: Check if phone private key exists
  ansible.builtin.stat:
    path: /etc/wireguard/phone.key
  register: phone_key_stat

- name: Generate phone private key
  ansible.builtin.shell: wg genkey > /etc/wireguard/phone.key
  when: not phone_key_stat.stat.exists

- name: Set permissions on phone private key
  ansible.builtin.file:
    path: /etc/wireguard/phone.key
    mode: "0600"
    owner: root
    group: root

- name: Read phone private key
  ansible.builtin.slurp:
    src: /etc/wireguard/phone.key
  register: phone_private_key

- name: Derive phone public key
  ansible.builtin.shell: wg pubkey < /etc/wireguard/phone.key
  register: phone_public_key
  changed_when: false

# --- Mac keypair ---
- name: Check if mac private key exists
  ansible.builtin.stat:
    path: /etc/wireguard/mac.key
  register: mac_key_stat

- name: Generate mac private key
  ansible.builtin.shell: wg genkey > /etc/wireguard/mac.key
  when: not mac_key_stat.stat.exists

- name: Set permissions on mac private key
  ansible.builtin.file:
    path: /etc/wireguard/mac.key
    mode: "0600"
    owner: root
    group: root

- name: Read mac private key
  ansible.builtin.slurp:
    src: /etc/wireguard/mac.key
  register: mac_private_key

- name: Derive mac public key
  ansible.builtin.shell: wg pubkey < /etc/wireguard/mac.key
  register: mac_public_key
  changed_when: false

# --- Server config ---
- name: Write wg0.conf
  ansible.builtin.template:
    src: wg0.conf.j2
    dest: /etc/wireguard/wg0.conf
    mode: "0600"
    owner: root
    group: root
  notify: Restart wg0

# --- Service ---
- name: Enable and start wg-quick@wg0
  ansible.builtin.systemd:
    name: wg-quick@wg0
    enabled: true
    state: started

# --- Phone client config + QR ---
- name: Write phone client config
  ansible.builtin.copy:
    dest: /etc/wireguard/phone-client.conf
    mode: "0600"
    owner: root
    group: root
    content: |
      [Interface]
      PrivateKey = {{ phone_private_key.content | b64decode | trim }}
      Address = 10.10.0.2/32
      DNS = 10.10.40.53

      [Peer]
      PublicKey = {{ server_public_key.stdout }}
      Endpoint = {{ wireguard_endpoint }}:51820
      AllowedIPs = 192.168.7.0/24, 10.10.40.0/24, 10.10.0.0/24
      PersistentKeepalive = 25

# --- Mac client config ---
- name: Write mac client config
  ansible.builtin.copy:
    dest: /etc/wireguard/mac-client.conf
    mode: "0600"
    owner: root
    group: root
    content: |
      [Interface]
      PrivateKey = {{ mac_private_key.content | b64decode | trim }}
      Address = 10.10.0.3/32
      DNS = 10.10.40.53

      [Peer]
      PublicKey = {{ server_public_key.stdout }}
      Endpoint = {{ wireguard_endpoint }}:51820
      AllowedIPs = 192.168.7.0/24, 10.10.0.0/24
      PersistentKeepalive = 25

- name: Display mac client config
  ansible.builtin.shell: cat /etc/wireguard/mac-client.conf
  register: mac_conf
  changed_when: false
  when: wireguard_show_client_configs | default(false)

- name: Show mac client config
  ansible.builtin.debug:
    msg: "{{ mac_conf.stdout_lines }}"
  when: wireguard_show_client_configs | default(false)

- name: Generate QR code for phone
  ansible.builtin.shell: qrencode -t ansiutf8 < /etc/wireguard/phone-client.conf
  register: phone_qr
  changed_when: false
  when: wireguard_show_client_configs | default(false)

- name: Display phone QR code
  ansible.builtin.debug:
    msg: "{{ phone_qr.stdout_lines }}"
  when: wireguard_show_client_configs | default(false)