first commit

2026-07-22 21:01:19 +02:00
commit 8bb06f3737
57 changed files with 3529 additions and 0 deletions
@@ -0,0 +1,132 @@
+---
+- name: Configure WireGuard VPN Client
+  hosts: load-balancer
+  become: true
+  vars:
+    vpn_ip: "10.0.0.12"
+    vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
+    vpn_server_pubkey: "VQa6g1foaXhJgYWbwyJ9R/EAmmXg0nOnhPhbIIPLlmg="
+    vpn_server_ip: "131.123.42.158"
+    vpn_server_port: "51820"
+    vpn_network: "10.0.0.0/24"
+    vpn_private_ip: "10.0.0.1"
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
+
+    - name: Install WireGuard and tools
+      apt:
+        name:
+          - wireguard
+          - wireguard-tools
+        state: present
+
+    - name: Create WireGuard config directory
+      file:
+        path: /etc/wireguard
+        state: directory
+        mode: '0700'
+
+    - name: Create WireGuard config
+      copy:
+        content: |
+          [Interface]
+          Address = {{ vpn_ip }}/32
+          ListenPort = 51821
+          PrivateKey = {{ vpn_private_key }}
+
+          [Peer]
+          PublicKey = {{ vpn_server_pubkey }}
+          Endpoint = {{ vpn_server_ip }}:{{ vpn_server_port }}
+          AllowedIPs = {{ vpn_network }}
+          PersistentKeepalive = 25
+        dest: /etc/wireguard/wg0.conf
+        mode: '0600'
+      register: wg_config
+
+    - name: Enable WireGuard service
+      systemd:
+        name: wg-quick@wg0
+        enabled: yes
+        state: started
+
+    - name: Redémarrer WireGuard si la config a changé (state:started ne recharge pas seul)
+      systemd:
+        name: wg-quick@wg0
+        state: restarted
+      when: wg_config.changed
+
+- name: Enregistrer le pair load-balancer sur le serveur VPN
+  hosts: vpn-uber
+  become: true
+  vars:
+    vpn_ip: "10.0.0.12"
+    vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
+
+  tasks:
+    - name: Calculer la clé publique du client à partir de sa clé privée
+      command: wg pubkey
+      args:
+        stdin: "{{ vpn_private_key }}"
+      delegate_to: localhost
+      become: false
+      register: client_pubkey
+      changed_when: false
+      no_log: true
+      tags: [vpn]
+
+    - name: Ajouter le pair dans wg0.conf
+      ansible.builtin.blockinfile:
+        path: /etc/wireguard/wg0.conf
+        marker: "# {mark} PEER load-balancer"
+        insertafter: EOF
+        block: |
+          [Peer]
+          PublicKey = {{ client_pubkey.stdout }}
+          AllowedIPs = {{ vpn_ip }}/32
+      register: peer_added
+      tags: [vpn]
+
+
+    - name: Appliquer la config sans couper les autres pairs
+      ansible.builtin.shell: wg syncconf wg0 <(wg-quick strip wg0)
+      args:
+        executable: /bin/bash
+      when: peer_added.changed
+      tags: [vpn]
+
+- name: Vérifier la connectivité VPN du load-balancer
+  hosts: load-balancer
+  become: true
+  vars:
+    vpn_ip: "10.0.0.12"
+    vpn_private_ip: "10.0.0.1"
+
+  tasks:
+    - name: Wait for VPN connection to establish
+      pause:
+        seconds: 3
+
+    - name: Check VPN connection
+      command: ip addr show wg0
+      register: wg_status
+      changed_when: false
+
+    - name: Test VPN connectivity
+      command: ping -c 1 "{{ vpn_private_ip }}"
+      register: ping_result
+      ignore_errors: yes
+
+    - name: Display VPN status
+      debug:
+        msg: |
+          VPN Configuration Complete!
+          IP Address: {{ vpn_ip }}
+          WireGuard Status:
+          {{ wg_status.stdout }}
+
+          Ping result ({{ 'SUCCESS' if ping_result.rc == 0 else 'FAILED' }}):
+          {{ ping_result.stdout | default('Connection test deferred') }}