171 lines
5.1 KiB
YAML
171 lines
5.1 KiB
YAML
---
|
|
- name: Configure WireGuard VPN Client
|
|
hosts: load-balancer
|
|
become: true
|
|
vars:
|
|
vpn_ip: "10.0.0.12"
|
|
vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
|
|
vpn_server_pubkey: "VQa6g1foaXhJgYWbwyJ9R/EAmmXg0nOnhPhbIIPLlmg="
|
|
vpn_server_ip: "131.123.42.158"
|
|
vpn_server_port: "51820"
|
|
vpn_network: "10.0.0.0/24"
|
|
vpn_private_ip: "10.0.0.1"
|
|
|
|
tasks:
|
|
- name: Update apt cache
|
|
apt:
|
|
update_cache: yes
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install WireGuard and tools
|
|
apt:
|
|
name:
|
|
- wireguard
|
|
- wireguard-tools
|
|
state: present
|
|
|
|
- name: Create WireGuard config directory
|
|
file:
|
|
path: /etc/wireguard
|
|
state: directory
|
|
mode: '0700'
|
|
|
|
- name: Create WireGuard config
|
|
copy:
|
|
content: |
|
|
[Interface]
|
|
Address = {{ vpn_ip }}/32
|
|
ListenPort = 51821
|
|
PrivateKey = {{ vpn_private_key }}
|
|
|
|
[Peer]
|
|
PublicKey = {{ vpn_server_pubkey }}
|
|
Endpoint = {{ vpn_server_ip }}:{{ vpn_server_port }}
|
|
AllowedIPs = {{ vpn_network }}
|
|
PersistentKeepalive = 25
|
|
dest: /etc/wireguard/wg0.conf
|
|
mode: '0600'
|
|
register: wg_config
|
|
|
|
- name: Enable WireGuard service
|
|
systemd:
|
|
name: wg-quick@wg0
|
|
enabled: yes
|
|
state: started
|
|
|
|
- name: Redémarrer WireGuard si la config a changé (state:started ne recharge pas seul)
|
|
systemd:
|
|
name: wg-quick@wg0
|
|
state: restarted
|
|
when: wg_config.changed
|
|
|
|
- name: Enregistrer le pair load-balancer sur le serveur VPN
|
|
hosts: vpn-uber
|
|
become: true
|
|
vars:
|
|
vpn_ip: "10.0.0.12"
|
|
vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
|
|
|
|
tasks:
|
|
# ─── Dynamic debug WireGuard ────────────────────────────────────────────
|
|
# Le module kernel wireguard ne logge les handshakes/keepalives (utilisés
|
|
# par les decoders/rules Wazuh) que si son dynamic debug est activé. Ce
|
|
# flag n'est PAS persistant : il retombe à "désactivé" à chaque reboot ou
|
|
# rechargement du module, ce qui coupe silencieusement la remontée des
|
|
# handshakes vers Wazuh sans toucher au fonctionnement du VPN lui-même
|
|
# (constaté : coupure du 18 au 30/07/2026 après un reboot du serveur).
|
|
- name: Déployer le service systemd qui réactive le dynamic debug wireguard au boot
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/wireguard-dyndbg.service
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
content: |
|
|
[Unit]
|
|
Description=Active le dynamic debug du module kernel WireGuard (logs handshakes pour Wazuh)
|
|
After=wg-quick@wg0.service sys-kernel-debug.mount
|
|
Requires=wg-quick@wg0.service
|
|
PartOf=wg-quick@wg0.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/bin/sh -c 'echo "module wireguard +p" > /sys/kernel/debug/dynamic_debug/control'
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
register: dyndbg_unit
|
|
tags: [vpn, logging]
|
|
|
|
- name: Activer et démarrer le service wireguard-dyndbg
|
|
ansible.builtin.systemd:
|
|
name: wireguard-dyndbg.service
|
|
daemon_reload: "{{ dyndbg_unit.changed }}"
|
|
enabled: yes
|
|
state: started
|
|
tags: [vpn, logging]
|
|
|
|
- name: Calculer la clé publique du client à partir de sa clé privée
|
|
command: wg pubkey
|
|
args:
|
|
stdin: "{{ vpn_private_key }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: client_pubkey
|
|
changed_when: false
|
|
no_log: true
|
|
tags: [vpn]
|
|
|
|
- name: Ajouter le pair dans wg0.conf
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/wireguard/wg0.conf
|
|
marker: "# {mark} PEER load-balancer"
|
|
insertafter: EOF
|
|
block: |
|
|
[Peer]
|
|
PublicKey = {{ client_pubkey.stdout }}
|
|
AllowedIPs = {{ vpn_ip }}/32
|
|
register: peer_added
|
|
tags: [vpn]
|
|
|
|
|
|
- name: Appliquer la config sans couper les autres pairs
|
|
ansible.builtin.shell: wg syncconf wg0 <(wg-quick strip wg0)
|
|
args:
|
|
executable: /bin/bash
|
|
when: peer_added.changed
|
|
tags: [vpn]
|
|
|
|
- name: Vérifier la connectivité VPN du load-balancer
|
|
hosts: load-balancer
|
|
become: true
|
|
vars:
|
|
vpn_ip: "10.0.0.12"
|
|
vpn_private_ip: "10.0.0.1"
|
|
|
|
tasks:
|
|
- name: Wait for VPN connection to establish
|
|
pause:
|
|
seconds: 3
|
|
|
|
- name: Check VPN connection
|
|
command: ip addr show wg0
|
|
register: wg_status
|
|
changed_when: false
|
|
|
|
- name: Test VPN connectivity
|
|
command: ping -c 1 "{{ vpn_private_ip }}"
|
|
register: ping_result
|
|
ignore_errors: yes
|
|
|
|
- name: Display VPN status
|
|
debug:
|
|
msg: |
|
|
VPN Configuration Complete!
|
|
IP Address: {{ vpn_ip }}
|
|
WireGuard Status:
|
|
{{ wg_status.stdout }}
|
|
|
|
Ping result ({{ 'SUCCESS' if ping_result.rc == 0 else 'FAILED' }}):
|
|
{{ ping_result.stdout | default('Connection test deferred') }}
|