133 lines
3.4 KiB
YAML
133 lines
3.4 KiB
YAML
---
|
|
- name: Configure WireGuard VPN Client
|
|
hosts: load-balancer
|
|
become: true
|
|
vars:
|
|
vpn_ip: "10.0.0.12"
|
|
vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
|
|
vpn_server_pubkey: "VQa6g1foaXhJgYWbwyJ9R/EAmmXg0nOnhPhbIIPLlmg="
|
|
vpn_server_ip: "131.123.42.158"
|
|
vpn_server_port: "51820"
|
|
vpn_network: "10.0.0.0/24"
|
|
vpn_private_ip: "10.0.0.1"
|
|
|
|
tasks:
|
|
- name: Update apt cache
|
|
apt:
|
|
update_cache: yes
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install WireGuard and tools
|
|
apt:
|
|
name:
|
|
- wireguard
|
|
- wireguard-tools
|
|
state: present
|
|
|
|
- name: Create WireGuard config directory
|
|
file:
|
|
path: /etc/wireguard
|
|
state: directory
|
|
mode: '0700'
|
|
|
|
- name: Create WireGuard config
|
|
copy:
|
|
content: |
|
|
[Interface]
|
|
Address = {{ vpn_ip }}/32
|
|
ListenPort = 51821
|
|
PrivateKey = {{ vpn_private_key }}
|
|
|
|
[Peer]
|
|
PublicKey = {{ vpn_server_pubkey }}
|
|
Endpoint = {{ vpn_server_ip }}:{{ vpn_server_port }}
|
|
AllowedIPs = {{ vpn_network }}
|
|
PersistentKeepalive = 25
|
|
dest: /etc/wireguard/wg0.conf
|
|
mode: '0600'
|
|
register: wg_config
|
|
|
|
- name: Enable WireGuard service
|
|
systemd:
|
|
name: wg-quick@wg0
|
|
enabled: yes
|
|
state: started
|
|
|
|
- name: Redémarrer WireGuard si la config a changé (state:started ne recharge pas seul)
|
|
systemd:
|
|
name: wg-quick@wg0
|
|
state: restarted
|
|
when: wg_config.changed
|
|
|
|
- name: Enregistrer le pair load-balancer sur le serveur VPN
|
|
hosts: vpn-uber
|
|
become: true
|
|
vars:
|
|
vpn_ip: "10.0.0.12"
|
|
vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
|
|
|
|
tasks:
|
|
- name: Calculer la clé publique du client à partir de sa clé privée
|
|
command: wg pubkey
|
|
args:
|
|
stdin: "{{ vpn_private_key }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: client_pubkey
|
|
changed_when: false
|
|
no_log: true
|
|
tags: [vpn]
|
|
|
|
- name: Ajouter le pair dans wg0.conf
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/wireguard/wg0.conf
|
|
marker: "# {mark} PEER load-balancer"
|
|
insertafter: EOF
|
|
block: |
|
|
[Peer]
|
|
PublicKey = {{ client_pubkey.stdout }}
|
|
AllowedIPs = {{ vpn_ip }}/32
|
|
register: peer_added
|
|
tags: [vpn]
|
|
|
|
|
|
- name: Appliquer la config sans couper les autres pairs
|
|
ansible.builtin.shell: wg syncconf wg0 <(wg-quick strip wg0)
|
|
args:
|
|
executable: /bin/bash
|
|
when: peer_added.changed
|
|
tags: [vpn]
|
|
|
|
- name: Vérifier la connectivité VPN du load-balancer
|
|
hosts: load-balancer
|
|
become: true
|
|
vars:
|
|
vpn_ip: "10.0.0.12"
|
|
vpn_private_ip: "10.0.0.1"
|
|
|
|
tasks:
|
|
- name: Wait for VPN connection to establish
|
|
pause:
|
|
seconds: 3
|
|
|
|
- name: Check VPN connection
|
|
command: ip addr show wg0
|
|
register: wg_status
|
|
changed_when: false
|
|
|
|
- name: Test VPN connectivity
|
|
command: ping -c 1 "{{ vpn_private_ip }}"
|
|
register: ping_result
|
|
ignore_errors: yes
|
|
|
|
- name: Display VPN status
|
|
debug:
|
|
msg: |
|
|
VPN Configuration Complete!
|
|
IP Address: {{ vpn_ip }}
|
|
WireGuard Status:
|
|
{{ wg_status.stdout }}
|
|
|
|
Ping result ({{ 'SUCCESS' if ping_result.rc == 0 else 'FAILED' }}):
|
|
{{ ping_result.stdout | default('Connection test deferred') }}
|