{"id":18555149,"url":"https://github.com/arillso/ansible.wireguard","last_synced_at":"2025-04-09T23:31:59.355Z","repository":{"id":39897728,"uuid":"308757989","full_name":"arillso/ansible.wireguard","owner":"arillso","description":"Ansible role for installation and configuration of wireguard VPN.","archived":false,"fork":false,"pushed_at":"2023-05-16T13:49:31.000Z","size":53,"stargazers_count":4,"open_issues_count":5,"forks_count":1,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-03-24T13:44:02.471Z","etag":null,"topics":["ansible","ansible-role","wireguard"],"latest_commit_sha":null,"homepage":"","language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/arillso.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/funding.yml","license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["sbaerlocher"]}},"created_at":"2020-10-30T22:35:21.000Z","updated_at":"2024-01-16T21:13:55.000Z","dependencies_parsed_at":"2024-11-06T21:32:19.752Z","dependency_job_id":"76bcc371-36ed-4776-9d9d-a2d3a526f0d8","html_url":"https://github.com/arillso/ansible.wireguard","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arillso%2Fansible.wireguard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arillso%2Fansible.wireguard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arillso%2Fansible.wireguard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arillso%2Fansible.wireguard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/arillso","download_url":"https://codeload.github.com/arillso/ansible.wireguard/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248129889,"owners_count":21052655,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-role","wireguard"],"created_at":"2024-11-06T21:25:24.888Z","updated_at":"2025-04-09T23:31:57.344Z","avatar_url":"https://github.com/arillso.png","language":"Jinja","funding_links":["https://github.com/sponsors/sbaerlocher"],"categories":[],"sub_categories":[],"readme":"# Ansible Role: wireguard\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\n[![license](https://img.shields.io/github/license/mashape/apistatus.svg?style=flat-square\u0026logo=Open%20Source%20Initiative)](LICENSE) [![Ansible Role](https://img.shields.io/ansible/role/52173?label=role%20name\u0026style=flat-square\u0026logo=ansible)](https://galaxy.ansible.com/arillso/wireguard) [![Ansible Role](https://img.shields.io/ansible/role/d/52173.svg?style=flat-square\u0026logo=ansible)](https://galaxy.ansible.com/arillso/wireguard) [![Ansible Quality Score](https://img.shields.io/ansible/quality/52173?label=role%20quality\u0026style=flat-square\u0026logo=ansible)](https://galaxy.ansible.com/arillso/wireguard) [![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/arillso/ansible.wireguard?style=flat-square\u0026logo=github)](https://github.com/arillso/ansible.wireguard/releases) [![GitHub Workflow Status (branch)](https://img.shields.io/github/workflow/status/arillso/ansible.wireguard/Role%20Tests/main?label=tests\u0026style=flat-square\u0026logo=github)](https://github.com/arillso/ansible.wireguard/actions?query=workflow%3A%22Role+Tests%22)\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n## Description\n\nAnsible role for installation and configuration of wireguard VPN.\n\n## Installation\n\n```bash\nansible-galaxy install arillso.wireguard\n```\n\n## Requirements\n\n- `ansible.posix` collections\n\n## Role Variables\n\nThese variables can be changed in `group_vars/` e.g.:\n\n```yml\n# Directory to store WireGuard configuration on the remote hosts\nwireguard_remote_directory: '/etc/wireguard' # On Linux\n# wireguard_remote_directory: \"/opt/local/etc/wireguard\"  # On MacOS\n\n# The default port WireGuard will listen if not specified otherwise.\nwireguard_port: '51820'\n\n# The default interface name that WireGuard should use if not specified otherwise.\nwireguard_interface: 'wg0'\n\n# The default owner of the wg.conf file\nwireguard_conf_owner: root\n\n# The default group of the wg.conf file\nwireguard_conf_group: \"{{ 'root' if not ansible_os_family == 'Darwin' else 'wheel' }}\"\n\n# The default mode of the wg.conf file\nwireguard_conf_mode: 0600\n```\n\nThe following variable is mandatory and needs to be configured for every host in `host_vars/` e.g.:\n\n```yml\nwireguard_address: '10.8.0.101/24'\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nOf course all IP's should be in the same subnet like `/24` we see in the example above. If `wireguard_allowed_ips` is not set then the default value is the value from `wireguard_address` without the CIDR but instead with `/32` which is basically a host route (have a look `templates/wg.conf.j2`). Let's see this example and let's assume you don't set `wireguard_allowed_ips` explicitly:\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n```ini\n[Interface]\nAddress = 10.8.0.2/24\nPrivateKey = ....\nListenPort = 51820\n\n[Peer]\nPrivateKey = ....\nAllowedIPs = 10.8.0.101/32\nEndpoint = controller01.p.domain.tld:51820\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nThis is part of the WireGuard config from my workstation. It has the VPN IP `10.8.0.2` and we've a `/24` subnet in which all my WireGuard hosts are located. Also you can see we've a peer here that has the endpoint `controller01.p.domain.tld:51820`. When `wireguard_allowed_ips` is not explicitly set the Ansible template will add an `AllowedIPs` entry with the IP of that host plus `/32`. In WireGuard this basically specifies the routing. The config above says: On my workstation with the IP `10.8.0.2` I want send all traffic to `10.8.0.101/32` to the endpoint `controller01.p.domain.tld:51820`. Now let's assume we set `wireguard_allowed_ips: \"0.0.0.0/0\"`. Then the resulting config looks like this.\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n```ini\n[Interface]\nAddress = 10.8.0.2/24\nPrivateKey = ....\nListenPort = 51820\n\n[Peer]\nPrivateKey = ....\nAllowedIPs = 0.0.0.0/0\nEndpoint = controller01.p.domain.tld:51820\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nNow this is basically the same as above BUT now the config says: I want to route EVERY traffic originating from my workstation to the endpoint `controller01.p.domain.tld:51820`. If that endpoint can handle the traffic is of course another thing and it's up to you how you configure the endpoint routing ;-)\n\nYou can specify further optional settings (they don't have a default and won't be set if not specified besides `wireguard_allowed_ips` as already mentioned) also per host in `host_vars/` (or in your Ansible hosts file if you like). The values for the following variables are just examples and no defaults (for more information and examples see [wg-quick.8](https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8)):\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n```yml\nwireguard_allowed_ips: ''\nwireguard_endpoint: 'host1.domain.tld'\nwireguard_persistent_keepalive: '30'\nwireguard_dns: '1.1.1.1'\nwireguard_fwmark: '1234'\nwireguard_mtu: '1492'\nwireguard_table: '5000'\nwireguard_preup:\n  - ...\nwireguard_predown:\n  - ...\nwireguard_postup:\n  - ...\nwireguard_postdown:\n  - ...\nwireguard_save_config: 'true'\nwireguard_unmanaged_peers:\n  client.example.com:\n    public_key: 5zsSBeZZ8P9pQaaJvY9RbELQulcwC5VBXaZ93egzOlI=\n    # preshared_key: ... e.g. from ansible-vault?\n    allowed_ips: 10.0.0.3/32\n    endpoint: client.example.com:51820\n    persistent_keepalive: 0\n```\n\n`wireguard_(preup|predown|postup|postdown)` are specified as lists. Here are two examples:\n\n```yml\nwireguard_postup:\n  - iptables -t nat -A POSTROUTING -o ens12 -j MASQUERADE\n  - iptables -A FORWARD -i %i -j ACCEPT\n  - iptables -A FORWARD -o %i -j ACCEPT\n```\n\n```yml\nwireguard_preup:\n  - echo 1 \u003e /proc/sys/net/ipv4/ip_forward\n  - ufw allow 51820/udp\n```\n\nThe commands are executed in order as described in [wg-quick.8](https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8).\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\n`wireguard_address` is required as already mentioned. It's the IP of the interface name defined with `wireguard_interface` variable (`wg0` by default). Every host needs a unique VPN IP of course. If you don't set `wireguard_endpoint` the playbook will use the hostname defined in the `vpn` hosts group (the Ansible inventory hostname). If you set `wireguard_endpoint` to `\"\"` (empty string) that peer won't have a endpoint. That means that this host can only access hosts that have a `wireguard_endpoint`. That's useful for clients that don't expose any services to the VPN and only want to access services on other hosts. So if you only define one host with `wireguard_endpoint` set and all other hosts have `wireguard_endpoint` set to `\"\"` (empty string) that basically means you've only clients besides one which in that case is the WireGuard server. The third possibility is to set `wireguard_endpoint` to some hostname. E.g. if you have different hostnames for the private and public DNS of that host and need different DNS entries for that case setting `wireguard_endpoint` becomes handy. Take for example the IP above: `wireguard_address: \"10.8.0.101\"`. That's a private IP and I've created a DNS entry for that private IP like `host01.i.domain.tld` (`i` for internal in that case). For the public IP I've created a DNS entry like `host01.p.domain.tld` (`p` for public). The `wireguard_endpoint` needs to be a interface that the other members in the `vpn` group can connect to. So in that case I would set `wireguard_endpoint` to `host01.p.domain.tld` because WireGuard normally needs to be able to connect to the public IP of the other host(s).\n\nHere is a litte example for what I use the playbook: I use WireGuard to setup a fully meshed VPN (every host can directly connect to every other host) and run my Kubernetes (K8s) cluster at Hetzner Cloud (but you should be able to use any hoster you want). So the important components like the K8s controller and worker nodes (which includes the pods) only communicate via encrypted WireGuard VPN. Also (as already mentioned) I've two clients. Both have `kubectl` installed and are able to talk to the internal Kubernetes API server by using WireGuard VPN. One of the two clients also exposes a WireGuard endpoint because the Postfix mailserver in the cloud and my internal Postfix needs to be able to talk to each other. I guess that's maybe a not so common use case for WireGuard :D But it shows what's possible. So let me explain the setup which might help you to use this Ansible role.\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\nFirst, here is a part of my Ansible `hosts` file:\n\n```ini\n[vpn]\ncontroller0[1:3].i.domain.tld\nworker0[1:2].i.domain.tld\nserver.at.home.i.domain.tld\nworkstation.i.domain.tld\n\n[k8s_controller]\ncontroller0[1:3].i.domain.tld\n\n[k8s_worker]\nworker0[1:2].i.domain.tld\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nAs you can see I've three groups here: `vpn` (all hosts on that will get WireGuard installed), `k8s_controller` (the Kubernetes controller nodes) and `k8s_worker` (the Kubernetes worker nodes). The `i` in the domainname is for `internal`. All the `i.domain.tld` DNS entries have a `A` record that points to the WireGuard IP that we define shortly for every host e.g.: `controller01.i.domain.tld. IN A 10.8.0.101`. The reason for that is that all Kubernetes components only binds and listen on the WireGuard interface in my setup. And since I need this internal IPs for all my Kubernetes components I specify the internal DNS entries in my Ansible `hosts` file. That way I can use the Ansible inventory hostnames and variables very easy in the playbooks and templates.\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\nFor the Kubernetes controller nodes I've defined the following host variables:\n\nAnsible host file: `host_vars/controller01.i.domain.tld`\n\n```yml\n---\nwireguard_address: '10.8.0.101/24'\nwireguard_endpoint: 'controller01.p.domain.tld'\nansible_host: 'controller01.p.domain.tld'\nansible_python_interpreter: /usr/bin/python3\n```\n\nAnsible host file: `host_vars/controller02.i.domain.tld`:\n\n```yml\n---\nwireguard_address: '10.8.0.102/24'\nwireguard_endpoint: 'controller02.p.domain.tld'\nansible_host: 'controller02.p.domain.tld'\nansible_python_interpreter: /usr/bin/python3\n```\n\nAnsible host file: `host_vars/controller03.i.domain.tld`:\n\n```yml\n---\nwireguard_address: '10.8.0.103/24'\nwireguard_endpoint: 'controller03.p.domain.tld'\nansible_host: 'controller03.p.domain.tld'\nansible_python_interpreter: /usr/bin/python3\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nI've specified `ansible_python_interpreter` here for every node as the controller nodes use Ubuntu 18.04 which has Python 3 installed by default. `ansible_host` is set to the public DNS of that host. Ansible will use this hostname to connect to the host via SSH. I use the same value also for `wireguard_endpoint` because of the same reason. The WireGuard peers needs to connect to the other peers via a public IP (well at least via a IP that the WireGuard hosts can connect to - that could be of course also a internal IP if it works for you). The `wireguard_address` needs to be unique of course for every host.\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\nFor the Kubernetes worker I've defined the following variables:\n\nAnsible host file: `host_vars/worker01.i.domain.tld`\n\n```yml\n---\nwireguard_address: '10.8.0.111/24'\nwireguard_endpoint: 'worker01.p.domain.tld'\nwireguard_persistent_keepalive: '30'\nansible_host: 'worker01.p.domain.tld'\nansible_python_interpreter: /usr/bin/python3\n```\n\nAnsible host file: `host_vars/worker02.i.domain.tld`:\n\n```yml\n---\nwireguard_address: '10.8.0.112/24'\nwireguard_endpoint: 'worker02.p.domain.tld'\nwireguard_persistent_keepalive: '30'\nansible_host: 'worker02.p.domain.tld'\nansible_python_interpreter: /usr/bin/python3\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nAs you can see the variables are basically the same as the controller nodes have with one exception: `wireguard_persistent_keepalive: \"30\"`. My worker nodes (at Hetzner Cloud) and my internal server (my server at home) are connected because I've running Postfix at my cloud nodes and the external Postfix server forwards the received mails to my internal server (and vice versa). I needed the keepalive setting because from time to time the cloud instances and the internal server lost connection and this setting solved the problem. The reason for this is of course because my internal server is behind NAT and the firewall/router must keep the NAT/firewall mapping valid (NAT and Firewall Traversal Persistence).\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\nFor my internal server at home (connected via DSL router to the internet) we've this configuration:\n\n```yml\n---\nwireguard_address: '10.8.0.1/24'\nwireguard_endpoint: 'server.at.home.p.domain.tld'\nwireguard_persistent_keepalive: '30'\nansible_host: 192.168.2.254\nansible_port: 22\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nBy default the SSH daemon is listening on a different port than 22 on all of my public nodes but internally I use `22` and that's the reason to set `ansible_port: 22` here. Also `ansible_host` is of course a internal IP for that host. The `wireguard_endpoint` value is a dynamic DNS entry. Since my IP at home isn't static I need to run a script every minute at my home server that checks if the IP has changed and if so adjusts my DNS record. I use OVH's DynHost feature to accomplish this but you can use and DynDNS provider you want of course. Also I forward incoming traffic on port `51820/UDP` to my internal server to allow incoming WireGuard traffic. The `wireguard_address` needs to be of course part of our WireGuard subnet.\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\nAnd finally for my workstation (on which I run all `ansible-playbook` commands):\n\n```yml\nwireguard_address: '10.8.0.2/24'\nwireguard_endpoint: ''\nansible_connection: local\nansible_become: false\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nAs you can see `wireguard_endpoint: \"\"` is a empty string here. That means the Ansible role won't set an endpoint for my workstation. Since there is no need for the other hosts to connect to my workstation it doesn't makes sense to have a endpoint defined. So in this case I can access all hosts defined in the Ansible group `vpn` from my workstation but not the other way round. So the resulting WireGuard config for my workstation looks like this:\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n```ini\n[Interface]\nAddress = 10.8.0.2/24\nPrivateKey = ....\nListenPort = 51820\n\n[Peer]\nPrivateKey = ....\nAllowedIPs = 10.8.0.101/32\nEndpoint = controller01.p.domain.tld:51820\n\n[Peer]\nPrivateKey = ....\nAllowedIPs = 10.8.0.102/32\nEndpoint = controller02.p.domain.tld:51820\n\n[Peer]\nPrivateKey = ....\nAllowedIPs = 10.8.0.103/32\nEndpoint = controller03.p.domain.tld:51820\n\n[Peer]\nPrivateKey = ....\nAllowedIPs = 10.8.0.111/32\nPersistentKeepalive = 30\nEndpoint = worker01.p.domain.tld:51820\n\n[Peer]\nPrivateKey = ....\nAllowedIPs = 10.8.0.112/32\nPersistentKeepalive = 30\nEndpoint = worker02.p.domain.tld:51820\n\n[Peer]\nPrivateKey = ....\nAllowedIPs = 10.8.0.1/32\nPersistentKeepalive = 30\nEndpoint = server.at.home.p.domain.tld:51820\n```\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\nThe other WireGuard config files (`wg0.conf` by default) looks similar but of course `[Interface]` includes the config of that specific host and the `[Peer]` entries lists the config of the other hosts.\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n## Dependencies\n\nNone\n\n## Example Playbook\n\n```yml\n- hosts: all\n  roles:\n    - arillso.wireguard\n```\n\n## Author\n\n- [Simon Bärlocher](https://sbaerlocher.ch)\n\n## Inspired\n\n- [githubixx](https://github.com/githubixx/ansible-role-wireguard)\n\n## License\n\nThis project is under the MIT License. See the [LICENSE](licence) file for the full license text.\n\n## Copyright\n\n(c) 2020, Arillso\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farillso%2Fansible.wireguard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farillso%2Fansible.wireguard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farillso%2Fansible.wireguard/lists"}