{"id":13638746,"url":"https://github.com/jmhale/terraform-aws-wireguard","last_synced_at":"2025-04-06T19:14:08.933Z","repository":{"id":33024092,"uuid":"149299254","full_name":"jmhale/terraform-aws-wireguard","owner":"jmhale","description":"Terraform module to deploy WireGuard on AWS","archived":false,"fork":false,"pushed_at":"2024-06-24T14:29:53.000Z","size":114,"stargazers_count":133,"open_issues_count":7,"forks_count":141,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-30T17:11:18.111Z","etag":null,"topics":["aws","terraform","terraform-modules","vpn","wireguard"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jmhale.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-09-18T14:10:27.000Z","updated_at":"2025-03-21T19:28:26.000Z","dependencies_parsed_at":"2024-01-14T09:08:52.768Z","dependency_job_id":"c2e7134a-9bcc-49ab-b75c-24d967e5547f","html_url":"https://github.com/jmhale/terraform-aws-wireguard","commit_stats":{"total_commits":96,"total_committers":11,"mean_commits":8.727272727272727,"dds":0.4375,"last_synced_commit":"5daaaac5d85cfa0ace30d76a9a3b7560203f265c"},"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jmhale%2Fterraform-aws-wireguard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jmhale%2Fterraform-aws-wireguard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jmhale%2Fterraform-aws-wireguard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jmhale%2Fterraform-aws-wireguard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jmhale","download_url":"https://codeload.github.com/jmhale/terraform-aws-wireguard/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247535521,"owners_count":20954576,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","terraform","terraform-modules","vpn","wireguard"],"created_at":"2024-08-02T01:00:52.851Z","updated_at":"2025-04-06T19:14:08.879Z","avatar_url":"https://github.com/jmhale.png","language":"HCL","funding_links":[],"categories":["Projects"],"sub_categories":["Deployment"],"readme":"# terraform-aws-wireguard\n\nA Terraform module to deploy a WireGuard VPN server on AWS. Can also used to run one or more servers behind a loadbalancer, for redundancy.\n\n## Prerequisites\nBefore using this module, you'll need to generate a key pair for your server and client, and store the server's private key and client's public key in AWS SSM, which cloud-init will source and add to WireGuard's configuration.\n\n- Install the WireGuard tools for your OS: https://www.wireguard.com/install/\n- Generate a key pair for each client\n  - `wg genkey | tee client1-privatekey | wg pubkey \u003e client1-publickey`\n- Generate a key pair for the server\n  - `wg genkey | tee server-privatekey | wg pubkey \u003e server-publickey`\n- Add the server private key to the AWS SSM parameter: `/wireguard/wg-server-private-key`\n  - `aws ssm put-parameter --name /wireguard/wg-server-private-key --type SecureString --value $ServerPrivateKeyValue`\n- Add each client's public key, along with the next available IP address as a key:value pair to the wg_client_public_keys map. See Usage for details.\n\n## Variables\n| Variable Name | Type | Required |Description |\n|---------------|-------------|-------------|-------------|\n|`subnet_ids`|`list`|Yes|A list of subnets for the Autoscaling Group to use for launching instances. May be a single subnet, but it must be an element in a list.|\n|`ssh_key_id`|`string`|Yes|A SSH public key ID to add to the VPN instance.|\n|`vpc_id`|`string`|Yes|The VPC ID in which Terraform will launch the resources.|\n|`env`|`string`|Optional - defaults to `prod`|The name of environment for WireGuard. Used to differentiate multiple deployments.|\n|`use_eip`|`bool`|Optional|Whether to attach an [Elastic IP](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) address to the VPN server. Useful for avoiding changing IPs.|\n|`eip_id`|`string`|Optional|When `use_eip` is enabled, specify the ID of the Elastic IP to which the VPN server will attach.|\n|`target_group_arns`|`string`|Optional|The Loadbalancer Target Group to which the vpn server ASG will attach.|\n|`additional_security_group_ids`|`list`|Optional|Used to allow added access to reach the WG servers or allow loadbalancer health checks.|\n|`asg_min_size`|`integer`|Optional - default to `1`|Number of VPN servers to permit minimum, only makes sense in loadbalanced scenario.|\n|`asg_desired_capacity`|`integer`|Optional - default to `1`|Number of VPN servers to maintain, only makes sense in loadbalanced scenario.|\n|`asg_max_size`|`integer`|Optional - default to `1`|Number of VPN servers to permit maximum, only makes sense in loadbalanced scenario.|\n|`instance_type`|`string`|Optional - defaults to `t2.micro`|Instance Size of VPN server.|\n|`wg_server_net`|`cidr address and netmask`|Yes|The server ip allocation and net - wg_client_public_keys entries MUST be in this netmask range.|\n|`wg_client_public_keys`|`list`|Yes|List of maps of client IP/netmasks and public keys. See Usage for details. See Examples for formatting.|\n|`wg_server_port`|`integer`|Optional - defaults to `51820`|Port to run wireguard service on, wireguard standard is 51820.|\n|`wg_persistent_keepalive`|`integer`|Optional - defaults to `25`|Regularity of Keepalives, useful for NAT stability.|\n|`wg_server_private_key_param`|`string`|Optional - defaults to `/wireguard/wg-server-private-key`|The Parameter Store key to use for the VPN server Private Key.|\n|`ami_id`|`string`|Optional - defaults to the newest Ubuntu 16.04 AMI|AMI to use for the VPN server.|\n|`wg_server_interface`|`string`|Optional - defaults to eth0|Server interface to route traffic to for installations forwarding traffic to private networks.|\n\n## Examples\n\nPlease see the following examples to understand usage with the relevant options.\n\n### Simple Elastic IP/public subnet usage\n\nSee [examples/simple_eip/main.tf](examples/simple_eip/main.tf) file.\n\n### Complex Elastic Load Balancer/private subnet usage\n\nSee [examples/complex_elb/main.tf](examples/complex_elb/main.tf) file.\n\n## Outputs\n| Output Name | Description |\n|---------------|-------------|\n|`vpn_asg_name`|The name of the wireguard Auto Scaling Group|\n|`vpn_sg_admin_id`|ID of the internal Security Group to associate with other resources needing to be accessed on VPN.|\n|`vpn_sg_external_id`|ID of the external Security Group to associate with the VPN.|\n\n## Caveats\n\n- I would strongly recommend forking this repo or cloning it locally and change the `source` definition to be something that you control. You really don't want your infra to be at the mercy of my changes.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjmhale%2Fterraform-aws-wireguard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjmhale%2Fterraform-aws-wireguard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjmhale%2Fterraform-aws-wireguard/lists"}