{"id":24890411,"url":"https://github.com/voxpupuli/puppet-wireguard","last_synced_at":"2026-03-08T09:36:51.289Z","repository":{"id":37568940,"uuid":"384487784","full_name":"voxpupuli/puppet-wireguard","owner":"voxpupuli","description":"Puppet module to setup wireguard with systemd","archived":false,"fork":false,"pushed_at":"2024-12-14T15:50:55.000Z","size":291,"stargazers_count":4,"open_issues_count":6,"forks_count":17,"subscribers_count":39,"default_branch":"master","last_synced_at":"2025-01-30T18:47:43.484Z","etag":null,"topics":["archlinux-puppet-module","debian-puppet-module","gentoo-puppet-module","hacktoberfest","linux-puppet-module","puppet","ubuntu-puppet-module"],"latest_commit_sha":null,"homepage":null,"language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/voxpupuli.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"open_collective":"vox-pupuli","github":"voxpupuli"}},"created_at":"2021-07-09T16:03:08.000Z","updated_at":"2024-12-14T15:50:59.000Z","dependencies_parsed_at":"2023-11-09T13:03:14.178Z","dependency_job_id":"b710a260-3eae-406e-9afc-0d560bc44306","html_url":"https://github.com/voxpupuli/puppet-wireguard","commit_stats":{"total_commits":156,"total_committers":17,"mean_commits":9.176470588235293,"dds":0.3910256410256411,"last_synced_commit":"3f959728e4a94e4a63c76315bd71853cadc232b3"},"previous_names":[],"tags_count":25,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-wireguard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-wireguard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-wireguard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-wireguard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/voxpupuli","download_url":"https://codeload.github.com/voxpupuli/puppet-wireguard/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":236692743,"owners_count":19189765,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["archlinux-puppet-module","debian-puppet-module","gentoo-puppet-module","hacktoberfest","linux-puppet-module","puppet","ubuntu-puppet-module"],"created_at":"2025-02-01T17:15:26.195Z","updated_at":"2025-10-16T07:30:53.940Z","avatar_url":"https://github.com/voxpupuli.png","language":"Ruby","funding_links":["https://opencollective.com/vox-pupuli","https://github.com/sponsors/voxpupuli"],"categories":[],"sub_categories":[],"readme":"# puppet-wireguard\n\n[![Build Status](https://github.com/voxpupuli/puppet-wireguard/workflows/CI/badge.svg)](https://github.com/voxpupuli/puppet-wireguard/actions?query=workflow%3ACI)\n[![Release](https://github.com/voxpupuli/puppet-wireguard/actions/workflows/release.yml/badge.svg)](https://github.com/voxpupuli/puppet-wireguard/actions/workflows/release.yml)\n[![Puppet Forge](https://img.shields.io/puppetforge/v/puppet/wireguard.svg)](https://forge.puppetlabs.com/puppet/wireguard)\n[![Puppet Forge - downloads](https://img.shields.io/puppetforge/dt/puppet/wireguard.svg)](https://forge.puppetlabs.com/puppet/wireguard)\n[![Puppet Forge - endorsement](https://img.shields.io/puppetforge/e/puppet/wireguard.svg)](https://forge.puppetlabs.com/puppet/wireguard)\n[![Puppet Forge - scores](https://img.shields.io/puppetforge/f/puppet/wireguard.svg)](https://forge.puppetlabs.com/puppet/wireguard)\n[![puppetmodule.info docs](http://www.puppetmodule.info/images/badge.png)](http://www.puppetmodule.info/m/puppet-wireguard)\n[![AGPL v3 License](https://img.shields.io/github/license/voxpupuli/puppet-wireguard.svg)](LICENSE)\n\nPuppet module to configure wireguard through systemd-networkd configs\n\n* [Setup](#setup)\n* [Example configurations](#example-configurations)\n* [Parameter reference](#parameter-reference)\n* [Tests](#tests)\n* [Contributions](#contributions)\n* [License and Author](#-icense-and-author)\n\n## Setup\n\nThe module can create firewall rules with [voxpupuli/nftables](https://github.com/voxpupuli/puppet-nftables?tab=readme-ov-file#nftables-puppet-module).\nThis is enabled by default but can be disabled by setting the `manage_firewall`\nparameter to false in the `wireguard::interface` defined resource. You need to\nhave the `nftables` class in your catalog to use the feature (Version 3.6.0 or\nnewer).\n\n**Version 3 and older of the module use voxpupuli/ferm to manage firewall rules**\n\nThis module can use [systemd-networkd](https://www.freedesktop.org/software/systemd/man/systemd-networkd.html) or [wg-quick](https://manpages.debian.org/wg-quick) to\nconfigure tunnels. For the former, you need to have a systemd-networkd\nservice resource in your catalog. We recommend [voxpupuli/systemd](https://github.com/voxpupuli/puppet-systemd#systemd)\nwith `manage_networkd` set to true. You do not need to configure your\nentire network with `systemd-networkd`, only the tunnels. That said,\n`wg-quick` might be better a better match if you do not want to touch\n`systemd`.\n\nFurthermore, this module assumes that you've a dualstack machine. Your IPv4 and\nIPv6 addresses will be automatically set to the `destination_addresses` array\nfrom the `wireguard::interface` defined resource. If you don't have dualstack\nyou need to overwrite the parameter.\n\nThere is a structured fact called `wireguard_pubkeys` which is a hash with each\nfilename without the `.pub` and the content (the public key):\n\n```\n# facter -p wireguard_pubkeys\n{\n  as1234 =\u003e \"40mH10BbolserhidsruhieudrstlJBB7fxvoPlU=\",\n  as5678 =\u003e \"Tci/bHoPColserjfoisehrjioesurrhGpEN+NDueNjUvBA=\",\n  asblub =\u003e \"M7lTopd2koserhioesrhiouwerhpcvqSWEviI=\",\n  notebook =\u003e \"sK9Ld+p1eH4id+BAuM6lserheoishriouwKhgwFf/HRw=\",\n  lan =\u003e \"dIXj6QcWGBWTzq0pwoerjow4eroiwe4jr4CGkXUID3J8rO2k=\"\n}\n```\n## Example configurations\n\nconfigure a tunnel with the name as9876.\n* listen for incoming traffic on port 9876\n* create a ferm rule to allow traffic on the global IPv4/IPv6 addresses\n* configure the provided public key from the peer\n* assign a IPv4 and IPv6 prefix on the tunnel interface\n\n```puppet\nwireguard::interface {'as9876':\n  source_addresses =\u003e ['2003:4e0:c17:5d::1', '195.37.53.176'],\n  public_key       =\u003e 'BcxLll1BVxGkehriuehrFvjvX+EBhS4vcDn0R0=',\n  endpoint         =\u003e 'wireguard.example.com:53668',\n  addresses        =\u003e [{'Address' =\u003e '192.168.123.6/30',},{'Address' =\u003e 'fe80::beef:1/64'},],\n}\n```\n\nconfigure a tunnel with the name as1234\n* listen on port 9876\n* don't create firewall rules\n* assign a IPv4 and IPv6 prefix on the tunnel interface\n  * use /32 for the IPv4 address and add a peer route\n\n```puppet\nwireguard::interface {'as1234':\n  manage_firewall =\u003e false,\n  public_key      =\u003e 'B1xSG/XTJRLd+GrWDsB06BqnIq8Xud93YVh/LYYYtUY=',\n  endpoint        =\u003e 'wireguard.example.com:53668',\n  addresses       =\u003e [{'Address' =\u003e '192.168.218.87/32', 'Peer' =\u003e '172.20.53.97/32'}, {'Address' =\u003e 'fe80::ade1/64',},],\n}\n````\n\nMore examples are available in the [REFERENCE.md](./REFERENCE.md) file.\n\n## Parameter reference\n\nAll parameters are documented with puppet-strings. You can view the\nmarkdown-rendered result at [REFERENCE.md](./REFERENCE.md).\n\n## Tests\n\nThis module has several unit tests and linters configured. You can execute them\nby running:\n\n```sh\nbundle exec rake test\n```\n\nDetailed instructions are in the [CONTRIBUTING.md](.github/CONTRIBUTING.md)\nfile.\n\n## Contributions\n\nContribution is fairly easy:\n\n* Fork the module into your namespace\n* Create a new branch\n* Commit your bugfix or enhancement\n* Write a test for it (maybe start with the test first)\n* Create a pull request\n\nDetailed instructions are in the [CONTRIBUTING.md](.github/CONTRIBUTING.md)\nfile.\n\n## License and Author\n\nThis module was originally written by [Tim Meusel](https://github.com/bastelfreak).\nIt's licensed with [AGPL version 3](LICENSE).\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fpuppet-wireguard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvoxpupuli%2Fpuppet-wireguard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fpuppet-wireguard/lists"}