wg_server.yml

---
- name: Set up wireguard server as a bounce-node
  hosts: all
  remote_user: root
  vars:
      wan_iface: enp1s0
      wg_iface: wg0
      wg_port: 1198
  tasks:
    - name: Install required packages
      apt:
        pkg:
          - wireguard
          - wireguard-tools
          - nftables
        state: latest
    - name: Remove UFW firewall if present
      apt:
        name: ufw
        state: absent
        purge: yes
    - name: Enable IP forwarding
      ansible.posix.sysctl:
        name: net.ipv4.ip_forward
        value: "1"
        state: present
        sysctl_set: yes
        reload: yes
    - name: Set up firewall configuration
      template:
        dest: /etc/nftables.conf
        src: wg_server_nftables.j2
        owner: root
        group: root
        mode: '0755'
    # Generate wireguard keys
    - name: Generate server key
      command: "wg genkey"
      register: wg_server_key
    - name: Calculate server public key
      shell: "echo {{ wg_server_key.stdout }} | wg pubkey "
      register: wg_server_pubkey
    - name: Generate client key
      command: "wg genkey"
      register: wg_client_key
    - name: Calculate client public key
      shell: "echo {{ wg_client_key.stdout }} | wg pubkey "
      register: wg_client_pubkey
    # Print client-side information to user
    - debug:
        msg: "Client Private Key: {{ wg_client_key.stdout }}"
    - debug:
        msg: "Server Public Key: {{ wg_server_pubkey.stdout }}"

    # Configure persistent wireguard with systemd
    - name: Set up wireguard configuration
      template:
          dest: /etc/wireguard/wg0.conf
          src: wg_server_wg0_conf.j2
          owner: root
          group: root
          mode: '0600'
    - name: Enable and start wg-quick service (to bring up wg0 persistently)
      systemd:
        name: wg-quick@wg0
        state: started
        enabled: yes

    # This can only happen after the 'wg_iface' is created because the config
    # references that interface
    - name: Enable firewall configuration
      systemd:
        name: nftables
        state: started
        enabled: yes