From 82f5efd2ec518abdc07971aea16e2ebfad113f65 Mon Sep 17 00:00:00 2001
From: EpicKiwi <me@epickiwi.fr>
Date: Wed, 4 Nov 2026 20:33:06 +0100
Subject: [PATCH] Added tunnel configuration

---
 playbooks/tunnel.yaml           | 37 +++++++++++++++++++++++++++++++++
 playbooks/tunnel/vars.yml       | 10 +++++++++
 playbooks/tunnel/wgkiwi.conf    | 10 +++++++++
 playbooks/tunnel/wgkiwi_berlier |  7 +++++++
 4 files changed, 64 insertions(+)
 create mode 100644 playbooks/tunnel.yaml
 create mode 100644 playbooks/tunnel/vars.yml
 create mode 100644 playbooks/tunnel/wgkiwi.conf
 create mode 100644 playbooks/tunnel/wgkiwi_berlier

diff --git a/playbooks/tunnel.yaml b/playbooks/tunnel.yaml
new file mode 100644
index 0000000..10f2950
--- /dev/null
+++ b/playbooks/tunnel.yaml
@@ -0,0 +1,37 @@
+- name: "Setup reverse-proxy tunnel"
+  hosts: berliet.medicenlutte.fr
+  vars_files:
+    - tunnel/vars.yml
+  tasks:
+
+    - name: Setup wireguard
+      ansible.builtin.apt:
+        name: wireguard
+        state: present
+      become: true
+
+    - name: Setup wireguard folder
+      ansible.builtin.file:
+        path: /etc/wireguard
+        state: directory
+        owner: root
+        group: root
+        mode: u=rwx,g=-rwx,o=-rwx
+      become: true
+    
+    - name: Setup wgkiwi wireguard
+      ansible.builtin.template:
+        src: tunnel/wgkiwi.conf
+        dest: /etc/wireguard/wgkiwi.conf
+        owner: root
+        group: root
+        mode: u=rwx,g=-rwx,o=-rwx
+      become: true
+    
+    - name: Setup wireguard interface
+      ansible.builtin.copy:
+        src: tunnel/wgkiwi_berlier
+        dest: /etc/network/interfaces.d/wgkiwi.conf
+        owner: root
+        group: root
+      become: true
\ No newline at end of file
diff --git a/playbooks/tunnel/vars.yml b/playbooks/tunnel/vars.yml
new file mode 100644
index 0000000..558baf6
--- /dev/null
+++ b/playbooks/tunnel/vars.yml
@@ -0,0 +1,10 @@
+wireguard:
+  berliet.medicenlutte.fr:
+    private_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          65336335613631616562303635353039363535653039643761313530386561346666323332343334
+          6137623135303636376666633933316534303465663065330a363361363335316564346131656265
+          32306132653138616464393735613962373638313361633135323432613134616663666562353637
+          3566616666653337660a333462313032636561616362383566333937366236636130313830313637
+          35616561313937333830363931653337366233346637613535646330356664373637346133653836
+          3335393864303763643164343330643366353133636135376364
\ No newline at end of file
diff --git a/playbooks/tunnel/wgkiwi.conf b/playbooks/tunnel/wgkiwi.conf
new file mode 100644
index 0000000..a148ff6
--- /dev/null
+++ b/playbooks/tunnel/wgkiwi.conf
@@ -0,0 +1,10 @@
+[Interface]
+ListenPort = 51821
+PrivateKey = {{ wireguard['berliet.medicenlutte.fr'].private_key }}
+# PublicKey = U+6lZyerTeSd9Vj/+S4MUPKf8s0uT0S2DHzYfLL+giM=
+
+# VPS epickiwi.fr
+[Peer]
+Endpoint = [2001:41d0:404:200::1450]:51822
+PublicKey = cJSTZJVGTgEpxhGwxanOMy/DxmYTWCkKlb7hdrJvLRU=
+AllowedIps = fd7f:ec75:87c5::/64
diff --git a/playbooks/tunnel/wgkiwi_berlier b/playbooks/tunnel/wgkiwi_berlier
new file mode 100644
index 0000000..4813f31
--- /dev/null
+++ b/playbooks/tunnel/wgkiwi_berlier
@@ -0,0 +1,7 @@
+auto wgkiwi
+allow-hotplug wgkiwi
+iface wgkiwi inet6 static
+	address fd7f:ec75:87c5::2/64
+	pre-up ip link add $IFACE type wireguard
+	pre-up wg setconf $IFACE /etc/wireguard/wgkiwi.conf
+	post-down ip link del $IFACE