Added tunnel configuration

playbooks/tunnel.yaml

@@ -0,0 +1,37 @@
+- name: "Setup reverse-proxy tunnel"
+  hosts: berliet.medicenlutte.fr
+  vars_files:
+    - tunnel/vars.yml
+  tasks:
+
+    - name: Setup wireguard
+      ansible.builtin.apt:
+        name: wireguard
+        state: present
+      become: true
+
+    - name: Setup wireguard folder
+      ansible.builtin.file:
+        path: /etc/wireguard
+        state: directory
+        owner: root
+        group: root
+        mode: u=rwx,g=-rwx,o=-rwx
+      become: true
+    
+    - name: Setup wgkiwi wireguard
+      ansible.builtin.template:
+        src: tunnel/wgkiwi.conf
+        dest: /etc/wireguard/wgkiwi.conf
+        owner: root
+        group: root
+        mode: u=rwx,g=-rwx,o=-rwx
+      become: true
+    
+    - name: Setup wireguard interface
+      ansible.builtin.copy:
+        src: tunnel/wgkiwi_berlier
+        dest: /etc/network/interfaces.d/wgkiwi.conf
+        owner: root
+        group: root
+      become: true

playbooks/tunnel/vars.yml

@@ -0,0 +1,10 @@
+wireguard:
+  berliet.medicenlutte.fr:
+    private_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          65336335613631616562303635353039363535653039643761313530386561346666323332343334
+          6137623135303636376666633933316534303465663065330a363361363335316564346131656265
+          32306132653138616464393735613962373638313361633135323432613134616663666562353637
+          3566616666653337660a333462313032636561616362383566333937366236636130313830313637
+          35616561313937333830363931653337366233346637613535646330356664373637346133653836
+          3335393864303763643164343330643366353133636135376364

playbooks/tunnel/wgkiwi.conf

@@ -0,0 +1,10 @@
+[Interface]
+ListenPort = 51821
+PrivateKey = {{ wireguard['berliet.medicenlutte.fr'].private_key }}
+# PublicKey = U+6lZyerTeSd9Vj/+S4MUPKf8s0uT0S2DHzYfLL+giM=
+
+# VPS epickiwi.fr
+[Peer]
+Endpoint = [2001:41d0:404:200::1450]:51822
+PublicKey = cJSTZJVGTgEpxhGwxanOMy/DxmYTWCkKlb7hdrJvLRU=
+AllowedIps = fd7f:ec75:87c5::/64

playbooks/tunnel/wgkiwi_berlier

@@ -0,0 +1,7 @@
+auto wgkiwi
+allow-hotplug wgkiwi
+iface wgkiwi inet6 static
+	address fd7f:ec75:87c5::2/64
+	pre-up ip link add $IFACE type wireguard
+	pre-up wg setconf $IFACE /etc/wireguard/wgkiwi.conf
+	post-down ip link del $IFACE