62 lines
1.8 KiB
YAML
62 lines
1.8 KiB
YAML
|
---
|
||
|
|
# La clé privée du serveur est générée SUR le serveur et n'en sort
|
||
|
|
# jamais : pas de vault, pas de secret dans ce dépôt. `creates:` rend la
|
||
|
|
# génération idempotente - un ré-exécution ne régénère pas une clé déjà
|
||
|
|
# en place.
|
||
|
|
|
||
|
|
- name: Installer le paquet wireguard
|
||
|
|
ansible.builtin.apt:
|
||
|
|
name: wireguard
|
||
|
|
state: present
|
||
|
|
update_cache: true
|
||
|
|
|
||
|
|
- name: Restreindre les permissions du dossier /etc/wireguard
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/wireguard
|
||
|
|
state: directory
|
||
|
|
mode: "0700"
|
||
|
|
|
||
|
|
- name: Générer la clé privée si absente
|
||
|
|
ansible.builtin.shell: umask 077 && wg genkey > /etc/wireguard/privatekey
|
||
|
|
args:
|
||
|
|
creates: /etc/wireguard/privatekey
|
||
|
|
|
||
|
|
- name: Restreindre les permissions de la clé privée
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/wireguard/privatekey
|
||
|
|
mode: "0600"
|
||
|
|
|
||
|
|
- name: Dériver la clé publique correspondante
|
||
|
|
ansible.builtin.shell: wg pubkey < /etc/wireguard/privatekey > /etc/wireguard/publickey
|
||
|
|
args:
|
||
|
|
creates: /etc/wireguard/publickey
|
||
|
|
|
||
|
|
- name: Lire la clé privée (jamais affichée dans les logs)
|
||
|
|
ansible.builtin.slurp:
|
||
|
|
path: /etc/wireguard/privatekey
|
||
|
|
register: wg_private_key_raw
|
||
|
|
no_log: true
|
||
|
|
|
||
|
|
- name: Déployer wg0.conf
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: wg0.conf.j2
|
||
|
|
dest: /etc/wireguard/wg0.conf
|
||
|
|
mode: "0600"
|
||
|
|
no_log: true
|
||
|
|
notify: redémarrer wireguard
|
||
|
|
|
||
|
|
- name: Activer et démarrer wg-quick@wg0
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: wg-quick@wg0
|
||
|
|
state: started
|
||
|
|
enabled: true
|
||
|
|
|
||
|
|
- name: Lire la clé publique du serveur (information non sensible)
|
||
|
|
ansible.builtin.slurp:
|
||
|
|
path: /etc/wireguard/publickey
|
||
|
|
register: wg_public_key_raw
|
||
|
|
|
||
|
|
- name: Afficher la clé publique du serveur
|
||
|
|
ansible.builtin.debug:
|
||
|
|
msg: "Clé publique WireGuard du serveur : {{ (wg_public_key_raw.content | b64decode).strip() }}"
|