Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Won't change interface IP with syncconf #175

Open
emestee opened this issue Jan 17, 2023 · 0 comments
Open

Won't change interface IP with syncconf #175

emestee opened this issue Jan 17, 2023 · 0 comments

Comments

@emestee
Copy link

emestee commented Jan 17, 2023

The syncconf method only applies wg(8) configuration that's produced by wg-quick strip, which excludes routes and the interface address that would be set up by wg-quick up ordinarily. This means that if we want to change the IP on a previously configured interface, wireguard_interface_restart must be set to true. This should be noted in the readme.

A subsequent problem is the loss of idempotence. Restart/syncconf is only applied if there was a change to the interface configuration file; but the configuration file does not necessary reflect the actual interface configuration. This means that if the runtime configuration was mangled, Ansible will not detect it. Conversely, if we change the IP without wireguard_interface_restart, the IP will not change and the next ansible run will not change it even with wireguard_interface_restart because the configuration file already reflects the change from the previous run so restart/syncconf is not applied.

One possible workaround to this problem would be to do wg-quick save prior to generating the new configuration file, but that's a kludge because it would require the role configuration template to behave exactly like the output of wg-quick save.

Realistically, correct update of the interface routes and IP is not possible with wg-quick without restarting the interface. This is because the functionality that wg-quick up invokes is not exposed.

It appears that the readme should be explicit that for proper idempotence, restarts (and therefore interruption of traffic) are not optional.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant