Merge pull request #13 from lablabs/feat/new_features

Michal Muransky · web-flow · commit 6b9727b9dba3 · 2022-10-26T13:38:32.000+02:00
Feat/new features
diff --git a/.github/RELEASE_DRAFTER.yml b/.github/RELEASE_DRAFTER.yml
@@ -13,6 +13,19 @@ categories:
       - 'bug'
   - title: 'Documentation'
     label: 'documentation'
+version-resolver:
+  major:
+    labels:
+      - 'major'
+  minor:
+    labels:
+      - 'enhancement'
+      - 'feature'
+  patch:
+    labels:
+      - 'ci'
+      - 'bug'
+  default: patch
 change-template: '- $TITLE, by @$AUTHOR (#$NUMBER)'
 template: |
   # What's changed
diff --git a/.github/workflows/galaxy.yaml b/.github/workflows/galaxy.yaml
@@ -10,7 +10,7 @@ jobs:
   release:
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Get the version name from the tags
         run: echo "RELEASE_VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
diff --git a/.github/workflows/molecule.yaml b/.github/workflows/molecule.yaml
@@ -30,19 +30,23 @@ jobs:
           - image: "ubuntu2204"
             tag: "latest"
     steps:
+      - name: Fix Git safe directories issue when in containers
+        # cf: https://github.com/actions/checkout/issues/760
+        run: git config --global --add safe.directory /__w/ansible-collection-wireguard/ansible-collection-wireguard
+
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           path: "${{ github.repository }}"
 
       - name: Molecule for Ansible
-        uses: robertdebock/molecule-action@4.0.7
+        uses: robertdebock/molecule-action@4.0.9
         with:
           image: ${{ matrix.config.image }}
           tag: ${{ matrix.config.tag }}
 
       - name: Upload configs
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: client-configs
           path: clients/
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
@@ -10,7 +10,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: actions/setup-python@v2
 
     - name: Run pre-commit
diff --git a/.gitignore b/.gitignore
@@ -1 +1,2 @@
 clients
+server
diff --git a/README.md b/README.md
@@ -2,7 +2,7 @@
 
 [![Molecule test](https://github.com/lablabs/ansible-collection-wireguard/actions/workflows/molecule.yaml/badge.svg)](https://github.com/lablabs/ansible-collection-wireguard/actions/workflows/molecule.yaml)
 
-[<img src="ll-logo.png">](https://lablabs.io/)
+[<img src="https://lablabs.io/static/ll-logo.png" width=350px>](https://lablabs.io/)
 
 Wireguard VPN Server Ansible Collection.
 
@@ -62,9 +62,9 @@ You may want to create a playbook to run all 3 playbooks in one run:
   tags: wireguard
 ```
 
-## Variables
+## Ansible Roles in this collection
 
-[Wireguard Role Variables](roles/wireguard/defaults/main.yml)
+[Wireguard README](roles/wireguard/README.md)
 
 ## License
 
diff --git a/galaxy.yml b/galaxy.yml
@@ -1,7 +1,7 @@
 ---
 namespace: lablabs
 name: wireguard
-version: "0.2.6"
+version: "0.3.0"
 readme: README.md
 authors:
   - Labyrinth Labs <info@lablabs.io>
@@ -10,7 +10,7 @@ license_file: LICENSE
 tags: [wireguard, vpn, system, linux, security, networking]
 dependencies:
   devsec.hardening: "7.12.0"
-  robertdebock.development_environment: "2.1.1"
+  robertdebock.roles: "1.9.7"
 repository: https://github.com/lablabs/ansible-collection-wireguard
 documentation: https://github.com/lablabs/ansible-collection-wireguard
 homepage: https://www.lablabs.io
diff --git a/molecule/default/collections.yml b/molecule/default/collections.yml
@@ -2,4 +2,4 @@
 ---
 collections:
   - devsec.hardening
-  - robertdebock.development_environment
+  - robertdebock.roles
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
@@ -19,6 +19,8 @@
     wireguard_dir: /data/wireguard
     wireguard_address: 10.214.214.0/24
     wireguard_download_clients: true
+    wireguard_download_serverkeys: true
+    wireguard_same_keys: true
     wireguard_additional_routes:
       - 172.11.0.0/16
       - 172.22.0.0/20
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
@@ -7,11 +7,15 @@ dependency:
     requirements-file: collections.yml
 driver:
   name: docker
-lint: |
-  yamllint -s .
-  ansible-lint --exclude molecule/ --exclude playbooks/
 platforms:
-  - name: instance
+  - name: instance1
+    image: "geerlingguy/docker-${image:-ubuntu2004}-ansible:${tag:-latest}"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    privileged: true
+    pre_build_image: ${MOLECULE_PREBUILT:-true}
+  - name: instance2
     image: "geerlingguy/docker-${image:-ubuntu2004}-ansible:${tag:-latest}"
     command: ${MOLECULE_DOCKER_COMMAND:-""}
     volumes:
diff --git a/playbooks/disk.yml b/playbooks/disk.yml
@@ -6,23 +6,23 @@
 
   tasks:
   - name: Create ext4 partition for on Data disk
-    parted:
+    community.general.parted:
       device: "{{ data_disk | default('/dev/nvme1n1') }}"
       number: 1
       state: present
       fs_type: ext4
-    when: ( configure_data_disk | default(false) )
+    when: (configure_data_disk | default(false))
 
   - name: Create a ext4 filesystem on additional disk
-    filesystem:
+    community.general.filesystem:
       fstype: ext4
       dev: "{{ data_disk_partition | default('/dev/nvme1n1p1') }}"
-    when: ( configure_data_disk | default(false) )
+    when: (configure_data_disk | default(false))
 
   - name: Mount additional disk
-    mount:
+    ansible.posix.mount:
       path: "{{ data_disk_mount | default('/data') }}"
       src: "{{ data_disk_partition | default('/dev/nvme1n1p1') }}"
       fstype: ext4
       state: mounted
-    when: ( configure_data_disk | default(false) )
+    when: (configure_data_disk | default(false))
diff --git a/playbooks/security.yml b/playbooks/security.yml
@@ -7,4 +7,4 @@
   roles:
     - name: devsec.hardening.ssh_hardening
     - name: devsec.hardening.os_hardening
-    - name: robertdebock.development_environment.fail2ban
+    - name: robertdebock.roles.fail2ban
diff --git a/playbooks/wireguard.yml b/playbooks/wireguard.yml
@@ -9,15 +9,15 @@
 
   post_tasks:
     - name: Install iptables-persistent
-      apt:
+      ansible.builtin.apt:
         name:
           - iptables
           - iptables-persistent
         state: present
         update_cache: true
 
     - name: Setup MASQUERADE for server access through vpn server
-      iptables:
+      ansible.builtin.iptables:
         chain: POSTROUTING
         jump: MASQUERADE
         table: nat
@@ -30,7 +30,7 @@
         path: /etc/iptables/rules.v4
 
     - name: Setup ipv4 IP forward
-      sysctl:
+      ansible.posix.sysctl:
         name: net.ipv4.ip_forward
         value: 1
         sysctl_set: true
diff --git a/roles/wireguard/README.md b/roles/wireguard/README.md
@@ -2,6 +2,8 @@
 
 This Ansible role will deploy [Wireguard](https://www.wireguard.com/) VPN tunnel and setup peers.
 
+[<img src="https://lablabs.io/static/ll-logo.png" width=350px>](https://lablabs.io/)
+
 ## Requirements
 
 Wireguard Ansible Role requires root access rights with global `become: true`.
@@ -14,19 +16,30 @@ This is a copy of `defaults/main.yml`.
 
 ```yaml
 ---
----
 # Directory to store WireGuard configuration on the remote hosts
 wireguard_dir: /etc/wireguard
 wireguard_clients_dir: "{{ wireguard_dir }}/clients"
 
+# Download client configs
 wireguard_clients_download_dir: clients/
 wireguard_download_clients: false
 
-# Predefined wireguard keys, this usually should be defined in ansible-vault
+# Download private, public and preshared keys
+wireguard_serverkeys_download_dir: server/
+wireguard_download_serverkeys: false
+
+# Path to Wireguard keys
 wireguard_privatekey_path: "{{ wireguard_dir }}/privatekey"
 wireguard_publickey_path: "{{ wireguard_dir }}/publickey"
 wireguard_presharedkey_path: "{{ wireguard_dir }}/presharedkey"
 
+# When defined, Ansible will restore wireguard keys (private key, public key, preshared key) from this directory.
+# NOTE: The directory path must end with "/"
+wireguard_restore_serverkeys_dir: ""
+
+# Configure all servers with same wireguard keys.
+wireguard_same_keys: false
+
 wireguard_systemd_path: /etc/systemd/network
 
 # Wireguard packages
@@ -49,16 +62,16 @@ wireguard_interface: wg0
 # Base wireguard subnet
 wireguard_address: 10.213.213.0/24
 
-wireguard_server_ip: "{{ wireguard_address | ipaddr('network') | ipmath(1) }}"
-wireguard_subnetmask: "{{ wireguard_address | ipaddr('prefix') }}"
-wireguard_peers_allowed_ips: "{{ ([(_wireguard_interface_addr | ipaddr('network/prefix'))] + (wireguard_additional_routes|default([]))) | join(\", \") }}"
+wireguard_server_ip: "{{ wireguard_address | ansible.utils.ipaddr('network') | ansible.utils.ipmath(1) }}"
+wireguard_subnetmask: "{{ wireguard_address | ansible.utils.ipaddr('prefix') }}"
+wireguard_peers_allowed_ips: "{{ ([(_wireguard_interface_addr | ansible.utils.ipaddr('network/prefix'))] + (wireguard_additional_routes | default([]))) | join(\", \") }}"
 
 # This role works only with PrivateKeyFile/PresharedKeyFile.
 wireguard_systemd_netdev:
   - NetDev:
       - Name: "{{ wireguard_interface }}"
       - Kind: wireguard
-      - Description: "wireguard server: {{ wireguard_interface}} server on {{ wireguard_address }}"
+      - Description: "wireguard server: {{ wireguard_interface }} server on {{ wireguard_address }}"
   - WireGuard:
       - PrivateKey: "{{ _privkey_value['content'] | b64decode }}"
       - ListenPort: "{{ wireguard_port }}"
@@ -93,7 +106,6 @@ wireguard_peers: []
 # Test Wirequard public keys and find possible errors
 # This will check the lenght of the key (44 characters) and test if it's a valid base64 string.
 run_publickey_pre_check: true
-
 ```
 
 ## Playbook example
diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml
@@ -3,14 +3,26 @@
 wireguard_dir: /etc/wireguard
 wireguard_clients_dir: "{{ wireguard_dir }}/clients"
 
+# Download client configs
 wireguard_clients_download_dir: clients/
 wireguard_download_clients: false
 
-# Predefined wireguard keys, this usually should be defined in ansible-vault
+# Download private, public and preshared keys
+wireguard_serverkeys_download_dir: server/
+wireguard_download_serverkeys: false
+
+# Path to Wireguard keys
 wireguard_privatekey_path: "{{ wireguard_dir }}/privatekey"
 wireguard_publickey_path: "{{ wireguard_dir }}/publickey"
 wireguard_presharedkey_path: "{{ wireguard_dir }}/presharedkey"
 
+# When defined, Ansible will restore wireguard keys (private key, public key, preshared key) from this directory.
+# NOTE: The directory path must end with "/"
+wireguard_restore_serverkeys_dir: ""
+
+# Configure all servers with same wireguard keys.
+wireguard_same_keys: false
+
 wireguard_systemd_path: /etc/systemd/network
 
 # Wireguard packages
@@ -33,16 +45,16 @@ wireguard_interface: wg0
 # Base wireguard subnet
 wireguard_address: 10.213.213.0/24
 
-wireguard_server_ip: "{{ wireguard_address | ipaddr('network') | ipmath(1) }}"
-wireguard_subnetmask: "{{ wireguard_address | ipaddr('prefix') }}"
-wireguard_peers_allowed_ips: "{{ ([(_wireguard_interface_addr | ipaddr('network/prefix'))] + (wireguard_additional_routes|default([]))) | join(\", \") }}"
+wireguard_server_ip: "{{ wireguard_address | ansible.utils.ipaddr('network') | ansible.utils.ipmath(1) }}"
+wireguard_subnetmask: "{{ wireguard_address | ansible.utils.ipaddr('prefix') }}"
+wireguard_peers_allowed_ips: "{{ ([(_wireguard_interface_addr | ansible.utils.ipaddr('network/prefix'))] + (wireguard_additional_routes | default([]))) | join(\", \") }}"
 
 # This role works only with PrivateKeyFile/PresharedKeyFile.
 wireguard_systemd_netdev:
   - NetDev:
       - Name: "{{ wireguard_interface }}"
       - Kind: wireguard
-      - Description: "wireguard server: {{ wireguard_interface}} server on {{ wireguard_address }}"
+      - Description: "wireguard server: {{ wireguard_interface }} server on {{ wireguard_address }}"
   - WireGuard:
       - PrivateKey: "{{ _privkey_value['content'] | b64decode }}"
       - ListenPort: "{{ wireguard_port }}"
diff --git a/roles/wireguard/handlers/main.yml b/roles/wireguard/handlers/main.yml
@@ -1,10 +1,10 @@
 ---
 
-- name: reload systemd
-  systemd:
+- name: Reload systemd
+  ansible.builtin.systemd:
     daemon_reload: true
 
-- name: restart systemd-networkd
-  service:
+- name: Restart systemd-networkd
+  ansible.builtin.service:
     name: systemd-networkd
     state: restarted
diff --git a/roles/wireguard/tasks/clients.yml b/roles/wireguard/tasks/clients.yml
@@ -1,18 +1,12 @@
 ---
 
-# - debug: msg="{{ item.WireGuardPeer | json_query('[?"AllowedIPs"].AllowedIPs') }}"
-#   loop: "{{ peers }}"
-
-# - debug: msg="{{ item.WireGuardPeer | json_query('[?"PublicKey"].PublicKey') }}"
-#   loop: "{{ peers }}"
-
 - name: List of defined clients
-  set_fact:
+  ansible.builtin.set_fact:
     _list_of_defined_clients: "{{ _list_of_defined_clients | default([]) + [item.publickey] }}"
   with_items: "{{ wireguard_peers }}"
 
 - name: Delete unused client configs
-  shell: |
+  ansible.builtin.shell: |
     cd "{{ wireguard_clients_dir }}"
     if [ ! -z "$(grep -L '''"{{ _list_of_defined_clients | join("\|") }}"''' *.conf)" ]; then
       rm -f $(grep -L '''"{{ _list_of_defined_clients | join("\|") }}"''' *.conf) \
@@ -24,7 +18,7 @@
   changed_when: "'deleted' in _delete_out.stdout"
 
 - name: Create clients configs
-  template:
+  ansible.builtin.template:
     src: "clients.conf.j2"
     dest: "{{ wireguard_clients_dir }}/{{ item.WireGuardPeer.0 | json_query('FriendlyName') }}.conf"
     mode: 0644
@@ -33,12 +27,13 @@
     preshared_key: "{{ _pskkey_value['content'] | b64decode }}"
   loop: "{{ peers | list }}"
   notify:
-    - restart systemd-networkd
+    - Restart systemd-networkd
 
 - name: Download client configs
-  fetch:
+  ansible.builtin.fetch:
     src: "{{ wireguard_clients_dir }}/{{ item.name }}.conf"
-    dest: "{{ wireguard_clients_download_dir }}"
+    dest: "{{ wireguard_clients_download_dir }}/{{ inventory_hostname }}/"
     flat: true
+  run_once: "{{ wireguard_same_keys | bool }}"
   loop: "{{ wireguard_peers | list }}"
   when: wireguard_download_clients | bool
diff --git a/roles/wireguard/tasks/install/centos.yml b/roles/wireguard/tasks/install/centos.yml
diff --git a/roles/wireguard/tasks/install/debian.yml b/roles/wireguard/tasks/install/debian.yml
diff --git a/roles/wireguard/tasks/install/rocky.yml b/roles/wireguard/tasks/install/rocky.yml
diff --git a/roles/wireguard/tasks/install/ubuntu.yml b/roles/wireguard/tasks/install/ubuntu.yml
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
diff --git a/roles/wireguard/tasks/pre_check.yml b/roles/wireguard/tasks/pre_check.yml
diff --git a/roles/wireguard/tasks/server.yml b/roles/wireguard/tasks/server.yml
