From 7a0ac83b6a9a8a1b62a8c3ea1a208120d79702c7 Mon Sep 17 00:00:00 2001
From: Scott Lowe <scott.lowe@scottlowe.org>
Date: Mon, 25 Jan 2021 21:31:05 -0700
Subject: [PATCH] Add simple Wireguard playbook

Add simple Wireguard playbook. Add Ansible configuration. Add README.md with instructions.

Signed-off-by: Scott Lowe <scott.lowe@scottlowe.org>
---
 ansible/wireguard/README.md      | 25 ++++++++++++++
 ansible/wireguard/ansible.cfg    |  4 +++
 ansible/wireguard/wireguard.yaml | 56 ++++++++++++++++++++++++++++++++
 3 files changed, 85 insertions(+)
 create mode 100644 ansible/wireguard/README.md
 create mode 100644 ansible/wireguard/ansible.cfg
 create mode 100644 ansible/wireguard/wireguard.yaml

diff --git a/ansible/wireguard/README.md b/ansible/wireguard/README.md
new file mode 100644
index 0000000..628300d
--- /dev/null
+++ b/ansible/wireguard/README.md
@@ -0,0 +1,25 @@
+# Basic Wireguard Installation
+
+These files provide a very basic installation of [Wireguard](https://www.wireguard.com/) on Ubuntu.
+
+## Contents
+
+* **ansible.cfg**: This file tells Ansible where to find the default inventory information (it looks for a file named `hosts` in the same directory).
+
+* **README.md**: The file you're currently reading.
+
+* **wireguard.yml**: This Ansible playbook performs a very basic installation of Wireguard, including the generation of private and public keys.
+
+## Instructions
+
+These instructions assume that Ansible is installed and working on your system.
+
+1. Place the files from the `ansible/wireguard` directory of this GitHub repository into a directory on your local system. You can clone the entire "learning-tools" repository (using `git clone`) or just download the specific files from the `ansible/wireguard` folder.
+
+2. Edit `hosts` and add the necessary inventory information for Ansible.
+
+3. Run `ansible-playbook wireguard.yml` to run the Ansible playbook against the systems specified in the inventory file.
+
+## License
+
+This content is licensed under the MIT License.
diff --git a/ansible/wireguard/ansible.cfg b/ansible/wireguard/ansible.cfg
new file mode 100644
index 0000000..ae1e00a
--- /dev/null
+++ b/ansible/wireguard/ansible.cfg
@@ -0,0 +1,4 @@
+[defaults]
+inventory = ./hosts
+private_key_file = ~/.ssh/aws_vmw_rsa
+remote_user = ubuntu
diff --git a/ansible/wireguard/wireguard.yaml b/ansible/wireguard/wireguard.yaml
new file mode 100644
index 0000000..33909f8
--- /dev/null
+++ b/ansible/wireguard/wireguard.yaml
@@ -0,0 +1,56 @@
+---
+- hosts: "all"
+  gather_facts: true
+  become: true
+
+  tasks:
+    - name: "Install Wireguard"
+      apt:
+        name:
+          - "wireguard"
+          - "wireguard-tools"
+        state: "present"
+      when: ansible_distribution == "Ubuntu"
+    
+    - name: "Enable IP forwarding"
+      sysctl:
+        name: "net.ipv4.ip_forward"
+        value: '1'
+        sysctl_set: yes
+        state: "present"
+        reload: yes
+
+    - name: "Check if Wireguard configuration directory exists"
+      stat:
+        path: "/etc/wireguard"
+      register: wg_conf_directory
+
+    - name: "Create Wireguard configuration directory"
+      file:
+        path: "/etc/wireguard"
+        owner: "root"
+        group: "root"
+        mode: 0700
+      when: not wg_conf_directory.stat.exists
+
+    - name: "Check if Wireguard private key exists"
+      stat:
+        path: "/etc/wireguard/privatekey"
+      register: wg_private_key
+
+    - name: "Generate private key if it doesn't exist"
+      command: "wg genkey"
+      register: wg_generate_private_key
+      when: not wg_private_key.stat.exists
+
+    - name: "Check if Wireguard public key exists"
+      stat:
+        path: "/etc/wireguard/publickey"
+      register: wg_public_key
+
+    - name: "Generate public key if it doesn't exist"
+      command: "wg pubkey"
+      args:
+        stdin: "{{ wg_generate_private_key.stdout }}"
+      register: wg_generate_public_key
+      when: not wg_public_key.stat.exists