aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlex Auvolat <alex@adnab.me>2020-05-23 17:16:25 +0200
committerAlex Auvolat <alex@adnab.me>2020-07-15 16:03:51 +0200
commit3bf830713f95c89caf736fa144f90ba7b6b8147a (patch)
tree7d6ba4146c3dba9cbc1a144097ac6100fcac2f67
parent207d1fa278bc1cb9e8600779287abaffe2ef7746 (diff)
downloadinfrastructure-3bf830713f95c89caf736fa144f90ba7b6b8147a.tar.gz
infrastructure-3bf830713f95c89caf736fa144f90ba7b6b8147a.zip
don't retrieve wireguard privkeys in ansible
-rw-r--r--ansible/roles/network/tasks/main.yml4
-rw-r--r--ansible/roles/network/templates/wireguard.conf.j22
-rw-r--r--ansible/roles/network/templates/wireguard_external.conf.j23
3 files changed, 3 insertions, 6 deletions
diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml
index 59f1d71..28104d0 100644
--- a/ansible/roles/network/tasks/main.yml
+++ b/ansible/roles/network/tasks/main.yml
@@ -43,10 +43,6 @@
- name: "Secure wireguard private key"
file: path=/etc/wireguard/privkey mode=0600
-- name: "Retrieve wireguard private key"
- shell: cat /etc/wireguard/privkey
- register: wireguard_privkey
-
- name: "Retrieve wireguard public key"
shell: wg pubkey < /etc/wireguard/privkey
register: wireguard_pubkey
diff --git a/ansible/roles/network/templates/wireguard.conf.j2 b/ansible/roles/network/templates/wireguard.conf.j2
index 9f70eb9..b4a530c 100644
--- a/ansible/roles/network/templates/wireguard.conf.j2
+++ b/ansible/roles/network/templates/wireguard.conf.j2
@@ -1,6 +1,6 @@
[Interface]
Address = {{ vpn_ip }}
-PrivateKey = {{ wireguard_privkey.stdout }}
+PostUp = wg set %i private-key <(cat /etc/wireguard/privkey)
ListenPort = 51820
{% for selected_host in groups['cluster_nodes']|difference([inventory_hostname]) %}
diff --git a/ansible/roles/network/templates/wireguard_external.conf.j2 b/ansible/roles/network/templates/wireguard_external.conf.j2
index f130ffd..f941446 100644
--- a/ansible/roles/network/templates/wireguard_external.conf.j2
+++ b/ansible/roles/network/templates/wireguard_external.conf.j2
@@ -1,9 +1,10 @@
# Template configuration file for VPN nodes that are non in the cluster
+# The private key should be stored as /etc/wireguard/privkey
# External nodes should be registered in network/vars/main.yml
[Interface]
Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml>
-PrivateKey = <INSERT YOUR PRIVKEY HERE, IT SHOULD MATCH THE PUBKEY IN vars/main.yml>
+PostUp = wg set %i private-key <(cat /etc/wireguard/privkey)
ListenPort = 51820
# Cluster nodes