You've already forked role_wireguard
41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
---
|
|
# tasks file for wireguard
|
|
|
|
- name: Create and store keys in OpenBao
|
|
block:
|
|
- name: Get keys from OpenBao
|
|
community.hashi_vault.vault_kv2_get:
|
|
engine_mount_point: "{{ wireguard_openbao_mount }}"
|
|
path: "{{ inventory_hostname }}/{{ ansible_role_name }}/{{ peer }}"
|
|
when: wireguard_openbao_mount | length > 0
|
|
delegate_to: 127.0.0.1
|
|
rescue:
|
|
- name: Generate peers privatekey # noqa: no-changed-when
|
|
ansible.builtin.command:
|
|
argv:
|
|
- wg
|
|
- genkey
|
|
register: peer_privatekey
|
|
|
|
- name: Generate peers publickey # noqa: no-changed-when
|
|
ansible.builtin.command:
|
|
argv:
|
|
- wg
|
|
- pubkey
|
|
stdin: "{{ peer_privatekey.stdout }}"
|
|
register: peer_publickey
|
|
|
|
- name: Write keys to OpenBao
|
|
community.hashi_vault.vault_kv2_write:
|
|
engine_mount_point: "{{ wireguard_openbao_mount }}"
|
|
path: "{{ inventory_hostname }}/{{ ansible_role_name }}/{{ peer }}"
|
|
data:
|
|
privatekey: "{{ peer_privatekey.stdout }}"
|
|
publickey: "{{ peer_publickey.stdout }}"
|
|
read_before_write: true
|
|
when:
|
|
- wireguard_openbao_mount | length > 0
|
|
- peer_privatekey.stdout | default('') | length > 0
|
|
- peer_publickey.stdout | default('') | length > 0
|
|
delegate_to: 127.0.0.1
|