WireGuard BSD

cloud.yml

@@ -1,7 +1,7 @@
 ---
 - name: Provision the server
   hosts: localhost
-  tags: algo
+  tags: always
   vars_files:
     - config.cfg
 

input.yml

@@ -1,7 +1,7 @@
 ---
 - name: Ask user for the input
   hosts: localhost
-  tags: algo
+  tags: always
   vars:
     defaults:
       server_name: algo

roles/common/tasks/facts.yml

@@ -23,4 +23,8 @@
 - set_fact:
     CA_password: "{{ CA_password.stdout }}"
     IP_subject_alt_name: "{{ IP_subject_alt_name }}"
+
+- name: Set IPv6 support as a fact
+  set_fact:
     ipv6_support: "{% if ansible_default_ipv6['gateway'] is defined %}true{% else %}false{% endif %}"
+  tags: always

roles/dns_encryption/templates/dnscrypt-proxy.toml.j2

@@ -151,7 +151,7 @@ tls_disable_session_tickets = true
 ## People in China may need to use 114.114.114.114:53 here.
 ## Other popular options include 8.8.8.8 and 1.1.1.1.
 
-fallback_resolver = '127.0.0.53:53'
+fallback_resolver = '{% if ansible_distribution == "FreeBSD" %}{{ ansible_dns.nameservers.0 }}:53{% else %}127.0.0.53:53{% endif %}'
 
 
 ## Never try to use the system DNS settings; unconditionally use the

roles/vpn/tasks/main.yml

@@ -1,11 +1,5 @@
 ---
 - block:
-    - name: Include WireGuard role
-      include_role:
-        name: wireguard
-      tags: wireguard
-      when: wireguard_enabled and ansible_distribution == 'Ubuntu'
-
     - name: Ensure that the strongswan group exist
       group: name=strongswan state=present
 

roles/wireguard/files/wireguard.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# PROVIDE: wireguard
+# REQUIRE: LOGIN
+# BEFORE:  securelevel
+# KEYWORD: shutdown
+
+. /etc/rc.subr
+
+name="wg"
+rcvar=wg_enable
+
+command="/usr/local/bin/wg-quick"
+start_cmd=wg_up
+stop_cmd=wg_down
+status_cmd=wg_status
+pidfile="/var/run/$name.pid"
+load_rc_config "$name"
+
+: ${wg_enable="NO"}
+: ${wg_interface="wg0"}
+
+wg_up() {
+  echo "Starting WireGuard..."
+  /usr/sbin/daemon -cS -p ${pidfile} ${command} up ${wg_interface}
+}
+
+wg_down() {
+  echo "Stopping WireGuard..."
+  ${command} down ${wg_interface}
+}
+
+wg_status () {
+  not_running () {
+    echo "WireGuard is not running on $wg_interface" && exit 1
+  }
+  /usr/local/bin/wg show wg0 && echo "WireGuard is running on $wg_interface" || not_running
+}
+
+run_rc_command "$1"

roles/wireguard/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
 - name: restart wireguard
   service:
-    name: "wg-quick@{{ wireguard_interface }}"
+    name: "{{ service_name }}"
     state: restarted

roles/wireguard/tasks/freebsd.yml

@@ -0,0 +1,16 @@
+---
+- name: BSD | WireGuard installed
+  package:
+    name: wireguard
+    state: present
+
+- set_fact:
+    service_name: wireguard
+  tags: always
+
+- name: BSD | Configure rc script
+  copy:
+    src: wireguard.sh
+    dest: /usr/local/etc/rc.d/wireguard
+    mode: "0755"
+  notify: restart wireguard

roles/wireguard/tasks/keys.yml

@@ -1,7 +1,7 @@
 ---
 - name: Delete the lock files
   file:
-    dest: "/etc/wireguard/private_{{ item }}.lock"
+    dest: "{{ config_prefix|default('/') }}etc/wireguard/private_{{ item }}.lock"
     state: absent
   when: keys_clean_all|bool == True
   with_items:
@@ -12,7 +12,7 @@
   command: wg genkey
   register: wg_genkey
   args:
-    creates: "/etc/wireguard/private_{{ item }}.lock"
+    creates: "{{ config_prefix|default('/') }}etc/wireguard/private_{{ item }}.lock"
   with_items:
     - "{{ users }}"
     - "{{ IP_subject_alt_name }}"
@@ -31,7 +31,7 @@
 
   - name: Touch the lock file
     file:
-      dest: "/etc/wireguard/private_{{ item }}.lock"
+      dest: "{{ config_prefix|default('/') }}etc/wireguard/private_{{ item }}.lock"
       state: touch
     with_items:
       - "{{ users }}"

roles/wireguard/tasks/main.yml

@@ -1,27 +1,4 @@
 ---
-- name: WireGuard repository configured
-  apt_repository:
-    repo: ppa:wireguard/wireguard
-    state: present
-  register: result
-  until: result is succeeded
-  retries: 10
-  delay: 3
-
-- name: WireGuard installed
-  apt:
-    name: wireguard
-    state: present
-    update_cache: true
-
-- name: Configure unattended-upgrades
-  copy:
-    src: 50-wireguard-unattended-upgrades
-    dest: /etc/apt/apt.conf.d/50-wireguard-unattended-upgrades
-    owner: root
-    group: root
-    mode: 0644
-
 - name: Ensure the required directories exist
   file:
     dest: "{{ wireguard_config_path }}/{{ item }}"
@@ -33,6 +10,16 @@
   delegate_to: localhost
   become: false
 
+- name: Include tasks for Ubuntu
+  include_tasks: ubuntu.yml
+  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
+  tags: always
+
+- name: Include tasks for FreeBSD
+  include_tasks: freebsd.yml
+  when: ansible_distribution == 'FreeBSD'
+  tags: always
+
 - name: Generate keys
   import_tasks: keys.yml
   tags: update-users
@@ -40,16 +27,11 @@
 - name: WireGuard configured
   template:
     src: server.conf.j2
-    dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
+    dest: "{{ config_prefix|default('/') }}etc/wireguard/{{ wireguard_interface }}.conf"
     mode: "0600"
   notify: restart wireguard
   tags: update-users
 
-- name: WireGuard reload-module-on-update
-  file:
-    dest: /etc/wireguard/.reload-module-on-update
-    state: touch
-
 - name: WireGuard users config generated
   template:
     src: client.conf.j2
@@ -62,7 +44,7 @@
 
 - name: WireGuard enabled and started
   service:
-    name: "wg-quick@{{ wireguard_interface }}"
+    name: "{{ service_name }}"
     state: started
     enabled: true
 

roles/wireguard/tasks/ubuntu.yml

@@ -0,0 +1,32 @@
+---
+- name: WireGuard repository configured
+  apt_repository:
+    repo: ppa:wireguard/wireguard
+    state: present
+  register: result
+  until: result is succeeded
+  retries: 10
+  delay: 3
+
+- name: WireGuard installed
+  apt:
+    name: wireguard
+    state: present
+    update_cache: true
+
+- name: WireGuard reload-module-on-update
+  file:
+    dest: /etc/wireguard/.reload-module-on-update
+    state: touch
+
+- name: Configure unattended-upgrades
+  copy:
+    src: 50-wireguard-unattended-upgrades
+    dest: /etc/apt/apt.conf.d/50-wireguard-unattended-upgrades
+    owner: root
+    group: root
+    mode: 0644
+
+- set_fact:
+    service_name: "wg-quick@{{ wireguard_interface }}"
+  tags: always

server.yml

@@ -9,6 +9,7 @@
 
   roles:
     - role: common
+      tags: common
     - role: dns_encryption
       when: dns_encryption
       tags: dns_encryption
@@ -18,6 +19,9 @@
     - role: ssh_tunneling
       when: algo_ssh_tunneling
       tags: ssh_tunneling
+    - role: wireguard
+      when: wireguard_enabled
+      tags: wireguard
     - role: vpn
       tags: vpn