Add wireguard to host_ldap

diff --git a/modules/profile/manifests/wireguard.pp b/modules/profile/manifests/wireguard.pp
index ad1b081fd067dbf7361b3d8cced40de944128ba6..829f82d201647169296d357b13b78cd0a3339edd 100644 (file)
--- a/modules/profile/manifests/wireguard.pp
+++ b/modules/profile/manifests/wireguard.pp
@@ -14,11 +14,22 @@ class profile::wireguard (
 
   $private_key = generate_password(32, $password_seed, "wireguard", "curve25519", true)
 
+  if file("/usr/bin/wg", "/dev/null") != "" {
+    $puppet_notifies_path = lookup("base_installation::puppet_notifies_path")
+    $public_key = generate("/usr/bin/bash", "-c", "echo $private_key | /usr/bin/wg pubkey")
+    concat::fragment { "host_ldap add wireguard":
+      target  => "$puppet_notifies_path/host_ldap.info",
+      content => "puppetVar: wireguard_public=$public_key",
+      order   => "00-80"
+    }
+  }
+
   file { "/etc/wireguard/network.conf":
     ensure  => "file",
     mode    => "0600",
     content => template("profile/wireguard/network.conf.erb"),
     require => [Package["wireguard-tools"], Package["wireguard-dkms"]],
+    notify  => Service["wg-quick@network"],
   }
   ->
   service { "wg-quick@network":

diff --git a/modules/profile/templates/wireguard/network.conf.erb b/modules/profile/templates/wireguard/network.conf.erb
index 0528050ca89ff5b5b7f81b2e9384dab0f8c95d8c..5327dfd305744c131ef445aae5a8c1c4243bb579 100644 (file)
--- a/modules/profile/templates/wireguard/network.conf.erb
+++ b/modules/profile/templates/wireguard/network.conf.erb
@@ -1,13 +1,19 @@
 [Interface]
-<%- @ips.each do |ip| %>
+<%- @ips.each do |ip| -%>
 Address = <%= ip %>
-<% end -%>
+<%- end -%>
 PrivateKey = <%= @private_key %>
+ListenPort = 51820
 
 <%- @facts["ldapvar"]["other"].each do |host| -%>
 <%- if (host["vars"]["wireguard_public"] || []).count > 0 %>
 [Peer]
-PublicKey = host["vars"]["wireguard_public"][0]
+# <%= host["vars"]["real_hostname"][0] %>
+PublicKey = <%= host["vars"]["wireguard_public"][0] %>
+<%- if (host["vars"]["wireguard_ip"] || []).count > 0 -%>
+AllowedIps = <%= host["vars"]["wireguard_ip"].join(", ").gsub /\/\d+/, "/32" %>
+<%- end -%>
+Endpoint = <%= host["vars"]["real_hostname"][0] %>:51820
 
 <% end -%>
 <%- end -%>