From cfad76106ad85e170c08a196e7e365a78293aa7c Mon Sep 17 00:00:00 2001
From: =?utf8?q?Isma=C3=ABl=20Bouya?= <ismael.bouya@normalesup.org>
Date: Fri, 17 Aug 2018 12:51:55 +0200
Subject: [PATCH] Add wireguard to host_ldap

---
 modules/profile/manifests/wireguard.pp               | 11 +++++++++++
 modules/profile/templates/wireguard/network.conf.erb | 12 +++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/modules/profile/manifests/wireguard.pp b/modules/profile/manifests/wireguard.pp
index ad1b081..829f82d 100644
--- a/modules/profile/manifests/wireguard.pp
+++ b/modules/profile/manifests/wireguard.pp
@@ -14,11 +14,22 @@ class profile::wireguard (
 
   $private_key = generate_password(32, $password_seed, "wireguard", "curve25519", true)
 
+  if file("/usr/bin/wg", "/dev/null") != "" {
+    $puppet_notifies_path = lookup("base_installation::puppet_notifies_path")
+    $public_key = generate("/usr/bin/bash", "-c", "echo $private_key | /usr/bin/wg pubkey")
+    concat::fragment { "host_ldap add wireguard":
+      target  => "$puppet_notifies_path/host_ldap.info",
+      content => "puppetVar: wireguard_public=$public_key",
+      order   => "00-80"
+    }
+  }
+
   file { "/etc/wireguard/network.conf":
     ensure  => "file",
     mode    => "0600",
     content => template("profile/wireguard/network.conf.erb"),
     require => [Package["wireguard-tools"], Package["wireguard-dkms"]],
+    notify  => Service["wg-quick@network"],
   }
   ->
   service { "wg-quick@network":
diff --git a/modules/profile/templates/wireguard/network.conf.erb b/modules/profile/templates/wireguard/network.conf.erb
index 0528050..5327dfd 100644
--- a/modules/profile/templates/wireguard/network.conf.erb
+++ b/modules/profile/templates/wireguard/network.conf.erb
@@ -1,13 +1,19 @@
 [Interface]
-<%- @ips.each do |ip| %>
+<%- @ips.each do |ip| -%>
 Address = <%= ip %>
-<% end -%>
+<%- end -%>
 PrivateKey = <%= @private_key %>
+ListenPort = 51820
 
 <%- @facts["ldapvar"]["other"].each do |host| -%>
 <%- if (host["vars"]["wireguard_public"] || []).count > 0 %>
 [Peer]
-PublicKey = host["vars"]["wireguard_public"][0]
+# <%= host["vars"]["real_hostname"][0] %>
+PublicKey = <%= host["vars"]["wireguard_public"][0] %>
+<%- if (host["vars"]["wireguard_ip"] || []).count > 0 -%>
+AllowedIps = <%= host["vars"]["wireguard_ip"].join(", ").gsub /\/\d+/, "/32" %>
+<%- end -%>
+Endpoint = <%= host["vars"]["real_hostname"][0] %>:51820
 
 <% end -%>
 <%- end -%>
-- 
2.41.0