Add WireGuard service

README.md

@@ -45,8 +45,8 @@ directly.
 #### Infrastructure & security
 - [Authentik](https://goauthentik.io), a self-hosted identity provider.
   Acts as a central authentication system for other services.
-- [Tailscale](https://tailscale.com), a VPN service.
-  Allows secure access to the server from anywhere.
+- [WireGuard](https://wireguard.com), a modern VPN protocol.
+  Allows secure access to the server and home network from anywhere.
 - [Bitwarden](https://bitwarden.com) password manager,
   using [Vaultwarden](https://github.com/dani-garcia/vaultwarden).
 

config.yml

@@ -227,17 +227,17 @@ traefik_acme_dns:
   env:
     CF_DNS_API_TOKEN: "{{ secret_cloudflare_dns_api_token }}"
 
+
 ######################
-# Tailscale settings #
+# WireGuard settings #
 ######################
 
-tailscale_enabled: true
-
-# Subnets to route traffic to
-tailscale_routes:
-  - "10.0.0.0/24"
+wireguard_enabled: yes
+wireguard_vpn_subnet: '10.5.19.0'
+wireguard_peers:
+  - KianPhone
+  - KianLaptop
 
-tailscale_auth_key: "{{ secret_tailscale_auth_key }}"
 
 ###################
 # Homarr settings #

config.yml.sample

@@ -206,17 +206,12 @@ traefik_acme_dns:
 
 
 ######################
-# Tailscale settings #
+# WireGuard settings #
 ######################
 
-tailscale_enabled: false
-
-# Subnets to route traffic to
-tailscale_routes:
-  - "10.0.0.0/24"
-
-# Use Ansible Vault to put your encrypted auth key here
-tailscale_auth_key: "{{ undef() }}"
+wireguard_enabled: yes
+wireguard_peers:
+  - TestClient
 
 
 ###################

main.yml

@@ -74,9 +74,9 @@
       tags:
         - traefik
 
-    - role: tailscale
+    - role: wireguard
       tags:
-        - tailscale
+        - wireguard
 
     - role: homarr
       tags:

roles/wireguard/defaults/main.yml

@@ -0,0 +1,20 @@
+---
+# Whether to enable the WireGuard service
+wireguard_enabled: yes
+
+# Port to use for the WireGuard service
+wireguard_port: 51820
+
+# Subnet to use for the WireGuard VPN.
+# It appears the CIDR notation is not allowed here; the container is hard-coded to use /24.
+wireguard_vpn_subnet: "10.13.13.0"
+
+# List of peers to add to the WireGuard configuration.
+# Supports alphanumeric names only.
+wireguard_peers: []
+
+# Tag to use for the lscr.io/linuxserver/wireguard image
+wireguard_tag: latest
+
+# Directory in which to store WireGuard data
+wireguard_data_dir: "{{ storage.data_dir }}/wireguard"

roles/wireguard/tasks/main.yml

@@ -0,0 +1,52 @@
+---
+- name: Set up Wireguard
+  when: wireguard_enabled is true
+  block:
+    - name: Create data directory
+      ansible.builtin.file:
+        path: "{{ wireguard_data_dir }}/config"
+        state: directory
+        owner: "{{ users.worker }}"
+        group: "{{ users.worker }}"
+        mode: '0750'
+
+    - name: Get worker UID
+      ansible.builtin.command:
+        cmd: "id -u {{ users.worker }}"
+      register: worker_uid
+      changed_when: false
+
+    - name: Get worker GID
+      ansible.builtin.command:
+        cmd: "id -g {{ users.worker }}"
+      register: worker_gid
+      changed_when: false
+
+    - name: Start Wireguard container
+      community.docker.docker_container:
+        name: wireguard
+        image: lscr.io/linuxserver/wireguard:{{ wireguard_tag }}
+        capabilities:
+          - NET_ADMIN
+        volumes:
+          - "{{ wireguard_data_dir }}/config:/config"
+        ports:
+          - "{{ wireguard_port }}:{{ wireguard_port }}/udp"
+        env:
+          PUID: "{{ worker_uid.stdout }}"
+          PGID: "{{ worker_gid.stdout }}"
+          SERVERURL: "{{ general.domain }}"
+          SERVERPORT: "{{ wireguard_port | string }}"
+          INTERNAL_SUBNET: "{{ wireguard_vpn_subnet }}"
+          LOG_CONFS: 'false'  # Don't log peer configurations on startup, since we won't be looking at the logs
+          PEERS: "{{ wireguard_peers | join(',') | default('0', true) }}"
+        sysctls:
+          net.ipv4.conf.all.src_valid_mark: '1'
+
+- name: Stop Wireguard
+  when: wireguard_enabled is false
+  block:
+    - name: Stop Wireguard container
+      community.docker.docker_container:
+        name: wireguard
+        state: absent