WIP: Create a role for a Wireguard VPN endpoint

hosts

@@ -58,6 +58,7 @@ matrix-services.adm.auro.re
 serge.adm.auro.re
 passbolt.adm.auro.re
 vpn-ovh.adm.auro.re
+vpn-ovh-ng.auro.re
 docker-ovh.adm.auro.re
 switchs-manager.adm.auro.re
 ldap-replica-ovh.adm.auro.re

roles/wireguard-endpoint/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: Reload network interfaces
+  command: ifreload -a
+
+- name: Reload nftables
+  systemd:
+    name: nftables.service
+    state: reloaded
+...

roles/wireguard-endpoint/tasks/main.yml

@@ -0,0 +1,60 @@
+---
+- name: Install required packages
+  apt:
+    pkg:
+      - ifupdown2
+      - wireguard
+      - nftables
+    state: latest
+    update_cache: yes
+
+- name: Tweak sysctl to enable IP forwarding
+  template:
+    src: sysctl.conf.j2
+    dest: /etc/sysctl.d/forwarding.conf
+    owner: root
+    group: root
+    mode: u=rw,g=r,o=
+
+- name: Create tunnels configurations
+  template:
+    src: wireguard.conf.j2
+    dest: "/etc/wireguard/{{ item.name }}.conf"
+    owner: root
+    group: root
+    mode: u=rw,g=,o=
+  loop: "{{ wireguard_endpoints }}"
+  # try to hide clear-text private keys from Ansible output
+  no_log: True
+  diff: no
+
+- name: Create network interfaces
+  template:
+    src: interface.j2
+    dest: "/etc/network/interfaces.d/{{ item.name }}"
+    owner: root
+    group: root
+    mode: u=rw,g=r,o=
+  loop: "{{ wireguard_endpoints }}"
+  no_log: True
+  diff: no
+  notify:
+    - Reload network interfaces
+
+- name: Enable nftables
+  systemd:
+    name: nftables.service
+    state: started
+    enabled: yes
+
+- name: Configure nftables
+  template:
+    src: nftables.conf.j2
+    dest: /etc/nftables.conf
+    validate: /sbin/nft -c -f %s
+    owner: root
+    group: root
+    mode: u=rw,g=r,o=
+  notify:
+    - Reload nftables
+...

roles/wireguard-endpoint/templates/interface.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+
+auto {{ item.name }}
+
+iface {{ item.name }}
+	link-type wireguard
+	pre-up wg setconf $IFACE /etc/wireguard/$IFACE.conf
+	{% for addr in item.addrs %}
+	address {{ addr }}
+	{% endfor %}

roles/wireguard-endpoint/templates/nftables.conf.j2

@@ -0,0 +1,86 @@
+#!/usr/sbin/nft -f
+# {{ ansible_managed }}
+
+flush ruleset
+
+#table ip nat {
+#
+#	chain prerouting {
+#		type nat hook prerouting priority -100
+#		policy accept
+#	}
+#
+#	chain postrouting {
+#		type nat hook prerouting priority 100
+#		policy accept
+#
+#		#{% for endpoint in wireguard_endpoints %}
+#		#oifname "{{ endpoint.name }}" masquerade
+#		#{% endfor %}
+#	}
+#
+#}
+
+table inet filter {
+
+	set blacklist_v4 {
+		type ipv4_addr
+	}
+
+	set blacklist_v6 {
+		type ipv6_addr
+	}
+
+	chain blacklist {
+		ip saddr @blacklist_v4 drop
+		ip6 saddr @blacklist_v6 drop
+	}
+
+	chain conntrack {
+		ct state invalid drop
+		ct state related, established accept
+	}
+
+	chain input {
+		type filter hook input priority 0
+		policy drop
+
+		iif lo accept
+
+		jump blacklist
+		jump conntrack
+
+		# TODO: ansible + separate nftables module
+		ip protocol icmp accept
+
+		{% for rule in nftables_basic_input_rules %}
+		{{ rule.proto }} \
+			{% if "saddr" in rule %} saddr {{ rule.saddr }} \ {% endif %}
+			{% if "sport" in rule %} sport {{ rule.sport }} \ {% endif %}
+			{% if "daddr" in rule %} daddr {{ rule.daddr }} \ {% endif %}
+			{% if "dport" in rule %} dport {{ rule.dport }} \ {% endif %}
+			{{ rule.verdict }}
+		{% endfor %}
+	}
+
+	chain forward {
+		type filter hook forward priority 0
+		policy drop
+
+		iif lo accept
+
+		jump blacklist
+		jump conntrack
+
+		{% for endpoint in wireguard_endpoints %}
+		iifname "{{ endpoint.name }}" accept
+		{% endfor %}
+	}
+
+	chain output {
+		type filter hook output priority 0
+		policy accept
+	}
+
+}
+

roles/wireguard-endpoint/templates/sysctl.conf.j2

@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+
+net.ipv4.ip_forward=1
+net.ipv6.conf.all.forwarding=1

roles/wireguard-endpoint/templates/wireguard.conf.j2

@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+
+[Interface]
+Address = {{ item.addrs | join(",") }}
+PrivateKey = {{ item.private_key }}
+ListenPort = {{ item.listen_port }}
+
+{% for peer in item.peers %}
+[Peer]
+PublicKey = {{ item.public_key }}
+AllowedIps = {{ item.allowed_addrs | join(",") }}
+{% endfor %}

vpn.yml

@@ -0,0 +1,6 @@
+#!/usr/bin/env ansible-playbook
+---
+- hosts: vpn-ovh-ng.auro.re
+  roles:
+    - wireguard-endpoint
+...