Add wireguard module (#538)

WireGuard on the router is configured by hand, so its tunnels are not reproducible from code. This adds a module to manage it from hieradata.

- add `wireguard` class to install wireguard-tools and manage interfaces from a hash
- add `wireguard::interface` to render `/etc/wireguard/<iface>.conf` (0600) and enable `wg-quick@<iface>`
- keep private and preshared keys `Sensitive` end to end (`wireguard::interfaces` lookup_options `convert_to: Sensitive`, typed peer Struct)
- without `private_key`, generate `/etc/wireguard/<iface>.key` (0600) only if absent and load it via PostUp, so the key never rotates
- apply config changes with `wg syncconf` instead of restarting the tunnel

Reviewed-on: #538
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

This commit was merged in pull request #538.

This commit is contained in:

Unkin Agent

2026-10-04 14:17:07 +11:00

committed by

BenVincent

parent 1ed268acda

commit 0272104504

4 changed files with 140 additions and 0 deletions

									
										hieradata/common.yaml
									
		+2
		
												View File
												
				@@ -178,6 +178,8 @@ lookup_options:

				    convert_to: Sensitive

				  stalwart::fallback_admin_password:

				    convert_to: Sensitive

				  wireguard::interfaces:

				    convert_to: Sensitive

				facts_path: '/opt/puppetlabs/facter/facts.d'