Keep wireguard keys Sensitive and generate missing private keys

modules/wireguard/manifests/interface.pp

@@ -1,16 +1,39 @@
-# manage one wg-quick interface; without private_key, the existing /etc/wireguard/<iface>.key is loaded via PostUp
+# manage one wg-quick interface; without private_key, /etc/wireguard/<iface>.key is generated once and loaded via PostUp
 define wireguard::interface (
-  Array[Stdlib::IP::Address]                   $addresses,
-  Optional[Stdlib::Port]                       $listen_port = undef,
-  Optional[Integer[1280, 9000]]                $mtu         = undef,
-  Optional[Variant[String, Sensitive[String]]] $private_key = undef,
-  Array[Hash]                                  $peers       = [],
+  Array[Stdlib::IP::Address]           $addresses,
+  Optional[Stdlib::Port]               $listen_port = undef,
+  Optional[Integer[1280, 9000]]        $mtu         = undef,
+  Optional[Sensitive[String[1]]]       $private_key = undef,
+  Array[Struct[{
+    public_key           => String[1],
+    allowed_ips          => Variant[String[1], Array[String[1], 1]],
+    preshared_key        => Optional[Sensitive[String[1]]],
+    endpoint             => Optional[String[1]],
+    persistent_keepalive => Optional[Integer[0, 65535]],
+  }]]                                  $peers       = [],
 ) {
 
   $conf = "/etc/wireguard/${name}.conf"
-  $key  = $private_key ? {
-    Sensitive => $private_key.unwrap,
-    default   => $private_key,
+  $key  = $private_key.then |$k| { $k.unwrap }
+
+  if $private_key =~ Undef {
+    $keyfile = "/etc/wireguard/${name}.key"
+
+    exec { "wireguard_genkey_${name}":
+      command => "/bin/sh -c 'umask 077; wg genkey > ${keyfile}'",
+      creates => $keyfile,
+      path    => ['/usr/bin', '/usr/sbin', '/bin', '/sbin'],
+      require => File['/etc/wireguard'],
+    }
+
+    file { $keyfile:
+      ensure  => file,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0600',
+      require => Exec["wireguard_genkey_${name}"],
+      before  => [File[$conf], Service["wg-quick@${name}"]],
+    }
   }
 
   file { $conf: