unkin-agent
0272104504
WireGuard on the router is configured by hand, so its tunnels are not reproducible from code. This adds a module to manage it from hieradata. - add `wireguard` class to install wireguard-tools and manage interfaces from a hash - add `wireguard::interface` to render `/etc/wireguard/<iface>.conf` (0600) and enable `wg-quick@<iface>` - keep private and preshared keys `Sensitive` end to end (`wireguard::interfaces` lookup_options `convert_to: Sensitive`, typed peer Struct) - without `private_key`, generate `/etc/wireguard/<iface>.key` (0600) only if absent and load it via PostUp, so the key never rotates - apply config changes with `wg syncconf` instead of restarting the tunnel Reviewed-on: #538 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
45 lines
1.2 KiB
Puppet
45 lines
1.2 KiB
Puppet
# manage wireguard interfaces via wg-quick
|
|
class wireguard (
|
|
Boolean $manage_package = true,
|
|
String $package_name = 'wireguard-tools',
|
|
Variant[Hash, Sensitive[Hash]] $interfaces = {},
|
|
) {
|
|
|
|
if $manage_package {
|
|
package { $package_name:
|
|
ensure => installed,
|
|
before => File['/etc/wireguard'],
|
|
}
|
|
}
|
|
|
|
file { '/etc/wireguard':
|
|
ensure => directory,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0700',
|
|
}
|
|
|
|
# hiera hands eyaml secrets over as plain strings inside the (Sensitive) hash; re-wrap them per resource
|
|
$raw = $interfaces ? {
|
|
Sensitive => $interfaces.unwrap,
|
|
default => $interfaces,
|
|
}
|
|
|
|
$raw.each |String $iface, Hash $data| {
|
|
$peers = $data.get('peers', []).map |Hash $peer| {
|
|
$peer['preshared_key'] =~ String ? {
|
|
true => $peer + { 'preshared_key' => Sensitive($peer['preshared_key']) },
|
|
default => $peer,
|
|
}
|
|
}
|
|
$private_key = $data['private_key'] =~ String ? {
|
|
true => Sensitive($data['private_key']),
|
|
default => $data['private_key'],
|
|
}
|
|
|
|
wireguard::interface { $iface:
|
|
* => $data + { 'peers' => $peers, 'private_key' => $private_key },
|
|
}
|
|
}
|
|
}
|