WG Provisioning generates client keys if needed

ansible/inventories/group_vars/wireguard_server/sifi.yaml

@@ -9,7 +9,13 @@ wg_server_address: 192.168.99.1/32
 wg_peers:  
   - name: fabio_test
     publicKey: "byR/8T9AZK2t1cxDCLVzdLXsxcUPRXA06CnfI8gwQyY="
-    allowedIP: "192.168.99.4/32"
+    ip: "192.168.99.4/32"
+    allowedIPs : 
+      - "192.168.99.0/24"
+      - "10.22.0.0.0/16"
   - name: lucio
     publicKey: "IifwTYaBMoL3IhAHHplyuVMCir7PHNT57cP57RvEIwg="
-    allowedIP: "192.168.99.3/32"
+    ip: "192.168.99.3/32"
+    allowedIPs : 
+      - "192.168.99.0/24"
+      - "10.22.0.0.0/16"

ansible/inventories/group_vars/wireguard_server/vlab1.yaml

@@ -0,0 +1,25 @@
+---
+wg_interface: wg0
+wg_port: 51820
+#wg_server_public_interface: eth0
+wg_server_address: 192.168.99.1/32
+#wg_server_private_key: "{{ wg_server_private_key }}"
+
+
+wg_peers:  
+  - name: fabio_test
+    publicKey: "9a3tgXpF5CAOffbHZdW1QBEJgSLFnBDVbD1JaMPgzkM="
+    ip: "192.168.99.4/32"
+    allowedIPs : 
+      - "192.168.99.0/24"
+      - "10.22.0.0/16"
+  - name: missing_key_test
+    ip: "192.168.99.5/32"
+    allowedIPs : 
+      - "192.168.99.0/24"
+      - "10.22.0.0/16"
+  - name: second_missing_key_test
+    ip: "192.168.99.6/32"
+    allowedIPs : 
+      - "192.168.99.0/24"
+      - "10.22.0.0/16"

ansible/inventories/vlab1.yaml

@@ -1,6 +1,9 @@
 ---
 vlab-1:
   children:
+    yuno:
+      hosts:
+        yuno.sse.cloud.isti.cnr.it:
     wireguard_server:
       hosts:
         vpn-1.sse.cloud.isti.cnr.it: 

ansible/playbooks/roles/wireguard_server/tasks/generate_client_configs.yaml

@@ -0,0 +1,57 @@
+---
+- name: Create local configs directory
+  become: false
+  local_action : ansible.builtin.file
+  args:
+    path: "{{ playbook_dir }}/wg_clients/{{ inventory_hostname }}"
+    state: directory
+    mode: '0700'
+
+- name: Init generated Keys dict
+  set_fact:
+    generated_keys: []
+
+- name : Gather needed key generation
+  set_fact:
+    generated_keys: "{{ generated_keys + [{'name': item.name}] }}"
+  when : item.publicKey is not defined
+  loop: "{{ wg_peers }}"
+
+- name : Generate private keys
+  command : wg genkey
+  register: privateKeyObjects
+  loop : "{{ generated_keys }}"
+
+
+- name : Generate public keys
+  shell : echo "{{privateKeyObjects.results[ansible_loop.index0].stdout}}" | wg pubkey
+  register: publicKeyObjects
+  loop : "{{ generated_keys }}"
+  loop_control:
+    extended: true
+
+- name: Registering generated keys
+  set_fact:
+     generated_keys: "{{ generated_keys | community.general.lists_mergeby ([{'privateKey' : privateKeyObjects.results[ansible_loop.index0].stdout, 'publicKey' : publicKeyObjects.results[ansible_loop.index0].stdout, 'name':item.name }],'name') }}"
+  loop: "{{ generated_keys }}"
+  loop_control:
+    extended: true  
+
+- name: Updating client configs info
+  set_fact:
+    wg_peers: "{{ wg_peers | community.general.lists_mergeby(generated_keys,'name')}}"
+
+
+- name : Generate client config file
+  become: false
+  local_action : ansible.builtin.template
+  args:
+    src: templates/wireguard_client.jinja
+    dest: "{{ playbook_dir }}/wg_clients/{{ inventory_hostname }}/{{ item.name }}.conf"
+  vars:
+    wg_client_public_key: "{{ item.publicKey }}"
+    wg_client_private_key: "{{ item.privateKey | default('')}}"
+    wg_client_address: "{{ item.ip }}"
+    allowed_ips : "{{ item.allowedIPs }}"
+    wg_server : "{{ inventory_hostname }}"
+  loop: "{{ wg_peers }}"

ansible/playbooks/roles/wireguard_server/tasks/generate_server_keys.yaml

@@ -6,39 +6,39 @@
     state: directory
     mode: '0700'
 
-- name: Check if private key already exists
+- name: Check if server private key already exists
   ansible.builtin.stat:
     path: /etc/wireguard/privatekey
-  register: privkey_file
+  register: privatekey_file
 
-- name: Generate private key
+- name: Generate server private key
   ansible.builtin.command: wg genkey
   register: wg_private_key
-  when: not privkey_file.stat.exists
+  when: not privatekey_file.stat.exists
   changed_when: true
 
-- name: Save private key
+- name: Save server private key
   ansible.builtin.copy:
     content: "{{ wg_private_key.stdout }}"
     dest: /etc/wireguard/privatekey
     owner: root
     group: root
     mode: '0600'
-  when: not privkey_file.stat.exists
+  when: not privatekey_file.stat.exists
 
-- name: Read private key
+- name: Read server private key
   ansible.builtin.slurp:
     src: /etc/wireguard/privatekey
   register: private_key_content
 
-- name: Generate public key from private key
+- name: Generate server public key from private key
   ansible.builtin.shell: echo "{{ private_key_content.content | b64decode | trim }}" | wg pubkey
-  register: wg_public_key
+  register: wg_server_public_key
   changed_when: false
 
-- name: Save public key
+- name: Save server public key
   ansible.builtin.copy:
-    content: "{{ wg_public_key.stdout }}"
+    content: "{{ wg_server_public_key.stdout }}"
     dest: /etc/wireguard/publickey
     owner: root
     group: root
@@ -46,4 +46,4 @@
 
 - name: Display public key for reference
   ansible.builtin.debug:
-    msg: "Public key for {{ inventory_hostname }}: {{ wg_public_key.stdout }}"
+    msg: "Public key for {{ inventory_hostname }}: {{ wg_server_public_key.stdout }}"

ansible/playbooks/roles/wireguard_server/tasks/main.yaml

@@ -1,4 +1,5 @@
 ---
 - include_tasks: install_wireguard.yaml
-- include_tasks: generate_keys.yaml
+- include_tasks: generate_server_keys.yaml
+- include_tasks: generate_client_configs.yaml
 - include_tasks: configure_server.yaml

ansible/playbooks/roles/wireguard_server/templates/wireguard_client.jinja

@@ -0,0 +1,18 @@
+[Interface]
+{% if wg_client_private_key is defined and wg_client_private_key != None and wg_client_private_key != ''%}
+PrivateKey = {{wg_client_private_key}}
+{% else%}
+
+# Public and private keys were pre generated by client
+# Insert private key below and uncomment in order to use the present configuration 
+# PrivateKey = 
+
+{% endif %}
+
+Address = {{wg_client_address}}
+
+[Peer]
+PublicKey = {{wg_server_public_key.stdout}}
+AllowedIPs = {{ allowed_ips | join(', ') }}
+Endpoint = {{ wg_server }}:{{ wg_port }}
+PersistentKeepalive = 25

ansible/playbooks/roles/wireguard_server/templates/wireguard_server.jinja

@@ -19,7 +19,7 @@ PostDown = iptables -t nat -D POSTROUTING ! -o {{wg_interface}} -m mark --mark 0
 # {{ peer.name }}
 [Peer]
 PublicKey = {{ peer.publicKey }}
-AllowedIPs = {{ peer.allowedIP }}
+AllowedIPs = {{ peer.ip }}
 {% if peer.persistent_keepalive is defined %}
 PersistentKeepalive = {{ peer.persistent_keepalive }}
 {% endif %}