Wireguard overlay network setup

Need to migrate away from networkd, because it can't add new wireguard
peers now out of the box without hacks.

[1]: https://github.com/systemd/systemd/issues/25547

1 files changed, 21 insertions, 0 deletions

diff --git a/roles/wgnet/tasks/main.yml b/roles/wgnet/tasks/main.yml
new file mode 100644
index 0000000..8e5a632
--- /dev/null
+++ b/roles/wgnet/tasks/main.yml
@@ -0,0 +1,21 @@
+- name: Configure IPv4 and IPv6 packet forwarding
+  ansible.builtin.sysctl:
+    name: '{{ item }}'
+    value: '1'
+    sysctl_set: true
+  loop:
+    - net.ipv4.ip_forward
+    - net.ipv4.conf.all.forwarding
+    - net.ipv6.conf.all.forwarding
+
+- name: Configure WireGuard for wgnet
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "/etc/systemd/network/{{ item.dest }}"
+    owner: systemd-network
+    group: systemd-network
+    mode: u+rw,g+r,o+r
+  loop:
+    - { src: templates/wg0.netdev.j2, dest: wg0.netdev }
+    - { src: templates/wg0.network.j2, dest: wg0.network }
+  notify: Reload network