From b84b37ff13288c9f98341deba41f018bc928d33d Mon Sep 17 00:00:00 2001 From: Chewbaccalakis Date: Fri, 16 Oct 2026 18:22:43 -0700 Subject: [PATCH] fixed gitignore and first run issue --- .DS_Store | Bin 6148 -> 8196 bytes .git_ignore => .gitignore | 0 templates/wg0.conf.j2 | 6 ++++- wg-relay.yml | 54 +++++++++++++++++++++++++++++++++++--- 4 files changed, 55 insertions(+), 5 deletions(-) rename .git_ignore => .gitignore (100%) diff --git a/.DS_Store b/.DS_Store index 6a066ced751d469235ca6c71aa3da389952ae0a9..cb8f71428683662abea85d2e45138b63d9b1cdbe 100644 GIT binary patch literal 8196 zcmeHMTWl0n7(U;$z>FPWs4Wy^*_B0Xpp|X82o!N?%cVjE*_LigvF>GPM`ma0&g?Fi zR7;4)TjJfsC!(T{M2$v_fuK(&N{pri08()!&QPMda`q{q_3rs24;*l9==m6Ik{vvxNrvkfxxC-=G+q# zduBStHsM)CqU_n3vS-Q-RqE7GPqMd9?N1sR+e#Sw^#N_VL+*9ZbX#68l3P6)+brZP zXF!{gNtu~~nR4}Yrpc9wH{HqPZPVOlJBDl6R&UbP_qyeU#)*=Bj-7Ygyu}7It>Ea} zby~|P>g}{5Emh5T+d9mbadzl=hiEh&6OJlJr_Bm4sBdh(eNB9Q$KBh^V2h4TXfxMVs;} z$wJzApkTQBw5TkLJwo%NimbiUpQV@Vw6lE0tS1SD=HDvIJ2}5CuTwABYG`o-8Kk-# z3XuPru_i^)oUT0t1YxQ!Um+`6w%bglb<=09ZXwp@o}%#FXV%^+E6I$V%aJpV;Dy@S zWm)^^UcT{`l;dt4)-BqbyS8C|DAddO>#|urOCHRrn_V5+9O{&{&*eU6D3#Z@mI$3? z{ynnnecr_9E3MBOu6;q+&4rp_6%7JDeHH@$a^M8YPO;PMEc=dq&(5=-*)QyOR6s>F=3)UFu>>(RVKrK? z25YeyUFgORq_GDkaeYLLZbmD-|em6Vrax>lX1YD^K6)^K}R<5?#E z(|G@konc=Q-p{e~n2aiD2%{diVI|>v12&-pThK`uPoft)(GMMi7{dL8co#*Kun+rj z2oDq9AH`#M7SH1ayokeinNWWOuMy_oz?*mr@8dX5;3Piq&_9MR@io4=49}h8@r-j5 z^O9l}LBJkHDfXenndn?&q?JVQ9 zc7&e$=;4j)jSA|SP{&m`-z&$7Uiib1#t~l@_vxshB%$`N{}Ax^zH|roe{laZ=Ra`& F{|Ru!ep3Jd delta 117 zcmZp1XfcprU|?W$DortDU=RQ@Ie-{MGjUEV6q~50$jG!YU^nAr0~wad`~q($JBlCM z*x<^tn4N<|kQt~92n4u+geyqL#=`H+llf&FK}Iq#GBB`!XeNl6V6n~dJad=<#R?L} diff --git a/.git_ignore b/.gitignore similarity index 100% rename from .git_ignore rename to .gitignore diff --git a/templates/wg0.conf.j2 b/templates/wg0.conf.j2 index adc2f34..6c9482c 100644 --- a/templates/wg0.conf.j2 +++ b/templates/wg0.conf.j2 @@ -8,7 +8,11 @@ ListenPort = {{ wg_listen_port }} MTU = {{ wg_mtu }} PrivateKey = {{ wg_relay_effective_private_key }} -{% for peer in wg_peers %} +{% if wg_active_peers | length == 0 %} +# No peer has a real public key yet. The interface comes up with no peers so +# this side can generate and print its key; add the peer's key and re-run. +{% endif %} +{% for peer in wg_active_peers %} # {{ peer.name }} [Peer] PublicKey = {{ peer.public_key }} diff --git a/wg-relay.yml b/wg-relay.yml index 2e46b7c..3517308 100644 --- a/wg-relay.yml +++ b/wg-relay.yml @@ -8,10 +8,12 @@ # ansible-playbook wg-relay.yml -e @vars/site-a.yml --check --diff # ansible-playbook wg-relay.yml -e @vars/site-a.yml # -# No inventory file needed. Set relay_host to localhost or leave it unset +# No inventory file needed. Set relay_host to localhost (or leave it unset) # to configure the machine you're running on. Defaults come from -# defaults.yml. -# The restrictions are enforced locally at each site. +# defaults.yml; anything in the vars file wins, since -e outranks it. +# +# The restrictions are enforced locally at each site, so neither side can +# widen the other's exposure. - name: Resolve which box to configure hosts: localhost @@ -180,6 +182,50 @@ # -- tunnel ------------------------------------------------------------- + # A peer whose public key is still a placeholder would make wg-quick + # refuse the whole config, so the first run could never get far enough to + # print the key you need in order to fill it in. Skip those peers instead: + # the interface comes up bare, prints its key, and picks up the peer on + # the next run once the key is in the vars file. + - name: Select peers whose public key is a real key + ansible.builtin.set_fact: + wg_active_peers: >- + {{ wg_peers | selectattr('public_key', 'match', '^[A-Za-z0-9+/]{43}=$') | list }} + + - name: Note any peers being skipped + ansible.builtin.debug: + msg: >- + Skipping peer(s) {{ wg_peers | map(attribute='name') | difference( + wg_active_peers | map(attribute='name') | list) | join(', ') }} + — public key not filled in yet. The tunnel will come up with no peer. + Put the key in your vars file and run again. + when: wg_active_peers | length < wg_peers | length + + # wg-quick resolves Endpoint at startup and fails the unit if it can't, + # which surfaces as an opaque systemd error. Catch it here instead. + - name: Check each peer endpoint resolves + ansible.builtin.command: + cmd: "getent hosts {{ item.endpoint | regex_replace(':[0-9]+$', '') }}" + loop: "{{ wg_active_peers | selectattr('endpoint', 'defined') | list }}" + loop_control: + label: "{{ item.name }}" + register: endpoint_check + changed_when: false + failed_when: false + when: item.endpoint | regex_replace(':[0-9]+$', '') is not match('^[0-9.]+$') + + - name: Fail clearly on an endpoint that does not resolve + ansible.builtin.assert: + that: item.rc == 0 + fail_msg: >- + Peer '{{ item.item.name }}' endpoint '{{ item.item.endpoint }}' does + not resolve. Fix it in your vars file, or drop the endpoint line if + this side should wait for the other to dial in. + quiet: true + loop: "{{ endpoint_check.results | default([]) | rejectattr('skipped', 'defined') | list }}" + loop_control: + label: "{{ item.item.name }}" + - name: Write the WireGuard config ansible.builtin.template: src: wg0.conf.j2 @@ -319,4 +365,4 @@ - name: Show tunnel status ansible.builtin.debug: - var: wg_status.stdout_lines \ No newline at end of file + var: wg_status.stdout_lines