algo/roles/wireguard/templates/server.conf.j2

[Interface]
Address = {{ wireguard_server_ip }}
ListenPort = {{ wireguard_port_actual if wireguard_port|int == wireguard_port_avoid|int else wireguard_port }}
PrivateKey = {{ lookup('file', wireguard_pki_path + '/private/' + IP_subject_alt_name) }}
SaveConfig = false

{% for u in wireguard_users %}
{% if u in users %}
{% set index = loop.index %}

[Peer]
# {{ u }}
PublicKey = {{ lookup('file', wireguard_pki_path + '/public/' + u) }}
PresharedKey = {{ lookup('file', wireguard_pki_path + '/preshared/' + u) }}
AllowedIPs = {{ wireguard_network_ipv4 | ipmath(index|int+1) | ipv4('address') }}/32{{ ',' + wireguard_network_ipv6 | ipmath(index|int+1) | ipv6('address') + '/128' if ipv6_support else '' }}
{% endif %}
{% endfor %}
Add WireGuard support for Android (#910) * WireGuard Implementation * Update client-android.md * Update README.md * WireGuard unattended upgrades * Update README.md * reload-module-on-update and syntax fix * SaveConfig to true * Azure firewall. Fixes #962 * Update README.md * Update client-android.md 6 years ago			`[Interface]`
WireGuard update-users fix (#1154) 6 years ago			`Address = {{ wireguard_server_ip }}`
Allow WireGuard to listen on port 53 (#1594) * Allow WireGuard to listen on port 53 * Use a variable for the port to avoid * Add comment to config.cfg 5 years ago			`ListenPort = {{ wireguard_port_actual if wireguard_port\|int == wireguard_port_avoid\|int else wireguard_port }}`
Refactoring (#1334) <!--- Provide a general summary of your changes in the Title above --> ## Description Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162 Configures Ansible to use python3 on the server side. Closes #1024 Removes unneeded playbooks, reorganises a lot of variables Reorganises the `config` folder. Closes #1330 <details><summary>Here is how the config directory looks like now</summary> <p> ``` configs/X.X.X.X/ \|-- ipsec \| \|-- apple \| \| \|-- desktop.mobileconfig \| \| \|-- laptop.mobileconfig \| \| `-- phone.mobileconfig \| \|-- manual \| \| \|-- cacert.pem \| \| \|-- desktop.p12 \| \| \|-- desktop.ssh.pem \| \| \|-- ipsec_desktop.conf \| \| \|-- ipsec_desktop.secrets \| \| \|-- ipsec_laptop.conf \| \| \|-- ipsec_laptop.secrets \| \| \|-- ipsec_phone.conf \| \| \|-- ipsec_phone.secrets \| \| \|-- laptop.p12 \| \| \|-- laptop.ssh.pem \| \| \|-- phone.p12 \| \| `-- phone.ssh.pem \| `-- windows \| \|-- desktop.ps1 \| \|-- laptop.ps1 \| `-- phone.ps1 \|-- ssh-tunnel \| \|-- desktop.pem \| \|-- desktop.pub \| \|-- laptop.pem \| \|-- laptop.pub \| \|-- phone.pem \| \|-- phone.pub \| `-- ssh_config `-- wireguard \|-- desktop.conf \|-- desktop.png \|-- laptop.conf \|-- laptop.png \|-- phone.conf `-- phone.png ``` ![finder](https://i.imgur.com/FtOmKO0.png) </p> </details> ## Motivation and Context This refactoring is focused to aim to the 1.0 release ## How Has This Been Tested? Deployed to several cloud providers with various options enabled and disabled ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Refactoring ## Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I have read the CONTRIBUTING document. - [x] My code follows the code style of this project. - [x] My change requires a change to the documentation. - [x] I have updated the documentation accordingly. - [x] All new and existing tests passed. 5 years ago			`PrivateKey = {{ lookup('file', wireguard_pki_path + '/private/' + IP_subject_alt_name) }}`
WireGuard: disable SaveConfig, update-users fix (#985) - Disables SaveConfig. SaveConfig totally breaks the idea of configuration management and it breaks update-users - WireGuard update-users fix. Mentioned in https://github.com/trailofbits/algo/issues/980#issuecomment-393720561 6 years ago			`SaveConfig = false`
Add WireGuard support for Android (#910) * WireGuard Implementation * Update client-android.md * Update README.md * WireGuard unattended upgrades * Update README.md * reload-module-on-update and syntax fix * SaveConfig to true * Azure firewall. Fixes #962 * Update README.md * Update client-android.md 6 years ago
WireGuard update-users fix (#1183) 6 years ago			`{% for u in wireguard_users %}`
			`{% if u in users %}`
			`{% set index = loop.index %}`
Add WireGuard support for Android (#910) * WireGuard Implementation * Update client-android.md * Update README.md * WireGuard unattended upgrades * Update README.md * reload-module-on-update and syntax fix * SaveConfig to true * Azure firewall. Fixes #962 * Update README.md * Update client-android.md 6 years ago
			`[Peer]`
			`# {{ u }}`
Refactoring (#1334) <!--- Provide a general summary of your changes in the Title above --> ## Description Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162 Configures Ansible to use python3 on the server side. Closes #1024 Removes unneeded playbooks, reorganises a lot of variables Reorganises the `config` folder. Closes #1330 <details><summary>Here is how the config directory looks like now</summary> <p> ``` configs/X.X.X.X/ \|-- ipsec \| \|-- apple \| \| \|-- desktop.mobileconfig \| \| \|-- laptop.mobileconfig \| \| `-- phone.mobileconfig \| \|-- manual \| \| \|-- cacert.pem \| \| \|-- desktop.p12 \| \| \|-- desktop.ssh.pem \| \| \|-- ipsec_desktop.conf \| \| \|-- ipsec_desktop.secrets \| \| \|-- ipsec_laptop.conf \| \| \|-- ipsec_laptop.secrets \| \| \|-- ipsec_phone.conf \| \| \|-- ipsec_phone.secrets \| \| \|-- laptop.p12 \| \| \|-- laptop.ssh.pem \| \| \|-- phone.p12 \| \| `-- phone.ssh.pem \| `-- windows \| \|-- desktop.ps1 \| \|-- laptop.ps1 \| `-- phone.ps1 \|-- ssh-tunnel \| \|-- desktop.pem \| \|-- desktop.pub \| \|-- laptop.pem \| \|-- laptop.pub \| \|-- phone.pem \| \|-- phone.pub \| `-- ssh_config `-- wireguard \|-- desktop.conf \|-- desktop.png \|-- laptop.conf \|-- laptop.png \|-- phone.conf `-- phone.png ``` ![finder](https://i.imgur.com/FtOmKO0.png) </p> </details> ## Motivation and Context This refactoring is focused to aim to the 1.0 release ## How Has This Been Tested? Deployed to several cloud providers with various options enabled and disabled ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Refactoring ## Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I have read the CONTRIBUTING document. - [x] My code follows the code style of this project. - [x] My change requires a change to the documentation. - [x] I have updated the documentation accordingly. - [x] All new and existing tests passed. 5 years ago			`PublicKey = {{ lookup('file', wireguard_pki_path + '/public/' + u) }}`
Adding preshared key support (#1465) * adding preshared key generation * adding preshared folder * Update client.conf.j2 adding preshared key options * adding preshared keys to server template * making sure private preshared is right * making sure preshared keygen working for main.yml * changing private to preshared for name * changing to preshared dir instead of public 5 years ago			`PresharedKey = {{ lookup('file', wireguard_pki_path + '/preshared/' + u) }}`
Allow more users (#1895) 4 years ago			`AllowedIPs = {{ wireguard_network_ipv4 \| ipmath(index\|int+1) \| ipv4('address') }}/32{{ ',' + wireguard_network_ipv6 \| ipmath(index\|int+1) \| ipv6('address') + '/128' if ipv6_support else '' }}`
WireGuard update-users fix (#1183) 6 years ago			`{% endif %}`
Add WireGuard support for Android (#910) * WireGuard Implementation * Update client-android.md * Update README.md * WireGuard unattended upgrades * Update README.md * reload-module-on-update and syntax fix * SaveConfig to true * Azure firewall. Fixes #962 * Update README.md * Update client-android.md 6 years ago			`{% endfor %}`