algo/roles/wireguard/defaults/main.yml

---
wireguard_PersistentKeepalive: 0
wireguard_config_path: configs/{{ IP_subject_alt_name }}/wireguard/
wireguard_pki_path: "{{ wireguard_config_path }}/.pki/"
wireguard_interface: wg0
wireguard_port_avoid: 53
wireguard_port_actual: 51820
keys_clean_all: false
wireguard_dns_servers: >-
  {% if algo_dns_adblocking|default(false)|bool or dns_encryption|default(false)|bool %}
  {{ local_service_ip }}{{ ', ' + local_service_ipv6 if ipv6_support else '' }}
  {% else %}
  {% for host in dns_servers.ipv4 %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %}{% if ipv6_support %},{% for host in dns_servers.ipv6 %}{{ host }}{% if
  not loop.last %},{% endif %}{% endfor %}{% endif %}
  {% endif %}
wireguard_client_ip: >-
  {{ wireguard_network_ipv4 | ipmath(index|int+2) }}
  {{ ',' + wireguard_network_ipv6 | ipmath(index|int+2) if ipv6_support else '' }}
wireguard_server_ip: >-
  {{ wireguard_network_ipv4 | ipaddr('1') }}
  {{ ',' + wireguard_network_ipv6 | ipaddr('1') if ipv6_support else '' }}
WireGuard update-users fix (#1154) 6 years ago			`---`
Disable wireguard PersistentKeepalive by default (#1338) 5 years ago			`wireguard_PersistentKeepalive: 0`
Ansible upgrade 6.1 (#14500) * linting * update ansible * linters 2 years ago			`wireguard_config_path: configs/{{ IP_subject_alt_name }}/wireguard/`
Refactoring (#1334) <!--- Provide a general summary of your changes in the Title above --> ## Description Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162 Configures Ansible to use python3 on the server side. Closes #1024 Removes unneeded playbooks, reorganises a lot of variables Reorganises the `config` folder. Closes #1330 <details><summary>Here is how the config directory looks like now</summary> <p> ``` configs/X.X.X.X/ \|-- ipsec \| \|-- apple \| \| \|-- desktop.mobileconfig \| \| \|-- laptop.mobileconfig \| \| `-- phone.mobileconfig \| \|-- manual \| \| \|-- cacert.pem \| \| \|-- desktop.p12 \| \| \|-- desktop.ssh.pem \| \| \|-- ipsec_desktop.conf \| \| \|-- ipsec_desktop.secrets \| \| \|-- ipsec_laptop.conf \| \| \|-- ipsec_laptop.secrets \| \| \|-- ipsec_phone.conf \| \| \|-- ipsec_phone.secrets \| \| \|-- laptop.p12 \| \| \|-- laptop.ssh.pem \| \| \|-- phone.p12 \| \| `-- phone.ssh.pem \| `-- windows \| \|-- desktop.ps1 \| \|-- laptop.ps1 \| `-- phone.ps1 \|-- ssh-tunnel \| \|-- desktop.pem \| \|-- desktop.pub \| \|-- laptop.pem \| \|-- laptop.pub \| \|-- phone.pem \| \|-- phone.pub \| `-- ssh_config `-- wireguard \|-- desktop.conf \|-- desktop.png \|-- laptop.conf \|-- laptop.png \|-- phone.conf `-- phone.png ``` ![finder](https://i.imgur.com/FtOmKO0.png) </p> </details> ## Motivation and Context This refactoring is focused to aim to the 1.0 release ## How Has This Been Tested? Deployed to several cloud providers with various options enabled and disabled ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Refactoring ## Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I have read the CONTRIBUTING document. - [x] My code follows the code style of this project. - [x] My change requires a change to the documentation. - [x] I have updated the documentation accordingly. - [x] All new and existing tests passed. 5 years ago			`wireguard_pki_path: "{{ wireguard_config_path }}/.pki/"`
			`wireguard_interface: wg0`
Allow WireGuard to listen on port 53 (#1594) * Allow WireGuard to listen on port 53 * Use a variable for the port to avoid * Add comment to config.cfg 5 years ago			`wireguard_port_avoid: 53`
			`wireguard_port_actual: 51820`
Refactoring (#1334) <!--- Provide a general summary of your changes in the Title above --> ## Description Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162 Configures Ansible to use python3 on the server side. Closes #1024 Removes unneeded playbooks, reorganises a lot of variables Reorganises the `config` folder. Closes #1330 <details><summary>Here is how the config directory looks like now</summary> <p> ``` configs/X.X.X.X/ \|-- ipsec \| \|-- apple \| \| \|-- desktop.mobileconfig \| \| \|-- laptop.mobileconfig \| \| `-- phone.mobileconfig \| \|-- manual \| \| \|-- cacert.pem \| \| \|-- desktop.p12 \| \| \|-- desktop.ssh.pem \| \| \|-- ipsec_desktop.conf \| \| \|-- ipsec_desktop.secrets \| \| \|-- ipsec_laptop.conf \| \| \|-- ipsec_laptop.secrets \| \| \|-- ipsec_phone.conf \| \| \|-- ipsec_phone.secrets \| \| \|-- laptop.p12 \| \| \|-- laptop.ssh.pem \| \| \|-- phone.p12 \| \| `-- phone.ssh.pem \| `-- windows \| \|-- desktop.ps1 \| \|-- laptop.ps1 \| `-- phone.ps1 \|-- ssh-tunnel \| \|-- desktop.pem \| \|-- desktop.pub \| \|-- laptop.pem \| \|-- laptop.pub \| \|-- phone.pem \| \|-- phone.pub \| `-- ssh_config `-- wireguard \|-- desktop.conf \|-- desktop.png \|-- laptop.conf \|-- laptop.png \|-- phone.conf `-- phone.png ``` ![finder](https://i.imgur.com/FtOmKO0.png) </p> </details> ## Motivation and Context This refactoring is focused to aim to the 1.0 release ## How Has This Been Tested? Deployed to several cloud providers with various options enabled and disabled ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Refactoring ## Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I have read the CONTRIBUTING document. - [x] My code follows the code style of this project. - [x] My change requires a change to the documentation. - [x] I have updated the documentation accordingly. - [x] All new and existing tests passed. 5 years ago			`keys_clean_all: false`
			`wireguard_dns_servers: >-`
dnscrypt-proxy as a dns adblocker (#1480) * Move DNS adblocking to dnscrypt-proxy * Update docs * remove unneeded variable dnscrypt_proxy_version * Update to the latest dnscrypt-proxy version * install.sh fix * spelling 5 years ago			`{% if algo_dns_adblocking\|default(false)\|bool or dns_encryption\|default(false)\|bool %}`
Add IPv6 support to DNS (#1425) * Add ipv6 * Add ipv6 * add ipv6 * add ipv6 * Switching out ipv6 address with local_service_ipv6 variable from #1429 * Fixing variable error 5 years ago			`{{ local_service_ip }}{{ ', ' + local_service_ipv6 if ipv6_support else '' }}`
Refactoring (#1334) <!--- Provide a general summary of your changes in the Title above --> ## Description Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162 Configures Ansible to use python3 on the server side. Closes #1024 Removes unneeded playbooks, reorganises a lot of variables Reorganises the `config` folder. Closes #1330 <details><summary>Here is how the config directory looks like now</summary> <p> ``` configs/X.X.X.X/ \|-- ipsec \| \|-- apple \| \| \|-- desktop.mobileconfig \| \| \|-- laptop.mobileconfig \| \| `-- phone.mobileconfig \| \|-- manual \| \| \|-- cacert.pem \| \| \|-- desktop.p12 \| \| \|-- desktop.ssh.pem \| \| \|-- ipsec_desktop.conf \| \| \|-- ipsec_desktop.secrets \| \| \|-- ipsec_laptop.conf \| \| \|-- ipsec_laptop.secrets \| \| \|-- ipsec_phone.conf \| \| \|-- ipsec_phone.secrets \| \| \|-- laptop.p12 \| \| \|-- laptop.ssh.pem \| \| \|-- phone.p12 \| \| `-- phone.ssh.pem \| `-- windows \| \|-- desktop.ps1 \| \|-- laptop.ps1 \| `-- phone.ps1 \|-- ssh-tunnel \| \|-- desktop.pem \| \|-- desktop.pub \| \|-- laptop.pem \| \|-- laptop.pub \| \|-- phone.pem \| \|-- phone.pub \| `-- ssh_config `-- wireguard \|-- desktop.conf \|-- desktop.png \|-- laptop.conf \|-- laptop.png \|-- phone.conf `-- phone.png ``` ![finder](https://i.imgur.com/FtOmKO0.png) </p> </details> ## Motivation and Context This refactoring is focused to aim to the 1.0 release ## How Has This Been Tested? Deployed to several cloud providers with various options enabled and disabled ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Refactoring ## Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I have read the CONTRIBUTING document. - [x] My code follows the code style of this project. - [x] My change requires a change to the documentation. - [x] I have updated the documentation accordingly. - [x] All new and existing tests passed. 5 years ago			`{% else %}`
Ansible upgrade 6.1 (#14500) * linting * update ansible * linters 2 years ago			`{% for host in dns_servers.ipv4 %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %}{% if ipv6_support %},{% for host in dns_servers.ipv6 %}{{ host }}{% if`
			`not loop.last %},{% endif %}{% endfor %}{% endif %}`
Refactoring (#1334) <!--- Provide a general summary of your changes in the Title above --> ## Description Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162 Configures Ansible to use python3 on the server side. Closes #1024 Removes unneeded playbooks, reorganises a lot of variables Reorganises the `config` folder. Closes #1330 <details><summary>Here is how the config directory looks like now</summary> <p> ``` configs/X.X.X.X/ \|-- ipsec \| \|-- apple \| \| \|-- desktop.mobileconfig \| \| \|-- laptop.mobileconfig \| \| `-- phone.mobileconfig \| \|-- manual \| \| \|-- cacert.pem \| \| \|-- desktop.p12 \| \| \|-- desktop.ssh.pem \| \| \|-- ipsec_desktop.conf \| \| \|-- ipsec_desktop.secrets \| \| \|-- ipsec_laptop.conf \| \| \|-- ipsec_laptop.secrets \| \| \|-- ipsec_phone.conf \| \| \|-- ipsec_phone.secrets \| \| \|-- laptop.p12 \| \| \|-- laptop.ssh.pem \| \| \|-- phone.p12 \| \| `-- phone.ssh.pem \| `-- windows \| \|-- desktop.ps1 \| \|-- laptop.ps1 \| `-- phone.ps1 \|-- ssh-tunnel \| \|-- desktop.pem \| \|-- desktop.pub \| \|-- laptop.pem \| \|-- laptop.pub \| \|-- phone.pem \| \|-- phone.pub \| `-- ssh_config `-- wireguard \|-- desktop.conf \|-- desktop.png \|-- laptop.conf \|-- laptop.png \|-- phone.conf `-- phone.png ``` ![finder](https://i.imgur.com/FtOmKO0.png) </p> </details> ## Motivation and Context This refactoring is focused to aim to the 1.0 release ## How Has This Been Tested? Deployed to several cloud providers with various options enabled and disabled ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Refactoring ## Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I have read the CONTRIBUTING document. - [x] My code follows the code style of this project. - [x] My change requires a change to the documentation. - [x] I have updated the documentation accordingly. - [x] All new and existing tests passed. 5 years ago			`{% endif %}`
Randomly generated IP address for the local dns resolver (#1429) * generate service IPs dynamically * update cloud-init tests * exclude ipsec and wireguard ranges from the random service ip * Update docs * @davidemyers: update wireguard docs for linux * Move to netaddr filter * AllowedIPs fix * WireGuard IPs fix 5 years ago			`wireguard_client_ip: >-`
Allow more users (#1895) 4 years ago			`{{ wireguard_network_ipv4 \| ipmath(index\|int+2) }}`
			`{{ ',' + wireguard_network_ipv6 \| ipmath(index\|int+2) if ipv6_support else '' }}`
Randomly generated IP address for the local dns resolver (#1429) * generate service IPs dynamically * update cloud-init tests * exclude ipsec and wireguard ranges from the random service ip * Update docs * @davidemyers: update wireguard docs for linux * Move to netaddr filter * AllowedIPs fix * WireGuard IPs fix 5 years ago			`wireguard_server_ip: >-`
			`{{ wireguard_network_ipv4 \| ipaddr('1') }}`
			`{{ ',' + wireguard_network_ipv6 \| ipaddr('1') if ipv6_support else '' }}`