d4f86bf44c
- wireguard_manage_dns (default true): auf NetworkManager-Hosts (Pi OS) MUSS false sein - resolvconf + 'DNS='-Zeile zerschiessen dort /etc/resolv.conf - host_vars/butler/wireguard.yml: Tunnel-IP 10.200.200.9, Endpoint = echter Hub netcup 194.13.80.132:51820 (NICHT tunnel.sascha-lutz.de = Hetzner/Caddy auf 443), AllowedIPs nur 10.200.200.0/24 (kein Konflikt mit vm_net_routes), DNS-mgmt aus - wireguard-butler.yml: gezieltes Playbook (butler ist nicht in [wireguard]-Node-Gruppe) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
---
|
|
# wireguard_manage_dns: auf NetworkManager-Hosts (Pi OS) MUSS das false sein -
|
|
# resolvconf + 'DNS='-Zeile zerschiessen dort /etc/resolv.conf (NM verwaltet DNS selbst).
|
|
- name: WireGuard installieren
|
|
apt:
|
|
name:
|
|
- wireguard
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: resolvconf installieren (nur wenn WG das DNS verwaltet)
|
|
apt:
|
|
name: resolvconf
|
|
state: present
|
|
when: wireguard_manage_dns | default(true)
|
|
|
|
- name: WireGuard Config deployen
|
|
copy:
|
|
dest: /etc/wireguard/wg0.conf
|
|
content: |
|
|
[Interface]
|
|
PrivateKey = {{ wireguard_private_key }}
|
|
Address = {{ wireguard_address }}
|
|
{% if wireguard_manage_dns | default(true) %}
|
|
DNS = 8.8.8.8
|
|
{% endif %}
|
|
MTU = {{ wireguard_mtu }}
|
|
|
|
[Peer]
|
|
PublicKey = {{ wireguard_vps_pubkey }}
|
|
Endpoint = {{ wireguard_endpoint }}
|
|
AllowedIPs = {{ wireguard_allowed_ips }}
|
|
PersistentKeepalive = {{ wireguard_persistent_keepalive }}
|
|
mode: "0600"
|
|
notify: restart wireguard
|
|
|
|
- name: WireGuard aktivieren und starten
|
|
systemd:
|
|
name: wg-quick@wg0
|
|
enabled: true
|
|
state: started
|