Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create private_key from parameter if wanted #43

Merged
merged 1 commit into from
Mar 11, 2022
Merged

Create private_key from parameter if wanted #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 36 additions & 10 deletions manifests/interface.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
# @param mtu configure the MTU (maximum transision unit) for the wireguard tunnel. By default linux will figure this out. You might need to lower it if you're connection through a DSL line. MTU needs to be equal on both tunnel endpoints
# @param peers is an array of struct (Wireguard::Peers) for multiple peers
# @param routes different routes for the systemd-networkd configuration
# @param private_key Define private key which should be used for this interface, if not provided a private key will be generated
#
# @author Tim Meusel <[email protected]>
# @author Sebastian Rakel <[email protected]>
Expand Down Expand Up @@ -89,6 +90,7 @@
Optional[Integer[1280, 9000]] $mtu = undef,
Optional[String[1]] $public_key = undef,
Array[Hash[String[1], Variant[String[1], Boolean]]] $routes = [],
Optional[String[1]] $private_key = undef,
) {
require wireguard

Expand All @@ -112,25 +114,49 @@
notify => Service['systemd-networkd'],
}
}
exec { "generate ${interface} keys":
command => "wg genkey | tee ${interface} | wg pubkey > ${interface}.pub",

$private_key_path = "${wireguard::config_directory}/${interface}"

if $private_key {
file { $private_key_path:
ensure => 'file',
content => $private_key,
owner => 'root',
group => 'systemd-network',
mode => '0640',
notify => Exec["generate public key ${interface}"],
}
} else {
exec { "generate private key ${interface}":
command => "wg genkey > ${interface}",
cwd => $wireguard::config_directory,
creates => $private_key_path,
path => '/usr/bin',
before => File[$private_key_path],
notify => Exec["generate public key ${interface}"],
}

file { $private_key_path:
ensure => 'file',
owner => 'root',
group => 'systemd-network',
mode => '0640',
}
}

exec { "generate public key ${interface}":
command => "wg pubkey < ${interface} > ${interface}.pub",
cwd => $wireguard::config_directory,
creates => "${wireguard::config_directory}/${interface}.pub",
path => '/usr/bin',
}
file { "${wireguard::config_directory}/${interface}":
ensure => 'file',
owner => 'root',
group => 'systemd-network',
mode => '0640',
require => Exec["generate ${interface} keys"],
}

file { "${wireguard::config_directory}/${interface}.pub":
ensure => 'file',
owner => 'root',
group => 'root',
mode => '0600',
require => Exec["generate ${interface} keys"],
require => Exec["generate public key ${interface}"],
}

if $public_key {
Expand Down
44 changes: 39 additions & 5 deletions spec/defines/interface_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,8 @@

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_class('wireguard') }
it { is_expected.to contain_exec("generate #{title} keys") }
it { is_expected.to contain_exec("generate private key #{title}") }
it { is_expected.to contain_exec("generate public key #{title}") }
it { is_expected.to contain_file("/etc/wireguard/#{title}.pub") }
it { is_expected.to contain_file("/etc/wireguard/#{title}") }
it { is_expected.to contain_systemd__network("#{title}.netdev") }
Expand Down Expand Up @@ -76,7 +77,8 @@

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_class('wireguard') }
it { is_expected.to contain_exec("generate #{title} keys") }
it { is_expected.to contain_exec("generate private key #{title}") }
it { is_expected.to contain_exec("generate public key #{title}") }
it { is_expected.to contain_file("/etc/wireguard/#{title}.pub") }
it { is_expected.to contain_file("/etc/wireguard/#{title}") }
it { is_expected.to contain_systemd__network("#{title}.netdev") }
Expand Down Expand Up @@ -110,7 +112,8 @@ class {"systemd":

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_class('wireguard') }
it { is_expected.to contain_exec("generate #{title} keys") }
it { is_expected.to contain_exec("generate private key #{title}") }
it { is_expected.to contain_exec("generate public key #{title}") }
it { is_expected.to contain_file("/etc/wireguard/#{title}.pub") }
it { is_expected.to contain_file("/etc/wireguard/#{title}") }
it { is_expected.to contain_systemd__network("#{title}.netdev") }
Expand All @@ -134,7 +137,8 @@ class {"systemd":

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_class('wireguard') }
it { is_expected.to contain_exec("generate #{title} keys") }
it { is_expected.to contain_exec("generate private key #{title}") }
it { is_expected.to contain_exec("generate public key #{title}") }
it { is_expected.to contain_file("/etc/wireguard/#{title}.pub") }
it { is_expected.to contain_file("/etc/wireguard/#{title}") }
it { is_expected.to contain_systemd__network("#{title}.netdev") }
Expand Down Expand Up @@ -268,7 +272,8 @@ class {"systemd":

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_class('wireguard') }
it { is_expected.to contain_exec("generate #{title} keys") }
it { is_expected.to contain_exec("generate private key #{title}") }
it { is_expected.to contain_exec("generate public key #{title}") }
it { is_expected.to contain_file("/etc/wireguard/#{title}.pub") }
it { is_expected.to contain_file("/etc/wireguard/#{title}") }
it { is_expected.to contain_systemd__network("#{title}.netdev") }
Expand All @@ -277,6 +282,35 @@ class {"systemd":
it { is_expected.to contain_file("/etc/systemd/network/#{title}.network").with_content(expected_network_content) }
it { is_expected.not_to contain_ferm__rule("allow_wg_#{title}") }
end

context 'with required params and defined private key and without firewall rules and with configured addresses' do
let :params do
{
public_key: 'blabla==',
private_key: 'gFYpkdIuGG3EhXKdGmuMJs/3rp/88wkFv2Go+shtu08=',
endpoint: 'wireguard.example.com:1234',
manage_firewall: false,
# we need to set destination_addresses to overwrite the default
# that would configure IPv4+IPv6, but GHA doesn't provide IPv6 for us
destination_addresses: [facts[:networking]['ip'],],
addresses: [{ 'Address' => '192.168.218.87/32', 'Peer' => '172.20.53.97/32' }, { 'Address' => 'fe80::ade1/64', },],
}
end

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_class('wireguard') }
it { is_expected.not_to contain_exec("generate private key #{title}") }
it { is_expected.to contain_file("/etc/wireguard/#{title}").with_content('gFYpkdIuGG3EhXKdGmuMJs/3rp/88wkFv2Go+shtu08=') }
it { is_expected.to contain_exec("generate public key #{title}") }
sebastianrakel marked this conversation as resolved.
Show resolved Hide resolved
it { is_expected.to contain_file("/etc/wireguard/#{title}.pub") }
it { is_expected.to contain_systemd__network("#{title}.netdev") }
it { is_expected.to contain_systemd__network("#{title}.network") }
it { is_expected.to contain_file("/etc/systemd/network/#{title}.network").with_content(%r{[Address]}) } # rubocop:disable Lint/DuplicateRegexpCharacterClassElement
it { is_expected.to contain_file("/etc/systemd/network/#{title}.network").with_content(%r{Address=192.168.218.87/32}) }
it { is_expected.to contain_file("/etc/systemd/network/#{title}.network").with_content(%r{Peer=172.20.53.97/32}) }
it { is_expected.to contain_file("/etc/systemd/network/#{title}.network").with_content(%r{Address=fe80::ade1/64}) }
it { is_expected.not_to contain_ferm__rule("allow_wg_#{title}") }
end
end
end
end