Move WireGuard gateway to Aegis

ansible/inventory/host_vars/aegis.yml

@@ -15,6 +15,26 @@ aegis_host_dns_servers:
   - 192.168.178.1
 aegis_host_dns_search_domains:
   - fritz.box
+
+# Aegis is the internal WireGuard endpoint and NAT gateway for the LAN.
+wireguard_overlay_enabled: true
+wireguard_address: 10.0.0.2/24
+wireguard_enable_ipv4_forwarding: true
+wireguard_reload_rootful_podman_networks: true
+wireguard_forwarding_policies:
+  - name: aegis-wireguard-to-lan
+    ingress_zone: wireguard
+    egress_zone: public
+    source: 10.0.0.0/24
+    destination: "{{ aegis_lan_subnet }}"
+    masquerade: true
+wireguard_peers:
+  - name: prometheus
+    host: prometheus
+    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
+    allowed_ips:
+      - 10.0.0.0/24
+    persistent_keepalive: 25
 aegis_ssh_authorized_keys:
   - name: ikaros
     key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"

ansible/inventory/host_vars/atlas.yml

@@ -52,19 +52,9 @@ atlas_manage_storage: true
 atlas_manage_sharing: true
 atlas_manage_media_stack: false
 
-wireguard_overlay_enabled: true
-wireguard_address: 10.0.0.2/24
-wireguard_peers:
-  - name: prometheus
-    host: prometheus
-    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
-    allowed_ips:
-      - 10.0.0.0/24
-    persistent_keepalive: 25
-
-backend_phase1_enabled: true
-backend_phase1_start_services: false
-backend_phase1_wireguard_address: 10.0.0.2
+# Atlas is a NAS-only host. WireGuard is retired manually on the host and is
+# intentionally no longer managed here.
+backend_phase1_enabled: false
 
 rocky_manage_openzfs_repo: true
 rocky_manage_syncthing_binary: false

ansible/inventory/host_vars/prometheus.yml

@@ -21,10 +21,12 @@ wireguard_listen_port: 51820
 wireguard_enable_ipv4_forwarding: true
 wireguard_reload_rootful_podman_networks: true
 wireguard_peers:
-  - name: atlas
-    host: atlas
+  - name: aegis
+    host: aegis
+    # TODO: Aggiungere VIP di Uranus in futuro
     allowed_ips:
       - 10.0.0.2/32
+      - 192.168.178.0/24
 
 host_packages:
   - cockpit

ansible/inventory/hosts.yml

@@ -99,7 +99,7 @@ all:
     wireguard_overlay:
       hosts:
         prometheus:
-        atlas:
+        aegis:
 
     role_backend_phase1:
       hosts:

ansible/roles/profile_aegis/defaults/main.yml

@@ -2,6 +2,7 @@
 aegis_hostname: aegis
 aegis_layered_packages:
   - nfs-utils
+  - wireguard-tools
 aegis_network_connection_name: ""
 aegis_network_connection_uuid: ""
 aegis_host_dns_servers: []

ansible/roles/profile_aegis/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: Manage Aegis layered packages
-  tags: [aegis, packages, nfs]
+  tags: [aegis, packages, nfs, wireguard]
   community.general.rpm_ostree_pkg:
     name: "{{ aegis_layered_packages }}"
     state: present
@@ -8,7 +8,7 @@
   when: aegis_layered_packages | length > 0
 
 - name: Report reboot required for Aegis layered packages
-  tags: [aegis, packages, nfs]
+  tags: [aegis, packages, nfs, wireguard]
   ansible.builtin.debug:
     msg: Reboot Aegis to activate the newly layered packages, then rerun the playbook.
   when: aegis_layered_packages_result.needs_reboot | default(false)

ansible/roles/wireguard_overlay/defaults/main.yml

@@ -10,6 +10,12 @@ wireguard_mtu: 1420
 wireguard_firewalld_zone: wireguard
 wireguard_public_firewalld_zone: public
 wireguard_enable_ipv4_forwarding: false
+# Legacy zone-level masquerading; policy-level masquerading is required for inter-zone forwarding.
+wireguard_enable_masquerade: false
+# A list of narrowly scoped inter-zone forwarding rules, rendered as persistent
+# firewalld policies. Each item requires name, ingress_zone, egress_zone,
+# source, and destination.
+wireguard_forwarding_policies: []
 wireguard_reload_rootful_podman_networks: false
 wireguard_handshake_retries: 12
 wireguard_handshake_delay: 5

ansible/roles/wireguard_overlay/tasks/main.yml

@@ -14,10 +14,44 @@
           Configure this host's WireGuard address and peers, and run the first
           key bootstrap against every peer in the same play.
 
-    - name: Install WireGuard userspace tools
+    - name: Validate WireGuard forwarding policies
+      ansible.builtin.assert:
+        that:
+          - item.name is defined
+          - item.ingress_zone is defined
+          - item.egress_zone is defined
+          - item.source is defined
+          - item.destination is defined
+        fail_msg: >-
+          Every WireGuard forwarding policy requires name, ingress_zone,
+          egress_zone, source, and destination.
+      loop: "{{ wireguard_forwarding_policies }}"
+      loop_control:
+        label: "{{ item.name | default('unnamed policy') }}"
+
+    - name: Install WireGuard userspace tools on mutable hosts
       ansible.builtin.dnf:
         name: "{{ wireguard_packages }}"
         state: present
+      when: "'platform_fedora_iot' not in group_names"
+
+    - name: Require WireGuard userspace tools in the booted deployment
+      ansible.builtin.command:
+        argv:
+          - wg
+          - --version
+      changed_when: false
+      failed_when: false
+      register: wireguard_userspace_tools
+
+    - name: Require active WireGuard userspace tools
+      ansible.builtin.assert:
+        that:
+          - wireguard_userspace_tools.rc == 0
+        fail_msg: >-
+          WireGuard userspace tools are not present in the booted deployment.
+          On Fedora IoT, reboot after rpm-ostree layers wireguard-tools, then
+          rerun the WireGuard play.
 
     - name: Create private WireGuard configuration directory
       ansible.builtin.file:
@@ -124,12 +158,33 @@
         permanent: true
       register: wireguard_firewalld_zone_result
 
-    - name: Reload firewalld after creating the WireGuard zone
+    - name: Create the firewalld policy directory
+      ansible.builtin.file:
+        path: /etc/firewalld/policies
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+      when: wireguard_forwarding_policies | length > 0
+
+    - name: Render WireGuard forwarding policies
+      ansible.builtin.template:
+        src: wireguard-forwarding-policy.xml.j2
+        dest: "/etc/firewalld/policies/{{ item.name }}.xml"
+        owner: root
+        group: root
+        mode: "0644"
+      loop: "{{ wireguard_forwarding_policies }}"
+      loop_control:
+        label: "{{ item.name }}"
+      register: wireguard_forwarding_policy_result
+
+    - name: Reload firewalld after WireGuard firewall changes
       ansible.builtin.systemd:
         name: firewalld.service
         state: reloaded
       when:
-        - wireguard_firewalld_zone_result is changed
+        - wireguard_firewalld_zone_result is changed or (wireguard_forwarding_policy_result | default({})) is changed
         - not ansible_check_mode
 
     - name: Restore rootful Podman networking after firewalld reload
@@ -142,7 +197,7 @@
       register: wireguard_podman_network_reload
       changed_when: wireguard_podman_network_reload.stdout_lines | length > 0
       when:
-        - wireguard_firewalld_zone_result is changed
+        - wireguard_firewalld_zone_result is changed or (wireguard_forwarding_policy_result | default({})) is changed
         - wireguard_reload_rootful_podman_networks | bool
         - not ansible_check_mode
 
@@ -154,6 +209,14 @@
         permanent: true
         immediate: true
 
+    - name: Manage legacy WireGuard zone masquerading
+      ansible.posix.firewalld:
+        zone: "{{ wireguard_firewalld_zone }}"
+        masquerade: true
+        state: "{{ 'enabled' if wireguard_enable_masquerade | bool else 'disabled' }}"
+        permanent: true
+        immediate: true
+
     - name: Permit this host's public WireGuard listener
       ansible.posix.firewalld:
         port: "{{ wireguard_listen_port }}/udp"

ansible/roles/wireguard_overlay/templates/wg.conf.j2

@@ -11,7 +11,8 @@ ListenPort = {{ wireguard_listen_port }}
 {% for peer in wireguard_peers %}
 [Peer]
 # {{ peer.name }}
-PublicKey = {{ hostvars[peer.host].wireguard_public_key }}
+{% if peer.comment is defined %}# {{ peer.comment }}
+{% endif %}PublicKey = {{ hostvars[peer.host].wireguard_public_key }}
 AllowedIPs = {{ peer.allowed_ips | join(', ') }}
 {% if peer.endpoint is defined %}
 Endpoint = {{ peer.endpoint }}

ansible/roles/wireguard_overlay/templates/wireguard-forwarding-policy.xml.j2

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<policy target="CONTINUE">
+  <short>WireGuard forwarding: {{ item.name }}</short>
+  <description>Managed WireGuard-to-LAN forwarding policy.</description>
+{% if item.masquerade | default(false) %}
+  <masquerade/>
+{% endif %}
+  <ingress-zone name="{{ item.ingress_zone }}"/>
+  <egress-zone name="{{ item.egress_zone }}"/>
+  <rule family="ipv4">
+    <source address="{{ item.source }}"/>
+    <destination address="{{ item.destination }}"/>
+    <accept/>
+  </rule>
+</policy>

ansible/site.yml

@@ -73,13 +73,6 @@
     - packages_rocky
     - services_systemd
 
-- name: Configure WireGuard overlay
-  hosts: wireguard_overlay
-  become: true
-
-  roles:
-    - wireguard_overlay
-
 - name: Configure Aegis Fedora IoT profile
   hosts: role_aegis
   become: true
@@ -87,6 +80,13 @@
   roles:
     - profile_aegis
 
+- name: Configure WireGuard overlay
+  hosts: wireguard_overlay
+  become: true
+
+  roles:
+    - wireguard_overlay
+
 - name: Configure Atlas NAS profile
   hosts: atlas
   become: true