[SOLVED] Sharing wireguard public keys ansible.posix.synchronize:

Issue

I've just started get into ansible so can you please help me or maybe give some advice? The point is that i`m trying to install and configurate wireguard with ansible-playbook (just in case i know how to configure wireguard without ansible)

So i want to share public keys through ansible (and then read them in wg0.conf by PublicKey = {{ lookup('file', '/etc/wireguard/publickey_client') }} )

I'm trying to use ansible.posix.synchronize in my playbook, but when it goes to task "sharing keys" it just start thinking but don't do anything (for a long time) till i stop the proccess. Starting playbook with -vv also don't show anything

Playbook wireguard_configuration.yml:

---
- hosts: client
  name: make wg keys on client
  become: true
  tasks:
    - name: wg0.conf client file
      ansible.builtin.copy:
        src: /etc/ansible/conf/wg0_client.conf
        dest: /etc/wireguard/wg0.conf
        mode: 0755
        owner: owner

    - name: creating wg keys on client
      ansible.builtin.shell:
        cmd: wg genkey | tee privatekey_client | wg pubkey > publickey_client
        chdir: /etc/wireguard

    - name: share pubkey from client to server
      ansible.posix.synchronize:
        src: /etc/wireguard/publickey_client
        dest: /etc/wireguard/publickey_client
      delegate_to: server


- hosts: server
  name: make wg keys on server
  become: true
  tasks:
    - name: wg0.conf server file
      ansible.builtin.copy:
        src: /etc/ansible/conf/wg0_server.conf
        dest: /etc/wireguard/wg0.conf
        mode: 0755
        owner: owner

    - name: creating wg keys on client
      ansible.builtin.shell:
        cmd: wg genkey | tee privatekey_server | wg pubkey > publickey_server
        chdir: /etc/wireguard

    - name: share pubkey from server to client
      ansible.posix.synchronize:
        src: /etc/wireguard/publickey_server
        dest: /etc/wireguard/publickey_server
      delegate_to: client

Solution

You don't need the synchronize module here: you're not trying to copy a large hierarchy of files; you're only trying to bring a single value from the client to the server. I think a better option is just to stick that value in a variable on the client and then access it via hostvars on the server.

The following playbook is one way of doing that. A few things to note:

• I've tried to document the tasks, but let me know if something isn't clear.
• This playbook is written to be idempotent: you can run it multiple times and it will only generate the private key once.

- hosts: client
  gather_facts: false
  become: true
  tasks:
    # Read an existing private key if it is available. We set
    # failed_when to false because an "error" simply means that
    # the key doesn't exist and we need to generate it.
    - name: read private key
      command: cat /etc/wireguard/privatekey_client
      failed_when: false
      changed_when: wg_private_read.rc != 0
      register: wg_private_read

    # Generate a new key if necessary. We used the "is changed" test
    # here so that we only generate a new key if we failed to read an
    # existing key in the previous task.
    - name: generate private key
      when: wg_private_read is changed
      command: wg genkey
      register: wg_private_create

    # This will either create the privatekey_client file or leave it
    # unmodified (because the content matches what we read from it
    # earlier in the "read private key" task).
    - name: write private key
      when: wg_private_read is changed
      copy:
        content: "{{ wg_private_create.stdout }}"
        dest: /etc/wireguard/privatekey_client

    # We generate a public key but we don't bother writing it to disk.
    # The client doesn't need it and we can always generate it from
    # the private key.
    - name: generate public key
      shell:
        cmd: wg pubkey
        stdin: "{{ (wg_private_read is changed)|ternary(wg_private_create.stdout, wg_private_read.stdout) }}"
      changed_when: false
      register: wg_public

- hosts: server
  gather_facts: false
  become: true
  tasks:
    - name: write client public key
      copy:
        content: "{{ hostvars.client.wg_public.stdout }}"
        dest: "/etc/wireguard/publickey_client"

Some useful documentation links:

• About failed_when and changed_when
• The ternary filter

Answered By - larsks

Answer Checked By - Senaida (WPSolving Volunteer)