feat(vpn-overlay): add WireGuard hub role and config updates

- Added new role: wireguard/hub with tasks, defaults, and template
- Added vpn-wireguard-hub.yaml playbook
- Updated vpn-overlay.yaml with hub definitions

ansible/playbooks/vpn-wireguard-hub.yaml

@@ -0,0 +1,8 @@
+- name: Setup WireGuard for hub
+  hosts: all
+  become: true
+  vars:
+    overlay_config_path: "{{ playbook_dir }}/../../config/hub/vpn-overlay.yaml"
+    overlay_keys_path: "{{ playbook_dir }}/../../config/hub/vpn-keys.yaml"
+  roles:
+    - vhosts/vpn-overlay/wireguard/hub

ansible/roles/vhosts/vpn-overlay/wireguard/hub/defaults/main.yml

@@ -0,0 +1,4 @@
+wg_interface: "wg0"
+overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml"
+overlay_keys_path: "{{ playbook_dir }}/../../config/sit/vpn-keys.yaml"
+wg_port: "51820"

ansible/roles/vhosts/vpn-overlay/wireguard/hub/tasks/main.yml

@@ -0,0 +1,45 @@
+---
+- name: 加载 overlay 配置（标准 YAML）
+  set_fact:
+    overlay_data: "{{ lookup('file', overlay_config_path) | from_yaml }}"
+
+- name: 加载密钥配置（支持 !vault）
+  include_vars:
+    file: "{{ overlay_keys_path }}"
+    name: overlay_keys
+
+- name: 提取当前 Hub 节点信息
+  set_fact:
+    current_node: >-
+      {{ overlay_data.hubs | selectattr('name', 'equalto', inventory_hostname) | list | first }}
+    current_key: >-
+      {{ overlay_keys['keys'] | selectattr('name', 'equalto', inventory_hostname) | list | first }}
+
+- name: 提取所有对端 Peer 信息
+  set_fact:
+    peer_nodes: >-
+      {{ (overlay_data.sites + overlay_data.hubs)
+         | selectattr('name', 'in', current_node.wireguard_peer) | list }}
+    peer_keys: >-
+      {{ overlay_keys['keys']
+         | selectattr('name', 'in', current_node.wireguard_peer) | list }}
+
+- name: 校验 Peer 节点数量
+  fail:
+    msg: "没有找到任何对端节点或对应密钥，请检查 wireguard_peer 设置"
+  when: peer_nodes | length == 0 or peer_keys | length == 0
+
+- name: 渲染 wg0.conf
+  template:
+    src: wg0.conf.j2
+    dest: /etc/wireguard/wg0.conf
+    mode: '0600'
+  become: true
+
+- name: 启用并启动 wg-quick@wg0
+  systemd:
+    name: wg-quick@wg0
+    enabled: true
+    state: started
+  become: true
+

ansible/roles/vhosts/vpn-overlay/wireguard/hub/templates/wg0.conf.j2

@@ -0,0 +1,16 @@
+[Interface]
+PrivateKey = {{ current_key.private_key }}
+Address = {{ current_node.wg_ip }}/32
+ListenPort = {{ wg_port }}
+DNS = 8.8.8.8
+MTU = 1400
+
+{% for peer, key in peer_nodes | zip(peer_keys) %}
+{% if peer.name != inventory_hostname %}
+[Peer]
+PublicKey = {{ key.public_key }}
+AllowedIPs = {{ peer.wg_ip }}/32
+Endpoint = {{ peer.public_ip }}:{{ overlay_data.hub_port | default(wg_port) }}
+PersistentKeepalive = 25
+{% endif %}
+{% endfor %}

config/sit/vpn-overlay.yaml

@@ -14,15 +14,31 @@ features:
 
 # WireGuard Hub 节点配置
 hubs:
-  - name: hub-1
-    wg_ip: 172.16.0.1
+  - name: cn-hub
+    interface: eth0
+    wg_ip: 172.30.0.1
     br_ip: 10.253.253.1
+    local_ip: 172.30.0.1
+    remote_ip: 172.31.0.1
     public_ip: global-proxy.onwalk.net
+    wireguard_peer:
+      - master-1
+      - slave-1 
+      - agent-1 
+      - agent-1 
 
-  - name: hub2
-    wg_ip: 10.100.1.1
-    br_ip: 172.16.1.1
+  - name: global-hub
+    interface: ens5
+    wg_ip: 172.31.0.1
+    br_ip: 10.253.253.2
+    local_ip: 172.31.0.1
+    remote_ip: 172.30.0.1
     public_ip: hub2.example.com
+    wireguard_peer:
+      - master-1
+      - slave-1 
+      - agent-1 
+      - agent-1 
 
 # 各个站点定义
 sites: