From 7f21f2802beaa1b4f157912df955bd4b463eb897 Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Sat, 12 Apr 2025 18:57:33 +0800
Subject: [PATCH] feat(vpn-overlay): add WireGuard hub role and config updates

- Added new role: wireguard/hub with tasks, defaults, and template
- Added vpn-wireguard-hub.yaml playbook
- Updated vpn-overlay.yaml with hub definitions
---
 ansible/playbooks/vpn-wireguard-hub.yaml      |  8 ++++
 .../wireguard/hub/defaults/main.yml           |  4 ++
 .../vpn-overlay/wireguard/hub/tasks/main.yml  | 45 +++++++++++++++++++
 .../wireguard/hub/templates/wg0.conf.j2       | 16 +++++++
 config/sit/vpn-overlay.yaml                   | 26 ++++++++---
 5 files changed, 94 insertions(+), 5 deletions(-)
 create mode 100644 ansible/playbooks/vpn-wireguard-hub.yaml
 create mode 100644 ansible/roles/vhosts/vpn-overlay/wireguard/hub/defaults/main.yml
 create mode 100644 ansible/roles/vhosts/vpn-overlay/wireguard/hub/tasks/main.yml
 create mode 100644 ansible/roles/vhosts/vpn-overlay/wireguard/hub/templates/wg0.conf.j2

diff --git a/ansible/playbooks/vpn-wireguard-hub.yaml b/ansible/playbooks/vpn-wireguard-hub.yaml
new file mode 100644
index 00000000..cb62cb5c
--- /dev/null
+++ b/ansible/playbooks/vpn-wireguard-hub.yaml
@@ -0,0 +1,8 @@
+- name: Setup WireGuard for hub
+  hosts: all
+  become: true
+  vars:
+    overlay_config_path: "{{ playbook_dir }}/../../config/hub/vpn-overlay.yaml"
+    overlay_keys_path: "{{ playbook_dir }}/../../config/hub/vpn-keys.yaml"
+  roles:
+    - vhosts/vpn-overlay/wireguard/hub
diff --git a/ansible/roles/vhosts/vpn-overlay/wireguard/hub/defaults/main.yml b/ansible/roles/vhosts/vpn-overlay/wireguard/hub/defaults/main.yml
new file mode 100644
index 00000000..116c449d
--- /dev/null
+++ b/ansible/roles/vhosts/vpn-overlay/wireguard/hub/defaults/main.yml
@@ -0,0 +1,4 @@
+wg_interface: "wg0"
+overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml"
+overlay_keys_path: "{{ playbook_dir }}/../../config/sit/vpn-keys.yaml"
+wg_port: "51820"
diff --git a/ansible/roles/vhosts/vpn-overlay/wireguard/hub/tasks/main.yml b/ansible/roles/vhosts/vpn-overlay/wireguard/hub/tasks/main.yml
new file mode 100644
index 00000000..c2072cf3
--- /dev/null
+++ b/ansible/roles/vhosts/vpn-overlay/wireguard/hub/tasks/main.yml
@@ -0,0 +1,45 @@
+---
+- name: 加载 overlay 配置（标准 YAML）
+  set_fact:
+    overlay_data: "{{ lookup('file', overlay_config_path) | from_yaml }}"
+
+- name: 加载密钥配置（支持 !vault）
+  include_vars:
+    file: "{{ overlay_keys_path }}"
+    name: overlay_keys
+
+- name: 提取当前 Hub 节点信息
+  set_fact:
+    current_node: >-
+      {{ overlay_data.hubs | selectattr('name', 'equalto', inventory_hostname) | list | first }}
+    current_key: >-
+      {{ overlay_keys['keys'] | selectattr('name', 'equalto', inventory_hostname) | list | first }}
+
+- name: 提取所有对端 Peer 信息
+  set_fact:
+    peer_nodes: >-
+      {{ (overlay_data.sites + overlay_data.hubs)
+         | selectattr('name', 'in', current_node.wireguard_peer) | list }}
+    peer_keys: >-
+      {{ overlay_keys['keys']
+         | selectattr('name', 'in', current_node.wireguard_peer) | list }}
+
+- name: 校验 Peer 节点数量
+  fail:
+    msg: "没有找到任何对端节点或对应密钥，请检查 wireguard_peer 设置"
+  when: peer_nodes | length == 0 or peer_keys | length == 0
+
+- name: 渲染 wg0.conf
+  template:
+    src: wg0.conf.j2
+    dest: /etc/wireguard/wg0.conf
+    mode: '0600'
+  become: true
+
+- name: 启用并启动 wg-quick@wg0
+  systemd:
+    name: wg-quick@wg0
+    enabled: true
+    state: started
+  become: true
+
diff --git a/ansible/roles/vhosts/vpn-overlay/wireguard/hub/templates/wg0.conf.j2 b/ansible/roles/vhosts/vpn-overlay/wireguard/hub/templates/wg0.conf.j2
new file mode 100644
index 00000000..952866f6
--- /dev/null
+++ b/ansible/roles/vhosts/vpn-overlay/wireguard/hub/templates/wg0.conf.j2
@@ -0,0 +1,16 @@
+[Interface]
+PrivateKey = {{ current_key.private_key }}
+Address = {{ current_node.wg_ip }}/32
+ListenPort = {{ wg_port }}
+DNS = 8.8.8.8
+MTU = 1400
+
+{% for peer, key in peer_nodes | zip(peer_keys) %}
+{% if peer.name != inventory_hostname %}
+[Peer]
+PublicKey = {{ key.public_key }}
+AllowedIPs = {{ peer.wg_ip }}/32
+Endpoint = {{ peer.public_ip }}:{{ overlay_data.hub_port | default(wg_port) }}
+PersistentKeepalive = 25
+{% endif %}
+{% endfor %}
diff --git a/config/sit/vpn-overlay.yaml b/config/sit/vpn-overlay.yaml
index c78c8fa9..ddbd0e43 100644
--- a/config/sit/vpn-overlay.yaml
+++ b/config/sit/vpn-overlay.yaml
@@ -14,15 +14,31 @@ features:
 
 # WireGuard Hub 节点配置
 hubs:
-  - name: hub-1
-    wg_ip: 172.16.0.1
+  - name: cn-hub
+    interface: eth0
+    wg_ip: 172.30.0.1
     br_ip: 10.253.253.1
+    local_ip: 172.30.0.1
+    remote_ip: 172.31.0.1
     public_ip: global-proxy.onwalk.net
+    wireguard_peer:
+      - master-1
+      - slave-1 
+      - agent-1 
+      - agent-1 
 
-  - name: hub2
-    wg_ip: 10.100.1.1
-    br_ip: 172.16.1.1
+  - name: global-hub
+    interface: ens5
+    wg_ip: 172.31.0.1
+    br_ip: 10.253.253.2
+    local_ip: 172.31.0.1
+    remote_ip: 172.30.0.1
     public_ip: hub2.example.com
+    wireguard_peer:
+      - master-1
+      - slave-1 
+      - agent-1 
+      - agent-1 
 
 # 各个站点定义
 sites: