-
FIXES
- add missing
wg-config
tag (Issue #211) - hide peers with empty endpoints (Issue #101 - contribution by @Miroka96)
- add missing
-
FEATURE
- add support for
Fedora 40
- add Netplan support for Ubuntu (contribution by @kbcz1989)
- add support for
-
OTHER
- update
.yamllint
- fix
ansible-lint
issues - update
.gitignore
- update
-
BREAKING
- removed support for
openSUSE 15.4
(reached end of life)
- removed support for
-
FEATURE
- add support for
Ubuntu 24.04
- add support for
openSUSE 15.6
- add support for
-
MOLECULE
- remove outdated
Proxmox
code - replace Vagrant box
rockylinux/9
withbento/rockylinux-9
- use
ansible.builtin.package
for AlmaLinux - remove
AlmaLinux 8
,Rocky Linux 8
andCentOS 7
(outdated Python makes it hard to test with Ansible)
- remove outdated
- OTHER
- revert change in
.github/workflows/release.yml
- revert change in
- OTHER
- update
.github/workflows/release.yml
- update
meta/main.yml
- update
-
BREAKING
- removed support for Fedora 37/38 (reached end of life)
-
FEATURE
- add support for Fedora 39
- introduce
wireguard_conf_backup
variable to keep track of configuration changes. Default tofalse
. (contribution by @shk3bq4d) - introduce
wireguard_install_kernel_module
. Allows to skip loading thewireguard
kernel module. Default totrue
(which was the previous behavior). (contribution by @gregorydlogan)
-
MOLECULE
- use different IP addresses
- use
generic
Vagrant boxes for Rocky Linux - use
alvistack
Vagrant boxes for Ubuntu - use official Rocky Linux 9 Vagrant box
- use official AlmaLinux Vagrant boxes
- move
memory
andcpus
parameter to Vagrant boxes
-
BREAKING
- removed support for Ubuntu 18.04 (reached end of life)
- removed support for Fedora 36 (reached end of life)
-
FEATURE
- add support for Fedora 37
- add support for Fedora 38
- add support for openSUSE 15.5
- add support for Debian 12
- prefix host name comment with
Name =
for wg-info in WireGuard interface configuration (contribution by @tarag)
-
MOLECULE
- rename
kvm
scenario todefault
- rename
kvm-single-server
scenario tosingle-server
- upgrade OS and reboot in prepare before converge for Almalinux
- rename
-
OTHER
- fix
ansible-lint
issues
- fix
-
BREAKING
- CentOS 7: Introduce
wireguard_centos7_kernel_plus_reboot
andwireguard_centos7_standard_reboot
variables. Both are set to "true" by default. This will cause the host to be rebooted in case the "wireguard" kernel module was installed the very first time. Ifwireguard_centos7_installation_method: "kernel-plus"
is set and the host wasn't booted with akernel-plus
kernel already you most probably need to reboot. For thestandard
kernel this might not be needed. - CentOS 7: Add reboot to the standard mode to make sure the WireGuard kernel module is available (contribution by @mofelee)
- Introduce
wireguard_update_cache
variable to control if package manager caches should be updated before the installation (contribution by @sebix). Before this release the package manager cache wasn't updated for AlmaLinux 9, Archlinux, Fedora and openSUSE. Withwireguard_update_cache
set totrue
by default those OSes are now also update the package manager cache. If you don't want that setwireguard_update_cache
tofalse
for the host in question.
- CentOS 7: Introduce
-
FEATURE
- add support for Oracle Linux 9 (contribution by @cola-zero)
-
DEPRECATION
- variable
wireguard_ubuntu_update_cache
is deprecated
- variable
- fix in README
- add IPv6 support (contribution by @DiscowZombie)
- introduce
wireguard_addresses
variable (contribution by @DiscowZombie)
- remove Fedora 35 support (reached EOL)
- remove openSUSE 15.3 support (reached EOL)
- remove Debian 10 (Buster) support (reached EOL)
- fix Molecule prepare for Archlinux
- fix
ansible-lint
issue intasks/setup-debian-raspbian-buster.yml
- add support for elementary OS 6
- ignore some minor linter warnings
- add support for Rocky Linux 9 (original PR from @vincentDcmps: #163)
- add support for AlmaLinux 9 (original PR from @trunet: #164)
- add
EL9
tometa/main.yml
- require Ansible >=
2.11
as Rocky Linux is only supported with this version or above ansible-lint
: usecommunity.general.pacman
module instead ofansible.builtin.pacman
for Archlinux setup
- remove Fedora 34 + add Fedora 36 to Molecule test
- remove support for Fedora 35 / add support for Fedora 36
- add Molecule setup for openSUSE 15.4
- add Github release action to push new release to Ansible Galaxy
- add
.yamllint
tasks/main.yml
: names should start with an uppercase letterhandlers/main.yml
: names should start with an uppercase letter- improve the task key order to: name, when, tags, block
- fix Jinja2 spacing
- add support for Ubuntu 22.04 (Jammy Jellyfish)
- add
wireguard_interface_restart
variable. This allows the user to decide if the WireGuard interface should be restarted or not in case of changes to the interface. The default is (and was) to usewg syncconf
which applies the changes to the interface without the need to restart the interface. Restarting the interface was only done ifwg
'ssyncconf
command wasn't available. But that's basically only true for very old (and outdated) WireGuard tools. For more information on this have a look at the README (initial PR by @lmm-git) - on Debian
lsb-release
is no longer needed (contribution by @blackandred) - WireGuard is directly supported by
Raspbian 11
(Bullseye) and higher. SoRaspbian 11
andRaspbian 10 (Buster)
(and lower) needs to be handled a little bit differently. (contribution by @penguineer) - implement a very basic Molecule unit test
- For
Rocky Linux 8
only: Added variablewireguard_rockylinux8_installation_method
. Setwireguard_rockylinux8_installation_method
todkms
to build WireGuard module from source, with wireguard-dkms. This is required if you use a custom kernel and/or your arch is notx86_64
. The default ofstandard
will install the kernel module with kmod-wireguard from ELRepo (contribution by @gitouche-sur-osm)
- FIX: The template rendering the WireGuard configuration only checked if
wireguard_save_config
was set and if so setsSaveConfig = true
. So settingwireguard_save_config: "false"
had no effect.
- set minimally required Ansible version to
2.9
(contribution by @8ware) - fully qualify modules names (requires Ansible >= 2.9) (contribution by @8ware)
- rearrange hooks to match lifecycle order (contribution by @8ware)
- remove
CentOS 8
support (reached end of life) - use AlmaLinux or Rocky Linux instead - remove
Fedora 33
support (reached end of life) - remove
openSUSE Leap 15.2
support (reached end of life) - add
openSUSE 15.3
support - add
Fedora 35
support - remove Proxmox from Molecule test (Vagrant boxes for Proxmox are not useable)
- Remove unnecessary check if value is an integer on
wireguard_port
(see #112 (contribution by @abelfodil)
- add support for installing wireguard in pve lxc guest (contribution by @tobias-richter)
- add Molecule test for CentOS 7
kernel-plus
- add support for
kernel-plus
for CentOS 7 (contribution by @john-p-potter)
- add Rocky Linux support
- add AlmaLinux support
- add Molecule tests for Rocky Linux and AlmaLinux
- add
Debian 11 (Bullseye)
support - add 'Fedora 34` support
- remove
Fedora 32
support (EOL was in May 2021) - fix various issues reported by
ansible-lint
- Archlinux: As
linux-lts
is using kernel5.10
now there is no need to installwireguard-lts
+ WireGuard DKMS packages any longer (and this packages are gone anyway)
- Refactor
wg-install
tag handling. For more details see Fix tag "wg-install" & Add no_log and [Tag wg-install is not applied properly](Tag wg-install is not applied properly) (contribution by @moonrail) - Default verbosity of 0 or slight increases up to 2 will now not print any private keys to output (contribution by @moonrail)
- Introduce new variables
wireguard_service_enabled
andwireguard_service_state
(contribution by @tjend)
- Support for Proxmox
- Check if
wireguard_endpoint
exists before checking if it is empty
- Added support for
Fedora 33
(contribution by @wzzrd) - Removed support for
Fedora 31
(reached end of life)
- Added support for
openSUSE Leap 15.2
- Use wireguard packages from Debian Backports instead of Debian Sid, these packages are more suitable for a stable distribution and have less impact on the system. Packages from unstable must be removed manually (including kernel) to make the switch on an existing system. Upgrading the role has no effect other than adding Debian Backports to the Apt repositories.
- Fix reboot mechanism in Raspbian role, now also works without
molly-guard
- Added
wireguard_private_key
variable (contribution by @j8r) - Fix check mode for Debian (contribution by @j8r)
wireguard
package is now available for Ubuntu 18.04 in universe repository. Before thatppa:wireguard/wireguard
was used but that one isn't available anymore. The install procedure for Ubuntu 18.04 and 20.04 is now the same as both can usewireguard
metapackage now. The role takes care to removewireguard-dkms
package in favour ofwireguard
metapackage but it leaves the configuration file forppa:wireguard/wireguard
repository untouched. So it's up to you to remove that PPA. Either useapt-add-repository --remove ppa:wireguard/wireguard
or remove the file manually at/etc/apt/sources.list.d/
directory (you man need to runapt-get update
afterwards).
- Added initial molecule infrastructure
- Remove useless block for single task in
setup-debian-vanilla.yml
(contribution by @rubendibattista)
- Debian only: Ensure the headers for the currently running kernel are installed instead of the latest one which might not be running yet. This allows DKMS to build the module for the current kernel version and avoids the need for an reboot to load the module. (contribution by @ldelelis and @ypid)
-
Fix spelling and typos in docs. (contribution by @ypid)
-
Drop Debian Stretch from the list of tested Linux distributions. Actual support was dropped/broken in 6.0.4 without updating the docs. (contribution by @ypid)
-
Remove obsolete
.reload-module-on-update
file. It does not serve any function anymore after support for module reloading has been removed from the postinst script in 0.0.20200215-2 on 2020-02-24. A module update is properly signaled via /run/reboot-required so that the admin can (automatically) schedule a reboot when convenient. This will also be more in line with future Debian releases because starting with Debian bullseye, the kernel ships the module. (contribution by @ypid) -
Add
ansible_managed
header to WireGuard configuration file (wg0.conf
by default). This will most probably change the WireGuard configuration file but only the formatting. But since the Ansible registers this file as changed Ansible will sync/restart WireGuard service. For newer WireGuard versions (since Nov. 2019) this isn't a problem normally aswg syncconf
command is used (also seehandlers/main.yml
). (contribution by @ypid) -
Behind the scenes coding style improvements and cleanup without user impact. (contribution by @ypid)
- Basic MacOS X support (contribution by @rubendibattista)
- Introduce variables
wireguard_conf_owner
,wireguard_conf_group
andwireguard_conf_mode
(contribution by @rubendibattista) - Fixed a typo bug in
handlers/main.yml
(contribution by @gabriel-v). But it looks like this had no impact on the "sync/restart" functionality. - Proper formatting of WireGuard configuration file (
wg0.conf
by default). This will most probably change the WireGuard configuration file but only the formatting. But since the Ansible registers this file as changed Ansible will sync/restart WireGuard service. For newer WireGuard versions (since Nov. 2019) this isn't a problem normally aswg syncconf
command is used (also seehandlers/main.yml
). - Introduce
wireguard_dc
variable. This is an alpha feature and subject to change and may be even removed in future releases again. Therefore no documentation for this variable yet.
- Add support for unmanaged peers with
wireguard_unmanaged_peers
(contribution by @joneskoo)
- Switched to install from ELRepo KMOD package for CentOS (see WireGuard installation). This change may break installation for systems with custom kernels. The role previously supported custom kernel implicitly because it was using DKMS package (contribution by @elcomtik)
- Role removes DKMS WireGuard package, however it doesn't remove jdoss-wireguard-epel-7 repository. If you don't need this repository, do cleanup by removing
/etc/yum.repos.d/wireguard.repo
- Support Openstack Debian images (contribution by @pallinger)
- Support Raspbian (contribution by @penguineer)
- Support Ubuntu 20.04 (Focal Fossa)
- Introduce
wireguard_ubuntu_update_cache
andwireguard_ubuntu_cache_valid_time
variables to specify individual Ubuntu package cache settings. Default values are the same as before. - As kernel >= 5.6 (and kernel 5.4 in Ubuntu 20.04) now have
wireguard
module includedwireguard-dkms
package is no longer needed in that case. That's why WireGuard package installation is now part of the includes for the specific OS to make it easier to handle various cases.
- Archlinux: Linux kernel >= 5.6 contains
wireguard
module now. No need to installwireguard-dkms
anymore in this case. Installations with LTS kernel installswireguard-lts
package now instead ofwireguard-dkms
. Installations with kernel <= 5.6 will still installwireguard-dkms
package.
-
Use the buster-backports repository on Debian Buster (or older), use package standard repositories on sid/bullseye. standard repositories on sid/bullseye.
The role no longer adds the unstable repo nor the apt preference for that repo. There is no need to clean the preference and unstable repository, since packages from your release have a higher priority.
If you remove the apt preference (
/etc/apt/preferences.d/limit-unstable
) updates fromunstable
are accepted by apt. This likely is not what you want and may lead to an unstable state.If you want to clean up:
- remove
/etc/apt/preferences.d/limit-unstable
and - remove
deb http://deb.debian.org/debian/ unstable main
from/etc/apt/sources.list.d/deb_debian_org_debian.list
.
The backports repository has a lower priority and does not need an apt preference.
- remove
- If
wg syncconf
command is not available do stop/start service instead of restart (contribution by @cristichiru)
- Debian: install
gnupg
package instead ofgpg
. (contribution by @zinefer)
- add shell options to syncconf handler to fail fast in case of error
- Newer versions of WireGuard (around November 2019) introduced
wg syncconf
subcommand. This has the advantage that changes to the WireGuard configuration can be applied without disturbing existing connections. With this change this role tries to usewg syncconf
subcommand when available. This even works if you have hosts with older and newer WireGuard versions.
wireguard_(preup|postdown|preup|predown)
settings are now a list. If moreiptables
commands needs to be specified e.g. then this changes makes it more readable. The commands are executed in order as described in wg-quick.8. Also see README for more examples. (contribution by @Madic-)
- Add support for Fedora (contribution by @ties)
- Install GPG to be able to import WireGuard key (Debian)
- Allow to specify additional Wireguard interface options:
fwmark
,mtu
,table
,preup
andpredown
(for more information and examples see wg-quick.8) - Add host comments in Wireguard config file
- While the changes introduced are backwards compatible in general if you stay with your current settings some variables are no longer needed. So this is partly a breaking change and therefore justifies a new major version.
- Support multiple Wireguard interfaces. See README for examples (contribution by fbourqui)
- Make role stateless: In the previous versions the private and public keys of the Wireguard hosts were stored locally in the directory defined with the
wireguard_cert_directory
variable. This is no longer the case. The variableswireguard_cert_directory
,wireguard_cert_owner
andwireguard_cert_group
are no longer needed and were removed. If you used this role before this release it's safe to remove them from your settings. The directory that was defined with thewireguard_cert_directory
variable will be kept. While not tested it may enable you to go back to an older version of this role and it should still work (contribution by fbourqui) - Reminder:
wireguard_cert_directory
default was~/wireguard/certs
. Public and Private keys where stored on the host running ansible playbook. As a security best practice private keys of all your WireGuard endpoints should not be kept locally.
- remove unneeded
with_inventory_hostnames
loops (thanks to @pierreozoux for initial PR)
- remove unnecessary files (contribution by @pierreozoux)
- add support for RHEL/CentOS (contribution by @ahanselka)
- pass package list directly to some modules by using the new and preferred syntax instead
loop
orwith_items
(contribution by @ahanselka)
- fix address in README
- support for Debian added (contribution by @ties)
- make Ansible linter happy
- use correct semantic versioning as described in Semantic versioning. Needed for Ansible Galaxy importer as it now insists on using semantic versioning.
- moved changelog entries to separate file
- make Ansible linter happy
- no major changes but decided to start a new major release as versioning scheme changed quite heavily
- update README
- update README
- initial implementation