main.yml

##### WIREGUARD VPN SERVER #####
# IP address at which the VPN server can be contacted by clients
wireguard_server_public_ip: "CHANGEME"
# IP address of the VPN server on the VPN network (CIDR notation)
# if you change this after deployment, please delete /etc/firewalld/zones/000-wireguard.xml from the server first
wireguard_server_ip: "10.200.200.1/24"
# yes/no: enable/disable the wireguard server service
wireguard_enable_service: yes

# List of wireguard peers (clients) allowed to connect to the server
# clients can generate a private/public key pair by running: wg genkey | (umask 0077 && tee wireguard.key) | wg pubkey > wireguard.pub
# wireguard_peers:
#   - name: client1 # arbitrary name for the peer
#     state: present # (optional, present/absent, default present) set to absent to remove the peer and its keys)
#     public_key: Faz...4vEQ= # the public key of the peer (contents of its wireguard.pub)
#     ip_address: "10.200.200.10" # IP address of the client on the VPN network (CIDR notation), must be part of the VPN server network
#     routes: "1.2.3.4/32, 192.168.18.0/24" # (optional, default 0.0.0.0/0 - route all traffic through the VPN) IP addresses/networks to route through the VPN on the client
#   - name: client2
#     state: absent
wireguard_peers: []

# firewall zones from which peers are allowed to connect to the VPN service, if nodiscc.xsrv.common/firewalld role is deployed
# 'zone:' is one of firewalld zones, set 'state:' to 'disabled' to remove the rule (the default is state: enabled)
wireguard_firewalld_zones:
  - zone: public
    state: enabled
  - zone: internal
    state: enabled

# allow wireguard clients to connect to these firewalld services/ports on the host
# in addition, the clients must have a route to the server IP in wireguard_peers.*.routes, see anotherclient example above
# Example:
# wireguard_firewalld_services:
#   - name: ssh # service name
#     state: enabled # enabled/disabled (default enabled)
#   - name: dns
#     state: enabled
#   - name: http
#   - name: https
#   - name: netdata
#   - name: imaps
#     state: disabled
wireguard_firewalld_services: []