Renew to wireguard

templates/etc/openvpn/client/client.ovpn.j2

@@ -1,29 +0,0 @@
-client
-dev tun
-proto {{ vpn_protocol }}
-remote {{ vpn_host }} {{ vpn_port }}
-remote-cert-tls server
-key-direction 1
-cipher AES-256-CBC
-auth SHA512
-auth-nocache
-tls-version-min 1.2
-tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
-comp-lzo
-nobind
-persist-key
-persist-tun
-mute-replay-warnings
-verb 3
-<ca>
-{{ lookup("file", easy_rsa_home + "/pki/ca.crt") }}
-</ca>
-<cert>
-{{ lookup("file", easy_rsa_home + "/pki/issued/" + client + ".crt") }}
-</cert>
-<key>
-{{ lookup("file", easy_rsa_home + "/pki/private/" + client + ".key") }}
-</key>
-<tls-auth>
-{{ lookup("file", vpn_tlsauth_key_file) }}
-</tls-auth>

templates/etc/wireguard/clients/wireguard-client.conf.j2

@@ -0,0 +1,11 @@
+[Interface]
+Address = {{ vpn_gateway_net_prefix }}.{{ vpn_client.index }}/32
+PrivateKey = {{ vpn_client.private_key }}
+DNS = {{ vpn_internal_dns }}
+
+[Peer]
+PublicKey = {{ vpn_gateway_public_key }}
+Endpoint = {{ vpn_gateway_host }}:{{ vpn_gateway_port }}
+AllowedIPs = {{ vpn_gateway_net_prefix }}.1/{% if vpn_allow_adjacent_client_traffic %}{{ vpn_gateway_net_cidr }}{% else %}32{% endif %}
+
+PersistentKeepalive = {{ vpn_keepalive }}

templates/etc/wireguard/private.key.j2

@@ -0,0 +1 @@
+{{ vpn_gateway_private_key }}

templates/etc/wireguard/public.key.j2

@@ -0,0 +1 @@
+{{ vpn_gateway_public_key }}

templates/etc/wireguard/wireguard.conf.j2

@@ -0,0 +1,25 @@
+[Interface]
+Address = {{ vpn_gateway_net_prefix }}.1/{{ vpn_gateway_net_cidr }}
+ListenPort = {{ vpn_gateway_port }}
+PrivateKey = {{ vpn_gateway_private_key }}
+
+{% if vpn_gateway_forward is defined and vpn_gateway_forward | length > 0 %}
+PreUp = sysctl -w net.ipv4.ip_forward=1
+PreUp = sysctl -w net.ipv6.conf.all.forwarding=1
+
+{% for config in vpn_gateway_forward %}
+PreUp = iptables -t nat -A PREROUTING -i {{ vpn_gateway_interface }} -p {{ config.protocol | default('tcp') }} --dport {{ config.server_port }} -j DNAT --to-destination {{ vpn_gateway_net_prefix }}.{{ config.client_index }}:{{ config.client_port }}
+PostDown = iptables -t nat -D PREROUTING -i {{ vpn_gateway_interface }} -p {{ config.protocol | default('tcp') }} --dport {{ config.server_port }} -j DNAT --to-destination {{ vpn_gateway_net_prefix }}.{{ config.client_index }}:{{ config.client_port }}
+
+{% endfor %}
+PreUp = iptables -t nat -A POSTROUTING -o {{ cloud_name }} -j MASQUERADE
+PostDown = iptables -t nat -D POSTROUTING -o {{ cloud_name }} -j MASQUERADE
+{% endif %}
+
+{% for client in vpn_clients %}
+## vpn {{ cloud_name }} - {{ client }} ##
+[Peer]
+PublicKey = {{ vpn_clients[client].public_key }}
+AllowedIPs = {{ vpn_gateway_net_prefix }}.{{ vpn_clients[client].index }}/32
+
+{% endfor %}