Skip to content

Commit 9e662bd

Browse files
baurmattbaurmatt
committed
Allow deferred for private_key
1 parent d33228c commit 9e662bd

File tree

12 files changed

+552
-105
lines changed

12 files changed

+552
-105
lines changed

‎README.md‎

Lines changed: 213 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,13 @@ secure point-to-point connections in routed or bridged configurations.
1616

1717
* [`wireguard::interface`](#wireguardinterface): Defines wireguard tunnel interfaces
1818

19+
**Functions**
20+
21+
* [`wireguard::genkey`](#wireguardgenkey): Returns an array containing the wireguard private and public (in this order) key for a certain interface.
22+
* [`wireguard::genprivatekey`](#wireguardgenprivatekey): Returns the private key. Will be generated and saved to disk if it doesn't already exist.
23+
* [`wireguard::genpsk`](#wireguardgenpsk): Returns string containing the wireguard psk for a certain interface.
24+
* [`wireguard::genpublickey`](#wireguardgenpublickey): Returns a public key derived from a private key. Will be generated and saved to disk if it doesn't already exist.
25+
1926
## Classes
2027

2128
### wireguard
@@ -95,6 +102,14 @@ Define wireguard interfaces
95102

96103
Default value: {}
97104

105+
##### `config_dir_purge`
106+
107+
Data type: `Boolean`
108+
109+
110+
111+
Default value: $wireguard::params::config_dir_purge
112+
98113
### wireguard::config
99114

100115
Class configures files and directories for wireguard
@@ -115,6 +130,12 @@ Data type: `String`
115130

116131
The config_dir access mode bits
117132

133+
##### `config_dir_purge`
134+
135+
Data type: `Boolean`
136+
137+
138+
118139
### wireguard::install
119140

120141
Class installs wireguard packages and sets yum repository
@@ -169,7 +190,7 @@ The following parameters are available in the `wireguard::interface` defined typ
169190

170191
##### `private_key`
171192

172-
Data type: `String`
193+
Data type: `Any`
173194

174195
Private key for data encryption
175196

@@ -193,6 +214,8 @@ Data type: `Optional[Variant[Array,String]]`
193214

194215
List of IP (v4 or v6) addresses (optionally with CIDR masks) to
195216
be assigned to the interface.
217+
Data type isn't 100% correct but needs to be 'Any' to allow 'Deferred'
218+
on Puppet 6 systems. epp will enforce Optional[Variant[Array,String]].
196219

197220
Default value: `undef`
198221

@@ -282,3 +305,192 @@ Data type: `Optional[Variant[Array,String]]`
282305

283306

284307
Default value: `undef`
308+
309+
## Functions
310+
311+
### wireguard::genkey
312+
313+
Type: Ruby 4.x API
314+
315+
Returns an array containing the wireguard private and public (in this order) key for a certain interface.
316+
317+
#### Examples
318+
319+
##### Creating private and public key for the interface wg0.
320+
321+
```puppet
322+
wireguard::genkey('wg0', '/etc/wireguard') => [
323+
'2N0YBID3tnptapO/V5x3GG78KloA8xkLz1QtX6OVRW8=',
324+
'Pz4sRKhRMSet7IYVXXeZrAguBSs+q8oAVMfAAXHJ7S8=',
325+
]
326+
```
327+
328+
#### `wireguard::genkey(String $name, Optional[String] $path)`
329+
330+
Returns an array containing the wireguard private and public (in this order) key for a certain interface.
331+
332+
Returns: `Array` Returns [$private_key, $public_key].
333+
334+
##### Examples
335+
336+
###### Creating private and public key for the interface wg0.
337+
338+
```puppet
339+
wireguard::genkey('wg0', '/etc/wireguard') => [
340+
'2N0YBID3tnptapO/V5x3GG78KloA8xkLz1QtX6OVRW8=',
341+
'Pz4sRKhRMSet7IYVXXeZrAguBSs+q8oAVMfAAXHJ7S8=',
342+
]
343+
```
344+
345+
##### `name`
346+
347+
Data type: `String`
348+
349+
The interface name.
350+
351+
##### `path`
352+
353+
Data type: `Optional[String]`
354+
355+
Absolut path to the wireguard key files (default '/etc/wireguard').
356+
357+
### wireguard::genprivatekey
358+
359+
Type: Ruby 4.x API
360+
361+
Returns the private key. Will be generated and saved to disk if it doesn't already exist.
362+
363+
#### Examples
364+
365+
##### Creating private key for the interface wg0.
366+
367+
```puppet
368+
wireguard::genprivatekey('/etc/wireguard/wg0.key') => '2N0YBID3tnptapO/V5x3GG78KloA8xkLz1QtX6OVRW8='
369+
```
370+
371+
##### Using it as a Deferred function
372+
373+
```puppet
374+
include wireguard
375+
wireguard::interface { 'wg0':
376+
private_key => Deferred('wireguard::genprivatekey', ['/etc/wireguard/wg0.key']),
377+
listen_port => 53098,
378+
}
379+
```
380+
381+
#### `wireguard::genprivatekey(String $path)`
382+
383+
Returns the private key. Will be generated and saved to disk if it doesn't already exist.
384+
385+
Returns: `String` Returns the private key.
386+
387+
##### Examples
388+
389+
###### Creating private key for the interface wg0.
390+
391+
```puppet
392+
wireguard::genprivatekey('/etc/wireguard/wg0.key') => '2N0YBID3tnptapO/V5x3GG78KloA8xkLz1QtX6OVRW8='
393+
```
394+
395+
###### Using it as a Deferred function
396+
397+
```puppet
398+
include wireguard
399+
wireguard::interface { 'wg0':
400+
private_key => Deferred('wireguard::genprivatekey', ['/etc/wireguard/wg0.key']),
401+
listen_port => 53098,
402+
}
403+
```
404+
405+
##### `path`
406+
407+
Data type: `String`
408+
409+
Absolut path to the private key
410+
411+
### wireguard::genpsk
412+
413+
Type: Ruby 4.x API
414+
415+
Returns string containing the wireguard psk for a certain interface.
416+
417+
#### Examples
418+
419+
##### Creating psk for the interface wg0.
420+
421+
```puppet
422+
wireguard::genpsk('wg0') => 'FIVuvMyHvzujQweYa+oJdLDRvrpbHBithvMmNjN5rK4='
423+
```
424+
425+
#### `wireguard::genpsk(String $name, Optional[String] $path)`
426+
427+
Returns string containing the wireguard psk for a certain interface.
428+
429+
Returns: `String` Returns psk.
430+
431+
##### Examples
432+
433+
###### Creating psk for the interface wg0.
434+
435+
```puppet
436+
wireguard::genpsk('wg0') => 'FIVuvMyHvzujQweYa+oJdLDRvrpbHBithvMmNjN5rK4='
437+
```
438+
439+
##### `name`
440+
441+
Data type: `String`
442+
443+
The interface name.
444+
445+
##### `path`
446+
447+
Data type: `Optional[String]`
448+
449+
Absolut path to the wireguard key files (default '/etc/wireguard').
450+
451+
### wireguard::genpublickey
452+
453+
Type: Ruby 4.x API
454+
455+
Returns a public key derived from a private key.
456+
Will be generated and saved to disk if it doesn't already exist.
457+
458+
#### Examples
459+
460+
##### Creating public key for the interface wg0.
461+
462+
```puppet
463+
wireguard::genpublickey('/etc/wireguard/wg0.key',
464+
'/etc/wireguard/wg0.pub'
465+
) => 'gNaMjIpR7LKg019iktKJC74GX/MD3Y35Wo+WRNRQZxA='
466+
```
467+
468+
#### `wireguard::genpublickey(String $private_key_path, String $public_key_path)`
469+
470+
Returns a public key derived from a private key.
471+
Will be generated and saved to disk if it doesn't already exist.
472+
473+
Returns: `String` Returns the public key.
474+
475+
##### Examples
476+
477+
###### Creating public key for the interface wg0.
478+
479+
```puppet
480+
wireguard::genpublickey('/etc/wireguard/wg0.key',
481+
'/etc/wireguard/wg0.pub'
482+
) => 'gNaMjIpR7LKg019iktKJC74GX/MD3Y35Wo+WRNRQZxA='
483+
```
484+
485+
##### `private_key_path`
486+
487+
Data type: `String`
488+
489+
Absolut path to the private key
490+
491+
##### `public_key_path`
492+
493+
Data type: `String`
494+
495+
Absolut path to the public key
496+

‎files/interface.conf.epp‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
<%- | Optional[Variant[Array,String]] $address,
2+
Boolean $saveconfig,
3+
String $private_key,
4+
Integer[1,65535] $listen_port,
5+
Optional[Integer[1,9202]] $mtu,
6+
Optional[String] $dns,
7+
Optional[Variant[Array,String]] $preup,
8+
Optional[Variant[Array,String]] $postup,
9+
Optional[Variant[Array,String]] $predown,
10+
Optional[Variant[Array,String]] $postdown,
11+
Array $peers,
12+
| -%>
13+
# This file is managed by puppet
14+
[Interface]
15+
<%- if $address { -%>
16+
<%- if $address =~ Array { -%>
17+
<%- $address.flatten.each |$adr| { -%>
18+
Address = <%= $adr %>
19+
<%- } -%>
20+
<%- } else {-%>
21+
Address = <%= $address %>
22+
<%- } -%>
23+
<%- } -%>
24+
<% if $saveconfig { -%>
25+
SaveConfig = true
26+
<% } -%>
27+
PrivateKey = <%= $private_key %>
28+
ListenPort = <%= $listen_port %>
29+
<%- if $mtu { -%>
30+
MTU = <%= $mtu %>
31+
<% } -%>
32+
<%- if $dns { -%>
33+
DNS = <%= $dns %>
34+
<% } -%>
35+
<%- if $preup { -%>
36+
<%- if $preup =~ Array { -%>
37+
<%- $preup.flatten.each |$p| { -%>
38+
PreUp = <%= $p %>
39+
<%- } -%>
40+
<%- } else { -%>
41+
PreUp = <%= $preup %>
42+
<%- } -%>
43+
<%- } -%>
44+
<%- if $postup { -%>
45+
<%- if $postup =~ Array { -%>
46+
<%- $postup.flatten.each |$p| { -%>
47+
PostUp = <%= $p %>
48+
<%- } -%>
49+
<%- } else { -%>
50+
PostUp = <%= $postup %>
51+
<%- } -%>
52+
<%- } -%>
53+
<%- if $predown { -%>
54+
<%- if $predown =~ Array { -%>
55+
<%- $predown.flatten.each |$p| { -%>
56+
PreDown = <%= $p %>
57+
<%- } -%>
58+
<%- } else { -%>
59+
PreDown = <%= $predown %>
60+
<%- } -%>
61+
<%- } -%>
62+
<%- if $postdown { -%>
63+
<%- if $postdown =~ Array { -%>
64+
<%- $postdown.flatten.each |$p| { -%>
65+
PostDown = <%= $p %>
66+
<%- } -%>
67+
<%- } else { -%>
68+
PostDown = <%= $postdown %>
69+
<%- } -%>
70+
<%- } -%>
71+
<%- if $peers { -%>
72+
73+
# Peers
74+
<%- $peers.each |$peer| { -%>
75+
[Peer]
76+
<%- $peer.each |$key,$value| { -%>
77+
<%- if $key == 'Comment' { -%>
78+
# <%= $value -%>
79+
<%- } else { -%>
80+
<%= $key %> = <%= $value -%>
81+
<%- } %>
82+
<%- } %>
83+
<%- } -%>
84+
<%- } -%>

‎lib/puppet/functions/wireguard/genkey.rb‎

Lines changed: 5 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
1+
# Returns an array containing the wireguard private and public (in this order) key for a certain interface.
12
Puppet::Functions.create_function(:'wireguard::genkey') do
2-
# Returns an array containing the wireguard private and public (in this order) key
3-
# for a certain interface.
43
# @param name The interface name.
54
# @param path Absolut path to the wireguard key files (default '/etc/wireguard').
65
# @return [Array] Returns [$private_key, $public_key].
@@ -11,33 +10,10 @@
1110
# ]
1211
dispatch :genkey do
1312
required_param 'String', :name
13+
optional_param 'String', :path
1414
return_type 'Array'
1515
end
1616

17-
def gen_privkey(private_key_path, public_key_path)
18-
unless File.exists?(private_key_path)
19-
private_key = Puppet::Util::Execution.execute(
20-
['/usr/bin/wg', 'genkey'],
21-
)
22-
File.open(private_key_path, 'w') do |f|
23-
f << private_key
24-
end
25-
File.delete(public_key_path) if File.exist?(public_key_path)
26-
end
27-
end
28-
29-
def gen_pubkey(private_key_path, public_key_path)
30-
unless File.exists?(public_key_path)
31-
public_key = Puppet::Util::Execution.execute(
32-
['/usr/bin/wg', 'pubkey'],
33-
{:stdinfile => private_key_path},
34-
)
35-
File.open(public_key_path, 'w') do |f|
36-
f << public_key
37-
end
38-
end
39-
end
40-
4117
def genkey(name, path='/etc/wireguard')
4218
private_key_path = File.join(path, "#{name}.key")
4319
public_key_path = File.join(path, "#{name}.pub")
@@ -47,9 +23,9 @@ def genkey(name, path='/etc/wireguard')
4723
raise Puppet::ParseError, "#{dir} is not writable" if not File.writable?(dir)
4824
end
4925

50-
gen_privkey(private_key_path, public_key_path)
51-
gen_pubkey(private_key_path, public_key_path)
52-
[File.read(private_key_path),File.read(public_key_path)]
26+
private_key = call_function('wireguard::genprivatekey', private_key_path)
27+
public_key = call_function('wireguard::genpublickey', private_key_path, public_key_path)
28+
[private_key, public_key]
5329
end
5430
end
5531

0 commit comments

Comments
 (0)