Automate Wireguard Key Generation #19

New Issue

Open

opened 2023-08-13 22:14:15 +02:00 by so-rose · 0 comments

so-rose commented

2023-08-13 22:14:15 +02:00

Owner

Currently, we must prepare the password-store with pre-generated Wireguard keys pseudo-like this:

wg genkey
pass insert path/to/private
pass /path/to/private | wg pubkey
pass insert /path/to/public

Save each in password-store under <host>_<private|public>_key.

Then, generate a "Pre-Shared Key" for each Peer-Peer:

wg genpsk > psk_peer_peer

This is obviously something that should be scripted; ideally in a dedicated Ansible playbook One key is generated per host, as well as one key per possible host interaction (it's a PK problem, yay!). That's a lot of typing.

The trouble is, the secret store is also involved, and must be written to thoroughly. Doing this properly, in a way that doesn't rely on a single developer's secret store, requires #18 to be implemented.

Currently, we must prepare the `password-store` with pre-generated Wireguard keys pseudo-like this: ```bash wg genkey pass insert path/to/private pass /path/to/private | wg pubkey pass insert /path/to/public ``` Save each in `password-store` under `<host>_<private|public>_key`. Then, generate a "Pre-Shared Key" for each Peer-Peer: ``` wg genpsk > psk_peer_peer ``` This is obviously something that should be scripted; ideally in a dedicated Ansible playbook One key is generated per host, as well as one key *per possible host interaction* (it's a PK problem, yay!). That's a lot of typing. The trouble is, the secret store is also involved, and must be written to thoroughly. Doing this properly, in a way that doesn't rely on a single developer's secret store, requires #18 to be implemented.