Root cause: regex_replace chains to extract subnet base from CIDR
weren't working in Ansible shell blocks, producing 10.66.66.0/24.2/32
instead of 10.66.66.2/32 — invalid CIDR that wg-quick can't parse.
Fix: replace fragile regex with simple string split via set_fact
(_subnet_base = wg_subnet.split('.')[0:3] | join('.')). Use echo
statements for lines needing shell expansion (PrivateKey, peer keys)
and quoted heredoc for static Jinja2-rendered lines (PostUp/PostDown).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- wg-quick runs under set -e; any non-zero exit kills the service
- 2>/dev/null only hides stderr, doesn't change exit code — need || true
- Split PostUp back to multiple lines (one command per line, cleaner)
- Use Jinja2 vars instead of shell heredoc for interface/subnet values
(quoted heredoc 'CONFEOF' prevents shell expansion issues, PrivateKey
written separately via echo since it needs shell expansion)
- Use -m conntrack --ctstate instead of deprecated -m state --state
- Add config dump debug task to capture generated config on failure
- Separate heredoc markers (CONFEOF/CLIENTEOF) to avoid conflicts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- ip6tables nat commands now redirect stderr to /dev/null so missing
ip6table_nat module doesn't fail PostUp and kill the service
- Pre-load ip6table_nat kernel module (ignore_errors for minimal kernels)
- Collapse PostUp/PostDown to single-line semicolon-chained commands
(avoids any heredoc whitespace or multi-line parsing issues)
- Remove comments from inside wg0.conf config body
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add IPv6 ip6tables rules to prevent IPv6 traffic leaks (forwarding was
enabled but only IPv4 masquerade existed)
- Tighten FORWARD chain: only allow wg0→internet and established return,
instead of blanket ACCEPT from wg0
- Scope NAT masquerade to VPN subnet only
- Block VPN clients from server-local services (SSH/80/443) via INPUT rules
- Set UFW DEFAULT_FORWARD_POLICY=ACCEPT (required for VPN routing; base
hardening sets default deny which blocks forwarded packets)
- Add SaveConfig = false to prevent runtime state overwriting config
- Add reload ufw handler
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
VPN/DNS/Vault → nanode/t3.micro, Matrix → g6-standard-2/t3.medium,
Cloud/Media/Email → g6-standard-1/t3.small, All-in-One → g6-standard-2/t3.medium.
Previously all services used the same provider-level default (often pulled
from c2itall vars), which meant a WireGuard VPN would default to g6-standard-2.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
n0mad1k