Implementation of pre shared keys per peer

tasks/main.yml

@@ -109,6 +109,28 @@
       tags:
         - wg-generate-keys
 
+- name: WireGuard pre shared key handling for new keys
+  when:
+    - not wireguard__register_config_file.stat.exists
+  block:
+    - name: Generate WireGuard pre shared key
+      ansible.builtin.command: "wg genpsk"
+      register: wireguard__register_pre_shared_keys
+      changed_when: false
+      no_log: '{{ ansible_verbosity < 3 }}'
+      tags:
+        - wg-generate-keys
+      with_items: "{{ ansible_play_hosts }}"
+
+    - name: Set pre shared keys fact (new)
+      ansible.builtin.set_fact:
+        wireguard__internal_preshared_keys: "{{ wireguard__internal_preshared_keys | default({}) | combine({item.item: item.stdout}) }}"
+      with_items: "{{ wireguard__register_pre_shared_keys.results }}"
+      when: hostvars[item.item].wireguard__internal_preshared_keys is not defined or item.item not in hostvars[item.item].wireguard__internal_preshared_keys
+      no_log: '{{ ansible_verbosity < 3 }}'
+      tags:
+        - wg-generate-keys
+
 - name: WireGuard private key handling for existing keys
   when:
     - wireguard__register_config_file.stat.exists
@@ -129,6 +151,36 @@
       tags:
         - wg-config
 
+- name: WireGuard pre shared key handling for existing keys
+  when:
+    - wireguard__register_config_file.stat.exists
+  block:
+    - name: Read WireGuard config file
+      ansible.builtin.slurp:
+        src: "{{ wireguard_remote_directory }}/{{ wireguard_interface }}.conf"
+      register: wireguard__register_config
+      no_log: '{{ ansible_verbosity < 3 }}'
+      tags:
+        - wg-config
+
+    - name: Set internal pre shared key facts
+      ansible.builtin.set_fact:
+        wireguard__internal_pre_shared_keys_hosts: "{{ wireguard__register_config['content'] | b64decode | regex_findall('\\[Peer\\].*\\n#\\s(.*)') }}"
+        wireguard__internal_pre_shared_keys_psks: "{{ wireguard__register_config['content'] | b64decode | regex_findall('\\[Peer\\](?:\\n.*?)*PresharedKey\\s=\\s(.*)') }}"
+      no_log: '{{ ansible_verbosity < 3 }}'
+      tags:
+        - wg-config
+
+    - name: Set pre shared key fact
+      ansible.builtin.set_fact:
+        wireguard__internal_preshared_keys: "{{ wireguard__internal_preshared_keys | default({}) | combine({item: wireguard__internal_pre_shared_keys_psks[idx]}) }}"
+      loop: "{{ wireguard__internal_pre_shared_keys_hosts }}"
+      loop_control:
+        index_var: idx
+      no_log: '{{ ansible_verbosity < 3 }}'
+      tags:
+        - wg-config
+
 - name: Derive WireGuard public key
   ansible.builtin.command: "wg pubkey"
   args:

templates/etc/wireguard/wg.conf.j2

@@ -50,6 +50,25 @@ SaveConfig = {{ wireguard_save_config }}
 [Peer]
 # {{ host }}
 PublicKey = {{hostvars[host].wireguard__fact_public_key}}
+{%     if  (
+         hostvars[host].wireguard__internal_preshared_keys is defined and
+         wireguard__internal_preshared_keys is defined and
+         inventory_hostname in hostvars[host].wireguard__internal_preshared_keys and
+         host in wireguard__internal_preshared_keys
+       )
+%}
+{%       if hostvars[host].wireguard__internal_preshared_keys[inventory_hostname] > wireguard__internal_preshared_keys[host] %}
+PresharedKey = {{hostvars[host].wireguard__internal_preshared_keys[inventory_hostname]}}
+{%       else %}
+PresharedKey = {{wireguard__internal_preshared_keys[host]}}
+{%       endif %}
+{%     elif hostvars[host].wireguard__internal_preshared_keys is defined and inventory_hostname in hostvars[host].wireguard__internal_preshared_keys %}
+PresharedKey = {{hostvars[host].wireguard__internal_preshared_keys[inventory_hostname]}}
+{%     elif wireguard__internal_preshared_keys is defined and host in wireguard__internal_preshared_keys %}
+PresharedKey = {{wireguard__internal_preshared_keys[host]}}
+{%     else %}
+# No pre shared key defined
+{%     endif %}
 {%     if hostvars[host].wireguard_allowed_ips is defined %}
 AllowedIPs = {{hostvars[host].wireguard_allowed_ips}}
 {%     else %}