Terraform provider reference / resources / router_wireguard_device

fiberax_router_wireguard_device (Resource)

A device (peer) of a router's WireGuard tunnel.

The private key never leaves the device. Generate the key pair on the device (or in Terraform with wireguard_asymmetric_key from the OJFord/wireguard provider) and give the platform the PUBLIC half only. Everything the device needs for its configuration is read back: its address here, and public_key, endpoint, allowed_ips, dns and keepalive of the tunnel from fiberax_router_wireguard.

The tunnel must be enabled before a device is added: reference the tunnel resource so that Terraform orders them (server_id = fiberax_router_wireguard.x.server_id). Up to ten devices per tunnel. The only changeable field is name; a new key means a new device.

Example Usage

# A device (peer) of the router's WireGuard tunnel.
#
# THE PRIVATE KEY NEVER LEAVES THE DEVICE: the platform receives the public half only.
# Generate the pair on the device with `wg genkey | tee private.key | wg pubkey`,
# or in Terraform with the OJFord/wireguard provider as below.
terraform {
  required_providers {
    fiberax   = { source = "fiberax/fiberax" }
    wireguard = { source = "OJFord/wireguard" }
  }
}

resource "wireguard_asymmetric_key" "laptop" {}

resource "fiberax_router_wireguard_device" "laptop" {
  # Referencing the tunnel resource makes Terraform enable it before adding the device.
  server_id  = fiberax_router_wireguard.vpn.server_id
  name       = "laptop"
  public_key = wireguard_asymmetric_key.laptop.public_key
}

# The device configuration, assembled from the tunnel and the device: nothing here
# comes from the platform's secrets. Feed it to `wg-quick`.
output "laptop_wg_conf" {
  sensitive = true
  value     = <<-EOT
    [Interface]
    PrivateKey = ${wireguard_asymmetric_key.laptop.private_key}
    Address = ${fiberax_router_wireguard_device.laptop.address}/${split("/", fiberax_router_wireguard.vpn.subnet)[1]}
    DNS = ${fiberax_router_wireguard.vpn.dns}

    [Peer]
    PublicKey = ${fiberax_router_wireguard.vpn.public_key}
    Endpoint = ${fiberax_router_wireguard.vpn.endpoint}
    AllowedIPs = ${join(", ", fiberax_router_wireguard.vpn.allowed_ips)}
    PersistentKeepalive = ${fiberax_router_wireguard.vpn.keepalive}
  EOT
}

Schema

Required

• name (String) Your name for the device, up to 64 characters.
• public_key (String) Public key of the device, 44 characters base64 (the wg pubkey output). The platform additionally requires the canonical encoding and answers invalid_public_key otherwise. Changing the key recreates the device.
• server_id (Number) The router whose tunnel the device belongs to. Changing it recreates the resource.

Read-Only

• address (String) Address of the device inside the tunnel, assigned by the platform. Use it with the tunnel subnet prefix in the [Interface] section.
• allowed_ips (List of String) Ranges the router routes to this device; normally the device's own address as /32.
• custom_allowed (Boolean) allowed_ips were changed inside the router by hand; the platform shows them as they are.
• foreign (Boolean) The peer was added inside the router, not through the platform: it can be deleted but not renamed.
• id (String) Device identifier on the router (dev1), assigned by the platform.
• online (Boolean) A handshake happened within the last three minutes. Not set when unknown.
• present (Boolean) The peer exists on the router. False when the tunnel is switched off or the peer was removed inside the router by hand: taint the resource to restore it.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The import ID is the router's server ID and the device ID, separated by a comma.
terraform import fiberax_router_wireguard_device.laptop 11102,dev1

Generated from the provider schema for version 0.3.0. How to install the provider: Terraform provider.