Configure Wireguard tunnelΒΆ

In this example, we show how to configure one (or more) Wireguard interfaces, and also provide (optional) readiness probes.

Each interface you wish to create will be named after the name parameter, and the config will be written to a file located under config_path.

The content parameter should be set with a valid Wireguard configuration.

The readiness probes ensure Wireguard has connectivity before continuing the cloud-init process. This could be useful if you need access to specific services like an internal APT repository server (e.g., Landscape) to install or update packages.

For a full list of keys, refer to the Wireguard module schema.

 1#cloud-config
 2wireguard:
 3  interfaces:
 4    - name: wg0
 5      config_path: /etc/wireguard/wg0.conf
 6      content: |
 7        [Interface]
 8        PrivateKey = <private_key>
 9        Address = <address>
10        [Peer]
11        PublicKey = <public_key>
12        Endpoint = <endpoint_ip>:<endpoint_ip_port>
13        AllowedIPs = <allowedip1>, <allowedip2>, ...
14    - name: wg1
15      config_path: /etc/wireguard/wg1.conf
16      content: |
17        [Interface]
18        PrivateKey = <private_key>
19        Address = <address>
20        [Peer]
21        PublicKey = <public_key>
22        Endpoint = <endpoint_ip>:<endpoint_ip_port>
23        AllowedIPs = <allowedip1>
24  readinessprobe:
25    - 'systemctl restart service'
26    - 'curl https://webhook.endpoint/example'
27    - 'nc -zv some-service-fqdn 443'