refactor(wireguard-hub): restructure role path and update config files

- Moved WireGuard Hub role into playbooks directory structure
- Updated vpn-wireguard-hub.yaml to match new role path
- Modified vpn-keys.yaml and vpn-overlay.yaml

ansible/playbooks/roles/vhosts/vpn-overlay/wireguard/hub/tasks/main.yml

@@ -29,6 +29,18 @@
     msg: "没有找到任何对端节点或对应密钥，请检查 wireguard_peer 设置"
   when: peer_nodes | length == 0 or peer_keys | length == 0
 
+- name: Ensure wireguard-tools is installed (Debian/Ubuntu)
+  apt:
+    name: wireguard-tools
+    state: present
+  when: ansible_os_family == 'Debian'
+
+- name: Ensure wireguard-tools is installed (RHEL/CentOS)
+  yum:
+    name: wireguard-tools
+    state: present
+  when: ansible_os_family == 'RedHat'
+
 - name: 渲染 wg0.conf
   template:
     src: wg0.conf.j2
@@ -42,4 +54,3 @@
     enabled: true
     state: started
   become: true
-

ansible/playbooks/vpn-wireguard-hub.yaml

@@ -2,7 +2,7 @@
   hosts: all
   become: true
   vars:
-    overlay_config_path: "{{ playbook_dir }}/../../config/hub/vpn-overlay.yaml"
-    overlay_keys_path: "{{ playbook_dir }}/../../config/hub/vpn-keys.yaml"
+    overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml"
+    overlay_keys_path: "{{ playbook_dir }}/../../config/sit/vpn-keys.yaml"
   roles:
-    - vhosts/vpn-overlay/wireguard/hub
+    - role: vhosts/vpn-overlay/wireguard/hub

config/sit/vpn-keys.yaml

@@ -42,7 +42,7 @@ keys:
     private_key: <site_c_private_key>
     public_key: <site_c_public_key>
 
-  - name: hub-1
+  - name: cn-hub
     private_key: !vault |
           $ANSIBLE_VAULT;1.1;AES256
           33643635306332303761356562383035353333373234393132313162613834323963313635326562
@@ -60,6 +60,6 @@ keys:
           34376231306239636536313830333962323934343035333263643234363363396164626366353061
           3833613132373666303563623863373735396566666239316536
 
-  - name: hub2
+  - name: global-hub
     private_key: <hub2_private_key>
     public_key: <hub2_public_key>

config/sit/vpn-overlay.yaml

@@ -16,6 +16,7 @@ features:
 hubs:
   - name: cn-hub
     interface: eth0
+    public_ip: 1.15.155.245
     wg_ip: 172.30.0.1
     br_ip: 10.253.253.1
     local_ip: 172.30.0.1
@@ -29,12 +30,13 @@ hubs:
       key_path: "/etc/ssl/onwalk.net.key"
     wireguard_peer:
       - master-1
-      - slave-1 
-      - agent-1 
-      - agent-1 
+      - slave-1
+      - agent-1
+      - agent-1
 
   - name: global-hub
     interface: ens5
+    public_ip: 1.15.155.245
     wg_ip: 172.31.0.1
     br_ip: 10.253.253.2
     local_ip: 172.31.0.1
@@ -96,6 +98,7 @@ hubs:
 sites:
   - name: master-1
     interface: ens5
+    public_ip: 1.15.155.245
     allowed_ips: "172.16.0.0/16"
     wireguard_peer: hub-1
     br_ip: 10.253.253.2
@@ -111,6 +114,7 @@ sites:
 
   - name: slave-1
     interface: ens5
+    public_ip: 1.15.155.245
     wireguard_peer: hub-1
     allowed_ips: "172.16.0.0/16"
     br_ip: 10.253.253.3
@@ -121,6 +125,7 @@ sites:
       enabled: false  # 此节点不通过 VLESS，直接访问 Hub
 
   - name: site_c
+    public_ip: 1.15.155.245
     wg_ip: 10.100.1.2
     br_ip: 172.16.1.2
     hub: hub2