wireguard.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Wireguard VPN appliances

Parameters:

  VpcId:
    Type: AWS::EC2::VPC::Id

  AMIID:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-ebs

  InstanceType:
    Type: String
    Default: t3.nano
    AllowedValues: [t3a.nano, t3.nano]

  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>

  InternalPeerIp:
    Type: String

  InternalServerIp:
    Type: String

  WireguardPort:
    Type: String

  ParameterStoreKMSKeyARN:
    Type: String

  VPNDomainName:
    Type: String

  VPNDomainHostedZoneId:
    Type: String

Resources:

  DNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref VPNDomainHostedZoneId
      Comment: !Ref AWS::StackName
      Name: !Ref VPNDomainName
      TTL: 300
      Type: CNAME
      ResourceRecords:
        - !GetAtt LoadBalancer.DNSName

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      IpAddressType: ipv4
      LoadBalancerAttributes:
        - Key: load_balancing.cross_zone.enabled
          Value: true
      Scheme: internet-facing
      Subnets: !Ref SubnetIds
      Type: network

  Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      LoadBalancerArn: !Ref LoadBalancer
      Port: !Ref WireguardPort
      Protocol: UDP

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      VpcId: !Ref VpcId
      HealthCheckPort: 22
      HealthCheckProtocol: TCP
      HealthCheckTimeoutSeconds: 10
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      Protocol: UDP
      Port: !Ref WireguardPort
      TargetType: instance
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 0

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VpcId
      GroupDescription: Wireguard Security Group
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
        - IpProtocol: -1
          CidrIpv6: ::/0
      SecurityGroupIngress:
        - IpProtocol: udp
          FromPort: !Ref WireguardPort
          ToPort: !Ref WireguardPort
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: !Ref WireguardPort
          ToPort: !Ref WireguardPort
          CidrIpv6: ::/0

  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
              - ec2.amazonaws.com
          Action:
            - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: wireguard
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - ec2:ModifyInstanceAttribute
                Resource:
                  - '*'
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                Resource:
                  - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/wireguard/*
              - Effect: Allow
                Action:
                  - kms:Decrypt
                Resource:
                  - !Ref ParameterStoreKMSKeyARN

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref InstanceRole

  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: !Ref AMIID
        InstanceInitiatedShutdownBehavior: terminate
        InstanceType: !Ref InstanceType
        NetworkInterfaces:
          - AssociatePublicIpAddress: true
            Groups:
              - !GetAtt SecurityGroup.GroupId
            DeviceIndex: 0
        IamInstanceProfile:
          Arn: !GetAtt InstanceProfile.Arn
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: Name
                Value: wireguard
        UserData:
          Fn::Base64:
            !Sub |
              #cloud-config
              write_files:
                - path: /etc/cron.d/wg
                  permissions: '0700'
                  owner: root:root
                  content: |
                    */1 * * * * root /root/wg-check.sh
                    @reboot root /root/wg-install.sh > /var/log/wg-install.log 2>&1
                - path: /root/wg-check.sh
                  permissions: '0700'
                  owner: root:root
                  content: |
                    #!/bin/bash
                    export PATH="/sbin:/bin:/usr/sbin:/usr/bin:/root/bin:/root/bin";
                    count=$(/bin/wg | /bin/wc -c);
                    if [[ `echo $count` == 0 ]]; then
                      /bin/wg-quick up wg0
                    else
                      /bin/wg
                    fi;
                - path: /etc/wireguard/wg0.conf
                  permissions: '0600'
                  owner: root:root
                  content: |
                    [Interface]
                    Address = ${InternalServerIp}
                    ListenPort = ${WireguardPort}
                    PrivateKey = PRIVATEKEY
                    SaveConfig = true
                    PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
                    PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

                    [Peer]
                    PublicKey = PEERPUBLIC
                    AllowedIPs = ${InternalPeerIp}

                - path: /root/wg-install.sh
                  permissions: '0700'
                  owner: root:root
                  content: |
                    #!/bin/bash
                    source /root/.bashrc;
                    set -euxo pipefail;
                    trap "/opt/aws/bin/cfn-signal --success false --region ${AWS::Region} --stack ${AWS::StackName} --resource AutoScalingGroup;" ERR;
                    export PATH="/sbin:/bin:/usr/sbin:/usr/bin:/root/bin:/root/bin";

                    curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo;
                    yum clean all;
                    yum install wireguard-dkms wireguard-tools iptables-services -y;
                    until /sbin/modprobe wireguard
                    do
                      dmesg | grep wireguard;
                    done;

                    # Wireguard keys
                    set +x;
                    PRIVATE_KEY=$(aws --region ${AWS::Region} ssm get-parameter --name /wireguard/private --with-decryption --query Parameter.Value --output text);
                    PEER_PUBLIC_KEY=$(aws --region ${AWS::Region} ssm get-parameter --name /wireguard/public/phone --with-decryption --query Parameter.Value --output text);
                    sed -i "s#PRIVATEKEY#$PRIVATE_KEY#" /etc/wireguard/wg0.conf;
                    sed -i "s#PEERPUBLIC#$PEER_PUBLIC_KEY#" /etc/wireguard/wg0.conf;
                    set -x;

                    # source/dest check
                    INSTANCE_ID=$(curl http://169.254.169.254/latest/meta-data/instance-id);
                    aws ec2 --region ${AWS::Region} modify-instance-attribute --instance-id $INSTANCE_ID --no-source-dest-check;

                    # iptables
                    /bin/systemctl enable iptables;
                    /bin/systemctl restart iptables;
                    /bin/systemctl status iptables;
                    /sbin/iptables -F;
                    /sbin/iptables-save > /etc/sysconfig/iptables;
                    /sbin/iptables -L;

                    # IP Forwarding
                    echo "
                    net.ipv4.conf.all.forwarding = 1
                    net.ipv6.conf.all.forwarding = 1
                    " > /etc/sysctl.d/wg.conf;
                    /sbin/sysctl --system;

                    systemctl enable wg-quick@wg0.service;
                    /opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource AutoScalingGroup;

                - path: /root/bootstrap.sh
                  permissions: '0700'
                  owner: root:root
                  content: |
                    #!/bin/bash
                    set -euxo pipefail;
                    trap "/opt/aws/bin/cfn-signal --success false --region ${AWS::Region} --stack ${AWS::StackName} --resource AutoScalingGroup;" ERR;

                    yum update -y;

                    # Enable cron jobs
                    chmod 644 /etc/cron.d/wg;
                    reboot;
              runcmd:
                - /root/bootstrap.sh;

  AutoUpdateScaleUp:
    Type: AWS::AutoScaling::ScheduledAction
    Properties:
      AutoScalingGroupName: !Ref AutoScalingGroup
      DesiredCapacity: 2
      MinSize: 1
      MaxSize: 2
      Recurrence: '0 14 * * *'

  AutoUpdateScaleDown:
    Type: AWS::AutoScaling::ScheduledAction
    Properties:
      AutoScalingGroupName: !Ref AutoScalingGroup
      DesiredCapacity: 1
      MinSize: 1
      MaxSize: 2
      Recurrence: '15 14 * * *'

  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier: !Ref SubnetIds
      DesiredCapacity: 1
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
      MinSize: 1
      MaxSize: 2
      TargetGroupARNs:
        - !Ref TargetGroup
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MaxBatchSize: 1
        MinInstancesInService: 1
        MinSuccessfulInstancesPercent: 100
        PauseTime: PT15M
        SuspendProcesses:
          - ScheduledActions
          - AZRebalance
          - ReplaceUnhealthy
        WaitOnResourceSignals: true