flokli/puppet-wireguard

puppet-wireguard

This module manages wireguard tunnels

Supported distributions

• Debian (Jessie and later)
• Ubuntu (Trusty, Xenial and later)
• Archlinux

puppet-wireguard's Issues

security vulnerability with private key parameter

The private key is passed directly to the template without any kind of encryption. This exposes the key in hiera, catalogs, and log files which could be used in spoofing a tunnel.

You could pass the path to the private key if the key was made via puppet or existed previously. Additionally you could also read with the file function `$private_key_hash = file('/etc/wireguard/privateKey'). Then use the variable in the template as you are doing. However, this method only works when puppet apply is used.

Alternatively you can use https://forge.puppet.com/binford2k/node_encrypt to encrypt the content all the way to the node.