Wireguard with Ansible and networkd

wireguard.yml

---
- name: Install wireguard
  apt: name=wireguard

- name: Read private key
  slurp:
    src: /etc/systemd/network/99-wg0.netdev
  register: netdev
  ignore_errors: yes

- name: Generate new private key
  when: netdev.failed
  block:
  - command: wg genkey
    register: privkey

  - set_fact:
      wg_privkey: "{{ privkey.stdout }}"

- name: Extract existing private key
  when: not netdev.failed
  set_fact:
    wg_privkey: "{{ netdev['content'] | b64decode | regex_findall('PrivateKey=(.+)') | first }}"

- name: Calculate public key
  shell: "echo {{ wg_privkey }} | wg pubkey"
  register: pubkey
  changed_when: false

- name: Store public key locally
  local_action: copy content="{{ pubkey.stdout }}" dest="{{ inventory_dir }}/keys/wireguard/{{ inventory_hostname }}"
  become: false

- name: Update wg0.netdev
  notify: restart networkd
  template:
    src: "{{ item }}"
    dest: /etc/systemd/network/
    owner: systemd-network
    mode: 0660
  with_items:
  - 99-wg0.netdev
  - 99-wg0.network