Turn UnifiOS Wireguard configs into MacOS device profiles

wireguard.j2

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>PayloadDisplayName</key>
        <string>WireGuard</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadDescription</key>
        <string>Configures WireGuard VPN profiles</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadIdentifier</key>
        <string>{{ payload_identifier }}.wireguard.D32300AD-56BD-4ABC-BB83-E2B1E876B0B1</string>
        <key>PayloadOrganization</key>
        <string>{{ organization }}</string>
        <key>PayloadUUID</key>
        <string>34666047-3707-4097-8D73-F6343F6EE558</string>
        <key>PayloadContent</key>
        <array>
                <dict>
                    <key>PayloadDisplayName</key>
                    <string>VPN</string>
                    <key>PayloadType</key>
                    <string>com.apple.vpn.managed</string>
                    <key>PayloadVersion</key>
                    <integer>1</integer>
                    <key>PayloadIdentifier</key>
                    <string>{{ payload_identifier }}.wireguard.full</string>
                    <key>PayloadUUID</key>
                    <string>2748B3D8-C01D-4249-9474-71DCC9302950</string>
                    <key>UserDefinedName</key>
                    <string>{{ organization }} - Full</string>
                    <key>VPNType</key>
                    <string>VPN</string>
                    <key>VPNSubType</key>
                    <string>com.wireguard.macos</string>
                    <key>VendorConfig</key>
                    <dict>
                        <key>WgQuickConfig</key>
                        <string>
                        [Interface]
                        PrivateKey = {{ private_key }}
                        Address = {{ address }}
                        DNS = {{ dns }}

                        [Peer]
                        PublicKey = {{ public_key }}
                        Endpoint = {{ endpoint_host }}:{{ endpoint_port }}
                        AllowedIPs = {{ allowed_ips_full }}
                        PersistentKeepalive = {{ keepalive }}
                        </string>
                    </dict>
                    <key>VPN</key>
                    <dict>
                        <key>RemoteAddress</key>
                        <string>{{ endpoint_host }}:{{ endpoint_port }}</string>
                        <key>AuthenticationMethod</key>
                        <string>Password</string>
                    </dict>
                </dict>
                <dict>
                    <key>PayloadDisplayName</key>
                    <string>VPN</string>
                    <key>PayloadType</key>
                    <string>com.apple.vpn.managed</string>
                    <key>PayloadVersion</key>
                    <integer>1</integer>
                    <key>PayloadIdentifier</key>
                    <string>{{ payload_identifier }}.wireguard.split</string>
                    <key>PayloadUUID</key>
                    <string>DB3D41DD-7AF7-4300-BD0C-B1DEBF7A0032</string>
                    <key>UserDefinedName</key>
                    <string>{{ organization }} - Split</string>
                    <key>VPNType</key>
                    <string>VPN</string>
                    <key>VPNSubType</key>
                    <string>com.wireguard.macos</string>
                    <key>VendorConfig</key>
                    <dict>
                        <key>WgQuickConfig</key>
                        <string>
                        [Interface]
                        PrivateKey = {{ private_key }}
                        Address = {{ address }}
                        DNS = {{ dns }}

                        [Peer]
                        PublicKey = {{ public_key }}
                        Endpoint = {{ endpoint_host }}:{{ endpoint_port }}
                        AllowedIPs = {{ allowed_ips_split }}
                        PersistentKeepalive = {{ keepalive }}
                        </string>
                    </dict>
                    <key>VPN</key>
                    <dict>
                        <key>RemoteAddress</key>
                        <string>{{ endpoint_host }}:{{ endpoint_port }}</string>
                        <key>AuthenticationMethod</key>
                        <string>Password</string>
                    </dict>
                </dict>
        </array>
    </dict>
</plist>

wireguard.py

#!/usr/bin/env python
"""
Converts a Ubiquiti Wireguard config into a MacOS profile.

Usage: ./wireguard.py wg_whatever.conf
"""

import argparse
import os
import sys

from configparser import ConfigParser

from jinja2 import Environment, FileSystemLoader


def main():
    """Where the magic happens"""
    parser = argparse.ArgumentParser()
    parser.add_argument("config_file")
    args = parser.parse_args()

    if not os.path.exists(args.config_file):
        sys.exit(f"Error: Config file {args.config_file} does not exist")
    else:
        try:
            config = ConfigParser()
            config.read(args.config_file)
        except IOError:
            sys.exit(f"Error: Could not parse config file {args.config_file}")

    jinja2_template = Environment(
        loader=FileSystemLoader(os.path.dirname(os.path.abspath(__file__)))
    )

    try:
        with open(
            f"{args.config_file.split('.')[0]}.mobileconfig", "w", encoding="utf-8"
        ) as mobileconfig:
            mobileconfig.write(
                jinja2_template.get_template("wireguard.j2").render(
                    address=config["Interface"]["Address"],
                    allowed_ips_full="0.0.0.0/0",
                    allowed_ips_split="10.0.0.0/16",
                    dns="10.0.10.1",
                    endpoint_host="router.yourcompany.net",
                    endpoint_port=51820,
                    keepalive=25,
                    organization="Your Company",
                    payload_identifier="net.yourcompany",
                    private_key=config["Interface"]["PrivateKey"],
                    public_key=config["Peer"]["PublicKey"],
                )
            )
    except EnvironmentError:
        sys.exit("Error: Could not write wireguard.mobileconfig")


if __name__ == "__main__":
    main()