diff options
author | Trygve Laugstøl <trygvis@inamo.no> | 2018-12-21 07:36:22 +0100 |
---|---|---|
committer | Trygve Laugstøl <trygvis@inamo.no> | 2018-12-21 07:36:22 +0100 |
commit | 36183579aa48bd9207237ac69d666f0f222cfc1d (patch) | |
tree | 00e6b7a4d5fc6a2e9ff2ce0a0df7c571e3b2a3b3 /ansible/experiments/strongswan/strongswan-server.yml | |
parent | d8b72bd2c77a362e16a2c713fe94d704c5802dc5 (diff) | |
download | infra-36183579aa48bd9207237ac69d666f0f222cfc1d.tar.gz infra-36183579aa48bd9207237ac69d666f0f222cfc1d.tar.bz2 infra-36183579aa48bd9207237ac69d666f0f222cfc1d.tar.xz infra-36183579aa48bd9207237ac69d666f0f222cfc1d.zip |
elasticsearch
Diffstat (limited to 'ansible/experiments/strongswan/strongswan-server.yml')
-rw-r--r-- | ansible/experiments/strongswan/strongswan-server.yml | 67 |
1 files changed, 67 insertions, 0 deletions
diff --git a/ansible/experiments/strongswan/strongswan-server.yml b/ansible/experiments/strongswan/strongswan-server.yml new file mode 100644 index 0000000..e555b90 --- /dev/null +++ b/ansible/experiments/strongswan/strongswan-server.yml @@ -0,0 +1,67 @@ +- hosts: + - knot + vars_files: + - strongswan-vars.yml + vars: + peers: + - arius + handlers: + - name: systemctl restart strongswan + become: true + systemd: + name: strongswan + state: restarted + tasks: + - become: true + block: + - name: packages + apt: + name: "{{ item }}" + install_recommends: no + with_items: + - strongswan-swanctl + - name: install certs + with_items: "{{ peers }}" + copy: + src=swanctl/{{ item }}/rsa/{{ item }}-key.der + dest=/etc/swanctl/rsa/{{ item }}-key.der + - name: install swanctl.conf + notify: systemctl restart strongswan + copy: + dest: /etc/swanctl/conf.d/trygvis.io.conf + content: | + connections { + + rw { + local_addrs = fec0::1 + + local { + auth = pubkey + certs = moonCert.pem + id = moon.strongswan.org + } + remote { + auth = pubkey + } + children { + net { + local_ts = {{ strongswan_ts }} + + updown = /usr/local/libexec/ipsec/_updown iptables + esp_proposals = aes128-sha256-x25519 + } + } + version = 2 + proposals = aes128-sha256-x25519 + } + } + + authorities { + strongswan { + #cacert = caCert.pem + #crl_uris = http://ip6-winnetou.strongswan.org/strongswan.crl + cacert = ca-cert.der + crl_uris = + } + } + |