aboutsummaryrefslogtreecommitdiff
path: root/ansible
diff options
context:
space:
mode:
authorTrygve Laugstøl <trygvis@inamo.no>2018-12-27 23:31:35 +0100
committerTrygve Laugstøl <trygvis@inamo.no>2018-12-27 23:31:35 +0100
commit41fe17ca222da77fb860374adc915a4ca3b2c573 (patch)
tree46e797dd6cac0873d9151fe75dbab98b1e7ef897 /ansible
parent871119bcb54ba12c45bff63436694d7984f066e9 (diff)
downloadinfra-41fe17ca222da77fb860374adc915a4ca3b2c573.tar.gz
infra-41fe17ca222da77fb860374adc915a4ca3b2c573.tar.bz2
infra-41fe17ca222da77fb860374adc915a4ca3b2c573.tar.xz
infra-41fe17ca222da77fb860374adc915a4ca3b2c573.zip
wireguard: wip.
Diffstat (limited to 'ansible')
-rw-r--r--ansible/all.yml5
-rw-r--r--ansible/files/birgitte/etc/wireguard/public.key1
-rw-r--r--ansible/files/fuckaduck/etc/wireguard/public.key1
-rw-r--r--ansible/files/knot/etc/wireguard/public.key1
-rw-r--r--ansible/group_vars/wireguard_net1/main.yml18
-rw-r--r--ansible/host_vars/knot/wireguard.yml1
-rw-r--r--ansible/inventory14
-rw-r--r--ansible/roles/wireguard/defaults/main.yml1
-rw-r--r--ansible/roles/wireguard/handlers/main.yml5
-rw-r--r--ansible/roles/wireguard/tasks/main.yml128
10 files changed, 172 insertions, 3 deletions
diff --git a/ansible/all.yml b/ansible/all.yml
index 90cdef8..f0556f7 100644
--- a/ansible/all.yml
+++ b/ansible/all.yml
@@ -25,3 +25,8 @@
- lxc-hosts
roles:
- lxc-host
+
+- hosts:
+ - wireguard_net1
+ roles:
+ - wireguard
diff --git a/ansible/files/birgitte/etc/wireguard/public.key b/ansible/files/birgitte/etc/wireguard/public.key
new file mode 100644
index 0000000..8343677
--- /dev/null
+++ b/ansible/files/birgitte/etc/wireguard/public.key
@@ -0,0 +1 @@
+C5jly5hJf21tODOKloocYPk257izs9Qp5n8pwmFl/n0=
diff --git a/ansible/files/fuckaduck/etc/wireguard/public.key b/ansible/files/fuckaduck/etc/wireguard/public.key
new file mode 100644
index 0000000..d8012b3
--- /dev/null
+++ b/ansible/files/fuckaduck/etc/wireguard/public.key
@@ -0,0 +1 @@
+1Fywv/wM2QrqpxlbX5ql5lJNZdmadUGGn7gkXlAnlgE=
diff --git a/ansible/files/knot/etc/wireguard/public.key b/ansible/files/knot/etc/wireguard/public.key
new file mode 100644
index 0000000..5d4a839
--- /dev/null
+++ b/ansible/files/knot/etc/wireguard/public.key
@@ -0,0 +1 @@
+TgWtNOhe1j1uF8/xkN+u7Sv5FtvXj5EYRcwjbHjKjRU=
diff --git a/ansible/group_vars/wireguard_net1/main.yml b/ansible/group_vars/wireguard_net1/main.yml
new file mode 100644
index 0000000..06efebd
--- /dev/null
+++ b/ansible/group_vars/wireguard_net1/main.yml
@@ -0,0 +1,18 @@
+wireguard__net_id: net1
+wireguard__listen_port: 51820
+wireguard__server:
+ ansible_hostname: knot
+ hostname: trygvis.io
+ ipv4:
+ address: 192.168.90.1
+ prefix: 24
+wireguard__clients:
+ birgitte:
+ state: present
+ ipv4: 192.168.90.2
+ conflatorio:
+ state: absent
+ ipv4: 192.168.90.3
+ fuckaduck:
+ state: present
+ ipv4: 192.168.90.4
diff --git a/ansible/host_vars/knot/wireguard.yml b/ansible/host_vars/knot/wireguard.yml
new file mode 100644
index 0000000..a921af1
--- /dev/null
+++ b/ansible/host_vars/knot/wireguard.yml
@@ -0,0 +1 @@
+wireguard__role: server
diff --git a/ansible/inventory b/ansible/inventory
index 6319cd4..e8daef8 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -27,13 +27,14 @@ all:
conflatorio:
arius:
akysis:
- elasticsearch-servers:
- hosts:
- numquam:
+ fuckaduck:
sbcs:
hosts:
homepi:
malabaricus:
+ elasticsearch-servers:
+ hosts:
+ numquam:
modern1:
hosts:
nextcloud:
@@ -90,4 +91,11 @@ all:
children:
borg_nas:
+ wireguard_net1:
+ hosts:
+ knot:
+ fuckaduck:
+ birgitte:
+ conflatorio:
+
# vim: set filetype=yaml:
diff --git a/ansible/roles/wireguard/defaults/main.yml b/ansible/roles/wireguard/defaults/main.yml
new file mode 100644
index 0000000..62705a7
--- /dev/null
+++ b/ansible/roles/wireguard/defaults/main.yml
@@ -0,0 +1 @@
+wireguard__role: client
diff --git a/ansible/roles/wireguard/handlers/main.yml b/ansible/roles/wireguard/handlers/main.yml
new file mode 100644
index 0000000..f0170dd
--- /dev/null
+++ b/ansible/roles/wireguard/handlers/main.yml
@@ -0,0 +1,5 @@
+- name: systemctl restart systemd-networkd
+ become: yes
+ systemd:
+ name: systemd-networkd
+ state: restarted
diff --git a/ansible/roles/wireguard/tasks/main.yml b/ansible/roles/wireguard/tasks/main.yml
new file mode 100644
index 0000000..197d54a
--- /dev/null
+++ b/ansible/roles/wireguard/tasks/main.yml
@@ -0,0 +1,128 @@
+- tags:
+ - wireguard
+ become: yes
+ block:
+ - name: Install packages
+ apt:
+ name: "{{ items }}"
+ install_recommends: no
+ vars:
+ items:
+ - wireguard
+ - "{{ 'linux-headers-amd64' if ansible_architecture == 'x86_64' else 'linux-headers-686' }}"
+
+ - name: systemctl enable systemd-networkd
+ systemd:
+ name: systemd-networkd
+ enabled: yes
+ state: started
+
+ - name: mkdir /etc/wireguard
+ file:
+ path: /etc/wireguard
+ state: directory
+ - name: wg genkey /etc/wireguard/private.key
+ shell: wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key
+ args:
+ creates: /etc/wireguard/private.key
+ register: wg_private_key
+
+ - when: wg_private_key.changed
+ fetch:
+ src: "/etc/wireguard/public.key"
+ dest: "files"
+
+ - name: Make /etc/systemd/network/60-wg-XXX.netdev (Client)
+ when: wireguard__role == 'client'
+ notify: systemctl restart systemd-networkd
+ tags: wireguard-config
+ copy:
+ dest: /etc/systemd/network/60-wg-{{ wireguard__net_id }}.netdev
+ content: |
+ [NetDev]
+ Name=wg-{{ wireguard__net_id }}
+ Kind=wireguard
+ Description=Net id: {{ wireguard__net_id }}
+
+ [WireGuard]
+ PrivateKey={{ lookup('file', ansible_hostname + '/etc/wireguard/public.key') }}
+ ListenPort={{ wireguard__listen_port }}
+
+ [WireGuardPeer]
+ PublicKey={{ lookup('file', wireguard__server.ansible_hostname + '/etc/wireguard/public.key') }}
+ AllowedIPs=0.0.0.0/0
+ AllowedIPs=::/0
+ Endpoint={{ wireguard__server.hostname }}:{{ wireguard__listen_port }}
+
+ - name: Make /etc/systemd/network/60-wg-XXX.netdev (Server)
+ when: wireguard__role == 'server'
+ notify: systemctl restart systemd-networkd
+ tags: wireguard-config
+ copy:
+ dest: /etc/systemd/network/60-wg-{{ wireguard__net_id }}.netdev
+ content: |
+ [NetDev]
+ Name=wg-{{ wireguard__net_id }}
+ Kind=wireguard
+ Description=Net id: {{ wireguard__net_id }}
+
+ [WireGuard]
+ PrivateKey={{ lookup('file', ansible_hostname + '/etc/wireguard/public.key') }}
+ ListenPort={{ wireguard__listen_port }}
+
+ {% for c in wireguard__clients %}
+ {% set client = wireguard__clients[c] %}
+ # Client: {{ c }}
+ {% if client.state == 'present' %}
+ [WireGuardPeer]
+ PublicKey={{ lookup('file', c + '/etc/wireguard/public.key') }}
+ AllowedIPs=0.0.0.0/0
+ # AllowedIPs={{ client.ipv4 }}
+ AllowedIPs=::/0
+ {% else %}
+ # absent
+ {% endif %}
+
+ {% endfor %}
+
+ - name: rm /etc/systemd/network/60-wg-XXX.network
+ tags: wireguard-config
+ file:
+ path: /etc/systemd/network/60-wg-{{ wireguard__net_id }}.network
+ state: absent
+
+ - name: Make /etc/systemd/network/61-wg-XXX.network (Client)
+ when: wireguard__role == 'client'
+ tags: wireguard-config
+ notify: systemctl restart systemd-networkd
+ copy:
+ dest: /etc/systemd/network/61-wg-{{ wireguard__net_id }}.network
+ content: |
+ [Match]
+ Name=wg-{{ wireguard__net_id }}
+
+ [Network]
+ Address={{ wireguard__clients[ansible_hostname].ipv4 }}/{{ wireguard__server.ipv4.prefix }}
+ # Address= TODO ipv6
+
+ - name: Make /etc/systemd/network/61-wg-XXX.network (Server)
+ when: wireguard__role == 'server'
+ tags: wireguard-config
+ notify: systemctl restart systemd-networkd
+ copy:
+ dest: /etc/systemd/network/61-wg-{{ wireguard__net_id }}.network
+ content: |
+ [Match]
+ Name=wg-{{ wireguard__net_id }}
+
+ [Network]
+ Address={{ wireguard__server.ipv4.address }}/{{ wireguard__server.ipv4.prefix }}
+ # Address= TODO ipv6
+
+ - name: UFW enable
+ when: wireguard__role == 'server'
+ tags: wireguard-config
+ ufw:
+ rule: allow
+ port: "{{ wireguard__listen_port }}"
+ proto: tcp