From a370a6ab15c2132d2582c649d50617b51bc5304c Mon Sep 17 00:00:00 2001 From: Ricard Illa Date: Tue, 6 Sep 2022 17:40:19 +0200 Subject: [PATCH] refactored wg variables --- deploy.yml | 114 -------------------------- group_vars/all/wg.yml | 106 ++++++++++++++++++++++++ roles/wireguard/templates/wg0.conf.j2 | 18 ++-- roles/wireguard/vars/main.yml | 2 + 4 files changed, 117 insertions(+), 123 deletions(-) create mode 100644 group_vars/all/wg.yml create mode 100644 roles/wireguard/vars/main.yml diff --git a/deploy.yml b/deploy.yml index 2c07d5d..c7390e8 100644 --- a/deploy.yml +++ b/deploy.yml @@ -37,11 +37,6 @@ become: true roles: - tinyproxy - vars: - users: - - rilla - - ansible - - woodpecker - name: wireguard hosts: @@ -51,115 +46,6 @@ roles: - wireguard tags: wg - vars: - wg: - dns: "10.0.0.1" - persistent_keepalive: 25 - listen_port: 51820 - peers: - - caladan: - endpoint: monotremata.xyz - address: "10.1.0.2/24" - allowed_ips: "10.1.0.2/32" - private_key: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 32316538626436333364666235613663663633333139663462363163646630346363363033326634 - 3931613161666162616231323132623233383535616434640a353766613533636137393864396331 - 30313333373133323035626538323938353832626161303532643738613539313737393865326365 - 6638303235396437310a613833633365393831656337623162386233313037646635346437346437 - 31623665346664393739646539333235313336623062303038373738383961616261336631326438 - 6366346238356136373938663266366463666462363332333432 - public_key: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 30366462356635313038396238363433353965633836333236373863323331616130376262336530 - 3865663030313637323163373738626436336331396166650a366164333465313038663563653166 - 35363261346332666237616262643137366665653865656631316564613035626337316361386263 - 3266303533303438350a376530306462316231323763366435356663386230353031366134383130 - 61313235336565313564353933623366626162393933663766633635326233313166343164643635 - 3737393832396138333135313638383064616365353434363934 - - fugu: - endpoint: mail.monotremata.xyz - address: "10.1.0.3/24" - allowed_ips: "10.1.0.3/32" - private_key: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 61623837393532316135383262643233386466316466616264646138383734343761313363376130 - 3162646464626634333531343466366466353862643936660a323466336463313232623162376139 - 66633565303234373762313732303239633765363932643966336335666237343763316461386630 - 3966363261316366360a613435626564663262346464326366663662663031643663643831323565 - 38306135353038303836326138383262623037333265663962316638336465333030393135613130 - 6130326566643134343830323531663932386236393666353261 - public_key: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 37386231353361303238323430636534343538613038386564343063363064353464643965653432 - 3235343764323937363534323731343038643230343831610a666366336463646232323462623064 - 63333433393332303963653733383436373034653231663836646531656233626238356638613136 - 3336303064646330320a373632313734653034613439353738353331353465353763333438613564 - 39663630306163623533383635643430346166616637313566323737316261303132383663623866 - 6537396339306366393430393431616234393834353039316530 - - - # openwrt is added as a peer but not managed by ansible - openwrt: - allowed_ips: "10.0.0.0/8" - endpoint: wg.monotremata.xyz - public_key: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 35393164366137313939356539343565633736613335636635343031663632303034373038303432 - 6138646366636431313938386565643534373634343934340a323536313161336232333534393264 - 62343231333464613136353964333166356162393437303630386666323731383965626639633462 - 6539386436373162370a656538366634623761663130663063303265343966383035346135636464 - 61306338616261646566353830613566323334623662373461346166303766386261333438376266 - 3833343366353531666162663137633430306234326338653864 - - preshared_keys: - caladan: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 35356436653232353331666262343364323764383234346638383430363230373766636530346533 - 6465396461393063356330643638323162643539383434320a626139616332333364663865623965 - 65636566363766343332343738323835613539333463656231326535653361373733383566333363 - 3463323033653764300a336365363264353863343362656433623331333934323563306436376262 - 37663765386231396230373333353139336261326261623636393639396330666564666536356337 - 6434303231613331396636363333383931376236613433323063 - fugu: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 65613566393936356361376262386166653966326262623837633935333162653938666665326564 - 3032373366666533366234363734636333626333303339320a636464616665306432303161643235 - 64646630326430656330383434656263336661383030633662616130663566656262373364643061 - 3633333261383865360a396239646137643366303232396435666534626666376237653932363066 - 65373532623230343461613834346633366131303832396632313839353565333439373439663035 - 3363626663393136313865626431306335653833616666396266 - - preshared_keys: - - caladan-openwrt: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 35356436653232353331666262343364323764383234346638383430363230373766636530346533 - 6465396461393063356330643638323162643539383434320a626139616332333364663865623965 - 65636566363766343332343738323835613539333463656231326535653361373733383566333363 - 3463323033653764300a336365363264353863343362656433623331333934323563306436376262 - 37663765386231396230373333353139336261326261623636393639396330666564666536356337 - 6434303231613331396636363333383931376236613433323063 - - caladan-fugu: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 31396637326464343238663736326530636139323263653464336430363530636261653433613166 - 3566613763653061396662616666393639656532336131620a323462333463666430376336396436 - 35353938383961343931343862653534663261373531356138336565396634333239643163663462 - 3565303233376138350a363736363664633963343261363835306334343130333130626666326364 - 61313937636635363666346665326131663763383639323666376236336234303162636565633830 - 3065643134616164323530396562613035633063356561336131 - - fugu-openwrt: !vault | - $ANSIBLE_VAULT;1.1;AES256 - 65613566393936356361376262386166653966326262623837633935333162653938666665326564 - 3032373366666533366234363734636333626333303339320a636464616665306432303161643235 - 64646630326430656330383434656263336661383030633662616130663566656262373364643061 - 3633333261383865360a396239646137643366303232396435666534626666376237653932363066 - 65373532623230343461613834346633366131303832396632313839353565333439373439663035 - 3363626663393136313865626431306335653833616666396266 - name: lbu commit hosts: snitch diff --git a/group_vars/all/wg.yml b/group_vars/all/wg.yml new file mode 100644 index 0000000..f2a14e5 --- /dev/null +++ b/group_vars/all/wg.yml @@ -0,0 +1,106 @@ +--- + +wg_dns: "10.0.0.1" + +wg_peers: + + caladan: + endpoint: monotremata.xyz + address: "10.1.0.2/24" + allowed_ips: "10.1.0.2/32" + private_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 32316538626436333364666235613663663633333139663462363163646630346363363033326634 + 3931613161666162616231323132623233383535616434640a353766613533636137393864396331 + 30313333373133323035626538323938353832626161303532643738613539313737393865326365 + 6638303235396437310a613833633365393831656337623162386233313037646635346437346437 + 31623665346664393739646539333235313336623062303038373738383961616261336631326438 + 6366346238356136373938663266366463666462363332333432 + public_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 30366462356635313038396238363433353965633836333236373863323331616130376262336530 + 3865663030313637323163373738626436336331396166650a366164333465313038663563653166 + 35363261346332666237616262643137366665653865656631316564613035626337316361386263 + 3266303533303438350a376530306462316231323763366435356663386230353031366134383130 + 61313235336565313564353933623366626162393933663766633635326233313166343164643635 + 3737393832396138333135313638383064616365353434363934 + + fugu: + endpoint: mail.monotremata.xyz + address: "10.1.0.3/24" + allowed_ips: "10.1.0.3/32" + private_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 61623837393532316135383262643233386466316466616264646138383734343761313363376130 + 3162646464626634333531343466366466353862643936660a323466336463313232623162376139 + 66633565303234373762313732303239633765363932643966336335666237343763316461386630 + 3966363261316366360a613435626564663262346464326366663662663031643663643831323565 + 38306135353038303836326138383262623037333265663962316638336465333030393135613130 + 6130326566643134343830323531663932386236393666353261 + public_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 37386231353361303238323430636534343538613038386564343063363064353464643965653432 + 3235343764323937363534323731343038643230343831610a666366336463646232323462623064 + 63333433393332303963653733383436373034653231663836646531656233626238356638613136 + 3336303064646330320a373632313734653034613439353738353331353465353763333438613564 + 39663630306163623533383635643430346166616637313566323737316261303132383663623866 + 6537396339306366393430393431616234393834353039316530 + + # openwrt is added as a peer but not managed by ansible + openwrt: + allowed_ips: "10.0.0.0/8" + endpoint: wg.monotremata.xyz + public_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35393164366137313939356539343565633736613335636635343031663632303034373038303432 + 6138646366636431313938386565643534373634343934340a323536313161336232333534393264 + 62343231333464613136353964333166356162393437303630386666323731383965626639633462 + 6539386436373162370a656538366634623761663130663063303265343966383035346135636464 + 61306338616261646566353830613566323334623662373461346166303766386261333438376266 + 3833343366353531666162663137633430306234326338653864 + preshared_keys: + caladan: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35356436653232353331666262343364323764383234346638383430363230373766636530346533 + 6465396461393063356330643638323162643539383434320a626139616332333364663865623965 + 65636566363766343332343738323835613539333463656231326535653361373733383566333363 + 3463323033653764300a336365363264353863343362656433623331333934323563306436376262 + 37663765386231396230373333353139336261326261623636393639396330666564666536356337 + 6434303231613331396636363333383931376236613433323063 + fugu: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 65613566393936356361376262386166653966326262623837633935333162653938666665326564 + 3032373366666533366234363734636333626333303339320a636464616665306432303161643235 + 64646630326430656330383434656263336661383030633662616130663566656262373364643061 + 3633333261383865360a396239646137643366303232396435666534626666376237653932363066 + 65373532623230343461613834346633366131303832396632313839353565333439373439663035 + 3363626663393136313865626431306335653833616666396266 + +wg_preshared_keys: + + caladan-openwrt: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35356436653232353331666262343364323764383234346638383430363230373766636530346533 + 6465396461393063356330643638323162643539383434320a626139616332333364663865623965 + 65636566363766343332343738323835613539333463656231326535653361373733383566333363 + 3463323033653764300a336365363264353863343362656433623331333934323563306436376262 + 37663765386231396230373333353139336261326261623636393639396330666564666536356337 + 6434303231613331396636363333383931376236613433323063 + + caladan-fugu: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 31396637326464343238663736326530636139323263653464336430363530636261653433613166 + 3566613763653061396662616666393639656532336131620a323462333463666430376336396436 + 35353938383961343931343862653534663261373531356138336565396634333239643163663462 + 3565303233376138350a363736363664633963343261363835306334343130333130626666326364 + 61313937636635363666346665326131663763383639323666376236336234303162636565633830 + 3065643134616164323530396562613035633063356561336131 + + fugu-openwrt: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 65613566393936356361376262386166653966326262623837633935333162653938666665326564 + 3032373366666533366234363734636333626333303339320a636464616665306432303161643235 + 64646630326430656330383434656263336661383030633662616130663566656262373364643061 + 3633333261383865360a396239646137643366303232396435666534626666376237653932363066 + 65373532623230343461613834346633366131303832396632313839353565333439373439663035 + 3363626663393136313865626431306335653833616666396266 diff --git a/roles/wireguard/templates/wg0.conf.j2 b/roles/wireguard/templates/wg0.conf.j2 index fab1604..a8829dd 100644 --- a/roles/wireguard/templates/wg0.conf.j2 +++ b/roles/wireguard/templates/wg0.conf.j2 @@ -1,20 +1,20 @@ [Interface] -PrivateKey = {{ wg.peers.get(inventory_hostname).private_key }} -ListenPort = {{ wg.listen_port }} -Address = {{ wg.peers.get(inventory_hostname).address }} -DNS = {{ wg.dns }} +PrivateKey = {{ wg_peers.get(inventory_hostname).private_key }} +ListenPort = {{ wg_listen_port }} +Address = {{ wg_peers.get(inventory_hostname).address }} +DNS = {{ wg_dns }} -{% for peer_hostname, peer_data in wg.peers.items() %} +{% for peer_hostname, peer_data in wg_peers.items() %} {% if peer_hostname != inventory_hostname %} [Peer] # {{ peer_hostname }} PublicKey = {{ peer_data.public_key }} -Endpoint = {{ peer_data.endpoint }}:{{ wg.listen_port }} +Endpoint = {{ peer_data.endpoint }}:{{ wg_listen_port }} AllowedIPs = {{ peer_data.allowed_ips }} -PersistentKeepalive = {{ wg.persistent_keepalive }} +PersistentKeepalive = {{ wg_persistent_keepalive }} PresharedKey = {{ - wg.preshared_keys.get( + wg_preshared_keys.get( inventory_hostname + "-" + peer_hostname, - wg.preshared_keys.get(peer_hostname + "-" + inventory_hostname) + wg_preshared_keys.get(peer_hostname + "-" + inventory_hostname) ) }} diff --git a/roles/wireguard/vars/main.yml b/roles/wireguard/vars/main.yml new file mode 100644 index 0000000..e30d4b8 --- /dev/null +++ b/roles/wireguard/vars/main.yml @@ -0,0 +1,2 @@ +wg_persistent_keepalive: 25 +wg_listen_port: 51820