wireguard role first draft
Ricard Illa
parent
b4d77d5657
commit
bd422fa3a8
118
deploy.yml
118
deploy.yml
|
|
@ -43,6 +43,124 @@
|
||||||
- ansible
|
- ansible
|
||||||
- woodpecker
|
- woodpecker
|
||||||
|
|
||||||
|
- name: wireguard
|
||||||
|
hosts:
|
||||||
|
- caladan
|
||||||
|
- fugu
|
||||||
|
become: true
|
||||||
|
roles:
|
||||||
|
- wireguard
|
||||||
|
tags: wg
|
||||||
|
vars:
|
||||||
|
wg:
|
||||||
|
dns: "10.0.0.1"
|
||||||
|
persistent_keepalive: 25
|
||||||
|
listen_port: 51820
|
||||||
|
peers:
|
||||||
|
|
||||||
|
caladan:
|
||||||
|
endpoint: monotremata.xyz
|
||||||
|
address: "10.1.0.2/24"
|
||||||
|
allowed_ips: "10.1.0.2/32"
|
||||||
|
private_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
32316538626436333364666235613663663633333139663462363163646630346363363033326634
|
||||||
|
3931613161666162616231323132623233383535616434640a353766613533636137393864396331
|
||||||
|
30313333373133323035626538323938353832626161303532643738613539313737393865326365
|
||||||
|
6638303235396437310a613833633365393831656337623162386233313037646635346437346437
|
||||||
|
31623665346664393739646539333235313336623062303038373738383961616261336631326438
|
||||||
|
6366346238356136373938663266366463666462363332333432
|
||||||
|
public_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
30366462356635313038396238363433353965633836333236373863323331616130376262336530
|
||||||
|
3865663030313637323163373738626436336331396166650a366164333465313038663563653166
|
||||||
|
35363261346332666237616262643137366665653865656631316564613035626337316361386263
|
||||||
|
3266303533303438350a376530306462316231323763366435356663386230353031366134383130
|
||||||
|
61313235336565313564353933623366626162393933663766633635326233313166343164643635
|
||||||
|
3737393832396138333135313638383064616365353434363934
|
||||||
|
|
||||||
|
fugu:
|
||||||
|
endpoint: mail.monotremata.xyz
|
||||||
|
address: "10.1.0.3/24"
|
||||||
|
allowed_ips: "10.1.0.3/32"
|
||||||
|
private_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
61623837393532316135383262643233386466316466616264646138383734343761313363376130
|
||||||
|
3162646464626634333531343466366466353862643936660a323466336463313232623162376139
|
||||||
|
66633565303234373762313732303239633765363932643966336335666237343763316461386630
|
||||||
|
3966363261316366360a613435626564663262346464326366663662663031643663643831323565
|
||||||
|
38306135353038303836326138383262623037333265663962316638336465333030393135613130
|
||||||
|
6130326566643134343830323531663932386236393666353261
|
||||||
|
public_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
37386231353361303238323430636534343538613038386564343063363064353464643965653432
|
||||||
|
3235343764323937363534323731343038643230343831610a666366336463646232323462623064
|
||||||
|
63333433393332303963653733383436373034653231663836646531656233626238356638613136
|
||||||
|
3336303064646330320a373632313734653034613439353738353331353465353763333438613564
|
||||||
|
39663630306163623533383635643430346166616637313566323737316261303132383663623866
|
||||||
|
6537396339306366393430393431616234393834353039316530
|
||||||
|
|
||||||
|
|
||||||
|
# openwrt is added as a peer but not managed by ansible
|
||||||
|
openwrt:
|
||||||
|
allowed_ips: "10.0.0.0/8"
|
||||||
|
endpoint: wg.monotremata.xyz
|
||||||
|
public_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
35393164366137313939356539343565633736613335636635343031663632303034373038303432
|
||||||
|
6138646366636431313938386565643534373634343934340a323536313161336232333534393264
|
||||||
|
62343231333464613136353964333166356162393437303630386666323731383965626639633462
|
||||||
|
6539386436373162370a656538366634623761663130663063303265343966383035346135636464
|
||||||
|
61306338616261646566353830613566323334623662373461346166303766386261333438376266
|
||||||
|
3833343366353531666162663137633430306234326338653864
|
||||||
|
|
||||||
|
preshared_keys:
|
||||||
|
caladan: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
35356436653232353331666262343364323764383234346638383430363230373766636530346533
|
||||||
|
6465396461393063356330643638323162643539383434320a626139616332333364663865623965
|
||||||
|
65636566363766343332343738323835613539333463656231326535653361373733383566333363
|
||||||
|
3463323033653764300a336365363264353863343362656433623331333934323563306436376262
|
||||||
|
37663765386231396230373333353139336261326261623636393639396330666564666536356337
|
||||||
|
6434303231613331396636363333383931376236613433323063
|
||||||
|
fugu: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
65613566393936356361376262386166653966326262623837633935333162653938666665326564
|
||||||
|
3032373366666533366234363734636333626333303339320a636464616665306432303161643235
|
||||||
|
64646630326430656330383434656263336661383030633662616130663566656262373364643061
|
||||||
|
3633333261383865360a396239646137643366303232396435666534626666376237653932363066
|
||||||
|
65373532623230343461613834346633366131303832396632313839353565333439373439663035
|
||||||
|
3363626663393136313865626431306335653833616666396266
|
||||||
|
|
||||||
|
preshared_keys:
|
||||||
|
|
||||||
|
caladan-openwrt: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
35356436653232353331666262343364323764383234346638383430363230373766636530346533
|
||||||
|
6465396461393063356330643638323162643539383434320a626139616332333364663865623965
|
||||||
|
65636566363766343332343738323835613539333463656231326535653361373733383566333363
|
||||||
|
3463323033653764300a336365363264353863343362656433623331333934323563306436376262
|
||||||
|
37663765386231396230373333353139336261326261623636393639396330666564666536356337
|
||||||
|
6434303231613331396636363333383931376236613433323063
|
||||||
|
|
||||||
|
caladan-fugu: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
31396637326464343238663736326530636139323263653464336430363530636261653433613166
|
||||||
|
3566613763653061396662616666393639656532336131620a323462333463666430376336396436
|
||||||
|
35353938383961343931343862653534663261373531356138336565396634333239643163663462
|
||||||
|
3565303233376138350a363736363664633963343261363835306334343130333130626666326364
|
||||||
|
61313937636635363666346665326131663763383639323666376236336234303162636565633830
|
||||||
|
3065643134616164323530396562613035633063356561336131
|
||||||
|
|
||||||
|
fugu-openwrt: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
65613566393936356361376262386166653966326262623837633935333162653938666665326564
|
||||||
|
3032373366666533366234363734636333626333303339320a636464616665306432303161643235
|
||||||
|
64646630326430656330383434656263336661383030633662616130663566656262373364643061
|
||||||
|
3633333261383865360a396239646137643366303232396435666534626666376237653932363066
|
||||||
|
65373532623230343461613834346633366131303832396632313839353565333439373439663035
|
||||||
|
3363626663393136313865626431306335653833616666396266
|
||||||
|
|
||||||
- name: lbu commit
|
- name: lbu commit
|
||||||
hosts: snitch
|
hosts: snitch
|
||||||
become: true
|
become: true
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
---
|
||||||
|
- name: set wg0.conf config file
|
||||||
|
template:
|
||||||
|
src: wg0.conf.j2
|
||||||
|
dest: /etc/wireguard/wg0.conf
|
||||||
|
mode: "0600"
|
||||||
|
owner: root
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
[Interface]
|
||||||
|
PrivateKey = {{ wg.peers.get(inventory_hostname).private_key }}
|
||||||
|
ListenPort = {{ wg.listen_port }}
|
||||||
|
Address = {{ wg.peers.get(inventory_hostname).address }}
|
||||||
|
DNS = {{ wg.dns }}
|
||||||
|
|
||||||
|
{% for peer_hostname, peer_data in wg.peers.items() %}
|
||||||
|
{% if peer_hostname != inventory_hostname %}
|
||||||
|
[Peer] # {{ peer_hostname }}
|
||||||
|
PublicKey = {{ peer_data.public_key }}
|
||||||
|
Endpoint = {{ peer_data.endpoint }}:{{ wg.listen_port }}
|
||||||
|
AllowedIPs = {{ peer_data.allowed_ips }}
|
||||||
|
PersistentKeepalive = {{ wg.persistent_keepalive }}
|
||||||
|
PresharedKey = {{
|
||||||
|
wg.preshared_keys.get(
|
||||||
|
inventory_hostname + "-" + peer_hostname,
|
||||||
|
wg.preshared_keys.get(peer_hostname + "-" + inventory_hostname)
|
||||||
|
)
|
||||||
|
}}
|
||||||
|
|
||||||
|
{% endif %}
|
||||||
|
{% endfor %}
|
||||||
Loading…
Reference in New Issue