DEV-1008 added wireguard vpn
Ketelsen, Sven
3 years ago
committed by
Michael Hähnel
parent
bbb940a978
commit
fa856141cf
@ -0,0 +1,8 @@
|
||||
---
|
||||
shared_service_vpn: "{{ stage }}-vpn-01"
|
||||
shared_service_vpn_ip: "{{ stage_server_infos
|
||||
| selectattr('name', 'match', shared_service_vpn )
|
||||
| map(attribute='public_ip')
|
||||
| list
|
||||
| first
|
||||
| default('-') }}"
|
||||
@ -1,2 +1,7 @@
|
||||
---
|
||||
# small server for vpn sufficient 1vCPU, 2GB RAM, 20 GB Disk
|
||||
hetzner_server_type: cx11
|
||||
hetzner_server_labels: "stage={{ stage }} service=vpn"
|
||||
|
||||
# disable traefik
|
||||
traefik_enabled: false
|
||||
@ -0,0 +1,3 @@
|
||||
---
|
||||
wireguard_image_name: "lscr.io/linuxserver/wireguard"
|
||||
wireguard_network: 10.200.1.1
|
||||
@ -0,0 +1,67 @@
|
||||
---
|
||||
|
||||
### tags:
|
||||
### update_config
|
||||
### update_deployment
|
||||
|
||||
- name: "Register wireguard peers"
|
||||
set_fact:
|
||||
wireguard_peers: "{{ wireguard_peers | default([]) + [ lookup('file', 'users/' + item + '/wireguard.yml') | from_yaml ] }}"
|
||||
loop: '{{ smardigo_plattform_users }}'
|
||||
when: "('users/' ~ item ~ '/wireguard.yml') is file"
|
||||
|
||||
- name: "Print wireguard peers"
|
||||
debug: var=wireguard_peers
|
||||
|
||||
- name: "Register source IPs"
|
||||
set_fact:
|
||||
source_ips: "{{ (wireguard_peers | selectattr('source_ip', 'defined') | map(attribute='source_ip') | list) }}"
|
||||
|
||||
- name: "Assert no duplicate source IPs"
|
||||
assert:
|
||||
that: "{{ source_ips|length == source_ips|unique|length }}"
|
||||
fail_msg: "Detected duplicate source IPs {{ source_ips }}"
|
||||
|
||||
- name: "Check if {{ wireguard_id }}/docker-compose.yml exists"
|
||||
stat:
|
||||
path: '{{ service_base_path }}/{{ wireguard_id }}/docker-compose.yml'
|
||||
register: check_docker_compose_file
|
||||
tags:
|
||||
- update_config
|
||||
- update_deployment
|
||||
|
||||
- name: "Stop {{ wireguard_id }}"
|
||||
community.docker.docker_compose:
|
||||
project_src: '{{ service_base_path }}/{{ wireguard_id }}'
|
||||
state: absent
|
||||
when: check_docker_compose_file.stat.exists
|
||||
tags:
|
||||
- update_config
|
||||
- update_deployment
|
||||
|
||||
- name: "Deploy docker templates for {{ wireguard_id }}"
|
||||
include_role:
|
||||
name: hetzner-ansible-sma-deploy
|
||||
tasks_from: templates
|
||||
vars:
|
||||
current_config: "_docker"
|
||||
current_base_path: "{{ service_base_path }}"
|
||||
current_destination: "{{ wireguard_id }}"
|
||||
current_owner: "{{ docker_owner }}"
|
||||
current_group: "{{ docker_group }}"
|
||||
current_docker: "{{ wireguard_docker }}"
|
||||
tags:
|
||||
- update_config
|
||||
|
||||
- name: "Deploy service templates for {{ wireguard_id }}"
|
||||
include_role:
|
||||
name: hetzner-ansible-sma-deploy
|
||||
tasks_from: templates
|
||||
vars:
|
||||
current_config: "wireguard"
|
||||
current_base_path: "{{ service_base_path }}"
|
||||
current_destination: "{{ wireguard_id }}"
|
||||
current_owner: "{{ docker_owner }}"
|
||||
current_group: "{{ docker_group }}"
|
||||
tags:
|
||||
- update_config
|
||||
@ -0,0 +1,25 @@
|
||||
---
|
||||
wireguard_id: "{{ inventory_hostname }}-wireguard"
|
||||
|
||||
wireguard_docker:
|
||||
services:
|
||||
- name: "{{ wireguard_id }}"
|
||||
image_name: "{{ wireguard_image_name }}"
|
||||
image_version: "{{ wireguard_version }}"
|
||||
environment:
|
||||
- "PUID: \"1000\""
|
||||
- "PGID: \"1000\""
|
||||
- "TZ: \"Etc/UTC\""
|
||||
- "PEERS: 0"
|
||||
- "INTERNAL_SUBNET: \"{{ wireguard_network }}\""
|
||||
volumes:
|
||||
- '"./config/templates/server.conf:/config/templates/server.conf:rw"'
|
||||
ports:
|
||||
- external: "{{ service_port_wireguard }}"
|
||||
internal: "{{ service_port_wireguard }}/udp"
|
||||
restart: "unless-stopped"
|
||||
cap_add:
|
||||
- "NET_ADMIN"
|
||||
- "SYS_MODULE"
|
||||
sysctls:
|
||||
- "\"net.ipv4.conf.all.src_valid_mark=1\""
|
||||
@ -0,0 +1,13 @@
|
||||
[Interface]
|
||||
Address = ${INTERFACE}.1
|
||||
ListenPort = {{ service_port_wireguard }}
|
||||
PrivateKey = $(cat /config/server/privatekey-server)
|
||||
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
|
||||
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE
|
||||
{% for item in wireguard_peers %}
|
||||
|
||||
[Peer]
|
||||
# Name = {{ item.name }}
|
||||
PublicKey = {{ item.public_key }}
|
||||
AllowedIPs = {{ item.source_ip }}
|
||||
{% endfor %}
|
||||
@ -0,0 +1,3 @@
|
||||
name: "hp.wissenbach"
|
||||
public_key: "t35U0S9W80EH6PuE85zvFBr5FJkC2idMCVnd6mawjAc="
|
||||
source_ip: "10.200.1.2/32"
|
||||
@ -0,0 +1,3 @@
|
||||
name: "mha"
|
||||
public_key: "wuBO3LHyC/DOOaPuks5o313SYGdReJbRB7mCkH5hVG4="
|
||||
source_ip: "10.200.1.3/32"
|
||||
@ -0,0 +1,3 @@
|
||||
name: "sven.ketelsen"
|
||||
public_key: "mT6edinYWI9jdIIhwem8KaqQwOATO6yOdeYD6tDTdBI="
|
||||
source_ip: "10.200.1.4/32"
|
||||
@ -0,0 +1,28 @@
|
||||
---
|
||||
- name: 'apply setup to {{ host | default("vpn") }}'
|
||||
hosts: '{{ host | default("vpn") }}'
|
||||
serial: "{{ serial_number | default(5) }}"
|
||||
strategy: free
|
||||
vars:
|
||||
ansible_ssh_host: "{{ stage_server_domain }}"
|
||||
become: yes
|
||||
|
||||
pre_tasks:
|
||||
- name: "Check if ansible version is at least {{ ansible_minimal_version }}"
|
||||
assert:
|
||||
that:
|
||||
- ansible_version.string is version(ansible_minimal_version, ">=")
|
||||
msg: "The ansible version has to be at least {{ ansible_minimal_version }}"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: "Import autodiscover pre-tasks"
|
||||
import_tasks: tasks/autodiscover_pre_tasks.yml
|
||||
become: false
|
||||
tags:
|
||||
- always
|
||||
|
||||
roles:
|
||||
- role: wireguard
|
||||
when:
|
||||
- "'vpn' in group_names"
|
||||
Loading…
Reference in New Issue