Browse Source

working role (I hope) using debian network/interface config instead of wg-quick

networking
histausse 1 year ago
parent
commit
4e962888f6
Signed by: histausse
GPG Key ID: 67486F107F62E9E9
  1. 4
      ansible.cfg
  2. 7
      host_vars/vm1/networking.yml
  3. 1
      host_vars/vm1/vpn.yml
  4. 7
      host_vars/vm2/networking.yml
  5. 1
      host_vars/vm2/vpn.yml
  6. 7
      host_vars/vm3/networking.yml
  7. 1
      host_vars/vm3/vpn.yml
  8. 7
      host_vars/vm4/networking.yml
  9. 1
      host_vars/vm4/vpn.yml
  10. 4
      roles/networking/handlers/main.yml
  11. 30
      roles/networking/tasks/main.yml
  12. 30
      roles/networking/templates/interface.conf.j2
  13. 3
      roles/networking/templates/interfaces.j2
  14. 11
      roles/vpn/handlers/main.yml
  15. 16
      roles/vpn/tasks/main.yml
  16. 1
      roles/vpn/templates/wiregard.conf.j2

4
ansible.cfg

@ -1,4 +1,4 @@
# Ansible configuration, copy from the AURORE config.
# Ansible configuration
[defaults]
@ -12,7 +12,7 @@ inventory = ./hosts
roles_path = ./roles
# Custom header in templates
ansible_managed = Ansible managed, modified on %Y-%m-%d %H:%M:%S by {uid}
ansible_managed = Ansible managed
# Do not use cows (with cowsay)
nocows = 1

7
host_vars/vm1/networking.yml

@ -1,8 +1,15 @@
---
interfaces:
enp0s3:
ipv4: 10.0.2.14
netmaskv4: 24
type: static
routes:
- {subnet: 0.0.0.0, netmask: 0, gateway: 10.0.2.1}
wg0:
ipv4: "{{ intranet.subnets.test.subnets.vm1.ipv4 }}"
netmaskv4: "{{ intranet.netmaskv4 }}"
type: wireguard
ipv4_forwarding: false
ipv6_forwarding: false

1
host_vars/vm1/vpn.yml

@ -1,7 +1,6 @@
---
vpn_interfaces:
wg0:
ip: "{{ interfaces.wg0.ipv4 }}"
private_key: "{{ vpn_vault_vm1_key }}"
public_key: "uccS/p19vinH/S2GpVarDTYah4oRiSIABue8uEqKzRs="
keepalive: true

7
host_vars/vm2/networking.yml

@ -1,8 +1,15 @@
---
interfaces:
enp0s3:
ipv4: 10.0.2.16
netmaskv4: 24
type: static
routes:
- {subnet: 0.0.0.0, netmask: 0, gateway: 10.0.2.1}
wg0:
ipv4: "{{ intranet.subnets.test.subnets.vm2.ipv4 }}"
netmaskv4: "{{ intranet.netmaskv4 }}"
type: wireguard
ipv4_forwarding: false
ipv6_forwarding: false

1
host_vars/vm2/vpn.yml

@ -1,7 +1,6 @@
---
vpn_interfaces:
wg0:
ip: "{{ interfaces.wg0.ipv4 }}"
private_key: "{{ vpn_vault_vm2_key }}"
public_key: "pxsYnL8N3VVVLlkXA8NOkqWsrSMrgdL1vj/VnZfKdRo="
keepalive: true

7
host_vars/vm3/networking.yml

@ -1,8 +1,15 @@
---
interfaces:
enp0s3:
ipv4: 10.0.2.17
netmaskv4: 24
type: static
routes:
- {subnet: 0.0.0.0, netmask: 0, gateway: 10.0.2.1}
wg0:
ipv4: "{{ intranet.subnets.test.subnets.vm3.ipv4 }}"
netmaskv4: "{{ intranet.netmaskv4 }}"
type: wireguard
ipv4_forwarding: false
ipv6_forwarding: false

1
host_vars/vm3/vpn.yml

@ -1,7 +1,6 @@
---
vpn_interfaces:
wg0:
ip: "{{ interfaces.wg0.ipv4 }}"
private_key: "{{ vpn_vault_vm3_key }}"
public_key: "Cj3HAjXXr9DcmJoOkQkHvLWujZm8h6tBt2d54g0pqEg="
keepalive: true

7
host_vars/vm4/networking.yml

@ -1,8 +1,15 @@
---
interfaces:
enp0s3:
ipv4: 10.0.2.32
netmaskv4: 24
type: static
routes:
- {subnet: 0.0.0.0, netmask: 0, gateway: 10.0.2.1}
wg0:
ipv4: "{{ intranet.subnets.test.subnets.vm4.ipv4 }}"
netmaskv4: "{{ intranet.netmaskv4 }}"
type: wireguard
ipv4_forwarding: false
ipv6_forwarding: false

1
host_vars/vm4/vpn.yml

@ -1,7 +1,6 @@
---
vpn_interfaces:
wg0:
ip: "{{ interfaces.wg0.ipv4 }}"
private_key: "{{ vpn_vault_vm4_key }}"
public_key: "5M84IO6uobYkMPupCI9h9y3iJXVIXAyDY8wkrMPcaRw="
keepalive: true

4
roles/networking/handlers/main.yml

@ -0,0 +1,4 @@
---
- name: Reload network interfaces
become: true
command: /sbin/ifreload -a

30
roles/networking/tasks/main.yml

@ -1,4 +1,15 @@
---
- name: Install wireguard
apt:
name:
- ifupdown2
state: latest
update_cache: true
register: apt_result
retries: 3
until: apt_result is succeeded
- name: Enable ipv4 forwarding
ansible.posix.sysctl:
name: net.ipv4.ip_forward
@ -26,3 +37,22 @@
value: '0'
sysctl_set: true
when: not ipv6_forwarding
- name: Create interface config files
ansible.builtin.template:
src: "interfaces.j2"
dest: "/etc/network/interfaces"
owner: root
group: root
mode: '644'
notify: Reload network interfaces
- name: Create interface config files
ansible.builtin.template:
src: "interface.conf.j2"
dest: "/etc/network/interfaces.d/{{ item.key }}.conf"
owner: root
group: root
mode: '640'
notify: Reload network interfaces
loop: "{{ lookup('dict', interfaces) }}"

30
roles/networking/templates/interface.conf.j2

@ -0,0 +1,30 @@
{{ ansible_managed | comment }}
auto {{ item.key }}
{% if item.value.type == 'wireguard' %}
iface {{ item.key }} inet static
{% elif item.value.type == 'dhcp' %}
iface {{ item.key }} inet dhcp
{% elif item.value.type == 'static' %}
iface {{ item.key }} inet static
{% endif %}
{% if item.value.type == 'wireguard' %}
pre-up ip link add $IFACE type wireguard
pre-up wg setconf $IFACE /etc/wireguard/$IFACE.conf
{% endif %}
{% if 'routes' in item.value %}
{% for route in item.value.routes %}
post-up ip route add {{ route.subnet }}/{{ route.netmask }} via {{ route.gateway }}
{% endfor %}
{% endif %}
{% if 'ipv4' in item.value %}
address {{ item.value.ipv4 }}/{{ item.value.netmaskv4 }}
{% endif %}
{% if 'routes' in item.value %}
{% for route in item.value.routes %}
post-down ip route del {{ route.subnet }}/{{ route.netmask }} via {{ route.gateway }}
{% endfor %}
{% endif %}
{% if item.value.type == 'wireguard' %}
post-down ip link del $IFACE
{% endif %}

3
roles/networking/templates/interfaces.j2

@ -0,0 +1,3 @@
{{ ansible_managed | comment }}
source /etc/network/interfaces.d/*

11
roles/vpn/handlers/main.yml

@ -1,9 +1,4 @@
---
# This is so uggly
- name: Restart wireguard for interface
systemd:
name: "wg-quick@{{ item.key }}"
state: restarted
loop:
- "{{ lookup('dict', vpn_interfaces) }}"
no_log: false
- name: Reload network interfaces
become: true
command: /sbin/ifreload -a

16
roles/vpn/tasks/main.yml

@ -21,29 +21,21 @@
apt:
name:
- wireguard
- ifupdown2
state: latest
update_cache: true
register: apt_result
retries: 3
until: apt_result is succeeded
- name: Create config files
- name: Create wireguard config files
ansible.builtin.template:
src: "wiregard.conf"
src: "wiregard.conf.j2"
dest: "/etc/wireguard/{{ item.key }}.conf"
owner: root
group: root
mode: '600'
notify: Restart wireguard for interface
notify: Reload network interfaces
loop:
- "{{ lookup('dict', vpn_interfaces) }}"
no_log: true
- name: Enable interface
systemd:
name: "wg-quick@{{ item.key }}"
state: started
enabled: yes
loop:
- "{{ lookup('dict', vpn_interfaces) }}"
no_log: false

1
roles/vpn/templates/wiregard.conf → roles/vpn/templates/wiregard.conf.j2

@ -1,7 +1,6 @@
{{ ansible_managed | comment }}
[Interface]
Address = {{ item.value.ip }}
PrivateKey = {{ item.value.private_key }}
ListenPort = {{ vpn_port }}
Loading…
Cancel
Save