sonny/arch-setup
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add laptop wireguard configuration

Browse source
This commit is contained in:
Sonny Bakker 2021-12-30 14:29:56 +01:00
parent c3cb8e1e8f
commit b914c1bdcf
18 changed files with 113 additions and 519 deletions
Download patch file Download diff file Expand all files Collapse all files

5
templates/laptop/network/vmbr0.netdev.j2 Normal file
View file

@ -0,0 +1,5 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[NetDev]
Name=vmbr0
Kind=bridge

10
templates/laptop/network/vmbr0.network.j2 Normal file
View file

@ -0,0 +1,10 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name=vmbr0
[Network]
Address=10.5.0.1/24
DHCP=ipv4
IPForward=ipv4
ConfigureWithoutCarrier=yes

24
templates/laptop/network/wg0.netdev.j2 Normal file
View file

@ -0,0 +1,24 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[NetDev]
Name={{ vpn_interface }}
Kind=wireguard
Description=WireGuard tunnel {{ vpn_interface }}
[WireGuard]
# PrivateKeyFile option does not seem to work, perhaps a bug?
PrivateKey={{ vpn_private_key }}
{% for peer in vpn_peers %}
[WireGuardPeer]
PublicKey={{ peer.public_key }}
# PresharedKeyFile option does not seem to work, perhaps a bug?
PresharedKey={{ peer.preshared_key }}
AllowedIPs={{ peer.allowd_ips }}
{% if peer.endpoint %}
Endpoint={{ peer.endpoint }}
{% endif %}
{% if not loop.last %}
{% endif %}
{% endfor %}

7
templates/laptop/network/wg0.network.j2 Normal file
View file

@ -0,0 +1,7 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name={{ vpn_interface }}
[Network]
Address={{ vpn_ip }}/{{ vpn_subnet }}

0
templates/laptop/network.j2 → templates/laptop/network/wireless.network.j2
View file

2
templates/laptop/nftables.j2
View file

@ -26,7 +26,7 @@ table inet filter {
tcp dport ssh accept
# syncthing
ip saddr 10.8.1.1 tcp dport 22000 accept
ip saddr 10.0.0.1 tcp dport 22000 accept
# allow dhcp requests for bridged connections
iifname "vmbr0" udp dport { 53, 67 } accept

2
templates/laptop/pulse-script.j2
View file

@ -2,4 +2,4 @@
#
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
/usr/bin/pactl load-module module-native-protocol-tcp auth-anonymous=1 listen=10.8.1.6
/usr/bin/pactl load-module module-native-protocol-tcp auth-anonymous=1 listen=10.0.0.2

8
templates/laptop/pulse.j2
View file

@ -1,8 +0,0 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
#
# see /usr/share/pipewire/pipewire-pulse.conf for reference
context.exec = [
{ path = "pactl" args = "module-native-protocol-tcp auth-anonymous=1 listen=10.8.1.6" }
]

2
templates/laptop/syncthing.j2
View file

@ -63,7 +63,7 @@
<junctionsAsDirs>true</junctionsAsDirs>
</folder>
<device id="PGSOVGQ-VOHWV77-F7DFFQO-JZKTWWG-Z2XU2DE-N4ATK5U-F7MXKKM-TFSROQJ" name="Zeus" compression="metadata" introducer="false" skipIntroductionRemovals="false" introducedBy="">
<address>tcp://10.8.0.1:22000</address>
<address>tcp://10.0.0.1:22000</address>
<paused>false</paused>
<autoAcceptFolders>false</autoAcceptFolders>
<maxSendKbps>0</maxSendKbps>