sonny/arch-setup
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add wireguard configuration

Browse source
This commit is contained in:
Sonny Bakker 2021-12-29 11:57:31 +01:00
parent 78e82f4bae
commit c3cb8e1e8f
18 changed files with 176 additions and 127 deletions
Download patch file Download diff file Expand all files Collapse all files

7
files/desktop/wireguard/desktop.key Normal file
View file

@ -0,0 +1,7 @@
$ANSIBLE_VAULT;1.1;AES256
64386433373038346364353966343664623636623866656535326139353563396466653663613565
3265323264623161653131663865343362323530643139340a383238383738303366333666326536
32373330623636613863303636626536613736323565323632353263363531386339623636613965
6232626334623437610a623236383763636431323332343237353835666432326439396361386139
31383538613265633766316565313538663631383833383636376630326130393039623561666232
3861343261303065363138616564666464653733353864386564

1
files/desktop/wireguard/desktop.pub Normal file
View file

@ -0,0 +1 @@
izHzmRwh2yzICps6pFI2Bg3TnmTD66/8uH4loJpkuD4=

7
files/desktop/wireguard/preshared.psk Normal file
View file

@ -0,0 +1,7 @@
$ANSIBLE_VAULT;1.1;AES256
35306261646161313832376338646666383439366336396566366163646263346661373861326630
3461373866323562356338323837653032346333323962310a353436613736353763373163306163
63356435306132623264323361333863363038306132333832303035393863616562363833663038
3265306165623435390a383464343539393964396430343932363364353363323337346565646335
37373332306534303963386139613931396561643763663438303932373832633565643765353433
6564326235623439363438626261346264393835636134383664

1
playbook.yml
View file

@ -16,7 +16,6 @@
- import_tasks: 'tasks/setup.yml'
- import_tasks: 'tasks/network.yml'
- import_tasks: 'tasks/systemd.yml'
- import_tasks: 'tasks/openvpn.yml'
- import_tasks: 'tasks/git.yml'
- import_tasks: 'tasks/mpv.yml'
- import_tasks: 'tasks/mpd.yml'

97
tasks/network.yml
View file

@ -1,42 +1,109 @@
- name: setup desktop systemd networkd
become: yes
template:
src: 'templates/desktop/network.j2'
dest: '/etc/systemd/network/20-wired.network'
- name: create wireguard directories
become: true
file:
path: '{{ item | dirname }}'
owner: root
group: root
group: systemd-network
mode: '0644'
notify: restart systemd-networkd
state: directory
loop:
- '{{ vpn_private_key_path }}'
- '{{ vpn_public_key_path }}'
- name: copy wireguard credentials
become: true
copy:
src: '{{ item.src }}'
dest: '{{ item.dest }}'
owner: root
group: systemd-network
mode: '0640'
loop:
- {
dest: '{{ vpn_public_key_path }}',
src: 'files/{{ platform }}/wireguard/{{ platform }}.pub',
}
- {
dest: '{{ vpn_private_key_path }}',
src: 'files/{{ platform }}/wireguard/{{ platform }}.key',
}
- name: copy wireguard preshared keys
become: true
copy:
src: '{{ item.preshared_key_source_path }}'
dest: '{{ item.preshared_key_path }}'
owner: root
group: systemd-network
mode: '0640'
loop: '{{ vpn_peers }}'
- name: setup desktop network configuration
become: true
template:
src: '{{ item.src }}'
dest: '{{ item.dest }}'
owner: root
group: systemd-network
mode: '0640'
loop:
- {
src: 'templates/desktop/network/enp.network.j2',
dest: '/etc/systemd/network/20-wired.network',
}
- {
src: 'templates/desktop/network/vmbr0.network.j2',
dest: '/etc/systemd/network/30-vmbr0.network',
}
- {
src: 'templates/desktop/network/vmbr0.netdev.j2',
dest: '/etc/systemd/network/30-vmbr0.netdev',
}
- {
src: 'templates/desktop/network/wg0.network.j2',
dest: '/etc/systemd/network/40-wg0.network',
}
- {
src: 'templates/desktop/network/wg0.netdev.j2',
dest: '/etc/systemd/network/40-wg0.netdev',
}
when: platform == "desktop"
- name: setup laptop systemd networkd
become: yes
# TODO: update network configuration path
- name: setup laptop network configuration
become: true
template:
src: 'templates/laptop/network.j2'
dest: '/etc/systemd/network/20-wireless.network'
owner: root
group: root
mode: '0644'
notify: restart systemd-networkd
when: platform == "laptop"
- name: restart systemd-networkd
become: true
systemd:
name: systemd-networkd
state: restarted
enabled: true
- name: start systemd-resolved service
become: yes
become: true
systemd:
name: systemd-resolved
state: started
enabled: yes
enabled: true
- name: start iwd service
become: yes
become: true
systemd:
name: iwd
state: started
enabled: yes
enabled: true
when: platform == "laptop"
- name: copy firewall template
become: yes
become: true
template:
src: 'templates/{{ platform }}/nftables.j2'
dest: '/etc/nftables.conf'

0
templates/desktop/network.j2 → templates/desktop/network/enp.network.j2
View file

5
templates/desktop/network/vmbr0.netdev.j2 Normal file
View file

@ -0,0 +1,5 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[NetDev]
Name=vmbr0
Kind=bridge

10
templates/desktop/network/vmbr0.network.j2 Normal file
View file

@ -0,0 +1,10 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name=vmbr0
[Network]
Address=10.4.0.1/24
DHCP=yes
IPForward=yes
ConfigureWithoutCarrier=yes

24
templates/desktop/network/wg0.netdev.j2 Normal file
View file

@ -0,0 +1,24 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[NetDev]
Name={{ vpn_interface }}
Kind=wireguard
Description=WireGuard tunnel {{ vpn_interface }}
[WireGuard]
# PrivateKeyFile option does not seem to work, perhaps a bug?
PrivateKey={{ vpn_private_key }}
{% for peer in vpn_peers %}
[WireGuardPeer]
PublicKey={{ peer.public_key }}
# PresharedKeyFile option does not seem to work, perhaps a bug?
PresharedKey={{ peer.preshared_key }}
AllowedIPs={{ peer.allowd_ips }}
{% if peer.endpoint %}
Endpoint={{ peer.endpoint }}
{% endif %}
{% if not loop.last %}
{% endif %}
{% endfor %}

7
templates/desktop/network/wg0.network.j2 Normal file
View file

@ -0,0 +1,7 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name={{ vpn_interface }}
[Network]
Address={{ vpn_ip }}/{{ vpn_subnet }}

4
templates/desktop/nftables.j2
View file

@ -25,10 +25,10 @@ table inet filter {
tcp dport ssh accept
# syncthing
ip saddr 10.8.1.1 tcp dport 22000 accept
ip saddr 10.0.0.1 tcp dport 22000 accept
# allow remote pulse audio
ip saddr 10.8.1.1 tcp dport 4713 accept
ip saddr 10.0.0.1 tcp dport 4713 accept
# allow dhcp requests for bridget connections
iifname "vmbr0" udp dport { 53, 67 } accept

2
templates/desktop/pulse-script.j2
View file

@ -2,4 +2,4 @@
#
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
/usr/bin/pactl load-module module-native-protocol-tcp auth-anonymous=1 listen=10.8.1.10
/usr/bin/pactl load-module module-native-protocol-tcp auth-anonymous=1 listen={{ vpn_ip }}

2
templates/desktop/syncthing.j2
View file

@ -71,7 +71,7 @@
<maxRequestKiB>0</maxRequestKiB>
</device>
<device id="PGSOVGQ-VOHWV77-F7DFFQO-JZKTWWG-Z2XU2DE-N4ATK5U-F7MXKKM-TFSROQJ" name="Zeus" compression="metadata" introducer="false" skipIntroductionRemovals="false" introducedBy="">
<address>tcp://10.8.0.1:22000</address>
<address>tcp://10.0.0.1:22000</address>
<paused>false</paused>
<autoAcceptFolders>false</autoAcceptFolders>
<maxSendKbps>0</maxSendKbps>

102
templates/laptop/openvpn.j2
View file

@ -1,102 +0,0 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
#
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
dev {{ vpn_interface }}
# Use unprivileged ip command
#iproute /usr/local/sbin/unpriv-ip
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
proto {{ vpn_protocol }}
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote {{ vpn_ip }}
port {{ vpn_port }}
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Ping every 30s - Inactivity restart 120s
keepalive 30 120
# Don't ping until connected to remote
ping-timer-rem
# Most clients don't need to bind to
# a specific local port number.
nobind
# Try to preserve some state across restarts.
persist-key
persist-tun
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca /etc/openvpn/client/zeus/ca.crt
cert /etc/openvpn/client/zeus/laptop.crt
key /etc/openvpn/client/zeus/laptop.key
# Verify server certificate by checking that the
# certicate has the correct key usage set.
# This is an important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the keyUsage set to
# digitalSignature, keyEncipherment
# and the extendedKeyUsage to
# serverAuth
# EasyRSA can do this for you.
remote-cert-tls server
# If a tls-auth key is used on the server
# then every client must also have the key.
tls-auth ta.key 1
auth SHA512
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
cipher AES-256-CBC
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
# Disabled as advised on https://openvpn.net/security-advisories/
#compress lz4
# Set log file verbosity.
verb {{ vpn_verbosity }}

25
vars/desktop.yml
View file

@ -1 +1,26 @@
platform_packages: []
vpn_ip: '10.0.0.3'
vpn_subnet: '24'
vpn_public_key_path: '/etc/wireguard/keys/public/desktop.pub'
vpn_private_key_path: '/etc/wireguard/keys/private/desktop.key'
vpn_private_key: !vault |
$ANSIBLE_VAULT;1.1;AES256
65386334366166306164363464633364383935313739373730373139663139373964336665636264
3563663038313039363230623266393164646164373739620a623536633631643231633938613461
63366239333230663531306333383962353937353736663336343434663633303232386531353832
6434633935333538650a613065306239333031656362356165326136333131356135383436326561
62303035386634636333353664373231633434656538303866386262353139363439363435346637
6637363334623133376134306165626564343864633032613763
vpn_peers:
- {
name: 'zeus',
allowd_ips: '10.0.0.1/32',
endpoint: '178.85.119.159:51902',
public_key: 'CeybSMpJiicXmndIuhe89Bay3z3PEdYNyAwIFsacBEo=',
preshared_key_path: '/etc/wireguard/keys/private/preshared-zeus.psk',
preshared_key_source_path: 'files/desktop/wireguard/preshared.psk',
preshared_key: !vault "$ANSIBLE_VAULT;1.1;AES256\r\n363333633336613939306632323163396239303739366135393232396134393266623939613534326238393638333137383235313039623264343932303038330a633934373638363966306533346235326234663464313963356238623064666430303030643533666536393662316237333463336462376366343335363131350a333135366239633765633136316133653535336661666461666365636233656165666635663037386666323931643265623233366133623237663734623661623661316436396465343866363266393565653237636136626536353630383263"
}

2
vars/laptop.yml
View file

@ -1,3 +1,5 @@
platform_packages:
- iwd
- powertop
vpn_ip: '10.0.0.2'

2
vars/main.yml
View file

@ -10,7 +10,6 @@ packages:
- nftables
- mpd
- nfs-utils
- openvpn
- okular
- postgresql
- plasma-meta
@ -29,5 +28,6 @@ packages:
- pipewire
- pipewire-pulse
- pipewire-alsa
- wireguard-tools
platform_packages: []

5
vars/vpn.yml
View file

@ -1,5 +1,2 @@
vpn_ip: '178.85.119.159'
vpn_port: '7531'
vpn_interface: 'tun0'
vpn_interface: 'wg0'
vpn_protocol: 'udp'
vpn_verbosity: '1'