sonny/arch-setup
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add wireguard configuration

Browse source
This commit is contained in:
Sonny Bakker 2021-12-29 11:57:31 +01:00
parent 78e82f4bae
commit c3cb8e1e8f
18 changed files with 176 additions and 127 deletions
Download patch file Download diff file Expand all files Collapse all files

0
templates/desktop/network.j2 → templates/desktop/network/enp.network.j2
View file

5
templates/desktop/network/vmbr0.netdev.j2 Normal file
View file

@ -0,0 +1,5 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[NetDev]
Name=vmbr0
Kind=bridge

10
templates/desktop/network/vmbr0.network.j2 Normal file
View file

@ -0,0 +1,10 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name=vmbr0
[Network]
Address=10.4.0.1/24
DHCP=yes
IPForward=yes
ConfigureWithoutCarrier=yes

24
templates/desktop/network/wg0.netdev.j2 Normal file
View file

@ -0,0 +1,24 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[NetDev]
Name={{ vpn_interface }}
Kind=wireguard
Description=WireGuard tunnel {{ vpn_interface }}
[WireGuard]
# PrivateKeyFile option does not seem to work, perhaps a bug?
PrivateKey={{ vpn_private_key }}
{% for peer in vpn_peers %}
[WireGuardPeer]
PublicKey={{ peer.public_key }}
# PresharedKeyFile option does not seem to work, perhaps a bug?
PresharedKey={{ peer.preshared_key }}
AllowedIPs={{ peer.allowd_ips }}
{% if peer.endpoint %}
Endpoint={{ peer.endpoint }}
{% endif %}
{% if not loop.last %}
{% endif %}
{% endfor %}

7
templates/desktop/network/wg0.network.j2 Normal file
View file

@ -0,0 +1,7 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name={{ vpn_interface }}
[Network]
Address={{ vpn_ip }}/{{ vpn_subnet }}

4
templates/desktop/nftables.j2
View file

@ -25,10 +25,10 @@ table inet filter {
tcp dport ssh accept
# syncthing
ip saddr 10.8.1.1 tcp dport 22000 accept
ip saddr 10.0.0.1 tcp dport 22000 accept
# allow remote pulse audio
ip saddr 10.8.1.1 tcp dport 4713 accept
ip saddr 10.0.0.1 tcp dport 4713 accept
# allow dhcp requests for bridget connections
iifname "vmbr0" udp dport { 53, 67 } accept

2
templates/desktop/pulse-script.j2
View file

@ -2,4 +2,4 @@
#
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
/usr/bin/pactl load-module module-native-protocol-tcp auth-anonymous=1 listen=10.8.1.10
/usr/bin/pactl load-module module-native-protocol-tcp auth-anonymous=1 listen={{ vpn_ip }}

2
templates/desktop/syncthing.j2
View file

@ -71,7 +71,7 @@
<maxRequestKiB>0</maxRequestKiB>
</device>
<device id="PGSOVGQ-VOHWV77-F7DFFQO-JZKTWWG-Z2XU2DE-N4ATK5U-F7MXKKM-TFSROQJ" name="Zeus" compression="metadata" introducer="false" skipIntroductionRemovals="false" introducedBy="">
<address>tcp://10.8.0.1:22000</address>
<address>tcp://10.0.0.1:22000</address>
<paused>false</paused>
<autoAcceptFolders>false</autoAcceptFolders>
<maxSendKbps>0</maxSendKbps>