Add media vpn setup
This commit is contained in:
parent
79d0e64eb2
commit
34b89bddff
39 changed files with 386 additions and 97 deletions
|
|
@ -1,24 +1,3 @@
|
|||
- name: load private key into var
|
||||
set_fact:
|
||||
vpn_server_key: '{{ lookup("file", "files/wireguard/server.key" ) }}'
|
||||
|
||||
- name: load public key into var
|
||||
set_fact:
|
||||
vpn_server_public_key: '{{ lookup("file", "files/wireguard/server.pub" ) }}'
|
||||
|
||||
# this should eventually be replaced with using the
|
||||
# PrivateKeyFile/PresharedKeyFile options
|
||||
- name: load preshared keys into variables
|
||||
set_fact:
|
||||
vpn_peers: '{{ vpn_peers | combine({item.key: item.value|combine({"preshared_key": lookup("file", item.value.preshared_key_source_path )})})}}'
|
||||
with_dict: '{{ vpn_peers }}'
|
||||
|
||||
- name: load mobile private_key
|
||||
set_fact:
|
||||
vpn_peers: '{{ vpn_peers | combine({item.key: item.value|combine({"private_key": lookup("file", item.value.private_key_source_path )})})}}'
|
||||
with_dict: '{{ vpn_peers }}'
|
||||
when: item.key == "mobile"
|
||||
|
||||
- name: copy network configuration files
|
||||
become: true
|
||||
template:
|
||||
|
|
@ -33,11 +12,7 @@
|
|||
src: 'templates/network/link1.network.j2',
|
||||
dest: '/etc/systemd/network/link1.network',
|
||||
}
|
||||
- { src: 'templates/network/wg0.netdev.j2', dest: '/etc/systemd/network/wg0.netdev' }
|
||||
- {
|
||||
src: 'templates/network/wg0.network.j2',
|
||||
dest: '/etc/systemd/network/wg0.network',
|
||||
}
|
||||
notify: restart systemd-networkd
|
||||
|
||||
- name: copy interface restart timer/service
|
||||
become: true
|
||||
|
|
@ -56,6 +31,7 @@
|
|||
src: 'templates/interface_restart.service.j2',
|
||||
dest: '/etc/systemd/system/interface-restart.service',
|
||||
}
|
||||
notify: restart systemd-networkd
|
||||
|
||||
- name: enable interface restart timer
|
||||
become: true
|
||||
|
|
@ -71,63 +47,4 @@
|
|||
dest: '/etc/hosts'
|
||||
mode: '0644'
|
||||
owner: root
|
||||
|
||||
- name: copy mobile configuration
|
||||
template:
|
||||
src: 'mobile.wireguard.j2'
|
||||
dest: '/tmp/mobile.wireguard.conf'
|
||||
mode: '0600'
|
||||
when: copy_mobile_conf
|
||||
|
||||
- name: create wireguard directories
|
||||
become: true
|
||||
file:
|
||||
path: '{{ item | dirname }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
state: directory
|
||||
loop:
|
||||
- '{{ vpn_server_key_path }}'
|
||||
- '{{ vpn_server_public_key_path }}'
|
||||
|
||||
- name: copy wireguard credentials
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
loop:
|
||||
- { src: 'files/wireguard/server.pub', dest: '{{ vpn_server_public_key_path }}' }
|
||||
- { src: 'files/wireguard/server.key', dest: '{{ vpn_server_key_path }}' }
|
||||
|
||||
- name: copy mobile wireguard credentials
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
loop:
|
||||
- { src: 'files/wireguard/mobile.pub', dest: '{{ vpn_server_public_key_path }}' }
|
||||
- { src: 'files/wireguard/mobile.key', dest: '{{ vpn_server_key_path }}' }
|
||||
|
||||
- name: copy wireguard preshared keys
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.value.preshared_key_source_path }}'
|
||||
dest: '{{ item.value.preshared_key_path }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
with_dict: '{{ vpn_peers }}'
|
||||
|
||||
- name: restart systemd-networkd
|
||||
become: true
|
||||
systemd:
|
||||
name: systemd-networkd
|
||||
state: restarted
|
||||
enabled: true
|
||||
notify: restart systemd-networkd
|
||||
|
|
|
|||
|
|
@ -41,3 +41,5 @@
|
|||
src: '/etc/nginx/sites-available/newsreader',
|
||||
dest: '/etc/nginx/sites-enabled/newsreader',
|
||||
}
|
||||
|
||||
# TODO: provision certbot configuration
|
||||
|
|
|
|||
|
|
@ -17,3 +17,6 @@
|
|||
group: root
|
||||
mode: '0644'
|
||||
notify: reload ssh
|
||||
|
||||
# TODO: provision default grub menu entry for now
|
||||
# linux-image-6.1.0-17 kernel seems to break networking
|
||||
|
|
|
|||
90
tasks/wireguard.yml
Normal file
90
tasks/wireguard.yml
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
- name: load private key into var
|
||||
set_fact:
|
||||
vpn_server_key: '{{ lookup("file", "files/wireguard/default/server.key" ) }}'
|
||||
|
||||
- name: load public key into var
|
||||
set_fact:
|
||||
vpn_server_public_key: '{{ lookup("file", "files/wireguard/default/server.pub" ) }}'
|
||||
|
||||
# this should eventually be replaced with using the
|
||||
# PrivateKeyFile/PresharedKeyFile options
|
||||
- name: load preshared keys into variables
|
||||
set_fact:
|
||||
vpn_peers: '{{ vpn_peers | combine({item.key: item.value|combine({"preshared_key": lookup("file", item.value.preshared_key_source_path )})})}}'
|
||||
with_dict: '{{ vpn_peers }}'
|
||||
|
||||
- name: load mobile private_key
|
||||
set_fact:
|
||||
vpn_peers: '{{ vpn_peers | combine({item.key: item.value|combine({"private_key": lookup("file", item.value.private_key_source_path )})})}}'
|
||||
with_dict: '{{ vpn_peers }}'
|
||||
when: item.key == "mobile"
|
||||
|
||||
- name: copy wireguard configuration files
|
||||
become: true
|
||||
template:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
loop:
|
||||
- { src: 'templates/network/wireguard/default/wg0.netdev.j2', dest: '/etc/systemd/network/wg0.netdev' }
|
||||
- {
|
||||
src: 'templates/network/wireguard/default/wg0.network.j2',
|
||||
dest: '/etc/systemd/network/wg0.network',
|
||||
}
|
||||
notify: restart systemd-networkd
|
||||
|
||||
- name: copy mobile configuration
|
||||
template:
|
||||
src: 'templates/network/wireguard/default/mobile.wireguard.j2'
|
||||
dest: '/tmp/mobile.wireguard.conf'
|
||||
mode: '0600'
|
||||
when: copy_vpn_configurations
|
||||
|
||||
- name: create wireguard directories
|
||||
become: true
|
||||
file:
|
||||
path: '{{ item | dirname }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
state: directory
|
||||
loop:
|
||||
- '{{ vpn_server_key_path }}'
|
||||
- '{{ vpn_server_public_key_path }}'
|
||||
|
||||
- name: copy wireguard credentials
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
loop:
|
||||
- { src: 'files/wireguard/default/server.pub', dest: '{{ vpn_server_public_key_path }}' }
|
||||
- { src: 'files/wireguard/default/server.key', dest: '{{ vpn_server_key_path }}' }
|
||||
|
||||
- name: copy mobile wireguard credentials
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
loop:
|
||||
- { src: 'files/wireguard/default/mobile.pub', dest: '{{ vpn_server_public_key_path|dirname }}/mobile.pub' }
|
||||
- { src: 'files/wireguard/default/mobile.key', dest: '{{ vpn_server_key_path|dirname }}/mobile.key' }
|
||||
|
||||
- name: copy wireguard preshared keys
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.value.preshared_key_source_path }}'
|
||||
dest: '{{ item.value.preshared_key_path }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
with_dict: '{{ vpn_peers }}'
|
||||
|
||||
97
tasks/wireguard_media.yml
Normal file
97
tasks/wireguard_media.yml
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
- name: load media private key into var
|
||||
set_fact:
|
||||
vpn_media_server_key: '{{ lookup("file", "files/wireguard/media/server.key" ) }}'
|
||||
|
||||
- name: load media public key into var
|
||||
set_fact:
|
||||
vpn_media_server_public_key: '{{ lookup("file", "files/wireguard/media/server.pub" ) }}'
|
||||
|
||||
# this should eventually be replaced with using the
|
||||
# PrivateKeyFile/PresharedKeyFile options
|
||||
- name: load preshared media keys into variables
|
||||
set_fact:
|
||||
vpn_media_peers: '{{ vpn_media_peers | combine({item.key: item.value|combine({"preshared_key": lookup("file", item.value.preshared_key_source_path )})})}}'
|
||||
with_dict: '{{ vpn_media_peers }}'
|
||||
|
||||
- name: load external media private_keys
|
||||
set_fact:
|
||||
vpn_media_peers: '{{ vpn_media_peers | combine({item.key: item.value|combine({"private_key": lookup("file", item.value.private_key_source_path )})})}}'
|
||||
with_dict: '{{ vpn_media_peers }}'
|
||||
when: item.key in ['mobile_peer_1', 'mobile_peer_2', 'tv']
|
||||
|
||||
- name: copy wireguard media configuration files
|
||||
become: true
|
||||
template:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
loop:
|
||||
- { src: 'templates/network/wireguard/media/wg1.netdev.j2', dest: '/etc/systemd/network/wg1.netdev' }
|
||||
- {
|
||||
src: 'templates/network/wireguard/media/wg1.network.j2',
|
||||
dest: '/etc/systemd/network/wg1.network',
|
||||
}
|
||||
notify: restart systemd-networkd
|
||||
|
||||
- name: copy external media configurations
|
||||
template:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
mode: '0600'
|
||||
loop:
|
||||
- { src: 'templates/network/wireguard/media/mobile_1.wireguard.j2', dest: '/tmp/mobile_1.wireguard.conf' }
|
||||
- { src: 'templates/network/wireguard/media/mobile_2.wireguard.j2', dest: '/tmp/mobile_2.wireguard.conf' }
|
||||
- { src: 'templates/network/wireguard/media/tv.wireguard.j2', dest: '/tmp/tv.wireguard.conf' }
|
||||
when: copy_vpn_media_configurations
|
||||
|
||||
- name: create wireguard media directories
|
||||
become: true
|
||||
file:
|
||||
path: '{{ item | dirname }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
state: directory
|
||||
loop:
|
||||
- '{{ vpn_media_server_key_path }}'
|
||||
- '{{ vpn_media_server_public_key_path }}'
|
||||
|
||||
- name: copy wireguard media credentials
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
loop:
|
||||
- { src: 'files/wireguard/media/server.pub', dest: '{{ vpn_media_server_public_key_path }}' }
|
||||
- { src: 'files/wireguard/media/server.key', dest: '{{ vpn_media_server_key_path }}' }
|
||||
|
||||
- name: copy mobile media wireguard credentials
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.src }}'
|
||||
dest: '{{ item.dest }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
loop:
|
||||
- { src: 'files/wireguard/media/mobile-1.pub', dest: '{{ vpn_media_server_public_key_path|dirname }}/mobile_1.pub' }
|
||||
- { src: 'files/wireguard/media/mobile-1.key', dest: '{{ vpn_media_server_key_path|dirname }}/mobile_1.key' }
|
||||
- { src: 'files/wireguard/media/mobile-2.pub', dest: '{{ vpn_media_server_public_key_path|dirname }}/mobile_2.pub' }
|
||||
- { src: 'files/wireguard/media/mobile-2.key', dest: '{{ vpn_media_server_key_path|dirname }}/mobile_2.key' }
|
||||
- { src: 'files/wireguard/media/tv.pub', dest: '{{ vpn_media_server_public_key_path|dirname }}/tv.pub' }
|
||||
- { src: 'files/wireguard/media/tv.key', dest: '{{ vpn_media_server_key_path|dirname }}/tv.key' }
|
||||
|
||||
- name: copy wireguard media preshared keys
|
||||
become: true
|
||||
copy:
|
||||
src: '{{ item.value.preshared_key_source_path }}'
|
||||
dest: '{{ item.value.preshared_key_path }}'
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: '0640'
|
||||
with_dict: '{{ vpn_media_peers }}'
|
||||
Loading…
Add table
Add a link
Reference in a new issue