sonny/debian-setup
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add wireguard configuration

Browse source
This commit is contained in:
sonny 2021-12-28 11:27:12 +01:00
parent ce46689f57
commit a043bae576
16 changed files with 155 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

7
files/wireguard/preshared.key Normal file
View file

@ -0,0 +1,7 @@
$ANSIBLE_VAULT;1.1;AES256
35383466626232303066643935333239346135616232366464393935366531346165316535356239
3561313239663637663462643131386462323133316365370a393736663761326239396531336532
64313761633331383535343863373066666239303363313139303134373566663636316631656562
6636656161623364350a653964633331386561336363663237303132373863373563616663343165
62633466346633373735616234633466643138373835393530616637393632363431373733313331
6234623066313439646163363838373762343839386435316262

7
files/wireguard/server.key Normal file
View file

@ -0,0 +1,7 @@
$ANSIBLE_VAULT;1.1;AES256
38393631323066623436313135633436613965643331323966346635666538613933343833346164
3738316333353933643764303134653662373139326165630a323638636137646238326637393263
34356639636330643861623836613636356435616164303439363362396464663631653965636339
3634363030313231340a373735313939343963343262646338626266653336303763313064363766
33663138666237663030363362356164396238336337313733393035663364396537666635376666
3734313634336138363764613166306237366439666230396234

1
files/wireguard/server.pub Normal file
View file

@ -0,0 +1 @@
CeybSMpJiicXmndIuhe89Bay3z3PEdYNyAwIFsacBEo=

1
playbook.yml
View file

@ -8,6 +8,7 @@
- common
tasks:
- import_tasks: 'tasks/setup.yml'
- import_tasks: 'tasks/network.yml'
- import_tasks: 'tasks/nfs.yml'
- import_tasks: 'tasks/radicale.yml'
- import_tasks: 'tasks/syncthing.yml'

68
tasks/network.yml Normal file
View file

@ -0,0 +1,68 @@
- name: copy network configuration files
become: true
template:
src: '{{ item.src }}'
dest: '{{ item.dest }}'
mode: '0640'
loop:
- {
src: 'templates/network/br0.netdev.j2',
dest: '/etc/systemd/network/br0.netdev',
}
- {
src: 'templates/network/br0.network.j2',
dest: '/etc/systemd/network/br0.network',
}
- {
src: 'templates/network/enp5s0.network.j2',
dest: '/etc/systemd/network/enp5s0.network',
}
- {
src: 'templates/network/wg0.netdev.j2',
dest: '/etc/systemd/network/wg0.netdev',
}
- {
src: 'templates/network/wg0.network.j2',
dest: '/etc/systemd/network/wg0.network',
}
- name: create wireguard directories
become: true
file:
path: '{{ item | dirname }}'
owner: root
group: systemd-network
mode: '0640'
state: directory
loop:
- '{{ vpn_server_key_path }}'
- '{{ vpn_server_public_key_path }}'
- name: copy wireguard credentials
become: true
copy:
src: '{{ item.src }}'
dest: '{{ item.dest }}'
owner: root
group: systemd-network
mode: '0640'
loop:
- {
src: 'files/wireguard/server.pub',
dest: '{{ vpn_server_public_key_path }}',
}
- {
src: 'files/wireguard/server.key',
dest: '{{ vpn_server_key_path }}',
}
- {
src: 'files/wireguard/preshared.key',
dest: '{{ vpn_preshared_path }}',
}
- name: restart systemd-networkd
become: true
systemd:
name: systemd-networkd
state: restarted
enabled: true

6
templates/network/br0.netdev.j2 Normal file
View file

@ -0,0 +1,6 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[NetDev]
Name={{ bridge_interface }}
Kind=bridge
MACAddress={{ bridge_mac }}

7
templates/network/br0.network.j2 Normal file
View file

@ -0,0 +1,7 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name={{ bridge_source_interface }}
[Network]
Bridge={{ bridge_interface }}

10
templates/network/enp5s0.network.j2 Normal file
View file

@ -0,0 +1,10 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name={{ bridge_interface }}
[Network]
DHCP=ipv4
Address={{ lan_ip_address }}/24
Gateway={{ lan_ip_address[:-3] }}1
DNS={{ lan_ip_address[:-3] }}1

17
templates/network/wg0.netdev.j2 Normal file
View file

@ -0,0 +1,17 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[NetDev]
Name={{ vpn_interface }}
Kind=wireguard
Description=WireGuard tunnel wg0
[WireGuard]
ListenPort={{ vpn_port }}
PrivateKeyFile={{ vpn_server_key_path }}
{% for peer in vpn_peers %}
[WireGuardPeer]
PublicKey={{ peer.public_key }}
PresharedKeyFile={{ vpn_preshared_path }}
AllowedIPs={{ peer.ip }}/32
{% endfor %}

7
templates/network/wg0.network.j2 Normal file
View file

@ -0,0 +1,7 @@
# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
[Match]
Name={{ vpn_interface }}
[Network]
Address={{ vpn_listen_address }}/24

14
templates/nftables.j2
View file

@ -19,14 +19,14 @@ table ip filter {
# allow icmp
ip protocol icmp accept
iifname 'br0' tcp dport {{ ssh_port }} accept comment 'SSH'
iifname 'br0' tcp dport { {{ http_port }}, {{ https_port }} } accept comment 'HTTP/HTTPS'
iifname "br0" tcp dport {{ ssh_port }} accept comment "SSH"
iifname "br0" tcp dport { {{ http_port }}, {{ https_port }} } accept comment "HTTP/HTTPS"
iifname 'br0' tcp dport {{ vpn_port }} accept comment 'Wireguard'
iifname "br0" tcp dport {{ vpn_port }} accept comment "Wireguard"
iifname '{{ vpn_interface }}' tcp dport { {{ http_port }}, {{ https_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'HTTP/HTTPS'
iifname '{{ vpn_interface }}' tcp dport {{ transmission_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'Transmission'
iifname '{{ vpn_interface }}' tcp dport { {{ syncthing_gui_port }}, {{ syncthing_protocol_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'Syncthing'
iifname '{{ vpn_interface }}' tcp dport {{ mpd_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'MPD'
iifname "{{ vpn_interface }}" tcp dport { {{ http_port }}, {{ https_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "HTTP/HTTPS"
iifname "{{ vpn_interface }}" tcp dport {{ transmission_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "Transmission"
iifname "{{ vpn_interface }}" tcp dport { {{ syncthing_gui_port }}, {{ syncthing_protocol_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "Syncthing"
iifname "{{ vpn_interface }}" tcp dport {{ mpd_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "MPD"
}
}

2
templates/transmission.j2
View file

@ -52,7 +52,7 @@
"rpc-port": {{ transmission_port }},
"rpc-url": "/transmission/",
"rpc-username": "transmission",
"rpc-whitelist": "127.0.0.1, {{ vpn_listen_address:[-1] }}*",
"rpc-whitelist": "127.0.0.1, {{ vpn_listen_address[:-1] }}*",
"rpc-whitelist-enabled": true,
"scrape-paused-torrents-enabled": true,
"script-torrent-done-enabled": false,

1
vars/main.yml
View file

@ -6,3 +6,4 @@ packages:
- openvpn
- mpd
- python3-virtualenv
- wireguard-tools

3
vars/mpd.yml
View file

@ -1,4 +1 @@
mpd_port: 21000
mpd_http_port: 21001
mpd_music_dir: '/home/sonny/music'

5
vars/network.yml
View file

@ -1,3 +1,8 @@
bridge_interface: 'br0'
bridge_source_interface: 'enp5s0'
bridge_mac: '70:85:c2:5a:ce:91'
lan_ip_address: '192.168.178.185'
http_port: 80
https_port: 443
ssh_port: 39901

12
vars/vpn.yml
View file

@ -6,10 +6,18 @@ vpn_interface: 'wg0'
vpn_source_range: '10.0.0.0/24'
vpn_destination_range: '10.0.0.1/32'
vpn_server_public_key_path: '/etc/wireguard/keys/public/server.pub'
vpn_server_key_path: '/etc/wireguard/keys/private/server.key'
vpn_preshared_path: '/etc/wireguard/keys/private/preshared.key'
vpn_peers:
- {
name: 'desktop', ip: '10.0.0.3'
name: 'desktop',
ip: '10.0.0.3',
public_key: 'izHzmRwh2yzICps6pFI2Bg3TnmTD66/8uH4loJpkuD4=',
}
- {
name: 'laptop', ip: '10.0.0.2'
name: 'laptop',
ip: '10.0.0.2',
public_key: 'EbWLf2+7x/RymeeiVuX72nZOBqPvdhu2V9pYhszpQEw=',
}