sonny/debian-setup
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactor nftables, vpn and transmission configuration

Browse source
This commit is contained in:
sonny 2025-03-09 20:54:41 +01:00
parent 465a5d2887
commit dcbdfdc422
24 changed files with 292 additions and 192 deletions
Download patch file Download diff file Expand all files Collapse all files

25
files/transmission/Dockerfile Normal file
View file

@ -0,0 +1,25 @@
FROM alpine:latest
ENV TRANSMISSION_HOME=/app/
RUN apk add --no-cache --update transmission transmission-daemon
RUN mkdir --parents \
/app/config/torrents \
/app/config/resume \
/app/config/blocklists \
/app/downloads \
/app/incomplete_downloads
WORKDIR /app
VOLUME ["/app/config", "/app/downloads", "/app/incomplete_downloads"]
ENTRYPOINT /usr/bin/transmission-daemon \
--config-dir /app/config \
--log-level info \
--foreground \
--download-dir /app/downloads \
--incomplete-dir /app/incomplete_downloads
EXPOSE 9091 51413/tcp 51413/udp

2
playbook.yml
View file

@ -56,9 +56,7 @@
- 'vars/vpn.yml'
- 'vars/vpn_media.yml'
- 'vars/network.yml'
- 'vars/nginx.yml'
- 'vars/transmission.yml'
- 'vars/syncthing.yml'
- 'vars/mpd.yml'
- 'vars/radicale.yml'
- 'vars/jellyfin.yml'

123
tasks/transmission.yml
View file

@ -1,60 +1,93 @@
# transmission's configuration file does not change while the service is
# still running
- name: stop transmission daemon
# Note: requires an up-to-date ansible version to make us of docker compose file
## TODO: use tracker blocklist
#
- name: Disable system process
become: true
systemd:
ansible.builtin.systemd:
name: transmission-daemon
state: stopped
- name: create transmission directories
- name: Create Transmission directories
become: true
file:
ansible.builtin.file:
path: '{{ item.path }}'
mode: '{{ item.mode }}'
owner: '{{ item.owner }}'
group: '{{ item.group }}'
mode: '0755'
state: directory
loop:
- {
path: '{{ ansible_env.HOME }}/.config/transmission-daemon',
mode: 755,
owner: 'sonny',
group: 'sonny',
}
- {
path: '/etc/systemd/system/transmission-daemon.service.d',
mode: 755,
owner: 'root',
group: 'root',
}
- path: '{{ transmission_app_dir }}'
owner: root
group: root
- path: '{{ transmission_app_dir }}/config'
owner: root
group: root
- path: '{{ transmission_app_dir }}/nginx.conf.d'
owner: sonny
group: sonny
- path: '{{ transmission_download_dir }}'
owner: sonny
group: sonny
- path: '{{ transmission_incomplete_dir }}'
owner: sonny
group: sonny
- name: copy transmission templates
- name: Remove previous transmission configurations
become: true
template:
src: '{{ item.src }}'
dest: '{{ item.dest }}'
mode: '{{ item.mode }}'
owner: '{{ item.owner }}'
group: '{{ item.group }}'
ansible.builtin.file:
path: '{{ item }}'
state: absent
loop:
- {
src: 'templates/systemd/transmission.j2',
dest: '/etc/systemd/system/transmission-daemon.service.d/override.conf',
mode: '755',
owner: 'root',
group: 'root',
}
- {
src: 'templates/transmission.j2',
dest: '{{ ansible_env.HOME }}/.config/transmission-daemon/settings.json',
mode: '0600',
owner: 'sonny',
group: 'sonny',
}
- '/etc/systemd/system/transmission-daemon.service.d'
- '{{ ansible_env.HOME }}/.config/transmission-daemon'
- name: start transmission daemon
- name: Copy Dockerfile
become: true
systemd:
name: transmission-daemon
state: started
enabled: true
ansible.builtin.copy:
src: 'files/transmission/Dockerfile'
dest: '{{ transmission_app_dir }}/Dockerfile'
owner: sonny
group: sonny
mode: '0755'
- name: Copy docker compose configuration
become: true
ansible.builtin.template:
src: 'templates/transmission/docker-compose.j2'
dest: '{{ transmission_app_dir }}/docker-compose.yml'
owner: sonny
group: sonny
mode: '0755'
# Prevents Tranmission from overwiting configuration files
- name: Stop docker compose containers
community.docker.docker_compose_v2:
project_src: '{{ transmission_app_dir }}'
state: stopped
- name: Copy Transmission configuration
become: true
ansible.builtin.template:
src: 'templates/transmission/config.j2'
dest: '{{ transmission_app_dir }}/config/settings.json'
owner: sonny
group: sonny
mode: '0755'
- name: Copy NGINX configuration
become: true
ansible.builtin.template:
src: 'templates/transmission/nginx.j2'
dest: '{{ transmission_app_dir }}/nginx.conf.d/default.conf'
owner: sonny
group: sonny
mode: '0755'
- name: Start container
community.docker.docker_compose_v2:
project_src: '{{ transmission_app_dir }}'
build: always
remove_orphans: true
state: restarted
pull: always

1
templates/network/hosts.j2
View file

@ -5,6 +5,7 @@
{{ lan_ip }} {{ domain_name }} {{ hostname }}
{{ vpn_listen_address }} {{ vpn_domain }}
{{ vpn_media_listen_address }} {{ vpn_media_domain }}
{{ transmission_nginx_ip }} {{ transmission_domain }}
# The following lines are desirable for IPv6 capable hosts
#::1 localhost ip6-localhost ip6-loopback

2
templates/network/link1.network.j2
View file

@ -4,7 +4,7 @@
Name={{ network_interface }}
[Network]
Address={{ lan_ip }}/24
Address={{ lan_ip }}/{{ lan_prefix }}
Gateway={{ lan_gateway }}
DNS={{ lan_dns }}
IgnoreCarrierLoss=true

6
templates/network/wireguard/default/mobile.wireguard.j2
View file

@ -1,12 +1,14 @@
# {{ ansible_managed }}
[Interface]
Address={{ vpn_peers.mobile.ip }}/24
Address={{ vpn_peers.mobile.ip }}/{{ vpn_prefix }}
DNS={{ vpn_listen_address }}
PrivateKey={{ lookup("file", vpn_peers.mobile.private_key_source_path) }}
[Peer]
PublicKey={{ lookup("file", vpn_server_public_key_source_path) }}
PresharedKey={{ lookup("file", vpn_peers.mobile.preshared_key_source_path) }}
AllowedIPs={{ vpn_listen_address }}/32
{% for ip in vpn_peers.mobile.allowed_ips %}
AllowedIPs={{ ip }}
{% endfor %}
Endpoint={{ domain_name }}:{{ vpn_port }}

2
templates/network/wireguard/default/wg0.netdev.j2
View file

@ -13,7 +13,7 @@ PrivateKeyFile={{ vpn_server_key_path }}
[WireGuardPeer]
PublicKey={{ properties.public_key }}
PresharedKeyFile={{ properties.preshared_key_path }}
AllowedIPs={{ properties.ip }}/32
AllowedIPs={{ properties.ip }}
{% if not loop.last %}
{% endif %}

2
templates/network/wireguard/default/wg0.network.j2
View file

@ -4,4 +4,4 @@
Name={{ vpn_interface }}
[Network]
Address={{ vpn_listen_address }}/{{ vpn_subnet }}
Address={{ vpn_listen_address }}/{{ vpn_prefix }}

6
templates/network/wireguard/media/mobile_1.wireguard.j2
View file

@ -1,12 +1,14 @@
# {{ ansible_managed }}
[Interface]
Address={{ vpn_media_peers.mobile_peer_1.ip }}/24
Address={{ vpn_media_peers.mobile_peer_1.ip }}/{{ vpn_media_prefix }}
DNS={{ vpn_media_listen_address }}
PrivateKey={{ lookup('file', vpn_media_peers.mobile_peer_1.private_key_source_path) }}
[Peer]
PublicKey={{ lookup('file', vpn_media_server_public_key_source_path) }}
PresharedKey={{ lookup('file', vpn_media_peers.mobile_peer_1.preshared_key_source_path) }}
AllowedIPs={{ vpn_media_listen_address }}/32
{% for ip in vpn_media_peers.mobile_peer_1.allowed_ips %}
AllowedIPs={{ ip }}
{% endfor %}
Endpoint={{ domain_name }}:{{ vpn_media_port }}

6
templates/network/wireguard/media/mobile_2.wireguard.j2
View file

@ -1,12 +1,14 @@
# {{ ansible_managed }}
[Interface]
Address={{ vpn_media_peers.mobile_peer_2.ip }}/24
Address={{ vpn_media_peers.mobile_peer_2.ip }}/{{ vpn_media_prefix }}
DNS={{ vpn_media_listen_address }}
PrivateKey={{ lookup('file', vpn_media_peers.mobile_peer_2.private_key_source_path) }}
[Peer]
PublicKey={{ lookup('file', vpn_media_server_public_key_source_path) }}
PresharedKey={{ lookup('file', vpn_media_peers.mobile_peer_2.preshared_key_source_path) }}
AllowedIPs={{ vpn_media_listen_address }}/32
{% for ip in vpn_media_peers.mobile_peer_2.allowed_ips %}
AllowedIPs={{ ip }}
{% endfor %}
Endpoint={{ domain_name }}:{{ vpn_media_port }}

6
templates/network/wireguard/media/tv.wireguard.j2
View file

@ -1,12 +1,14 @@
# {{ ansible_managed }}
[Interface]
Address={{ vpn_media_peers.tv.ip }}/24
Address={{ vpn_media_peers.tv.ip }}/{{ vpn_media_prefix }}
DNS={{ vpn_media_listen_address }}
PrivateKey={{ lookup('file', vpn_media_peers.tv.private_key_source_path) }}
[Peer]
PublicKey={{ lookup('file', vpn_media_server_public_key_source_path) }}
PresharedKey={{ lookup('file', vpn_media_peers.tv.preshared_key_source_path) }}
AllowedIPs={{ vpn_media_listen_address }}/32
{% for ip in vpn_media_peers.tv.allowed_ips %}
AllowedIPs={{ ip }}
{% endfor %}
Endpoint={{ domain_name }}:{{ vpn_media_port }}

2
templates/network/wireguard/media/wg1.netdev.j2
View file

@ -13,7 +13,7 @@ PrivateKeyFile={{ vpn_media_server_key_path }}
[WireGuardPeer]
PublicKey={{ properties.public_key }}
PresharedKeyFile={{ properties.preshared_key_path }}
AllowedIPs={{ properties.ip }}/32
AllowedIPs={{ properties.ip }}
{% if not loop.last %}
{% endif %}

2
templates/network/wireguard/media/wg1.network.j2
View file

@ -4,4 +4,4 @@
Name={{ vpn_media_interface }}
[Network]
Address={{ vpn_media_listen_address }}/{{ vpn_media_subnet }}
Address={{ vpn_media_listen_address }}/{{ vpn_media_prefix }}

72
templates/nftables.j2
View file

@ -4,6 +4,7 @@
flush ruleset
table ip filter {
chain input {
type filter hook input priority 0; policy drop;
@ -19,32 +20,53 @@ table ip filter {
# allow icmp
ip protocol icmp accept
iifname "{{ network_interface }}" tcp dport {{ ssh_port }} accept comment "SSH"
iifname "{{ network_interface }}" tcp dport {{ forgejo_ssh_port }} accept comment "Forgejo SSH"
iifname "{{ network_interface }}" tcp dport { {{ http_port }}, {{ https_port }} } accept comment "HTTP/HTTPS"
iifname "{{ network_interface }}" tcp dport {{ transmission_port }} accept comment "Transmission"
iifname "{{ network_interface }}" udp dport {{ vpn_port }} accept comment "Wireguard"
iifname "{{ network_interface }}" udp dport {{ vpn_media_port }} accept comment "Wireguard media"
# TODO: create combined rule
iifname "{{ vpn_interface }}" tcp dport 53 ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "DNS TCP"
iifname "{{ vpn_interface }}" udp dport 53 ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "DNS UDP"
iifname "{{ vpn_interface }}" tcp dport { {{ http_port }}, {{ https_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "HTTP/HTTPS"
iifname "{{ vpn_interface }}" tcp dport {{ transmission_web_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "Transmission Web"
iifname "{{ vpn_interface }}" tcp dport { {{ syncthing_gui_port }}, {{ syncthing_protocol_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "Syncthing"
iifname "{{ vpn_interface }}" tcp dport {{ mpd_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "MPD"
iifname "{{ vpn_interface }}" tcp dport {{ mpd_http_stream_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "MPD HTTP stream"
iifname "{{ vpn_interface }}" tcp dport {{ mpd_http_mobile_stream_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "MPD HTTP mobile stream"
# TODO: create combined rule
iifname "{{ vpn_media_interface }}" tcp dport 53 ip saddr {{ vpn_media_source_range }} ip daddr {{ vpn_media_destination_range }} accept comment "DNS TCP"
iifname "{{ vpn_media_interface }}" udp dport 53 ip saddr {{ vpn_media_source_range }} ip daddr {{ vpn_media_destination_range }} accept comment "DNS UDP"
iifname "{{ vpn_media_interface }}" tcp dport {{ jellyfin_http_port }} ip saddr {{ vpn_media_source_range }} ip daddr {{ vpn_media_destination_range }} accept comment "Jellyfin HTTP"
iifname vmap {
{{ network_interface }} : goto wlan-chain,
{{ vpn_interface }} : goto vpn-chain,
{{ vpn_media_interface }} : goto media-vpn-chain
}
log
}
chain wlan-chain {
tcp dport {{ ssh_port }} accept comment "SSH"
tcp dport {{ forgejo_ssh_port }} accept comment "Forgejo SSH"
tcp dport { {{ http_port }}, {{ https_port }} } accept comment "HTTP/HTTPS"
udp dport {{ vpn_port }} accept comment "Wireguard"
udp dport {{ vpn_media_port }} accept comment "Wireguard media"
}
set vpn_set {
typeof ip saddr . ip daddr
flags interval
elements = { {{ vpn_subnet }} . {{ vpn_listen_address }}/{{ vpn_prefix }} }
}
chain vpn-chain {
meta l4proto { tcp, udp } th dport 53 ip saddr . ip daddr @vpn_set accept comment "DNS"
tcp dport { {{ http_port }}, {{ https_port }} } ip saddr . ip daddr @vpn_set accept comment "HTTP/HTTPS"
tcp dport { 80, 443 } ip saddr {{ vpn_subnet }} ip daddr {{ transmission_nginx_ip }} accept comment "Transmission Web"
tcp dport { {{ syncthing_gui_port }}, {{ syncthing_protocol_port }} } ip saddr . ip daddr @vpn_set accept comment "Syncthing"
tcp dport {{ mpd_port }} ip saddr . ip daddr @vpn_set accept comment "MPD"
tcp dport {{ mpd_http_stream_port }} ip saddr . ip daddr @vpn_set accept comment "MPD HTTP stream"
tcp dport {{ mpd_http_mobile_stream_port }} ip saddr . ip daddr @vpn_set accept comment "MPD HTTP mobile stream"
}
set vpn_media_set {
typeof ip saddr . ip daddr
flags interval
elements = { {{ vpn_media_subnet }} . {{ vpn_media_listen_address }}/{{ vpn_media_prefix }} }
}
chain media-vpn-chain {
meta l4proto { tcp, udp } th dport 53 ip saddr . ip daddr @vpn_media_set accept comment "DNS"
tcp dport {{ jellyfin_http_port }} ip saddr . ip daddr @vpn_media_set accept comment "Jellyfin HTTP"
}
}

73
templates/transmission.j2
View file

@ -1,73 +0,0 @@
{
"alt-speed-down": 50,
"alt-speed-enabled": false,
"alt-speed-time-begin": 540,
"alt-speed-time-day": 127,
"alt-speed-time-enabled": false,
"alt-speed-time-end": 1020,
"alt-speed-up": 50,
"bind-address-ipv4": "",
"bind-address-ipv6": "",
"blocklist-enabled": false,
"blocklist-url": "http://www.example.com/blocklist",
"cache-size-mb": 4,
"dht-enabled": true,
"download-dir": "{{ transmission_download_folder }}",
"download-limit": 100,
"download-limit-enabled": 0,
"download-queue-enabled": true,
"download-queue-size": 5,
"encryption": 1,
"idle-seeding-limit": 30,
"idle-seeding-limit-enabled": false,
"incomplete-dir": "{{ transmission_incomplete_folder }}",
"incomplete-dir-enabled": true,
"lpd-enabled": true,
"max-peers-global": 200,
"message-level": 1,
"peer-congestion-algorithm": "",
"peer-id-ttl-hours": 6,
"peer-limit-global": 200,
"peer-limit-per-torrent": 50,
"peer-port": {{ transmission_port }},
"peer-port-random-high": 65535,
"peer-port-random-low": 49152,
"peer-port-random-on-start": false,
"peer-socket-tos": "default",
"pex-enabled": true,
"port-forwarding-enabled": true,
"preallocation": 1,
"prefetch-enabled": true,
"queue-stalled-enabled": true,
"queue-stalled-minutes": 30,
"ratio-limit": {{ transmission_ratelimit_ratio }},
"ratio-limit-enabled": false,
"rename-partial-files": true,
"rpc-authentication-required": false,
"rpc-bind-address": "{{ vpn_listen_address }}",
"rpc-enabled": true,
"rpc-host-whitelist": "",
"rpc-host-whitelist-enabled": false,
"rpc-password": "{6d8c6eafffb8ae980db6f2d7e2c36dbf8d111479Z/5l3mfq",
"rpc-port": {{ transmission_web_port }},
"rpc-url": "/transmission/",
"rpc-username": "transmission",
"rpc-whitelist": "127.0.0.1, {{ vpn_listen_address[:-1] }}*",
"rpc-whitelist-enabled": true,
"scrape-paused-torrents-enabled": true,
"script-torrent-done-enabled": false,
"script-torrent-done-filename": "",
"seed-queue-enabled": false,
"seed-queue-size": 10,
"speed-limit-down": 100,
"speed-limit-down-enabled": false,
"speed-limit-up": 5,
"speed-limit-up-enabled": true,
"start-added-torrents": true,
"trash-original-torrent-files": false,
"umask": 18,
"upload-limit": 1,
"upload-limit-enabled": 1,
"upload-slots-per-torrent": 14,
"utp-enabled": true
}

13
templates/transmission/config.j2 Normal file
View file

@ -0,0 +1,13 @@
{
"download-dir": "/app/downloads",
"incomplete-dir": "/app/incomplete_downloads",
"incomplete-dir-enabled": true,
"peer-port": {{ transmission_peer_port }},
"rpc-port": {{ transmission_web_port }},
"rpc-host-whitelist-enabled": false,
"rpc-whitelist-enabled": false,
"ratio-limit": {{ transmission_ratelimit_ratio }},
"ratio-limit-enabled": true,
"speed-limit-up": 5,
"speed-limit-up-enabled": true
}

32
templates/transmission/docker-compose.j2 Normal file
View file

@ -0,0 +1,32 @@
# {{ ansible_managed }}
networks:
transmission-net:
ipam:
config:
- subnet: '{{ transmission_subnet }}'
services:
transmission:
image: alpine:latest
build:
context: .
dockerfile: Dockerfile
restart: always
networks:
transmission-net:
volumes:
- {{ transmission_download_dir }}:/app/downloads
- {{ transmission_incomplete_dir }}:/app/incomplete_downloads
- {{ transmission_app_dir }}/config:/app/config
nginx:
image: nginx:mainline-alpine
depends_on:
- transmission
restart: always
networks:
transmission-net:
ipv4_address: '{{ transmission_nginx_ip }}'
volumes:
- '{{ transmission_app_dir }}/nginx.conf.d:/etc/nginx/conf.d'

20
templates/transmission/nginx.j2 Normal file
View file

@ -0,0 +1,20 @@
# {{ ansible_managed }}
upstream transmission-upstream {
server transmission:9091;
}
server {
listen 80;
server_name {{ transmission_domain }};
location / {
proxy_read_timeout 300;
proxy_pass_header X-Transmission-Session-Id;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://transmission-upstream;
}
}

3
vars/jellyfin.yml
View file

@ -1,3 +0,0 @@
jellyfin_http_port: 8096
jellyfin_service_port: 1900
jellyfin_client_port: 7359

40
vars/network.yml
View file

@ -4,31 +4,61 @@ network_mac: '00:1b:21:3b:50:e2'
lan_ip: '192.168.2.1'
lan_gateway: '192.168.2.254'
lan_dns: '192.168.2.254'
lan_prefix: 24
domain_name: 'fudiggity.nl'
http_port: 80
https_port: 443
ssh_port: 39901
vpn_listen_address: '10.0.0.1'
vpn_prefix: 24
vpn_subnet: '10.0.0.0/{{ vpn_prefix }}'
vpn_port: 51902
vpn_interface: 'wg0'
vpn_domain: 'vpn.{{ domain_name }}'
vpn_media_listen_address: '10.0.1.1'
vpn_media_prefix: 24
vpn_media_subnet: '10.0.1.0/{{ vpn_media_prefix }}'
vpn_media_port: 51903
vpn_media_interface: 'wg1'
vpn_media_domain: 'media-vpn.{{ domain_name }}'
mpd_port: 21000
mpd_http_stream_port: 8000
mpd_http_mobile_stream_port: 8001
forgejo_ip: '127.0.0.1'
forgejo_port: '3000'
forgejo_ssh_port: '22'
forgejo_port: 3000
forgejo_ssh_port: 22
forgejo_domain: 'forgejo.fudiggity.nl'
woodpecker_ip: '127.0.0.1'
woodpecker_port: '7000'
woodpecker_port: 7000
woodpecker_domain: 'woodpecker.fudiggity.nl'
newsreader_ip: '127.0.0.1'
newsreader_port: '5000'
newsreader_port: 5000
newsreader_domain: 'rss.fudiggity.nl'
glitchtip_ip: '127.0.0.1'
glitchtip_port: '7200'
glitchtip_port: 7200
glitchtip_domain: 'glitchtip.fudiggity.nl'
syncthing_gui_port: 8384
syncthing_protocol_port: 22000
radicale_listen_addres: '127.0.0.1'
radicale_port: 5232
transmission_domain: 'transmission.{{ domain_name }}'
transmission_prefix: 24
transmission_subnet: '172.16.238.0/{{ transmission_prefix }}'
transmission_web_port: 9091
transmission_peer_port: 51413
transmission_nginx_ip: '172.16.238.10'
jellyfin_http_port: 8096
jellyfin_service_port: 1900
jellyfin_client_port: 7359

4
vars/nginx.yml
View file

@ -1,4 +0,0 @@
forgejo_domain: 'forgejo.fudiggity.nl'
woodpecker_domain: 'woodpecker.fudiggity.nl'
glitchtip_domain: 'glitchtip.fudiggity.nl'
newsreader_domain: 'rss.fudiggity.nl'

8
vars/transmission.yml
View file

@ -1,5 +1,5 @@
transmission_port: 50409
transmission_web_port: 9091
transmission_download_folder: '/home/sonny/downloads'
transmission_incomplete_folder: '/home/sonny/downloads/Incompleet'
transmission_app_dir: '/srv/docker/tranmission'
transmission_download_dir: '/home/sonny/downloads'
transmission_incomplete_dir: '/home/sonny/downloads/incomplete_downloads'
transmission_ratelimit_ratio: 2

15
vars/vpn.yml
View file

@ -1,12 +1,3 @@
vpn_listen_address: '10.0.0.1'
vpn_domain: 'vpn.{{ domain_name }}'
vpn_subnet: '24'
vpn_port: '51902'
vpn_interface: 'wg0'
vpn_source_range: '10.0.0.0/24'
vpn_destination_range: '10.0.0.1/32'
vpn_server_public_key_path: '{{ vpn_config_dir }}/keys/public/server.pub'
vpn_server_public_key_source_path: 'files/wireguard/default/server.pub'
vpn_server_key_path: '{{ vpn_config_dir }}/keys/private/server.key'
@ -19,13 +10,19 @@ vpn_peers:
public_key: 'EbWLf2+7x/RymeeiVuX72nZOBqPvdhu2V9pYhszpQEw='
preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-laptop.psk'
preshared_key_source_path: 'files/wireguard/default/preshared-laptop.psk'
desktop:
ip: '10.0.0.3'
public_key: 'izHzmRwh2yzICps6pFI2Bg3TnmTD66/8uH4loJpkuD4='
preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-desktop.psk'
preshared_key_source_path: 'files/wireguard/default/preshared-desktop.psk'
# has extra key to generate mobile configuration file
mobile:
ip: '10.0.0.4'
allowed_ips:
- '{{ vpn_subnet }}'
- '{{ transmission_subnet }}'
public_key: '4aBHRiglCOE7qEDLqeFgQ5PMMsKczpPoL4bx4jyAEDY='
preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-mobile.psk'
preshared_key_source_path: 'files/wireguard/default/preshared-mobile.psk'

19
vars/vpn_media.yml
View file

@ -1,12 +1,3 @@
vpn_media_listen_address: '10.0.1.1'
vpn_media_domain: 'media-vpn.{{ domain_name }}'
vpn_media_subnet: '24'
vpn_media_port: '51903'
vpn_media_interface: 'wg1'
vpn_media_source_range: '10.0.1.0/24'
vpn_media_destination_range: '10.0.1.1/32'
vpn_media_server_public_key_path: '{{ vpn_config_dir }}/keys/public/media_server.pub'
vpn_media_server_public_key_source_path: 'files/wireguard/media/server.pub'
vpn_media_server_key_path: '{{ vpn_config_dir }}/keys/private/media_server.key'
@ -19,25 +10,35 @@ vpn_media_peers:
public_key: 'hI4rqlv2afs4RJkt5xR+dYxQODSd6lR0OqWJRlnQdjM='
preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-laptop.psk'
preshared_key_source_path: 'files/wireguard/media/preshared-laptop.psk'
desktop:
ip: '10.0.1.3'
public_key: 'YDH5lZcxUHM4AU2ZxQrFqjDIV2Z7PSUQKMcYXLExV0E='
preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-desktop.psk'
preshared_key_source_path: 'files/wireguard/media/preshared-desktop.psk'
mobile_peer_1:
ip: '10.0.1.4'
allowed_ips:
- '{{ vpn_media_subnet }}'
public_key: '6fj8FXvzT0IUlZLJjQ/+FhwwRDsJeQsUFHqKQcyXdwQ='
preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-mobile-1.psk'
preshared_key_source_path: 'files/wireguard/media/preshared-mobile-1.psk'
private_key_source_path: 'files/wireguard/media/mobile-1.key'
mobile_peer_2:
ip: '10.0.1.5'
allowed_ips:
- '{{ vpn_media_subnet }}'
public_key: 'w/pswNrAYFdEUoaLk3zSqOu4gg2s41BBCN02E//ai1c='
preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-mobile-2.psk'
preshared_key_source_path: 'files/wireguard/media/preshared-mobile-2.psk'
private_key_source_path: 'files/wireguard/media/mobile-2.key'
tv:
ip: '10.0.1.6'
allowed_ips:
- '{{ vpn_media_subnet }}'
public_key: '5+yz9C9PhaLhsvAZ1e3mDsTQpMZVrPZnSQa6ERJIKU0='
preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-tv.psk'
preshared_key_source_path: 'files/wireguard/media/preshared-tv.psk'