2023-04-13 07:25:26 +00:00
|
|
|
# role_wireguard
|
2023-04-12 15:03:10 +00:00
|
|
|
|
2023-04-13 07:25:26 +00:00
|
|
|
Rôle de déploiement de wireguard.
|
|
|
|
|
|
|
|
|
|
## Variables
|
|
|
|
|
|
|
|
|
|
### wireguard_module_host
|
|
|
|
|
|
|
|
|
|
Variable permettant de déployer le module (dkms) de wireguard sur l'hôte qui héberge le conteneur.
|
|
|
|
|
|
|
|
|
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
|
|
|
|
|
2023-05-03 14:12:42 +00:00
|
|
|
### wireguard_restart_services
|
|
|
|
|
|
|
|
|
|
Redémarrer les services si la configuration a été modifiée.
|
|
|
|
|
|
|
|
|
|
*<span style="text-decoration: underline">Valeur par défaut:</span> `true`*
|
|
|
|
|
|
2023-04-13 07:25:26 +00:00
|
|
|
### wireguard_interfaces
|
|
|
|
|
|
|
|
|
|
Configuration des interfaces de wireguard (`/etc/wireguard/wgX.conf`).
|
|
|
|
|
|
|
|
|
|
*<span style="text-decoration: underline">Valeur par défaut:</span> aucune*
|
|
|
|
|
|
|
|
|
|
## Exemples
|
|
|
|
|
|
|
|
|
|
Dans les exemples ci-dessous, j'utilise aussi le rôle *nftables* afin d'installer et configurer le pare-feu logiciel éponyme.
|
|
|
|
|
|
|
|
|
|
### host_vars/infra-wgclient-2316.nyx.ykn.local.yml
|
|
|
|
|
|
|
|
|
|
```yaml
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# BEGIN role_ifupdown
|
|
|
|
|
ifupdown_interfaces:
|
|
|
|
|
- interface: eth0
|
|
|
|
|
ipv4:
|
|
|
|
|
inet: static
|
|
|
|
|
address: 192.168.1.51
|
|
|
|
|
mask: 24
|
|
|
|
|
gateway: 192.168.1.254
|
|
|
|
|
dns: 192.168.1.254
|
|
|
|
|
ipv6:
|
|
|
|
|
inet: auto
|
|
|
|
|
# END role_ifupdown
|
|
|
|
|
|
|
|
|
|
# BEGIN role_nftables
|
|
|
|
|
nftables_rules:
|
|
|
|
|
- filename: wireguard
|
|
|
|
|
rules:
|
|
|
|
|
- ip saddr 10.5.89.1 udp dport 51820 accept
|
|
|
|
|
# END role_nftables
|
|
|
|
|
|
|
|
|
|
# BEGIN role_wireguard
|
|
|
|
|
wireguard_end_ip: "{{ (ifupdown_interfaces | first).ipv4.address | split('.') | last }}"
|
|
|
|
|
wireguard_module_host: neree.gaia.ykn.local
|
|
|
|
|
wireguard_interfaces:
|
|
|
|
|
- addresses:
|
|
|
|
|
- 192.168.100.{{ wireguard_end_ip }}/24
|
|
|
|
|
- fd00:a100::b{{ wireguard_end_ip }}/64
|
|
|
|
|
privkey: !vault |
|
|
|
|
|
$ANSIBLE_VAULT;1.1;AES256
|
|
|
|
|
31316231366435626664353933356139396430363366363633666434323135663366666435356462
|
|
|
|
|
6431636238336163326330376437343639613137386265390a323433386134323538653330643062
|
|
|
|
|
38353336323263313466623865393865306662396432363063383532653932346332306363346233
|
|
|
|
|
3165383635326264630a313661386236633137376432653333623533393765333565376336623933
|
|
|
|
|
6638
|
|
|
|
|
peers:
|
|
|
|
|
- name: hyperion.erebos.ykn.local
|
|
|
|
|
pubkey: gGd7wgu7Npe6rhEkG6qQ8SQ7KRVihAeBsyJ2qV+MslA=
|
|
|
|
|
endpoint: "[10.5.89.1]:1194"
|
|
|
|
|
allowed_ips:
|
|
|
|
|
- 0.0.0.0/0
|
|
|
|
|
- ::/0
|
|
|
|
|
persistent_keepalive: 25
|
|
|
|
|
# END role_wireguard
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### playbook.yml
|
|
|
|
|
|
|
|
|
|
```yaml
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
- name: Déployer wireguard
|
|
|
|
|
hosts: infra-wgclient-2316.nyx.ykn.local
|
|
|
|
|
roles:
|
|
|
|
|
- name: nftables
|
|
|
|
|
- name: wireguard
|
|
|
|
|
```
|
