diff options
| author | Alex Auvolat <alex@adnab.me> | 2020-05-21 23:41:39 +0200 |
|---|---|---|
| committer | Alex Auvolat <alex@adnab.me> | 2020-07-15 16:03:42 +0200 |
| commit | 207d1fa278bc1cb9e8600779287abaffe2ef7746 (patch) | |
| tree | 367eb0afcc7e878c105ad977b85fad738de09dd0 /ansible/roles/network/templates | |
| parent | bee7e10256e0939c1852e4cc3fba1829e0c78c4f (diff) | |
| download | infrastructure-207d1fa278bc1cb9e8600779287abaffe2ef7746.tar.gz infrastructure-207d1fa278bc1cb9e8600779287abaffe2ef7746.zip | |
Allow external VPN nodes, make multi-DC deployment work
Diffstat (limited to 'ansible/roles/network/templates')
| -rw-r--r-- | ansible/roles/network/templates/rules.v4.j2 | 9 | ||||
| -rw-r--r-- | ansible/roles/network/templates/wireguard.conf.j2 | 8 | ||||
| -rw-r--r-- | ansible/roles/network/templates/wireguard_external.conf.j2 | 26 |
3 files changed, 42 insertions, 1 deletions
diff --git a/ansible/roles/network/templates/rules.v4.j2 b/ansible/roles/network/templates/rules.v4.j2 index ef2cf64..69f7a09 100644 --- a/ansible/roles/network/templates/rules.v4.j2 +++ b/ansible/roles/network/templates/rules.v4.j2 @@ -13,8 +13,15 @@ -A INPUT -s {{ hostvars[selected_host]['public_ip'] }} -p udp --dport 51820 -j ACCEPT -A INPUT -s {{ hostvars[selected_host]['vpn_ip'] }} -j ACCEPT {% endfor %} +{% for host in other_vpn_nodes %} +-A INPUT -s {{ host.public_ip }} -p udp --dport 51820 -j ACCEPT +-A INPUT -s {{ host.vpn_ip }} -j ACCEPT +{% endfor %} + +# Rennes +-A INPUT -s 93.2.173.168 -j ACCEPT +-A INPUT -s 82.253.205.190 -j ACCEPT -# Local -A INPUT -i docker0 -j ACCEPT -A INPUT -s 127.0.0.1/8 -j ACCEPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT diff --git a/ansible/roles/network/templates/wireguard.conf.j2 b/ansible/roles/network/templates/wireguard.conf.j2 index 907d546..9f70eb9 100644 --- a/ansible/roles/network/templates/wireguard.conf.j2 +++ b/ansible/roles/network/templates/wireguard.conf.j2 @@ -10,3 +10,11 @@ Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].pu AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32 PersistentKeepalive = 25 {% endfor %} + +{% for host in other_vpn_nodes %} +[Peer] +PublicKey = {{ host.pubkey }} +Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }} +AllowedIPs = {{ host.vpn_ip }}/32 +PersistentKeepalive = 25 +{% endfor %} diff --git a/ansible/roles/network/templates/wireguard_external.conf.j2 b/ansible/roles/network/templates/wireguard_external.conf.j2 new file mode 100644 index 0000000..f130ffd --- /dev/null +++ b/ansible/roles/network/templates/wireguard_external.conf.j2 @@ -0,0 +1,26 @@ +# Template configuration file for VPN nodes that are non in the cluster +# External nodes should be registered in network/vars/main.yml + +[Interface] +Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml> +PrivateKey = <INSERT YOUR PRIVKEY HERE, IT SHOULD MATCH THE PUBKEY IN vars/main.yml> +ListenPort = 51820 + +# Cluster nodes +{% for selected_host in groups['cluster_nodes'] %} +[Peer] +PublicKey = {{ hostvars[selected_host].wireguard_pubkey.stdout }} +Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].public_vpn_port }} +AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32 +PersistentKeepalive = 25 +{% endfor %} + +# External nodes +# TODO: remove yourself from here +{% for host in other_vpn_nodes %} +[Peer] +PublicKey = {{ host.pubkey }} +Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }} +AllowedIPs = {{ host.vpn_ip }}/32 +PersistentKeepalive = 25 +{% endfor %} |