Allow external VPN nodes, make multi-DC deployment work

7 files changed, 59 insertions, 3 deletions

diff --git a/ansible/roles/consul/templates/consul.json.j2 b/ansible/roles/consul/templates/consul.json.j2
index 4a36dc2..a98175c 100644
--- a/ansible/roles/consul/templates/consul.json.j2
+++ b/ansible/roles/consul/templates/consul.json.j2
@@ -1,4 +1,5 @@
 {
+  "datacenter": "deuxfleurs",
   "data_dir": "/var/lib/consul",
   "bind_addr": "0.0.0.0",
   "advertise_addr": "{{ vpn_ip }}",
@@ -11,7 +12,7 @@
      "{{ hostvars[selected_host]['vpn_ip'] }}" {{ "," if not loop.last else "" }}
    {% endfor %}
   ],
-  "bootstrap_expect": 3,
+  "bootstrap_expect": {{ groups['cluster_nodes']|length }},
   "server": true,
   "ui": true,
   "ports": {
diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml
index e8e059a..59f1d71 100644
--- a/ansible/roles/network/tasks/main.yml
+++ b/ansible/roles/network/tasks/main.yml
@@ -1,3 +1,6 @@
+- name: "Create iptables configuration direcetory"
+  file: path=/etc/iptables/ state=directory
+
 - name: "Deploy iptablesv4 configuration"
   template: src=rules.v4.j2 dest=/etc/iptables/rules.v4
 
@@ -55,3 +58,6 @@
 
 - name: "Enable Wireguard systemd service at boot"
   service: name=wg-quick@wgdeuxfleurs state=started enabled=yes daemon_reload=yes
+
+- name: "Create /tmp/wgdeuxfleurs.template.conf example configuration file for external nodes"
+  local_action: template src=wireguard_external.conf.j2 dest=/tmp/wgdeuxfleurs.template.conf
diff --git a/ansible/roles/network/templates/rules.v4.j2 b/ansible/roles/network/templates/rules.v4.j2
index ef2cf64..69f7a09 100644
--- a/ansible/roles/network/templates/rules.v4.j2
+++ b/ansible/roles/network/templates/rules.v4.j2
@@ -13,8 +13,15 @@
 -A INPUT -s {{ hostvars[selected_host]['public_ip'] }} -p udp --dport 51820 -j ACCEPT
 -A INPUT -s {{ hostvars[selected_host]['vpn_ip'] }} -j ACCEPT
 {% endfor %}
+{% for host in other_vpn_nodes %}
+-A INPUT -s {{ host.public_ip }} -p udp --dport 51820 -j ACCEPT
+-A INPUT -s {{ host.vpn_ip }} -j ACCEPT
+{% endfor %}
+
+# Rennes
+-A INPUT -s 93.2.173.168 -j ACCEPT
+-A INPUT -s 82.253.205.190 -j ACCEPT
 
-# Local
 -A INPUT -i docker0 -j ACCEPT
 -A INPUT -s 127.0.0.1/8 -j ACCEPT
 -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
diff --git a/ansible/roles/network/templates/wireguard.conf.j2 b/ansible/roles/network/templates/wireguard.conf.j2
index 907d546..9f70eb9 100644
--- a/ansible/roles/network/templates/wireguard.conf.j2
+++ b/ansible/roles/network/templates/wireguard.conf.j2
@@ -10,3 +10,11 @@ Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].pu
 AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32
 PersistentKeepalive = 25
 {% endfor %}
+
+{% for host in other_vpn_nodes %}
+[Peer]
+PublicKey = {{ host.pubkey }}
+Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }}
+AllowedIPs = {{ host.vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}
diff --git a/ansible/roles/network/templates/wireguard_external.conf.j2 b/ansible/roles/network/templates/wireguard_external.conf.j2
new file mode 100644
index 0000000..f130ffd
--- /dev/null
+++ b/ansible/roles/network/templates/wireguard_external.conf.j2
@@ -0,0 +1,26 @@
+# Template configuration file for VPN nodes that are non in the cluster
+# External nodes should be registered in network/vars/main.yml
+
+[Interface]
+Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml>
+PrivateKey = <INSERT YOUR PRIVKEY HERE, IT SHOULD MATCH THE PUBKEY IN vars/main.yml>
+ListenPort = 51820
+
+# Cluster nodes
+{% for selected_host in groups['cluster_nodes'] %}
+[Peer]
+PublicKey = {{ hostvars[selected_host].wireguard_pubkey.stdout }}
+Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].public_vpn_port }}
+AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}
+
+# External nodes
+# TODO: remove yourself from here
+{% for host in other_vpn_nodes %}
+[Peer]
+PublicKey = {{ host.pubkey }}
+Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }}
+AllowedIPs = {{ host.vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}
diff --git a/ansible/roles/network/vars/main.yml b/ansible/roles/network/vars/main.yml
new file mode 100644
index 0000000..6bd100b
--- /dev/null
+++ b/ansible/roles/network/vars/main.yml
@@ -0,0 +1,6 @@
+---
+other_vpn_nodes:
+  - pubkey: "QUiUNMk70TEQ75Ut7Uqikr5uGVSXmx8EGNkGM6tANlg="
+    public_ip: "37.187.118.206"
+    public_vpn_port: "51820"
+    vpn_ip: "10.68.70.101"
diff --git a/ansible/roles/nomad/templates/nomad.hcl.j2 b/ansible/roles/nomad/templates/nomad.hcl.j2
index 8d62d9b..b39a96b 100644
--- a/ansible/roles/nomad/templates/nomad.hcl.j2
+++ b/ansible/roles/nomad/templates/nomad.hcl.j2
@@ -1,3 +1,5 @@
+datacenter = "{{ datacenter }}"
+
 addresses {
   http = "0.0.0.0"
   rpc = "0.0.0.0"
@@ -14,7 +16,7 @@ data_dir = "/var/lib/nomad"
 
 server {
   enabled          = true
-  bootstrap_expect = 3
+  bootstrap_expect = {{ groups['cluster_nodes']|length }}
 }
 
 consul {