diff options
| -rw-r--r-- | ansible/lxvm | 7 | ||||
| -rw-r--r-- | ansible/roles/consul/templates/consul.json.j2 | 3 | ||||
| -rw-r--r-- | ansible/roles/network/tasks/main.yml | 6 | ||||
| -rw-r--r-- | ansible/roles/network/templates/rules.v4.j2 | 9 | ||||
| -rw-r--r-- | ansible/roles/network/templates/wireguard.conf.j2 | 8 | ||||
| -rw-r--r-- | ansible/roles/network/templates/wireguard_external.conf.j2 | 26 | ||||
| -rw-r--r-- | ansible/roles/network/vars/main.yml | 6 | ||||
| -rw-r--r-- | ansible/roles/nomad/templates/nomad.hcl.j2 | 4 | ||||
| -rw-r--r-- | nomad/bottin2.hcl | 2 | ||||
| -rw-r--r-- | nomad/traefik.hcl | 2 |
10 files changed, 65 insertions, 8 deletions
diff --git a/ansible/lxvm b/ansible/lxvm index f5e517c..89fafaf 100644 --- a/ansible/lxvm +++ b/ansible/lxvm @@ -1,5 +1,6 @@ [cluster_nodes] #ubuntu1 ansible_host=192.168.42.10 -debian1 ansible_host=192.168.42.20 ansible_user=root public_ip=192.168.42.20 dns_server=208.67.222.222 vpn_ip=10.68.70.11 public_vpn_port=51820 -debian2 ansible_host=192.168.42.21 ansible_user=root public_ip=192.168.42.21 dns_server=208.67.222.222 vpn_ip=10.68.70.12 public_vpn_port=51820 -debian3 ansible_host=192.168.42.22 ansible_user=root public_ip=192.168.42.22 dns_server=208.67.222.222 vpn_ip=10.68.70.13 public_vpn_port=51820 +debian1 ansible_host=192.168.42.20 ansible_user=root public_ip=192.168.42.20 dns_server=208.67.222.222 vpn_ip=10.68.70.11 public_vpn_port=51820 datacenter=belair +debian2 ansible_host=192.168.42.21 ansible_user=root public_ip=192.168.42.21 dns_server=208.67.222.222 vpn_ip=10.68.70.12 public_vpn_port=51820 datacenter=belair +debian3 ansible_host=192.168.42.22 ansible_user=root public_ip=192.168.42.22 dns_server=208.67.222.222 vpn_ip=10.68.70.13 public_vpn_port=51820 datacenter=belair +ovh1 ansible_host=51.75.4.20 ansible_user=debian ansible_become=yes public_ip=51.75.4.20 dns_server=208.67.222.222 vpn_ip=10.68.70.20 public_vpn_port=51820 datacenter=saturne diff --git a/ansible/roles/consul/templates/consul.json.j2 b/ansible/roles/consul/templates/consul.json.j2 index 4a36dc2..a98175c 100644 --- a/ansible/roles/consul/templates/consul.json.j2 +++ b/ansible/roles/consul/templates/consul.json.j2 @@ -1,4 +1,5 @@ { + "datacenter": "deuxfleurs", "data_dir": "/var/lib/consul", "bind_addr": "0.0.0.0", "advertise_addr": "{{ vpn_ip }}", @@ -11,7 +12,7 @@ "{{ hostvars[selected_host]['vpn_ip'] }}" {{ "," if not loop.last else "" }} {% endfor %} ], - "bootstrap_expect": 3, + "bootstrap_expect": {{ groups['cluster_nodes']|length }}, "server": true, "ui": true, "ports": { diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml index e8e059a..59f1d71 100644 --- a/ansible/roles/network/tasks/main.yml +++ b/ansible/roles/network/tasks/main.yml @@ -1,3 +1,6 @@ +- name: "Create iptables configuration direcetory" + file: path=/etc/iptables/ state=directory + - name: "Deploy iptablesv4 configuration" template: src=rules.v4.j2 dest=/etc/iptables/rules.v4 @@ -55,3 +58,6 @@ - name: "Enable Wireguard systemd service at boot" service: name=wg-quick@wgdeuxfleurs state=started enabled=yes daemon_reload=yes + +- name: "Create /tmp/wgdeuxfleurs.template.conf example configuration file for external nodes" + local_action: template src=wireguard_external.conf.j2 dest=/tmp/wgdeuxfleurs.template.conf diff --git a/ansible/roles/network/templates/rules.v4.j2 b/ansible/roles/network/templates/rules.v4.j2 index ef2cf64..69f7a09 100644 --- a/ansible/roles/network/templates/rules.v4.j2 +++ b/ansible/roles/network/templates/rules.v4.j2 @@ -13,8 +13,15 @@ -A INPUT -s {{ hostvars[selected_host]['public_ip'] }} -p udp --dport 51820 -j ACCEPT -A INPUT -s {{ hostvars[selected_host]['vpn_ip'] }} -j ACCEPT {% endfor %} +{% for host in other_vpn_nodes %} +-A INPUT -s {{ host.public_ip }} -p udp --dport 51820 -j ACCEPT +-A INPUT -s {{ host.vpn_ip }} -j ACCEPT +{% endfor %} + +# Rennes +-A INPUT -s 93.2.173.168 -j ACCEPT +-A INPUT -s 82.253.205.190 -j ACCEPT -# Local -A INPUT -i docker0 -j ACCEPT -A INPUT -s 127.0.0.1/8 -j ACCEPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT diff --git a/ansible/roles/network/templates/wireguard.conf.j2 b/ansible/roles/network/templates/wireguard.conf.j2 index 907d546..9f70eb9 100644 --- a/ansible/roles/network/templates/wireguard.conf.j2 +++ b/ansible/roles/network/templates/wireguard.conf.j2 @@ -10,3 +10,11 @@ Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].pu AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32 PersistentKeepalive = 25 {% endfor %} + +{% for host in other_vpn_nodes %} +[Peer] +PublicKey = {{ host.pubkey }} +Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }} +AllowedIPs = {{ host.vpn_ip }}/32 +PersistentKeepalive = 25 +{% endfor %} diff --git a/ansible/roles/network/templates/wireguard_external.conf.j2 b/ansible/roles/network/templates/wireguard_external.conf.j2 new file mode 100644 index 0000000..f130ffd --- /dev/null +++ b/ansible/roles/network/templates/wireguard_external.conf.j2 @@ -0,0 +1,26 @@ +# Template configuration file for VPN nodes that are non in the cluster +# External nodes should be registered in network/vars/main.yml + +[Interface] +Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml> +PrivateKey = <INSERT YOUR PRIVKEY HERE, IT SHOULD MATCH THE PUBKEY IN vars/main.yml> +ListenPort = 51820 + +# Cluster nodes +{% for selected_host in groups['cluster_nodes'] %} +[Peer] +PublicKey = {{ hostvars[selected_host].wireguard_pubkey.stdout }} +Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].public_vpn_port }} +AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32 +PersistentKeepalive = 25 +{% endfor %} + +# External nodes +# TODO: remove yourself from here +{% for host in other_vpn_nodes %} +[Peer] +PublicKey = {{ host.pubkey }} +Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }} +AllowedIPs = {{ host.vpn_ip }}/32 +PersistentKeepalive = 25 +{% endfor %} diff --git a/ansible/roles/network/vars/main.yml b/ansible/roles/network/vars/main.yml new file mode 100644 index 0000000..6bd100b --- /dev/null +++ b/ansible/roles/network/vars/main.yml @@ -0,0 +1,6 @@ +--- +other_vpn_nodes: + - pubkey: "QUiUNMk70TEQ75Ut7Uqikr5uGVSXmx8EGNkGM6tANlg=" + public_ip: "37.187.118.206" + public_vpn_port: "51820" + vpn_ip: "10.68.70.101" diff --git a/ansible/roles/nomad/templates/nomad.hcl.j2 b/ansible/roles/nomad/templates/nomad.hcl.j2 index 8d62d9b..b39a96b 100644 --- a/ansible/roles/nomad/templates/nomad.hcl.j2 +++ b/ansible/roles/nomad/templates/nomad.hcl.j2 @@ -1,3 +1,5 @@ +datacenter = "{{ datacenter }}" + addresses { http = "0.0.0.0" rpc = "0.0.0.0" @@ -14,7 +16,7 @@ data_dir = "/var/lib/nomad" server { enabled = true - bootstrap_expect = 3 + bootstrap_expect = {{ groups['cluster_nodes']|length }} } consul { diff --git a/nomad/bottin2.hcl b/nomad/bottin2.hcl index 85bda59..05b5cf9 100644 --- a/nomad/bottin2.hcl +++ b/nomad/bottin2.hcl @@ -1,5 +1,5 @@ job "directory2" { - datacenters = ["dc1"] + datacenters = ["dc1", "saturne", "belair"] type = "service" constraint { diff --git a/nomad/traefik.hcl b/nomad/traefik.hcl index a0803e4..9dcb5b5 100644 --- a/nomad/traefik.hcl +++ b/nomad/traefik.hcl @@ -1,5 +1,5 @@ job "frontend" { - datacenters = ["dc1"] + datacenters = ["dc1", "saturne"] type = "service" group "traefik" { |