aboutsummaryrefslogtreecommitdiff
path: root/ansible
diff options
context:
space:
mode:
Diffstat (limited to 'ansible')
-rw-r--r--ansible/lxvm7
-rw-r--r--ansible/roles/consul/templates/consul.json.j23
-rw-r--r--ansible/roles/network/tasks/main.yml6
-rw-r--r--ansible/roles/network/templates/rules.v4.j29
-rw-r--r--ansible/roles/network/templates/wireguard.conf.j28
-rw-r--r--ansible/roles/network/templates/wireguard_external.conf.j226
-rw-r--r--ansible/roles/network/vars/main.yml6
-rw-r--r--ansible/roles/nomad/templates/nomad.hcl.j24
8 files changed, 63 insertions, 6 deletions
diff --git a/ansible/lxvm b/ansible/lxvm
index f5e517c..89fafaf 100644
--- a/ansible/lxvm
+++ b/ansible/lxvm
@@ -1,5 +1,6 @@
[cluster_nodes]
#ubuntu1 ansible_host=192.168.42.10
-debian1 ansible_host=192.168.42.20 ansible_user=root public_ip=192.168.42.20 dns_server=208.67.222.222 vpn_ip=10.68.70.11 public_vpn_port=51820
-debian2 ansible_host=192.168.42.21 ansible_user=root public_ip=192.168.42.21 dns_server=208.67.222.222 vpn_ip=10.68.70.12 public_vpn_port=51820
-debian3 ansible_host=192.168.42.22 ansible_user=root public_ip=192.168.42.22 dns_server=208.67.222.222 vpn_ip=10.68.70.13 public_vpn_port=51820
+debian1 ansible_host=192.168.42.20 ansible_user=root public_ip=192.168.42.20 dns_server=208.67.222.222 vpn_ip=10.68.70.11 public_vpn_port=51820 datacenter=belair
+debian2 ansible_host=192.168.42.21 ansible_user=root public_ip=192.168.42.21 dns_server=208.67.222.222 vpn_ip=10.68.70.12 public_vpn_port=51820 datacenter=belair
+debian3 ansible_host=192.168.42.22 ansible_user=root public_ip=192.168.42.22 dns_server=208.67.222.222 vpn_ip=10.68.70.13 public_vpn_port=51820 datacenter=belair
+ovh1 ansible_host=51.75.4.20 ansible_user=debian ansible_become=yes public_ip=51.75.4.20 dns_server=208.67.222.222 vpn_ip=10.68.70.20 public_vpn_port=51820 datacenter=saturne
diff --git a/ansible/roles/consul/templates/consul.json.j2 b/ansible/roles/consul/templates/consul.json.j2
index 4a36dc2..a98175c 100644
--- a/ansible/roles/consul/templates/consul.json.j2
+++ b/ansible/roles/consul/templates/consul.json.j2
@@ -1,4 +1,5 @@
{
+ "datacenter": "deuxfleurs",
"data_dir": "/var/lib/consul",
"bind_addr": "0.0.0.0",
"advertise_addr": "{{ vpn_ip }}",
@@ -11,7 +12,7 @@
"{{ hostvars[selected_host]['vpn_ip'] }}" {{ "," if not loop.last else "" }}
{% endfor %}
],
- "bootstrap_expect": 3,
+ "bootstrap_expect": {{ groups['cluster_nodes']|length }},
"server": true,
"ui": true,
"ports": {
diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml
index e8e059a..59f1d71 100644
--- a/ansible/roles/network/tasks/main.yml
+++ b/ansible/roles/network/tasks/main.yml
@@ -1,3 +1,6 @@
+- name: "Create iptables configuration direcetory"
+ file: path=/etc/iptables/ state=directory
+
- name: "Deploy iptablesv4 configuration"
template: src=rules.v4.j2 dest=/etc/iptables/rules.v4
@@ -55,3 +58,6 @@
- name: "Enable Wireguard systemd service at boot"
service: name=wg-quick@wgdeuxfleurs state=started enabled=yes daemon_reload=yes
+
+- name: "Create /tmp/wgdeuxfleurs.template.conf example configuration file for external nodes"
+ local_action: template src=wireguard_external.conf.j2 dest=/tmp/wgdeuxfleurs.template.conf
diff --git a/ansible/roles/network/templates/rules.v4.j2 b/ansible/roles/network/templates/rules.v4.j2
index ef2cf64..69f7a09 100644
--- a/ansible/roles/network/templates/rules.v4.j2
+++ b/ansible/roles/network/templates/rules.v4.j2
@@ -13,8 +13,15 @@
-A INPUT -s {{ hostvars[selected_host]['public_ip'] }} -p udp --dport 51820 -j ACCEPT
-A INPUT -s {{ hostvars[selected_host]['vpn_ip'] }} -j ACCEPT
{% endfor %}
+{% for host in other_vpn_nodes %}
+-A INPUT -s {{ host.public_ip }} -p udp --dport 51820 -j ACCEPT
+-A INPUT -s {{ host.vpn_ip }} -j ACCEPT
+{% endfor %}
+
+# Rennes
+-A INPUT -s 93.2.173.168 -j ACCEPT
+-A INPUT -s 82.253.205.190 -j ACCEPT
-# Local
-A INPUT -i docker0 -j ACCEPT
-A INPUT -s 127.0.0.1/8 -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
diff --git a/ansible/roles/network/templates/wireguard.conf.j2 b/ansible/roles/network/templates/wireguard.conf.j2
index 907d546..9f70eb9 100644
--- a/ansible/roles/network/templates/wireguard.conf.j2
+++ b/ansible/roles/network/templates/wireguard.conf.j2
@@ -10,3 +10,11 @@ Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].pu
AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32
PersistentKeepalive = 25
{% endfor %}
+
+{% for host in other_vpn_nodes %}
+[Peer]
+PublicKey = {{ host.pubkey }}
+Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }}
+AllowedIPs = {{ host.vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}
diff --git a/ansible/roles/network/templates/wireguard_external.conf.j2 b/ansible/roles/network/templates/wireguard_external.conf.j2
new file mode 100644
index 0000000..f130ffd
--- /dev/null
+++ b/ansible/roles/network/templates/wireguard_external.conf.j2
@@ -0,0 +1,26 @@
+# Template configuration file for VPN nodes that are non in the cluster
+# External nodes should be registered in network/vars/main.yml
+
+[Interface]
+Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml>
+PrivateKey = <INSERT YOUR PRIVKEY HERE, IT SHOULD MATCH THE PUBKEY IN vars/main.yml>
+ListenPort = 51820
+
+# Cluster nodes
+{% for selected_host in groups['cluster_nodes'] %}
+[Peer]
+PublicKey = {{ hostvars[selected_host].wireguard_pubkey.stdout }}
+Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].public_vpn_port }}
+AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}
+
+# External nodes
+# TODO: remove yourself from here
+{% for host in other_vpn_nodes %}
+[Peer]
+PublicKey = {{ host.pubkey }}
+Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }}
+AllowedIPs = {{ host.vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}
diff --git a/ansible/roles/network/vars/main.yml b/ansible/roles/network/vars/main.yml
new file mode 100644
index 0000000..6bd100b
--- /dev/null
+++ b/ansible/roles/network/vars/main.yml
@@ -0,0 +1,6 @@
+---
+other_vpn_nodes:
+ - pubkey: "QUiUNMk70TEQ75Ut7Uqikr5uGVSXmx8EGNkGM6tANlg="
+ public_ip: "37.187.118.206"
+ public_vpn_port: "51820"
+ vpn_ip: "10.68.70.101"
diff --git a/ansible/roles/nomad/templates/nomad.hcl.j2 b/ansible/roles/nomad/templates/nomad.hcl.j2
index 8d62d9b..b39a96b 100644
--- a/ansible/roles/nomad/templates/nomad.hcl.j2
+++ b/ansible/roles/nomad/templates/nomad.hcl.j2
@@ -1,3 +1,5 @@
+datacenter = "{{ datacenter }}"
+
addresses {
http = "0.0.0.0"
rpc = "0.0.0.0"
@@ -14,7 +16,7 @@ data_dir = "/var/lib/nomad"
server {
enabled = true
- bootstrap_expect = 3
+ bootstrap_expect = {{ groups['cluster_nodes']|length }}
}
consul {