mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
refactor(svc-net-wireguard): remove legacy core, plain, and firewalled roles
Superseded by the unified Docker-based svc-net-wireguard role.
This commit is contained in:
25 files changed
-387
No files matched your search
@@ -1,37 +0,0 @@
|
||||
# Administration
|
||||
|
||||
## Client
|
||||
|
||||
### Setup wireguard
|
||||
|
||||
```bash
|
||||
pacman -S wireguard-tools
|
||||
```
|
||||
|
||||
### Create Client Keys
|
||||
|
||||
```bash
|
||||
wg_private_key="$(wg genkey)"
|
||||
wg_public_key="$(echo "$wg_private_key" | wg pubkey)"
|
||||
echo "PrivateKey: $wg_private_key"
|
||||
echo "PublicKey: $wg_public_key"
|
||||
echo "PresharedKey: $(wg genpsk)"
|
||||
```
|
||||
|
||||
### Activate Configuration
|
||||
|
||||
```bash
|
||||
cp /path/to/wg0.conf /etc/wireguard/wg0.conf
|
||||
systemctl enable wg-quick@wg0.service --now
|
||||
```
|
||||
|
||||
### Check status
|
||||
|
||||
```bash
|
||||
systemctl status wg-quick@wg0.service
|
||||
```
|
||||
|
||||
## Further Resources
|
||||
|
||||
- [ArchWiki: WireGuard](https://wiki.archlinux.org/index.php/WireGuard)
|
||||
- [Subnetting Basics](https://www.scaleuptech.com/de/blog/was-ist-und-wie-funktioniert-subnetting/)
|
||||
@@ -1,36 +0,0 @@
|
||||
# Wireguard
|
||||
|
||||
## Description
|
||||
|
||||
This role manages [Wireguard](https://www.wireguard.com/) on the host. It installs the necessary Wireguard packages, configures sysctl settings for IPv4/IPv6 forwarding, and deploys the Wireguard configuration file to enable the VPN service using [wg-quick](https://www.wireguard.com/quickstart/).
|
||||
|
||||
## Overview
|
||||
|
||||
Optimized for both [Arch Linux](https://wiki.archlinux.org/index.php/WireGuard) and [Ubuntu/Debian](https://wireguard.com/install/), this role performs the following tasks:
|
||||
|
||||
- Installs Wireguard tools using the appropriate package manager.
|
||||
- Copies a sysctl configuration file to enable IP forwarding and proper IPv6 settings.
|
||||
- Deploys a host-specific Wireguard configuration file to `/etc/wireguard/wg0.infinito.conf`.
|
||||
- Uses systemd handlers to restart the Wireguard service and reload sysctl settings.
|
||||
|
||||
## Purpose
|
||||
|
||||
The primary purpose of this role is to set up and manage a Wireguard VPN configuration on the host. By automating package installation and configuration file deployment, it ensures that the VPN service is enabled with optimal network settings for secure connectivity.
|
||||
|
||||
## Features
|
||||
|
||||
- **Multi-Platform Support:** Installs Wireguard tools using [pacman](https://wiki.archlinux.org/title/Pacman) on Arch Linux and [apt](https://en.wikipedia.org/wiki/APT_(software)) on Ubuntu/Debian.
|
||||
- **Sysctl Configuration:** Deploys a sysctl configuration file to manage IPv4/IPv6 forwarding and related network parameters.
|
||||
- **Wireguard Configuration:** Copies a host-specific Wireguard configuration file to `/etc/wireguard/wg0.infinito.conf`.
|
||||
- **Service Management:** Provides handlers to restart the Wireguard service and reload sysctl settings.
|
||||
|
||||
## Administration
|
||||
|
||||
For detailed client setup instructions, please see the [Administration](./Administration.md) file.
|
||||
|
||||
## Credits
|
||||
|
||||
Developed and maintained by **Kevin Veen-Birkenbach**.
|
||||
Learn more at [veen.world](https://www.veen.world).
|
||||
Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code).
|
||||
Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license).
|
||||
@@ -1,8 +0,0 @@
|
||||
# This file is created by
|
||||
# https://s.infinito.nexus/code/tree/main/roles/wireguard
|
||||
|
||||
net.ipv6.conf.all.disable_ipv6 = 0
|
||||
net.ipv6.conf.default.disable_ipv6 = 0
|
||||
net.ipv6.conf.lo.disable_ipv6 = 0
|
||||
net.ipv6.conf.all.forwarding = 1
|
||||
net.ipv4.ip_forward = 1
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
- name: "restart wireguard"
|
||||
systemd:
|
||||
name: wg-quick@wg0.service
|
||||
state: restarted
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
|
||||
- name: "reload sysctl configuration"
|
||||
shell: "sysctl --load='/etc/sysctl.d/wireguard-ip.conf'"
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
galaxy_info:
|
||||
author: Kevin Veen-Birkenbach
|
||||
description: Manages Wireguard VPN configuration on the host. Installs necessary tools, deploys sysctl settings for IP forwarding, and copies the Wireguard
|
||||
configuration file to enable secure VPN connectivity.
|
||||
license: Infinito.Nexus Community License (Non-Commercial)
|
||||
company: |
|
||||
Kevin Veen-Birkenbach
|
||||
https://www.veen.world
|
||||
min_ansible_version: "2.9"
|
||||
platforms:
|
||||
- name: ArchLinux
|
||||
versions:
|
||||
- all
|
||||
- name: Debian
|
||||
versions:
|
||||
- all
|
||||
- name: EL
|
||||
versions:
|
||||
- all
|
||||
- name: Fedora
|
||||
versions:
|
||||
- all
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- all
|
||||
galaxy_tags:
|
||||
- wireguard
|
||||
- vpn
|
||||
- networking
|
||||
- systemd
|
||||
- configuration
|
||||
issue_tracker_url: https://s.infinito.nexus/issues
|
||||
dependencies: []
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
wireguard-core:
|
||||
min_storage: 0GB
|
||||
lifecycle: alpha
|
||||
cpus: "0.1"
|
||||
mem_reservation: "32m"
|
||||
mem_limit: "64m"
|
||||
pids_limit: 64
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
- name: install wireguard for Arch
|
||||
package:
|
||||
name: wireguard-tools
|
||||
state: present
|
||||
when: ansible_facts['os_family'] == "Archlinux"
|
||||
|
||||
- name: install wireguard for Ubuntu
|
||||
apt:
|
||||
name: wireguard
|
||||
state: present
|
||||
when: ansible_facts['os_family'] == "Debian"
|
||||
|
||||
- name: create wireguard-ip.conf
|
||||
copy:
|
||||
src: "wireguard-ip.conf"
|
||||
dest: /etc/sysctl.d/wireguard-ip.conf
|
||||
owner: root
|
||||
group: root
|
||||
notify: reload sysctl configuration
|
||||
|
||||
- name: "deploy {{ WG0_CONF_DEST }}"
|
||||
copy:
|
||||
src: "{{ [inventory_dir, 'files', inventory_hostname, 'etc/wireguard/wg0.conf' ] | path_join }}"
|
||||
dest: "{{ WG0_CONF_DEST }}"
|
||||
owner: root
|
||||
group: root
|
||||
notify: restart wireguard
|
||||
|
||||
- include_tasks: utils/once/flag.yml
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
- include_tasks: 01_core.yml
|
||||
when:
|
||||
- run_once_svc_net_wireguard_core is not defined
|
||||
- not (DOCKER_IN_CONTAINER | bool)
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
application_id: svc-net-wireguard-core
|
||||
|
||||
WG0_CONF_DEST: "/etc/wireguard/wg0.conf"
|
||||
@@ -1,34 +0,0 @@
|
||||
# WireGuard Client behind NAT
|
||||
|
||||
## Description
|
||||
|
||||
This role adapts iptables rules to enable proper connectivity for a WireGuard client running behind a NAT or firewall. It ensures that traffic is forwarded correctly by applying necessary masquerading rules.
|
||||
|
||||
## Overview
|
||||
|
||||
Optimized for environments with network address translation (NAT), this role:
|
||||
|
||||
- Executes shell commands to modify iptables rules.
|
||||
- Allows traffic from the WireGuard client interface (e.g. `wg0-client`) and sets up NAT masquerading on the external interface (e.g. `eth0`).
|
||||
- Works as an extension to the native WireGuard client role.
|
||||
|
||||
## Purpose
|
||||
|
||||
The primary purpose of this role is to enable proper routing and connectivity for a WireGuard client situated behind a firewall or NAT device. By adapting iptables rules, it ensures that the client can communicate effectively with external networks.
|
||||
|
||||
## Features
|
||||
|
||||
- **iptables Rule Adaptation:** Modifies iptables to allow forwarding and NAT masquerading for the WireGuard client.
|
||||
- **NAT Support:** Configures the external interface for proper masquerading.
|
||||
- **Role Integration:** Depends on the [svc-net-wireguard-plain](../svc-net-wireguard-plain/README.md) role to ensure that WireGuard is properly configured before applying firewall rules.
|
||||
|
||||
## Further Resources
|
||||
|
||||
- [Debian Wiki: iptables](https://wiki.debian.org/iptables)
|
||||
|
||||
## Credits
|
||||
|
||||
Developed and maintained by **Kevin Veen-Birkenbach**.
|
||||
Learn more at [veen.world](https://www.veen.world).
|
||||
Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code).
|
||||
Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license).
|
||||
@@ -1,35 +0,0 @@
|
||||
---
|
||||
galaxy_info:
|
||||
author: Kevin Veen-Birkenbach
|
||||
description: Adapts iptables rules to enable proper connectivity for a WireGuard client running behind a NAT or firewall, ensuring that traffic is correctly
|
||||
forwarded and masqueraded.
|
||||
license: Infinito.Nexus Community License (Non-Commercial)
|
||||
company: |
|
||||
Kevin Veen-Birkenbach
|
||||
https://www.veen.world
|
||||
min_ansible_version: "2.9"
|
||||
platforms:
|
||||
- name: ArchLinux
|
||||
versions:
|
||||
- all
|
||||
- name: Debian
|
||||
versions:
|
||||
- all
|
||||
- name: EL
|
||||
versions:
|
||||
- all
|
||||
- name: Fedora
|
||||
versions:
|
||||
- all
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- all
|
||||
galaxy_tags:
|
||||
- wireguard
|
||||
- nat
|
||||
- firewall
|
||||
- iptables
|
||||
- networking
|
||||
issue_tracker_url: https://s.infinito.nexus/issues
|
||||
dependencies:
|
||||
- svc-net-wireguard-plain
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
wireguard-firewalled:
|
||||
lifecycle: alpha
|
||||
min_storage: "50MB"
|
||||
cpus: "0.1"
|
||||
mem_reservation: "32m"
|
||||
mem_limit: "64m"
|
||||
pids_limit: 64
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
- name: adapt iptable rules
|
||||
shell: iptables -A FORWARD -i wg0-client -j ACCEPT && iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||
|
||||
- include_tasks: utils/once/flag.yml
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
- include_tasks: 01_core.yml
|
||||
when:
|
||||
- run_once_svc_net_wireguard_firewalled is not defined
|
||||
- not (DOCKER_IN_CONTAINER | bool)
|
||||
@@ -1,2 +0,0 @@
|
||||
---
|
||||
application_id: svc-net-wireguard-firewalled
|
||||
@@ -1,11 +0,0 @@
|
||||
# Administration
|
||||
|
||||
## Create Client Keys
|
||||
|
||||
```bash
|
||||
wg_private_key="$(wg genkey)"
|
||||
wg_public_key="$(echo "$wg_private_key" | wg pubkey)"
|
||||
echo "PrivateKey: $wg_private_key"
|
||||
echo "PublicKey: $wg_public_key"
|
||||
echo "PresharedKey: $(wg genpsk)"
|
||||
```
|
||||
@@ -1,43 +0,0 @@
|
||||
# Wireguard Client
|
||||
|
||||
## Description
|
||||
|
||||
This role manages WireGuard on a client system. It sets up essential services and scripts to configure and optimize WireGuard connectivity.
|
||||
|
||||
## Overview
|
||||
|
||||
Optimized for client configurations, this role:
|
||||
|
||||
- Deploys a systemd service and its associated script to set the MTU on specified network interfaces.
|
||||
- Uses a Jinja2 template to generate the `set-mtu.sh` script.
|
||||
- Ensures that the MTU is configured correctly before starting WireGuard with [wg-quick](https://www.wireguard.com/quickstart/).
|
||||
|
||||
## Purpose
|
||||
|
||||
The primary purpose of this role is to configure WireGuard on a client by setting appropriate MTU values on network interfaces. This ensures a stable and optimized VPN connection.
|
||||
|
||||
## Features
|
||||
|
||||
- **MTU Configuration:** Deploys a template-based script to set the MTU on all defined internet interfaces.
|
||||
- **Systemd Service Integration:** Creates and manages a systemd service to execute the MTU configuration script.
|
||||
- **Administration Support:** For client key creation and further setup, please refer to the [Administration](./Administration.md) file.
|
||||
- **Modular Design:** Easily integrates with other WireGuard roles or network configuration roles.
|
||||
|
||||
## Further Resources
|
||||
|
||||
- [WireGuard Documentation](https://www.wireguard.com/)
|
||||
- [ArchWiki: WireGuard](https://wiki.archlinux.org/index.php/WireGuard)
|
||||
- [Subnetting Basics](https://www.scaleuptech.com/de/blog/was-ist-und-wie-funktioniert-subnetting/)
|
||||
- [WireGuard Permissions Issue Discussion](https://bodhilinux.boards.net/thread/450/wireguard-rtnetlink-answers-permission-denied)
|
||||
- [UFW and SSH via WireGuard](https://unix.stackexchange.com/questions/717172/why-is-ufw-blocking-acces-to-ssh-via-wireguard)
|
||||
- [OpenWrt Forum Discussion on WireGuard](https://forum.openwrt.org/t/cannot-ssh-to-clients-on-lan-when-accessing-router-via-wireguard-client/132709/3)
|
||||
- [WireGuard Connection Dies on Ubuntu](https://serverfault.com/questions/1086297/wireguard-connection-dies-on-ubuntu-peer)
|
||||
- [SSH Fails with WireGuard IP](https://unix.stackexchange.com/questions/624987/ssh-fails-to-start-when-listenaddress-is-set-to-wireguard-vpn-ip)
|
||||
- [WireGuard NAT and Firewall Issues](https://serverfault.com/questions/210408/cannot-ssh-debug1-expecting-ssh2-msg-kex-dh-gex-reply)
|
||||
|
||||
## Credits
|
||||
|
||||
Developed and maintained by **Kevin Veen-Birkenbach**.
|
||||
Learn more at [veen.world](https://www.veen.world).
|
||||
Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code).
|
||||
Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license).
|
||||
@@ -1,2 +0,0 @@
|
||||
---
|
||||
internet_interfaces: []
|
||||
@@ -1,35 +0,0 @@
|
||||
---
|
||||
galaxy_info:
|
||||
author: Kevin Veen-Birkenbach
|
||||
description: Manages WireGuard on a client system by deploying services and scripts to set MTU on network interfaces and ensure optimal VPN connectivity.
|
||||
license: Infinito.Nexus Community License (Non-Commercial)
|
||||
company: |
|
||||
Kevin Veen-Birkenbach
|
||||
https://www.veen.world
|
||||
min_ansible_version: "2.9"
|
||||
platforms:
|
||||
- name: ArchLinux
|
||||
versions:
|
||||
- all
|
||||
- name: Debian
|
||||
versions:
|
||||
- all
|
||||
- name: EL
|
||||
versions:
|
||||
- all
|
||||
- name: Fedora
|
||||
versions:
|
||||
- all
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- all
|
||||
galaxy_tags:
|
||||
- wireguard
|
||||
- vpn
|
||||
- client
|
||||
- mtu
|
||||
- systemd
|
||||
- configuration
|
||||
issue_tracker_url: https://s.infinito.nexus/issues
|
||||
dependencies:
|
||||
- svc-net-wireguard-core
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
wireguard-plain:
|
||||
lifecycle: alpha
|
||||
min_storage: "50MB"
|
||||
cpus: "0.1"
|
||||
mem_reservation: "32m"
|
||||
mem_limit: "64m"
|
||||
pids_limit: 64
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
- include_role:
|
||||
name: sys-service
|
||||
|
||||
- include_tasks: utils/once/flag.yml
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
- include_tasks: 01_core.yml
|
||||
when:
|
||||
- run_once_svc_net_wireguard_plain is not defined
|
||||
- not (DOCKER_IN_CONTAINER | bool)
|
||||
@@ -1,4 +0,0 @@
|
||||
#!/bin/bash
|
||||
{% for internet_interface in internet_interfaces %}
|
||||
ip li set mtu 1400 dev {{internet_interface}}
|
||||
{% endfor %}
|
||||
@@ -1,10 +0,0 @@
|
||||
[Unit]
|
||||
Description=set MTU
|
||||
Before=wg-quick@wg0.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart={{ system_service_script_exec }}
|
||||
|
||||
[Install]
|
||||
RequiredBy=wg-quick@wg0.service
|
||||
@@ -1,3 +0,0 @@
|
||||
---
|
||||
application_id: svc-net-wireguard-plain
|
||||
system_service_id: "{{ application_id }}"
|
||||
Reference in new issue
Block a user