update mesh

2024-06-24 17:04:36 -04:00
parent b7f93fe41d
commit 4e51d263fb
11 changed files with 54 additions and 7 deletions
--- a/mesh/README.md
+++ b/mesh/README.md
@@ -0,0 +1,124 @@
+# Wireguard
+
+## Install Wireguard
+
+<https://www.wireguard.com/install/>
+
+## Ansible
+
+```bash
+ansible-playbook -i ansible/inventory.yaml wireguard/keys.yaml
+ansible-playbook -i ansible/inventory.yaml wireguard/wireguard.yaml
+ansible-playbook -i ansible/inventory.yaml wireguard/peers.yaml
+```
+
+## DNS Records
+
+Collect DNS records from vars.yaml
+
+```bash
+cat wireguard/vars.yaml | \
+    yq -r '.ip | map([.hostname + "-wg.reeselink.com", .address]).[].[]' > dns/duconet-wg.txt
+```
+
+## CLI Setup
+
+```bash
+# Peer 1
+wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
+
+ip link add dev duconet-wg type wireguard
+
+ip address add dev duconet-wg fd00:fd41:d0f1:1010::0/64
+
+wg set duconet-wg \
+    listen-port 51821 \
+    private-key /etc/wireguard/privatekey
+
+wg set duconet-wg \
+    peer CQxNsdPgfzjvOszjn/UZHFdAY3k+D9J+vI8qKUjCYV0= \
+    allowed-ips '10.10.10.0/24' \
+    endpoint 10.1.200.253:51821
+
+ip link set up dev duconet-wg
+touch /etc/wireguard/duconet-wg.conf
+wg-quick save duconet-wg
+
+# Peer 2
+wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
+
+ip link add dev duconet-wg type wireguard
+
+ip address add dev duconet-wg 10.10.10.2/24
+
+wg set duconet-wg \
+    listen-port 51821 \
+    private-key /etc/wireguard/privatekey \
+    peer kzbHUGzYk6Uyan/NFYY5mh3pxf2IX/WzWZtImeyp6Sw= \
+    allowed-ips '10.10.10.0/24' \
+    endpoint 10.1.203.197:51821
+
+ip link set up dev duconet-wg
+touch /etc/wireguard/duconet-wg.conf
+wg-quick save duconet-wg
+
+# Peer 3
+wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
+
+ip link add dev duconet-wg type wireguard
+
+ip address add dev duconet-wg 10.10.10.3/24
+
+wg set duconet-wg \
+    listen-port 51821 \
+    private-key /etc/wireguard/privatekey \
+    peer kzbHUGzYk6Uyan/NFYY5mh3pxf2IX/WzWZtImeyp6Sw= \
+    allowed-ips '10.10.10.0/24' \
+    endpoint 10.1.203.197:51821
+
+wg set duconet-wg \
+    peer 9/dBUlO9TGf0H9M3xwPiuIuz6Q/u7fSJVZaUxqAiqi8= \
+    allowed-ips '10.10.10.0/24' \
+    endpoint 10.1.2.10:51821
+
+ip link set up dev duconet-wg
+touch /etc/wireguard/duconet-wg.conf
+wg-quick save duconet-wg
+```
+
+## Teardown
+
+```bash
+# teardown
+ip link delete duconet-wg
+systemctl disable wg-quick@duconet-wg
+```
+
+## Truenas
+
+Because truenas's /etc/wireguard is ephemeral we need to create scripts to save and load
+our wireguard config at shutdown/boot.
+
+Select these scripts in system settings -> advanced -> init/shutdown scripts
+
+Startup Script:
+
+/mnt/enc1/truenas/wireguard/duconet-save.sh
+
+```bash
+#!/bin/bash
+
+cp -a /mnt/enc1/truenas/wireguard/* /etc/wireguard/
+wg-quick up duconet-wg
+```
+
+Shutdown Script:
+
+/mnt/enc1/truenas/wireguard/duconet-load.sh
+
+```bash
+#!/bin/bash
+
+wg-quick save duconet-wg
+cp -a /etc/wireguard/* /mnt/enc1/truenas/wireguard/
+```
--- a/mesh/interface.yaml
+++ b/mesh/interface.yaml
@@ -0,0 +1,40 @@
+- name: Configure Wireguard Network Link
+  hosts: 
+    - colors
+    - kubernetes
+    - truenas
+    - nextcloud-aio
+    - unifi-external
+  become: true
+  become_user: root
+  become_method: sudo
+  vars_files:
+    - vars.yaml
+  tasks:
+  - name: Check if duconet-wg exists
+    shell: ip link show duconet-wg
+    register: link_check
+    ignore_errors: yes
+  - name: Add duconet-wg link
+    shell: ip link add dev duconet-wg type wireguard
+    when: link_check.rc != 0
+  - name: Add duconet-wg addresses
+    shell: "ip address add dev duconet-wg {{ ip[inventory_hostname].address }}/64"
+    when: link_check.rc != 0
+  - name: wg set port/key
+    shell: >
+      wg set duconet-wg
+      listen-port {{ wireguard.listen_port }}
+      private-key /etc/wireguard/privatekey
+  - name: Set link up
+    shell: ip link set up dev duconet-wg
+  - name: Touch duconet-wg.conf
+    ansible.builtin.file:
+      path: /etc/wireguard/duconet-wg.conf
+      state: touch
+  - name: save wg config
+    shell: wg-quick save duconet-wg
+  - name: Enable wg-quick@duconet-wg
+    ansible.builtin.systemd_service:
+      name: wg-quick@duconet-wg
+      enabled: true
--- a/mesh/keys.yaml
+++ b/mesh/keys.yaml
@@ -0,0 +1,28 @@
+- name: Update nginx stream configuration
+  hosts:
+    - colors
+    - kubernetes
+    - truenas
+    - nextcloud-aio
+    - unifi-external
+  become: true
+  become_user: root
+  become_method: sudo
+  tasks:
+  - name: Ensure wireguard directory exists
+    ansible.builtin.file:
+      path: /etc/wireguard
+      state: directory
+      mode: '0700'
+  - name: Check if privatekey exists
+    stat: path=/etc/wireguard/privatekey
+    register: key
+  - name: Generate pubkey and privatekey
+    shell: wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
+    when: not key.stat.exists or key.stat.size == 0
+  - name: cat pubkey
+    command: cat /etc/wireguard/publickey
+    register: pubkey
+  - name: Print publickey to console
+    debug:
+      msg: "{{pubkey.stdout}}"
--- a/mesh/peers.yaml
+++ b/mesh/peers.yaml
@@ -0,0 +1,24 @@
+- name: Add wireguard peers to each server
+  hosts: 
+    - colors
+    - kubernetes
+    - truenas
+    - nextcloud-aio
+    - unifi-external
+  become: true
+  become_user: root
+  become_method: sudo
+  vars_files:
+    - vars.yaml
+  tasks:
+  - name: wg set peers
+    shell: >
+      wg set duconet-wg
+      peer {{ item.public_key }}
+      allowed-ips '{{ ip[item.name].address }}'
+      {% if item.endpoint %}
+      endpoint '{{ item.endpoint }}'
+      {% endif %}
+    loop: "{{ peers }}"
+  - name: save wg config
+    shell: wg-quick save duconet-wg
--- a/mesh/vars.yaml
+++ b/mesh/vars.yaml
@@ -0,0 +1,54 @@
+wireguard:
+  listen_port: 51821
+  allowed_ips: fd00:fd41:d0f1:1010::0/64
+  interface: duconet-wg
+peers:
+  - name: yellow
+    public_key: kzbHUGzYk6Uyan/NFYY5mh3pxf2IX/WzWZtImeyp6Sw=
+    endpoint: yellow.reeselink.com:51821
+  - name: orange
+    public_key: CQxNsdPgfzjvOszjn/UZHFdAY3k+D9J+vI8qKUjCYV0=
+    endpoint: orange.reeselink.com:51821
+  - name: node1
+    public_key: 1K3CszRSSnUSWpgL7q57+LTgOEbIt8TonSK1gV/JnXE=
+    endpoint: node1.reeselink.com:51821
+  - name: node2
+    public_key: /7IGSgTEPh+lGYtkMUME2+0XlZEz1ILLd8J0oIxgnjA=
+    endpoint: node2.reeselink.com:51821
+  - name: node3
+    public_key: BwLY8W9nUCpF2xpLlvbkPkwQDV1Kqe+afCINXjEhQnY=
+    endpoint: node3.reeselink.com:51821
+  - name: driveripper
+    public_key: o7alrWFIMHZyeMNJDotj7Aa8ggAZ3xxcMehVnjCJjmA=
+    endpoint: driveripper.reeselink.com:51821
+  - name: unifi-external
+    public_key: UdbGYnVoxv9J7iv98EJ5hRfjlvPvHENsUqNJQADRHQI=
+    endpoint: unifi-external.reeselink.com:51821
+  - name: nextcloud-aio
+    public_key: G4L1WGm9nIwaw2p6oZqT4W7+ekoziCePrjI8AFwXHTw=
+    endpoint: nextcloud-aio.reeselink.com:51821
+ip:
+  yellow: 
+    address: fd00:fd41:d0f1:1010::1
+    hostname: yellow
+  orange:
+    address: fd00:fd41:d0f1:1010::2
+    hostname: orange
+  node1:
+    address: fd00:fd41:d0f1:1010::3
+    hostname: node1
+  node2:
+    address: fd00:fd41:d0f1:1010::4
+    hostname: node2
+  node3:
+    address: fd00:fd41:d0f1:1010::5
+    hostname: node3
+  driveripper:
+    address: fd00:fd41:d0f1:1010::6
+    hostname: driveripper
+  unifi-external:
+    address: fd00:fd41:d0f1:1010::7
+    hostname: unifi-external
+  nextcloud-aio:
+    address: fd00:fd41:d0f1:1010::8
+    hostname: nextcloud-aio