update mesh

README.md

@@ -10,6 +10,7 @@ A project to store homelab stuff.
     - [Reverse Proxy](#reverse-proxy)
     - [Service Mesh](#service-mesh)
     - [Data Storage](#data-storage)
+  - [Order of Operations](#order-of-operations)
   - [Components](#components)
     - [CoreDNS](#coredns)
     - [Metal LB](#metal-lb)
@@ -75,6 +76,13 @@ to the wireguard-assigned IP addresses.
 
 All servers will use ISCSI.
 
+## Order of Operations
+
+1. Establish DNS records (`dns/`, `aws/`, `ddns/`)
+2. Create reverse proxy(s) (`nginx/`)
+3. Create service mesh (`mesh/`)
+4. Install services
+
 ## Components
 
 ### CoreDNS

ansible/inventory.yaml

@@ -13,11 +13,6 @@ colors:
     yellow:
 
 nextcloud-aio:
-  hosts:
-    nextcloud-aio:
-
-unifi-external:
-  hosts:
 unifi-external:
 
 hardware: 

nginx/https.conf

@@ -8,6 +8,11 @@ server {
     }
 {% endif %}
 
+{% if item.external.password_protect is defined and item.external.password_protect is sameas true %}
+    auth_basic           "Administrator’s Area";
+    auth_basic_user_file /etc/nginx/.htpasswd;
+{% endif %}
+
     http2 on;
 
     gzip on;

nginx/service/certbot-renew.service

@@ -3,4 +3,4 @@ Description=Certbot Renewal
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/certbot renew
+ExecStart=/usr/bin/certbot renew --dns-route53 -n

nginx/vars.yaml

@@ -9,7 +9,9 @@ defaults:
     internal_https_port: 443
 internal_ipv4_regex:
   - "10.1.*"
-  - "10.10.*"
+  - "192.168.4.*"
+  - "192.168.5.*"
+  - "192.168.6.*"
 internal_ipv6_regex:
   - "2600:1700:1e6c:a81f.*"
 expose_tld: .reeseapps.com

podman/README.md

@@ -6,6 +6,7 @@
     - [iperf3](#iperf3)
     - [pihole](#pihole)
     - [Cloudflared](#cloudflared)
+    - [WG Easy (Deprecated - use Unifi)](#wg-easy-deprecated---use-unifi)
   - [Update yellow/orange](#update-yelloworange)
 
 ## Notes
@@ -84,6 +85,42 @@ podman run \
     compose /compose/cloudflared-compose.yaml
 ```
 
+### WG Easy (Deprecated - use Unifi)
+
+<https://github.com/wg-easy/wg-easy>
+
+Note, to create PASSWORD_HASH run:
+
+```bash
+python -c 'import bcrypt; print(bcrypt.hashpw(b"testpass", bcrypt.gensalt()).decode())'
+```
+
+```bash
+podman run \
+    -v ./podman/quadlets:/quadlets \
+    quay.io/k9withabone/podlet \
+    -f /quadlets \
+    -i \
+    --overwrite \
+    --wants network-online.target \
+    --after network-online.target \
+    --name=wg-easy \
+    podman run \
+    -e LANG=en \
+    -e WG_HOST=wg.reeseapps.com \
+    -e PORT=51821 \
+    -e WG_PORT=51820 \
+    -v wg-easy:/etc/wireguard \
+    -p 51820:51820/udp \
+    -p 51822:51821/tcp \
+    --secret wg_easy_password,type=env,target=PASSWORD_HASH \
+    --cap-add=NET_ADMIN \
+    --cap-add=SYS_MODULE \
+    --cap-add=NET_RAW \
+    --restart unless-stopped \
+    ghcr.io/wg-easy/wg-easy:nightly
+```
+
 ## Update yellow/orange
 
 ```bash