Archive Legacy Setup And Add Ansible Control Plane

2026-07-08 12:47:37 +03:00
parent 841d56380b
commit 4bafa7d09e
203 changed files with 1663 additions and 11 deletions
@@ -0,0 +1,19 @@
+- name: Check WireGuard tunnel from ru-vps
+  hosts: ru-vps
+  gather_facts: false
+  tasks:
+    - name: Ping wg-mini WireGuard address
+      ansible.builtin.command: ping -c 3 -W 2 10.77.0.2
+      changed_when: false
+
+    - name: Check mini-pc PVE port through wg-mini gateway
+      ansible.builtin.command: nc -vz -w 5 192.168.1.10 8006
+      changed_when: false
+
+    - name: Check cloud-pc PVE port through wg-mini gateway
+      ansible.builtin.command: nc -vz -w 5 192.168.1.5 8006
+      changed_when: false
+
+    - name: Check PBS port through wg-mini gateway
+      ansible.builtin.command: nc -vz -w 5 192.168.1.20 8007
+      changed_when: false
@@ -0,0 +1,61 @@
+- name: Remove WireGuard from ru-vps and wg-mini
+  hosts: wireguard
+  gather_facts: false
+  become: true
+  vars:
+    wireguard_interface: wg0
+    wireguard_listen_port: 3422
+    wireguard_home_routes:
+      - 192.168.1.5/32
+      - 192.168.1.6/31
+      - 192.168.1.8/29
+      - 192.168.1.16/28
+      - 192.168.1.32/29
+      - 192.168.1.40/32
+  tasks:
+    - name: Stop WireGuard service
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ wireguard_interface }}"
+        state: stopped
+        enabled: false
+      failed_when: false
+
+    - name: Remove WireGuard route entries on server
+      ansible.builtin.command: "ip route del {{ item }} dev {{ wireguard_interface }}"
+      loop: "{{ wireguard_home_routes }}"
+      changed_when: false
+      failed_when: false
+      when: inventory_hostname == 'ru-vps'
+
+    - name: Remove WireGuard NAT rule on gateway
+      ansible.builtin.command: "iptables -t nat -D POSTROUTING -s 10.77.0.0/30 -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE"
+      changed_when: false
+      failed_when: false
+      when: inventory_hostname == 'wg-mini'
+
+    - name: Remove WireGuard config directory
+      ansible.builtin.file:
+        path: /etc/wireguard
+        state: absent
+
+    - name: Remove WireGuard package
+      ansible.builtin.apt:
+        name: wireguard-tools
+        state: absent
+        purge: true
+
+    - name: Remove diagnostic tcpdump from gateway
+      ansible.builtin.apt:
+        name: tcpdump
+        state: absent
+        purge: true
+      when: inventory_hostname == 'wg-mini'
+
+    - name: Delete UFW WireGuard UDP rules on server
+      ansible.builtin.command: "ufw delete allow {{ item }}/udp"
+      loop:
+        - 3422
+        - 51820
+      changed_when: false
+      failed_when: false
+      when: inventory_hostname == 'ru-vps'
@@ -0,0 +1,6 @@
+- name: Configure WireGuard on ru-vps and wg-mini
+  hosts: wireguard
+  gather_facts: true
+  become: true
+  roles:
+    - wireguard_gateway
@@ -0,0 +1,12 @@
+---
+wireguard_interface: wg0
+wireguard_listen_port: 3422
+wireguard_private_key_path: /etc/wireguard/privatekey
+wireguard_public_key_path: /etc/wireguard/publickey
+wireguard_home_routes:
+  - 192.168.1.5/32
+  - 192.168.1.6/31
+  - 192.168.1.8/29
+  - 192.168.1.16/28
+  - 192.168.1.32/29
+  - 192.168.1.40/32
@@ -0,0 +1,6 @@
+---
+- name: restart wireguard
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}"
+    state: restarted
+    enabled: true
@@ -0,0 +1,75 @@
+---
+- name: Install WireGuard packages
+  ansible.builtin.apt:
+    name:
+      - wireguard-tools
+      - iptables
+      - iproute2
+      - netcat-openbsd
+    state: present
+    update_cache: true
+
+- name: Ensure WireGuard config directory exists
+  ansible.builtin.file:
+    path: /etc/wireguard
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Generate private key if missing
+  ansible.builtin.shell: umask 077 && wg genkey > {{ wireguard_private_key_path }}
+  args:
+    creates: "{{ wireguard_private_key_path }}"
+
+- name: Generate public key
+  ansible.builtin.shell: wg pubkey < {{ wireguard_private_key_path }} > {{ wireguard_public_key_path }}
+  args:
+    creates: "{{ wireguard_public_key_path }}"
+
+- name: Read private key
+  ansible.builtin.slurp:
+    src: "{{ wireguard_private_key_path }}"
+  register: wireguard_private_key_raw
+  no_log: true
+
+- name: Read public key
+  ansible.builtin.slurp:
+    src: "{{ wireguard_public_key_path }}"
+  register: wireguard_public_key_raw
+
+- name: Store WireGuard keys as facts
+  ansible.builtin.set_fact:
+    wireguard_private_key: "{{ wireguard_private_key_raw.content | b64decode | trim }}"
+    wireguard_public_key: "{{ wireguard_public_key_raw.content | b64decode | trim }}"
+  no_log: true
+
+- name: Enable IPv4 forwarding on gateway
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    reload: true
+  when: wireguard_role == 'gateway'
+
+- name: Allow WireGuard UDP in UFW on server
+  ansible.builtin.command: "ufw allow {{ wireguard_listen_port }}/udp"
+  register: ufw_allow_wireguard
+  changed_when: "'Rule added' in ufw_allow_wireguard.stdout or 'Rules updated' in ufw_allow_wireguard.stdout"
+  failed_when: false
+  when: wireguard_role == 'server'
+
+- name: Render WireGuard config
+  ansible.builtin.template:
+    src: "wg0.conf.j2"
+    dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart wireguard
+
+- name: Enable and start WireGuard
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}"
+    state: started
+    enabled: true
@@ -0,0 +1,26 @@
+[Interface]
+Address = {{ wireguard_address }}
+PrivateKey = {{ wireguard_private_key }}
+{% if wireguard_role == 'server' %}
+ListenPort = {{ wireguard_listen_port }}
+{% for route in wireguard_home_routes %}
+PostUp = ip route replace {{ route }} dev {{ wireguard_interface }}
+PostDown = ip route del {{ route }} dev {{ wireguard_interface }} || true
+{% endfor %}
+{% endif %}
+{% if wireguard_role == 'gateway' %}
+PostUp = iptables -t nat -A POSTROUTING -s {{ wireguard_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE
+PostDown = iptables -t nat -D POSTROUTING -s {{ wireguard_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE || true
+{% endif %}
+
+[Peer]
+{% if wireguard_role == 'server' %}
+PublicKey = {{ hostvars['wg-mini'].wireguard_public_key }}
+AllowedIPs = {{ wireguard_peer_address }}/32, {{ wireguard_home_routes | join(', ') }}
+{% endif %}
+{% if wireguard_role == 'gateway' %}
+PublicKey = {{ hostvars['ru-vps'].wireguard_public_key }}
+Endpoint = 157.22.231.198:{{ wireguard_listen_port }}
+AllowedIPs = {{ wireguard_peer_address }}/32
+PersistentKeepalive = 25
+{% endif %}