Changed Wireguard role documentation format to AsciiDoc
This commit is contained in:
parent
ca482ccef8
commit
4f7f7d2945
GPG Key ID:
BC9570E849334AF9
133
roles/wireguard/README.adoc
Normal file
133
roles/wireguard/README.adoc
Normal file
@ -0,0 +1,133 @@
|
||||
= Wireguard setup
|
||||
|
||||
Wireguard setup role. This role extends https://github.com/lablabs/ansible-collection-wireguard/tree/main/roles/wireguard[this codebase] to my needs. It's a bit simpler and adds more idempotence, e.g. when replaying the role to add another client to the server.
|
||||
|
||||
== Requirements
|
||||
|
||||
This role was written for Debian (tested on >=11) and requires root privileges. It also requires to have several collections installed on your ansible host you won't necessarily have depending on your Ansible installation:
|
||||
|
||||
- ansible.posix
|
||||
- community.general (iptables_save module)
|
||||
- ansible.utils (network filters)
|
||||
- netaddr (python package)
|
||||
|
||||
== Role Variables
|
||||
|
||||
Variables can be found in the link:./defaults/main.yml[default vars file].
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_dir: /etc/wireguard
|
||||
wireguard_clients_dir: "{{ wireguard_dir }}/clients"
|
||||
wireguard_clients_download_dir: clients/
|
||||
wireguard_download_clients: false
|
||||
wireguard_serverkeys_download_dir: server/
|
||||
wireguard_download_serverkeys: false
|
||||
----
|
||||
|
||||
Defines basic arborescence to store Wireguard files. `wireguard_download_clients` and `wireguard_download_serverkeys` can optionally set to true in order to download respectively clients and server's keys from the target host.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_restore_serverkeys_dir: ""
|
||||
----
|
||||
|
||||
Use this variable if you want to use pre-existing keys from a directory to bootstrap Wireguard. Must ends with '/'.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_packages:
|
||||
- wireguard
|
||||
----
|
||||
|
||||
List of packages to install.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_port: 51810
|
||||
----
|
||||
|
||||
Port which Wireguard will listen to.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_hostname: "{{ inventory_hostname }}"
|
||||
----
|
||||
|
||||
Hostname the client will use to connect to the server.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_interface: wg0
|
||||
----
|
||||
|
||||
Interface which will be mounted to the server.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
nat_out_interface: eth0
|
||||
----
|
||||
|
||||
Interface where the traffic will be NATed to on the server.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_address: 10.213.213.0/24
|
||||
----
|
||||
|
||||
Subnet definition for the VPN network.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_keepalive: 25
|
||||
----
|
||||
|
||||
Uses this if you wanna specify a keepalive value. See https://github.com/pirate/wireguard-docs#persistentkeepalive[this] for more information on keepalive.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
wireguard_peers: []
|
||||
----
|
||||
|
||||
Lits of peers (clients) you wanna create. You can define specific name, address, allowedIPs, DNS and keepalive for each peer. See playbook below for example.
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
filter_forward: false
|
||||
other_interface:
|
||||
----
|
||||
|
||||
Set `filter_forward` to true and specify an interface name for `other_interface` if you wanna drop packets from `wireguard_interface` to this interface.
|
||||
|
||||
== Dependencies
|
||||
|
||||
None.
|
||||
|
||||
== Example Playbook
|
||||
|
||||
[source,yaml]
|
||||
----
|
||||
- name: Deploy Wireguard
|
||||
hosts: wireguard_hosts
|
||||
become: true
|
||||
vars:
|
||||
wireguard_hostname: "mywireguard.server.com"
|
||||
wireguard_address: 10.10.10.0/24
|
||||
wireguard_peers:
|
||||
- name: client_001
|
||||
allowed_ip: "0.0.0.0/0, ::/0"
|
||||
address: "10.10.10.2"
|
||||
- name: client_002
|
||||
allowed_ip: "0.0.0.0/0, ::/0"
|
||||
address: "10.10.10.3"
|
||||
roles:
|
||||
- wireguard
|
||||
----
|
||||
|
||||
== License
|
||||
|
||||
BSD-3
|
||||
|
||||
== Author Information
|
||||
|
||||
Role created by https://git.syyrell.com/syrell[syrell].
|
||||
@ -1,128 +0,0 @@
|
||||
Wireguard setup
|
||||
===============
|
||||
|
||||
Wireguard setup role. This role extends `this codebase <https://github.com/lablabs/ansible-collection-wireguard/tree/main/roles/wireguard>`_ to my needs. It's a bit simpler and adds more idempotence, e.g. when replaying the role to add another client to the server.
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
This role was written for Debian (11) and requires root privileges. It also requires to have several collections installed on your ansible host you won't necessarily have depending on your Ansible installation:
|
||||
|
||||
- ansible.posix
|
||||
- community.general (iptables_save module)
|
||||
- ansible.utils (network filters)
|
||||
- netaddr (python package)
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
Variables can be found in the `default vars <defaults/main.yml>`_
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_dir: /etc/wireguard
|
||||
wireguard_clients_dir: "{{ wireguard_dir }}/clients"
|
||||
wireguard_clients_download_dir: clients/
|
||||
wireguard_download_clients: false
|
||||
wireguard_serverkeys_download_dir: server/
|
||||
wireguard_download_serverkeys: false
|
||||
|
||||
Defines basic arborescence to store Wireguard files. ``wireguard_download_clients`` and ``wireguard_download_serverkeys`` can optionally set to true in order to download respectively clients and server's keys from the target host.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_restore_serverkeys_dir: ""
|
||||
|
||||
Use this variable if you want to use pre-existing keys from a directory to bootstrap Wireguard. Must ends with '/'.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_packages:
|
||||
- wireguard
|
||||
|
||||
List of packages to install.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_port: 51810
|
||||
|
||||
Port which Wireguard will listen to.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_hostname: "{{ inventory_hostname }}"
|
||||
|
||||
Hostname the client will use to connect to the server.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_interface: wg0
|
||||
|
||||
Interface which will be mounted to the server.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
nat_out_interface: eth0
|
||||
|
||||
Interface where the traffic will be NATed to on the server.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_address: 10.213.213.0/24
|
||||
|
||||
Subnet definition for the VPN network.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_keepalive: 25
|
||||
|
||||
Uses this if you wanna specify a keepalive value. See `this <https://github.com/pirate/wireguard-docs#persistentkeepalive>`_ for more information on keepalive.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
wireguard_peers: []
|
||||
|
||||
Lits of peers (clients) you wanna create. You can define specific name, address, allowedIPs, DNS and keepalive for each peer. See playbook below for example.
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
filter_forward: false
|
||||
other_interface:
|
||||
|
||||
Set ``filter_forward`` to true and specify an interface name for ``other_interface`` if you wanna drop packets from ``wireguard_interface`` to this interface.
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
None.
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
- name: Deploy Wireguard
|
||||
hosts: wireguard_hosts
|
||||
become: true
|
||||
vars:
|
||||
wireguard_hostname: "mywireguard.server.com"
|
||||
wireguard_address: 10.10.10.0/24
|
||||
wireguard_peers:
|
||||
- name: client_001
|
||||
allowed_ip: "0.0.0.0/0, ::/0"
|
||||
address: "10.10.10.2"
|
||||
- name: client_002
|
||||
allowed_ip: "0.0.0.0/0, ::/0"
|
||||
address: "10.10.10.3"
|
||||
roles:
|
||||
- wireguard
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
BSD-3
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
Role created by `syrell <https://git.syyrell.com/syrell>`_
|
||||
Loading…
x
Reference in New Issue
Block a user