bee/beepi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stuff

Browse Source
This commit is contained in:
bee
2026-08-15 19:18:59 +02:00
parent 59aa8a7bcf
commit c63db540e8
32 changed files with 767 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/wireguard-ingress/client.conf.j2
+10
View File
@@ -0,0 +1,10 @@
[Interface]
PrivateKey = {{ lookup('file', wireguard_client_dir ~ '/' ~ item.item.name ~ '.private') }}
Address = {{ item.item.ip }}/32
[Peer]
PublicKey = {{ wireguard_server_public_key }}
PresharedKey = {{ lookup('file', wireguard_client_dir ~ '/' ~ item.item.name ~ '.psk.private') }}
Endpoint = {{ wireguard_ingress_endpoint }}:{{ wireguard_ingress_port }}
AllowedIPs = {{ item.item.allowed_ips | default(wireguard_client_allowed_ips) }}
PersistentKeepalive = 25
playbooks/wireguard-ingress/wg0.conf.j2
+18 -28
View File
@@ -1,36 +1,26 @@
[Interface]
PrivateKey = {{ wireguard_server_private_key }}
Address = 10.10.1.1/24
ListenPort = 41194
Address = {{ wireguard_ingress_address }}
ListenPort = {{ wireguard_ingress_port }}
PostUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25 -j DNAT --to-destination 10.10.1.2:25
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 25 -j DNAT --to-destination 10.10.1.2:25
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 993 -j DNAT --to-destination 10.10.1.2:993
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 993 -j DNAT --to-destination 10.10.1.2:993
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 587 -j DNAT --to-destination 10.10.1.2:587
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 587 -j DNAT --to-destination 10.10.1.2:587
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 465 -j DNAT --to-destination 10.10.1.2:465
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 465 -j DNAT --to-destination 10.10.1.2:465
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.10.1.2:80
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.10.1.2:80
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.10.1.2:443
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.10.1.2:443
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8448 -j DNAT --to-destination 10.10.1.2:8448
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 8448 -j DNAT --to-destination 10.10.1.2:8448
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 4444 -j DNAT --to-destination 10.10.1.2:4444
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 4444 -j DNAT --to-destination 10.10.1.2:4444
{% for port in wireguard_dnat_ports %}
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport {{ port }} -j DNAT --to-destination {{ wireguard_beepi_ip }}:{{ port }}
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport {{ port }} -j DNAT --to-destination {{ wireguard_beepi_ip }}:{{ port }}
{% endfor %}
#PreUp = iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
#PostDown = iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
# ----- site-to-site: beepi -----
[Peer]
PublicKey = oI69uWkbkwtpuIYxDNGmzg4nRjY1BIZFVFjZwguIvwE=
AllowedIPs = 10.10.1.2/32
PublicKey = {{ wireguard_beepi_public_key }}
AllowedIPs = {{ wireguard_beepi_ip }}/32
{% for peer in client_public_keys.results %}
# ----- road-warrior: {{ peer.item.name }} -----
[Peer]
PublicKey = {{ peer.stdout }}
PresharedKey = {{ lookup('file', wireguard_client_dir ~ '/' ~ peer.item.name ~ '.psk.private') }}
AllowedIPs = {{ peer.item.ip }}/32
{% endfor %}
playbooks/wireguard-ingress/wireguard-ingress.yml
+146 -6
View File
@@ -10,23 +10,163 @@
3239666637326337650a636433616264386162326535306461326233323961643664373134363634
35633238393933386231373535353635646462383763613362363761363935363965383836366431
3766343166643632306162343761613030653631353361373936
wireguard_ingress_address: 10.10.1.1/24
wireguard_ingress_port: 41194
wireguard_ingress_endpoint: 192.3.44.243
wireguard_server_public_key: r0XaxIE3AVud9Z42UPZF3mwoh2R0B0M1EUDY9cvuyDA=
wireguard_beepi_ip: 10.10.1.2
wireguard_beepi_public_key: oI69uWkbkwtpuIYxDNGmzg4nRjY1BIZFVFjZwguIvwE=
wireguard_dnat_ports:
- 25 # mail
- 80
- 443
- 465 # mail
- 587 # mail
- 993 # mail
- 4444 # backup ssh
- 8448 # matrix federation
wireguard_clients:
- name: phone
ip: 10.10.1.3
wireguard_client_allowed_ips: 10.10.1.2/32
wireguard_client_dir: "{{ playbook_dir }}/clients"
# Changes to Address, ListenPort or wireguard_dnat_ports = -e wireguard_full_restart=true
wireguard_full_restart: false
tasks:
- name: Install wireguard
ansible.builtin.apt:
name: wireguard
state: present
- name: Down wg0
changed_when: true
failed_when: false
ansible.builtin.command: wg-quick down wg0
- name: Create local client key directory
ansible.builtin.file:
path: "{{ wireguard_client_dir }}"
state: directory
mode: '0700'
delegate_to: localhost
become: false
- name: Generate client private keys
ansible.builtin.shell:
cmd: "umask 077 && wg genkey > {{ wireguard_client_dir }}/{{ item.name }}.private"
creates: "{{ wireguard_client_dir }}/{{ item.name }}.private"
loop: "{{ wireguard_clients }}"
loop_control:
label: "{{ item.name }}"
delegate_to: localhost
become: false
- name: Generate client preshared keys
ansible.builtin.shell:
cmd: "umask 077 && wg genpsk > {{ wireguard_client_dir }}/{{ item.name }}.psk.private"
creates: "{{ wireguard_client_dir }}/{{ item.name }}.psk.private"
loop: "{{ wireguard_clients }}"
loop_control:
label: "{{ item.name }}"
delegate_to: localhost
become: false
- name: Derive client public keys
ansible.builtin.command:
cmd: "wg pubkey"
stdin: "{{ lookup('file', wireguard_client_dir ~ '/' ~ item.name ~ '.private') }}"
loop: "{{ wireguard_clients }}"
loop_control:
label: "{{ item.name }}"
register: client_public_keys
changed_when: false
delegate_to: localhost
become: false
- name: Copy wg0.conf
ansible.builtin.template:
src: wg0.conf.j2
dest: /etc/wireguard/wg0.conf
mode: '0600'
register: wg0_config
- name: Up wg0
- name: Check whether wg0 is up
ansible.builtin.command:
cmd: wg show wg0
register: wg0_state
failed_when: false
changed_when: false
- name: Sync peers without dropping the tunnel
ansible.builtin.shell:
cmd: "wg syncconf wg0 <(wg-quick strip wg0)"
executable: /bin/bash
changed_when: true
ansible.builtin.command: wg-quick up wg0
when:
- wg0_config.changed
- wg0_state.rc == 0
- not wireguard_full_restart | bool
- name: Bounce wg0
ansible.builtin.shell:
cmd: "wg-quick down wg0 || true; wg-quick up wg0"
changed_when: true
when: wg0_state.rc != 0 or wireguard_full_restart | bool
- name: Enable wg-quick@wg0 on boot
ansible.builtin.service:
name: wg-quick@wg0
enabled: true
- name: Render client configs
ansible.builtin.template:
src: client.conf.j2
dest: "{{ wireguard_client_dir }}/{{ item.item.name }}.conf"
mode: '0600'
loop: "{{ client_public_keys.results }}"
loop_control:
label: "{{ item.item.name }}"
delegate_to: localhost
become: false
- name: Check for qrencode
ansible.builtin.command:
cmd: "which qrencode"
register: qrencode_check
failed_when: false
changed_when: false
delegate_to: localhost
become: false
- name: Render QR codes for mobile enrolment
ansible.builtin.command:
cmd: "qrencode -t ansiutf8 -r {{ wireguard_client_dir }}/{{ item.item.name }}.conf"
loop: "{{ client_public_keys.results }}"
loop_control:
label: "{{ item.item.name }}"
register: client_qr
changed_when: false
when: qrencode_check.rc == 0
delegate_to: localhost
become: false
- name: Show QR codes
ansible.builtin.debug:
msg: "{{ (item.stdout | default('')).split('\n') }}"
loop: "{{ client_qr.results | default([]) }}"
loop_control:
label: "{{ item.item.item.name | default('') }}"
when: qrencode_check.rc == 0
- name: Show peer status
ansible.builtin.command:
cmd: wg show wg0
register: wg0_final
changed_when: false
- name: Report
ansible.builtin.debug:
msg: "{{ wg0_final.stdout_lines }}"