Deuxfleurs/infrastructure
Archived
24
2
Fork 2
Code Issues 22 Pull requests Projects 1 Releases Wiki Activity

don't retrieve wireguard privkeys in ansible

Browse source
This commit is contained in:
Alex 2020-05-23 17:16:25 +02:00
parent 207d1fa278
commit 3bf830713f
3 changed files with 3 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ansible/roles/network/tasks/main.yml
View file

@ -43,10 +43,6 @@
- name: "Secure wireguard private key" - name: "Secure wireguard private key"
file: path=/etc/wireguard/privkey mode=0600 file: path=/etc/wireguard/privkey mode=0600
- name: "Retrieve wireguard private key"
shell: cat /etc/wireguard/privkey
register: wireguard_privkey
- name: "Retrieve wireguard public key" - name: "Retrieve wireguard public key"
shell: wg pubkey < /etc/wireguard/privkey shell: wg pubkey < /etc/wireguard/privkey
register: wireguard_pubkey register: wireguard_pubkey

2
ansible/roles/network/templates/wireguard.conf.j2
View file

@ -1,6 +1,6 @@
[Interface] [Interface]
Address = {{ vpn_ip }} Address = {{ vpn_ip }}
PrivateKey = {{ wireguard_privkey.stdout }} PostUp = wg set %i private-key <(cat /etc/wireguard/privkey)
ListenPort = 51820 ListenPort = 51820
{% for selected_host in groups['cluster_nodes']|difference([inventory_hostname]) %} {% for selected_host in groups['cluster_nodes']|difference([inventory_hostname]) %}

3
ansible/roles/network/templates/wireguard_external.conf.j2
View file

@ -1,9 +1,10 @@
# Template configuration file for VPN nodes that are non in the cluster # Template configuration file for VPN nodes that are non in the cluster
# The private key should be stored as /etc/wireguard/privkey
# External nodes should be registered in network/vars/main.yml # External nodes should be registered in network/vars/main.yml
[Interface] [Interface]
Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml> Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml>
PrivateKey = <INSERT YOUR PRIVKEY HERE, IT SHOULD MATCH THE PUBKEY IN vars/main.yml> PostUp = wg set %i private-key <(cat /etc/wireguard/privkey)
ListenPort = 51820 ListenPort = 51820
# Cluster nodes # Cluster nodes