Allow external VPN nodes, make multi-DC deployment work

This commit is contained in:
Alex 2020-05-21 23:41:39 +02:00
parent bee7e10256
commit 207d1fa278
10 changed files with 65 additions and 8 deletions

View file

@ -1,5 +1,6 @@
[cluster_nodes]
#ubuntu1 ansible_host=192.168.42.10
debian1 ansible_host=192.168.42.20 ansible_user=root public_ip=192.168.42.20 dns_server=208.67.222.222 vpn_ip=10.68.70.11 public_vpn_port=51820
debian2 ansible_host=192.168.42.21 ansible_user=root public_ip=192.168.42.21 dns_server=208.67.222.222 vpn_ip=10.68.70.12 public_vpn_port=51820
debian3 ansible_host=192.168.42.22 ansible_user=root public_ip=192.168.42.22 dns_server=208.67.222.222 vpn_ip=10.68.70.13 public_vpn_port=51820
debian1 ansible_host=192.168.42.20 ansible_user=root public_ip=192.168.42.20 dns_server=208.67.222.222 vpn_ip=10.68.70.11 public_vpn_port=51820 datacenter=belair
debian2 ansible_host=192.168.42.21 ansible_user=root public_ip=192.168.42.21 dns_server=208.67.222.222 vpn_ip=10.68.70.12 public_vpn_port=51820 datacenter=belair
debian3 ansible_host=192.168.42.22 ansible_user=root public_ip=192.168.42.22 dns_server=208.67.222.222 vpn_ip=10.68.70.13 public_vpn_port=51820 datacenter=belair
ovh1 ansible_host=51.75.4.20 ansible_user=debian ansible_become=yes public_ip=51.75.4.20 dns_server=208.67.222.222 vpn_ip=10.68.70.20 public_vpn_port=51820 datacenter=saturne

View file

@ -1,4 +1,5 @@
{
"datacenter": "deuxfleurs",
"data_dir": "/var/lib/consul",
"bind_addr": "0.0.0.0",
"advertise_addr": "{{ vpn_ip }}",
@ -11,7 +12,7 @@
"{{ hostvars[selected_host]['vpn_ip'] }}" {{ "," if not loop.last else "" }}
{% endfor %}
],
"bootstrap_expect": 3,
"bootstrap_expect": {{ groups['cluster_nodes']|length }},
"server": true,
"ui": true,
"ports": {

View file

@ -1,3 +1,6 @@
- name: "Create iptables configuration direcetory"
file: path=/etc/iptables/ state=directory
- name: "Deploy iptablesv4 configuration"
template: src=rules.v4.j2 dest=/etc/iptables/rules.v4
@ -55,3 +58,6 @@
- name: "Enable Wireguard systemd service at boot"
service: name=wg-quick@wgdeuxfleurs state=started enabled=yes daemon_reload=yes
- name: "Create /tmp/wgdeuxfleurs.template.conf example configuration file for external nodes"
local_action: template src=wireguard_external.conf.j2 dest=/tmp/wgdeuxfleurs.template.conf

View file

@ -13,8 +13,15 @@
-A INPUT -s {{ hostvars[selected_host]['public_ip'] }} -p udp --dport 51820 -j ACCEPT
-A INPUT -s {{ hostvars[selected_host]['vpn_ip'] }} -j ACCEPT
{% endfor %}
{% for host in other_vpn_nodes %}
-A INPUT -s {{ host.public_ip }} -p udp --dport 51820 -j ACCEPT
-A INPUT -s {{ host.vpn_ip }} -j ACCEPT
{% endfor %}
# Rennes
-A INPUT -s 93.2.173.168 -j ACCEPT
-A INPUT -s 82.253.205.190 -j ACCEPT
# Local
-A INPUT -i docker0 -j ACCEPT
-A INPUT -s 127.0.0.1/8 -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

View file

@ -10,3 +10,11 @@ Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].pu
AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32
PersistentKeepalive = 25
{% endfor %}
{% for host in other_vpn_nodes %}
[Peer]
PublicKey = {{ host.pubkey }}
Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }}
AllowedIPs = {{ host.vpn_ip }}/32
PersistentKeepalive = 25
{% endfor %}

View file

@ -0,0 +1,26 @@
# Template configuration file for VPN nodes that are non in the cluster
# External nodes should be registered in network/vars/main.yml
[Interface]
Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml>
PrivateKey = <INSERT YOUR PRIVKEY HERE, IT SHOULD MATCH THE PUBKEY IN vars/main.yml>
ListenPort = 51820
# Cluster nodes
{% for selected_host in groups['cluster_nodes'] %}
[Peer]
PublicKey = {{ hostvars[selected_host].wireguard_pubkey.stdout }}
Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].public_vpn_port }}
AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32
PersistentKeepalive = 25
{% endfor %}
# External nodes
# TODO: remove yourself from here
{% for host in other_vpn_nodes %}
[Peer]
PublicKey = {{ host.pubkey }}
Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }}
AllowedIPs = {{ host.vpn_ip }}/32
PersistentKeepalive = 25
{% endfor %}

View file

@ -0,0 +1,6 @@
---
other_vpn_nodes:
- pubkey: "QUiUNMk70TEQ75Ut7Uqikr5uGVSXmx8EGNkGM6tANlg="
public_ip: "37.187.118.206"
public_vpn_port: "51820"
vpn_ip: "10.68.70.101"

View file

@ -1,3 +1,5 @@
datacenter = "{{ datacenter }}"
addresses {
http = "0.0.0.0"
rpc = "0.0.0.0"
@ -14,7 +16,7 @@ data_dir = "/var/lib/nomad"
server {
enabled = true
bootstrap_expect = 3
bootstrap_expect = {{ groups['cluster_nodes']|length }}
}
consul {

View file

@ -1,5 +1,5 @@
job "directory2" {
datacenters = ["dc1"]
datacenters = ["dc1", "saturne", "belair"]
type = "service"
constraint {

View file

@ -1,5 +1,5 @@
job "frontend" {
datacenters = ["dc1"]
datacenters = ["dc1", "saturne"]
type = "service"
group "traefik" {