Allow external VPN nodes, make multi-DC deployment work

ansible/lxvm

@@ -1,5 +1,6 @@
 [cluster_nodes]
 #ubuntu1 ansible_host=192.168.42.10
-debian1 ansible_host=192.168.42.20 ansible_user=root public_ip=192.168.42.20 dns_server=208.67.222.222 vpn_ip=10.68.70.11 public_vpn_port=51820
-debian2 ansible_host=192.168.42.21 ansible_user=root public_ip=192.168.42.21 dns_server=208.67.222.222 vpn_ip=10.68.70.12 public_vpn_port=51820
-debian3 ansible_host=192.168.42.22 ansible_user=root public_ip=192.168.42.22 dns_server=208.67.222.222 vpn_ip=10.68.70.13 public_vpn_port=51820
+debian1 ansible_host=192.168.42.20 ansible_user=root public_ip=192.168.42.20 dns_server=208.67.222.222 vpn_ip=10.68.70.11 public_vpn_port=51820 datacenter=belair
+debian2 ansible_host=192.168.42.21 ansible_user=root public_ip=192.168.42.21 dns_server=208.67.222.222 vpn_ip=10.68.70.12 public_vpn_port=51820 datacenter=belair
+debian3 ansible_host=192.168.42.22 ansible_user=root public_ip=192.168.42.22 dns_server=208.67.222.222 vpn_ip=10.68.70.13 public_vpn_port=51820 datacenter=belair
+ovh1 ansible_host=51.75.4.20 ansible_user=debian ansible_become=yes public_ip=51.75.4.20 dns_server=208.67.222.222 vpn_ip=10.68.70.20 public_vpn_port=51820 datacenter=saturne

ansible/roles/consul/templates/consul.json.j2

@@ -1,4 +1,5 @@
 {
+  "datacenter": "deuxfleurs",
   "data_dir": "/var/lib/consul",
   "bind_addr": "0.0.0.0",
   "advertise_addr": "{{ vpn_ip }}",
@@ -11,7 +12,7 @@
      "{{ hostvars[selected_host]['vpn_ip'] }}" {{ "," if not loop.last else "" }}
    {% endfor %}
   ],
-  "bootstrap_expect": 3,
+  "bootstrap_expect": {{ groups['cluster_nodes']|length }},
   "server": true,
   "ui": true,
   "ports": {

ansible/roles/network/tasks/main.yml

@@ -1,3 +1,6 @@
+- name: "Create iptables configuration direcetory"
+  file: path=/etc/iptables/ state=directory
+
 - name: "Deploy iptablesv4 configuration"
   template: src=rules.v4.j2 dest=/etc/iptables/rules.v4
 
@@ -55,3 +58,6 @@
 
 - name: "Enable Wireguard systemd service at boot"
   service: name=wg-quick@wgdeuxfleurs state=started enabled=yes daemon_reload=yes
+
+- name: "Create /tmp/wgdeuxfleurs.template.conf example configuration file for external nodes"
+  local_action: template src=wireguard_external.conf.j2 dest=/tmp/wgdeuxfleurs.template.conf

ansible/roles/network/templates/rules.v4.j2

@@ -13,8 +13,15 @@
 -A INPUT -s {{ hostvars[selected_host]['public_ip'] }} -p udp --dport 51820 -j ACCEPT
 -A INPUT -s {{ hostvars[selected_host]['vpn_ip'] }} -j ACCEPT
 {% endfor %}
+{% for host in other_vpn_nodes %}
+-A INPUT -s {{ host.public_ip }} -p udp --dport 51820 -j ACCEPT
+-A INPUT -s {{ host.vpn_ip }} -j ACCEPT
+{% endfor %}
+
+# Rennes
+-A INPUT -s 93.2.173.168 -j ACCEPT
+-A INPUT -s 82.253.205.190 -j ACCEPT
 
-# Local
 -A INPUT -i docker0 -j ACCEPT
 -A INPUT -s 127.0.0.1/8 -j ACCEPT
 -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

ansible/roles/network/templates/wireguard.conf.j2

@@ -10,3 +10,11 @@ Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].pu
 AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32
 PersistentKeepalive = 25
 {% endfor %}
+
+{% for host in other_vpn_nodes %}
+[Peer]
+PublicKey = {{ host.pubkey }}
+Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }}
+AllowedIPs = {{ host.vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}

ansible/roles/network/templates/wireguard_external.conf.j2

@@ -0,0 +1,26 @@
+# Template configuration file for VPN nodes that are non in the cluster
+# External nodes should be registered in network/vars/main.yml
+
+[Interface]
+Address = <INSERT YOUR IP HERE, IT SHOULD MATCH THE ONE IN vars/main.yml>
+PrivateKey = <INSERT YOUR PRIVKEY HERE, IT SHOULD MATCH THE PUBKEY IN vars/main.yml>
+ListenPort = 51820
+
+# Cluster nodes
+{% for selected_host in groups['cluster_nodes'] %}
+[Peer]
+PublicKey = {{ hostvars[selected_host].wireguard_pubkey.stdout }}
+Endpoint = {{ hostvars[selected_host].public_ip }}:{{ hostvars[selected_host].public_vpn_port }}
+AllowedIPs = {{ hostvars[selected_host].vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}
+
+# External nodes
+# TODO: remove yourself from here
+{% for host in other_vpn_nodes %}
+[Peer]
+PublicKey = {{ host.pubkey }}
+Endpoint = {{ host.public_ip }}:{{ host.public_vpn_port }}
+AllowedIPs = {{ host.vpn_ip }}/32
+PersistentKeepalive = 25
+{% endfor %}

ansible/roles/network/vars/main.yml

@@ -0,0 +1,6 @@
+---
+other_vpn_nodes:
+  - pubkey: "QUiUNMk70TEQ75Ut7Uqikr5uGVSXmx8EGNkGM6tANlg="
+    public_ip: "37.187.118.206"
+    public_vpn_port: "51820"
+    vpn_ip: "10.68.70.101"

ansible/roles/nomad/templates/nomad.hcl.j2

@@ -1,3 +1,5 @@
+datacenter = "{{ datacenter }}"
+
 addresses {
   http = "0.0.0.0"
   rpc = "0.0.0.0"
@@ -14,7 +16,7 @@ data_dir = "/var/lib/nomad"
 
 server {
   enabled          = true
-  bootstrap_expect = 3
+  bootstrap_expect = {{ groups['cluster_nodes']|length }}
 }
 
 consul {

nomad/bottin2.hcl

@@ -1,5 +1,5 @@
 job "directory2" {
-  datacenters = ["dc1"]
+  datacenters = ["dc1", "saturne", "belair"]
   type = "service"
 
   constraint {

nomad/traefik.hcl

@@ -1,5 +1,5 @@
 job "frontend" {
-  datacenters = ["dc1"]
+  datacenters = ["dc1", "saturne"]
   type = "service"
 
   group "traefik" {