Compare commits

..

2 commits

Author SHA1 Message Date
Nikos Papadakis
7f7e612132
wireguard 2023-11-27 21:07:07 +02:00
Nikos Papadakis
33f12242ba
attic changes 2023-11-27 19:02:47 +02:00
9 changed files with 129 additions and 21 deletions

View file

@ -22,3 +22,7 @@ s3_bucket: "prymn-cache"
s3_endpoint: "https://75178f9eca227dea51b3db4db2c15a5a.r2.cloudflarestorage.com"
s3_access_key_id: "{{ vault_s3_access_key_id }}"
s3_secret_access_key: "{{ vault_s3_secret_access_key }}"
# Wireguard
wireguard_ip: "10.0.42.1"
wireguard_network_mask: "24"

View file

@ -0,0 +1,2 @@
ansible_become_pass: "{{ ulna_become_pass | default(omit) }}"
wireguard_ip: "10.0.42.1"

View file

@ -3,9 +3,15 @@
hosts: ulna
tasks:
- name: Install nix libraries
ansible.builtin.apt:
name: nix-bin
state: present
become: true
- name: Unarchive
ansible.builtin.unarchive:
src: attic.tar.xz
src: files/attic.tar.xz
dest: /usr/local
become: true
@ -30,7 +36,7 @@
state: directory
become: true
- name: Restart systemd
- name: Restart service
ansible.builtin.systemd:
state: restarted
name: attic

View file

@ -30,6 +30,7 @@
- WOODPECKER_GITEA_URL=https://{{ gitea_host }}
- WOODPECKER_GITEA_CLIENT={{ woodpecker_client_id }}
- WOODPECKER_GITEA_SECRET={{ woodpecker_client_secret }}
- WOODPECKER_ADMIN=nikos
woodpecker-agent:
image: woodpeckerci/woodpecker-agent:next

View file

@ -1,10 +1,16 @@
$ANSIBLE_VAULT;1.1;AES256
34626236366363333963613532643239643331333637613664653238336431636338303537643936
3830343365336262633165616535363336313665383261310a383931623831326530313837346137
35663961343433396461653164613666363331396430393131393038393433346263653331653064
3162663361623439340a363865633661623563366330336666633766656531663033613131343466
39366463393839333963326531376436373038386239623937303839336264336462613236623431
37633635333738316665346463333361363234636465333764643464323830313636616165646365
39663235323764323564326135333631613665336338646565666362336666633337643065626362
66663631313434393636326531616261623132633730333439313534636165373635393465616531
66643663376238653164626364386338363863366661313235353966316664343039
63613665646438616265666332616134306638336363643763376536386338336265333036633561
3866393138653031346363613137343238323839633632330a346433343633383938383835373438
33306235633230633734663937316365643263373964386234613236316132396661643565356639
3966326363643566360a326135633033396262636661366536653132613939323034346138353434
63356662653461333537643737353537353862313366356265623333373635323133393462353638
35646563643231666632666537373633643037376638323132383739613736393035376462313065
63633366363265396163343633306439313364656161663930623965376337343661323230616532
35613663373263323839313534623831366334346135383439316439366634343133343462366631
31663363346138336163633562366130663430626633303733643730333039646663643930626564
38366466306534366661646564386566303562303733663534666334383639623939616238666237
34353130663033376534386533633639656161333164646164346136323937623630663638633731
32353131386538326230633630626530393561623930353963316431663635343131373539633937
38396539323566616565633161653835306435653639633336626434643562316564346665616662
39633663343736366264623334653763323763366133343634306162356664386564393232386564
346330633462313734343039633666616536

View file

@ -58,33 +58,33 @@ url = "sqlite:///usr/local/share/attic/server.db"
# Storage type
#
# Can be "local" or "s3".
type = "s3"
type = "local"
# ## Local storage
## Local storage
# The directory to store all files under
# path = "/home/nikos/.local/share/attic/storage"
path = "/usr/local/share/attic/storage"
# ## S3 Storage (set type to "s3" and uncomment below)
# The AWS region
region = "auto"
# region = "auto"
# The name of the bucket
bucket = "{{ s3_bucket }}"
# bucket = "{{ s3_bucket }}"
# Custom S3 endpoint
#
# Set this if you are using an S3-compatible object storage (e.g., Minio).
endpoint = "{{ s3_endpoint }}"
# endpoint = "{{ s3_endpoint }}"
# Credentials
#
# If unset, the credentials are read from the `AWS_ACCESS_KEY_ID` and
# `AWS_SECRET_ACCESS_KEY` environment variables.
[storage.credentials]
access_key_id = "{{ s3_access_key_id }}"
secret_access_key = "{{ s3_secret_access_key }}"
# [storage.credentials]
# access_key_id = "{{ s3_access_key_id }}"
# secret_access_key = "{{ s3_secret_access_key }}"
# Data chunking
#
@ -127,7 +127,7 @@ type = "zstd"
#
# If zero, automatic garbage collection is disabled, but
# it can still be run manually with `atticd --mode garbage-collector-once`.
interval = "12 hours"
interval = "0"
# Default retention period
#

View file

@ -0,0 +1,25 @@
[NetDev]
Name=wg0
Kind=wireguard
Description=Wireguard tunnel wg0
[WireGuard]
ListenPort=51820
PrivateKey={{ wireguard_private_key.stdout }}
{% for peer in groups['wireguard'] %}
{% if peer != inventory_hostname %}
[WireGuardPeer]
PublicKey={{ hostvars[peer].wireguard_public_key.stdout }}
AllowedIPs={{ hostvars[peer].wireguard_ip }}/32
PersistentKeepalive=25
{% endif %}
{% endfor %}
# ouroboros
[WireGuardPeer]
PublicKey={{ ouroboros_wireguard_public_key }}
AllowedIPs={{ ouroboros_wireguard_ip }}/32
PersistentKeepalive=25

View file

@ -0,0 +1,5 @@
[Match]
Name=wg0
[Network]
Address={{ wireguard_ip }}/{{ wireguard_network_mask }}

59
wireguard.yml Normal file
View file

@ -0,0 +1,59 @@
---
- hosts: [wireguard]
tasks:
- name: Install wireguard packages
become: true
ansible.builtin.apt:
name: wireguard
state: present
- name: Generate keys
become: true
ansible.builtin.shell: |
umask 0077
wg genkey > /etc/wireguard/privatekey
wg pubkey < /etc/wireguard/privatekey > /etc/wireguard/publickey
args:
creates:
- /etc/wireguard/privatekey
- /etc/wireguard/publickey
- name: Register public key
become: true
ansible.builtin.shell: cat /etc/wireguard/publickey
register: wireguard_public_key
changed_when: false
- name: Register private key
become: true
ansible.builtin.shell: cat /etc/wireguard/privatekey
register: wireguard_private_key
changed_when: false
- name: Setup network device
become: yes
notify: systemd network restart
ansible.builtin.template:
src: ./templates/wireguard/wg0.netdev.j2
dest: /etc/systemd/network/wg0.netdev
owner: root
group: systemd-network
mode: 0640
- name: Setup network
become: yes
notify: systemd network restart
ansible.builtin.template:
src: ./templates/wireguard/wg0.network.j2
dest: /etc/systemd/network/wg0.network
owner: root
group: systemd-network
mode: 0640
handlers:
- name: systemd network restart
become: true
ansible.builtin.service:
name: systemd-networkd
state: restarted
enabled: true