phfroidmont/self-hosting
1
0
Fork 0
mirror of https://github.com/phfroidmont/self-hosting.git synced 2025-12-25 13:46:59 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use tinc for private networking

Browse source
This commit is contained in:
Paul-Henri Froidmont 2019-04-07 16:26:03 +02:00
parent 904167ec30
commit 224bdffc8b
9 changed files with 29 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

3
roles/tinc/defaults/main.yml
View file

@ -1,8 +1,7 @@
---
api_floating_ip: 192.168.66.253
netname: meshvpn
scw_private_domain: priv.cloud.scaleway.com
tinc_primary_router: proxy1
tinc_primary_router: master1
tinc_route_default_ip: 192.168.66.1
tinc_route_get_ip: 169.254.42.42
vpn_interface: tun0

18
roles/tinc/tasks/main.yml
View file

@ -1,4 +1,9 @@
---
- name: Install tinc
apt:
name: tinc
state: latest
- name: Ensure tinc netname directory exists
file:
path: /etc/tinc/{{ netname }}/hosts
@ -55,12 +60,7 @@
lineinfile:
dest: /etc/tinc/{{ netname }}/hosts/{{ inventory_hostname }}
line: |-
{%- if "k8s_proxy" in group_names -%}
{%- set interface = 'ansible_' + tinc_private_interface | default('eth0') -%}
Address = {{ vars[interface].ipv4.address }}
{%- else -%}
Address = {{ ansible_eth0.ipv4.address }}
{%- endif -%}
create: yes
notify:
- restart tinc
@ -74,14 +74,6 @@
notify:
- restart tinc
# in case of multimaster we need to add a subnet line
- name: Ensure that keepalived ip is properly set in tinc host file on k8s_masters
lineinfile:
dest: /etc/tinc/{{ netname }}/hosts/{{ inventory_hostname }}
line: "Subnet = {{ api_floating_ip }}/{{ vpn_subnet_cidr_netmask }}"
create: yes
when: groups.k8s_masters | length > 1
- name: Check whether /etc/tinc/netname/hosts/inventory_hostname contains "-----END RSA PUBLIC KEY-----"
command: awk '/^-----END RSA PUBLIC KEY-----$/' /etc/tinc/{{ netname }}/hosts/{{ inventory_hostname }}
changed_when: "public_key.stdout != '-----END RSA PUBLIC KEY-----'"

13
roles/tinc/templates/tinc-up.j2
View file

@ -1,16 +1,3 @@
#!/bin/sh
ifconfig {{ vpn_interface }} {{ vpn_ip }} netmask {{ vpn_netmask }}
{% if inventory_hostname != tinc_primary_router %}
ROUTE_GET_IP={{ tinc_route_get_ip }}
INTERFACE=$(ip route get $ROUTE_GET_IP | head -n1 | sed -E 's/.+ dev ([^ ]+).+/\1/')
GATEWAY=$(ip route | awk '$3 == "'$INTERFACE'" { print $1 }' | cut -d'/' -f1)
ip route add 10.0.0.0/8 via $GATEWAY dev $INTERFACE
ip route add 169.254.0.0/16 via $GATEWAY dev $INTERFACE
ip route add 172.16.0.0/12 via $GATEWAY dev $INTERFACE
ip route add 192.168.0.0/16 via $GATEWAY dev $INTERFACE
ip route replace default via {{ tinc_route_default_ip }}
{% endif %}