mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 05:34:43 +02:00
ALI YESILKAYA
bc0e1dd53e
- rôle wireguard : serveur wg0 (10.99.0.0/24) sur storage-01, profils clients générés dans /etc/wireguard/clients/ (fichier .conf / QR code) - gateway : filtrage nftables par pair — full (tout le lab) / portal (uniquement Traefik :80 = portail Guacamole), masquerade VPN→cluster - dnsmasq : bind-dynamic + écoute wg0 → *.lab.local résolu dans le tunnel - pairs initiaux : alkatrazz (full), invite-01 (portal) - vault : clés WireGuard + reprise de l'archive Authentik (remplace #78) - doc : admin/infra/wireguard.md (onboarding pair, pièges, exploitation) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
42 lines
1 KiB
YAML
42 lines
1 KiB
YAML
---
|
|
- name: Install wireguard-tools
|
|
ansible.builtin.dnf:
|
|
name: wireguard-tools
|
|
state: present
|
|
|
|
- name: Deploy wg0 server config
|
|
ansible.builtin.template:
|
|
src: wg0.conf.j2
|
|
dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
notify: Restart wireguard
|
|
|
|
- name: Create clients config directory
|
|
ansible.builtin.file:
|
|
path: /etc/wireguard/clients
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0700'
|
|
|
|
# Profils clients prêts à distribuer (fichier .conf à envoyer / QR code —
|
|
# voir admin/infra/wireguard.md)
|
|
- name: Generate client configs
|
|
ansible.builtin.template:
|
|
src: client.conf.j2
|
|
dest: "/etc/wireguard/clients/{{ item.name }}.conf"
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
loop: "{{ wireguard_peers }}"
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
no_log: true
|
|
|
|
- name: Enable and start wg-quick
|
|
ansible.builtin.systemd:
|
|
name: "wg-quick@{{ wireguard_interface }}"
|
|
enabled: true
|
|
state: started
|