From 846f385a215e24bf2283ebcb8d76c6448e92f0e8 Mon Sep 17 00:00:00 2001 From: Tobias Hachmer Date: Fri, 29 Sep 2017 13:32:20 +0200 Subject: [PATCH] Add role service-tinc --- inventory/group_vars/all | 5 ++ playbooks/gateways.yml | 1 + roles/service-bird-icvpn/meta/main.yml | 1 + roles/service-tinc/README.md | 45 ++++++++++++ roles/service-tinc/handlers/main.yml | 12 ++++ roles/service-tinc/tasks/main.yml | 72 ++++++++++++++++++++ roles/service-tinc/templates/nets.boot.j2 | 5 ++ roles/service-tinc/templates/rsa_key.priv.j2 | 1 + roles/service-tinc/templates/tinc-down.j2 | 11 +++ roles/service-tinc/templates/tinc-up.j2 | 14 ++++ roles/service-tinc/templates/tinc.conf.j2 | 12 ++++ 11 files changed, 179 insertions(+) create mode 100644 roles/service-tinc/README.md create mode 100644 roles/service-tinc/handlers/main.yml create mode 100644 roles/service-tinc/tasks/main.yml create mode 100644 roles/service-tinc/templates/nets.boot.j2 create mode 100644 roles/service-tinc/templates/rsa_key.priv.j2 create mode 100644 roles/service-tinc/templates/tinc-down.j2 create mode 100644 roles/service-tinc/templates/tinc-up.j2 create mode 100644 roles/service-tinc/templates/tinc.conf.j2 diff --git a/inventory/group_vars/all b/inventory/group_vars/all index bc72b66..3c0a1b6 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -58,6 +58,11 @@ meshes: peers_mesh_repo: https://github.com/freifunk-mwu/peers-ffwi.git peers_intragate_repo: https://github.com/freifunk-mwu/ffwi-infrastructure-peers.git +icvpn: + prefix: mwu + interface: icVPN + icvpn_repo: https://github.com/freifunk/icvpn + bgp_mwu_servers: spinat: ipv4: 10.37.0.7 diff --git a/playbooks/gateways.yml b/playbooks/gateways.yml index 584ee41..b9dc606 100755 --- a/playbooks/gateways.yml +++ b/playbooks/gateways.yml @@ -20,6 +20,7 @@ - git-fastd-peers - network-fastd - network-ffrl + - service-tinc - service-bird - service-bird-icvpn - service-bird-ffrl diff --git a/roles/service-bird-icvpn/meta/main.yml b/roles/service-bird-icvpn/meta/main.yml index ad1a852..0c405d4 100644 --- a/roles/service-bird-icvpn/meta/main.yml +++ b/roles/service-bird-icvpn/meta/main.yml @@ -1,4 +1,5 @@ --- dependencies: - { role: git-repos } + - { role: service-tinc } - { role: service-bird } diff --git a/roles/service-tinc/README.md b/roles/service-tinc/README.md new file mode 100644 index 0000000..f2ad562 --- /dev/null +++ b/roles/service-tinc/README.md @@ -0,0 +1,45 @@ +# Ansible role service-tinc + +Diese Ansible role installiert und konfiguriert den tinc daemon, der für die Verbindung in das InterCity-VPN benötigt wird. + +- installiert tinc +- erzeugt icVPN tinc Instanz + - klont freifunk/icvpn repo + - schreibt tinc.conf + - schreibt tinc-up hook script + - schreibt tinc-down hook script + - liest tinc private key aus dem pass + +## Benötigte Variablen + +- Dictionary `icvpn` +``` +icvpn: + prefix: mwu + interface: icVPN + icvpn_repo: https://github.com/freifunk/icvpn +``` +- Variable `icvpn_ipv4_transfer_net` +- Variable `icvpn_ipv6_transfer_net` +- Dictionary `routing_tables` +``` +routing_tables: + icvpn: 23 + ... +``` +- Host Variable `magic` +- Host Variable `tinc_private_key` +``` +tinc_private_key: "{{ lookup('passwordstore', 'tinc/icVPN/$Hostname_private returnall=true') }}" +``` + +## tinc private key + +Der private Schlüssel der icVPN tinc-Instanz liegt im passwordstore. +Bevor man ein Gateway aufsetzt, muss der private Schlüssel generiert und im passwordstore hinterlegt werden. +Die Variable `tinc_private_key` folgt dem Aufbau: +``` +tinc_private_key: + $Instanz-Name: "{{ lookup('passwordstore', '$Pfad-im-passwordstore returnall=true') }}" +``` + diff --git a/roles/service-tinc/handlers/main.yml b/roles/service-tinc/handlers/main.yml new file mode 100644 index 0000000..b88ce92 --- /dev/null +++ b/roles/service-tinc/handlers/main.yml @@ -0,0 +1,12 @@ +--- +- name: configure systemd unit tinc + systemd: + name: tinc + enabled: yes + daemon_reload: yes + +- name: restart systemd unit tinc + systemd: + name: tinc + enabled: yes + state: restarted diff --git a/roles/service-tinc/tasks/main.yml b/roles/service-tinc/tasks/main.yml new file mode 100644 index 0000000..994f480 --- /dev/null +++ b/roles/service-tinc/tasks/main.yml @@ -0,0 +1,72 @@ +--- +- name: install tinc packages + apt: + name: "{{ item }}" + state: present + with_items: + - tinc + notify: configure systemd unit tinc + +- name: clone icvpn repo + git: + repo: "{{ icvpn.icvpn_repo }}" + dest: /etc/tinc/{{ icvpn.interface }} + update: no + +- name: set directory permissions + file: + path: /etc/tinc/{{ icvpn.interface }} + state: directory + owner: admin + group: admin + recurse: yes + +- name: register metanodes + command: cat /etc/tinc/{{ icvpn.interface }}/metanodes + register: metanodes + changed_when: false + +- name: write tinc.conf + template: + src: tinc.conf.j2 + dest: /etc/tinc/{{ icvpn.interface }}/tinc.conf + mode: 0664 + owner: admin + group: admin + notify: restart systemd unit tinc + +- name: write tinc-up hook script + template: + src: tinc-up.j2 + dest: /etc/tinc/{{ icvpn.interface }}/tinc-up + mode: 0775 + owner: admin + group: admin + notify: restart systemd unit tinc + +- name: write tinc-down hook script + template: + src: tinc-down.j2 + dest: /etc/tinc/{{ icvpn.interface }}/tinc-down + mode: 0775 + owner: admin + group: admin + notify: restart systemd unit tinc + +- name: write tinc private key + template: + src: rsa_key.priv.j2 + dest: /etc/tinc/{{ icvpn.interface }}/rsa_key.priv + mode: 0600 + owner: admin + group: admin + notify: restart systemd unit tinc + +- name: write nets.boot + template: + src: nets.boot.j2 + dest: /etc/tinc/nets.boot + mode: 0644 + owner: root + group: root + notify: restart systemd unit tinc diff --git a/roles/service-tinc/templates/nets.boot.j2 b/roles/service-tinc/templates/nets.boot.j2 new file mode 100644 index 0000000..5e4cdf7 --- /dev/null +++ b/roles/service-tinc/templates/nets.boot.j2 @@ -0,0 +1,5 @@ +# +# {{ ansible_managed }} +# +# This file contains all names of the networks to be started on system startup. +{{ icvpn.interface }} diff --git a/roles/service-tinc/templates/rsa_key.priv.j2 b/roles/service-tinc/templates/rsa_key.priv.j2 new file mode 100644 index 0000000..7c952bc --- /dev/null +++ b/roles/service-tinc/templates/rsa_key.priv.j2 @@ -0,0 +1 @@ +{{ tinc_private_key }} diff --git a/roles/service-tinc/templates/tinc-down.j2 b/roles/service-tinc/templates/tinc-down.j2 new file mode 100644 index 0000000..f0a44b0 --- /dev/null +++ b/roles/service-tinc/templates/tinc-down.j2 @@ -0,0 +1,11 @@ +#!/bin/sh +# +# {{ ansible_managed }} +# +/sbin/ip addr del dev ${INTERFACE} {{ icvpn_ipv4_transfer_net | ipaddr('net') | ipsubnet(24, 37) | ipaddr(magic) | ipaddr('address') }}/16 broadcast {{ icvpn_ipv4_transfer_net | ipaddr('net') | ipaddr('broadcast') }} +/sbin/ip -6 addr del dev ${INTERFACE} {{ icvpn_ipv6_transfer_net | ipaddr('net') | ipsubnet(112, 37) | ipaddr(magic) | ipaddr('address') }}/96 + +/sbin/ip -4 route del {{ icvpn_ipv4_transfer_net }} proto static dev ${INTERFACE} table {{ routing_tables.icvpn }} +/sbin/ip -6 route del {{ icvpn_ipv6_transfer_net }} proto static dev ${INTERFACE} table {{ routing_tables.icvpn }} + +/sbin/ip link set dev ${INTERFACE} down diff --git a/roles/service-tinc/templates/tinc-up.j2 b/roles/service-tinc/templates/tinc-up.j2 new file mode 100644 index 0000000..5fb6692 --- /dev/null +++ b/roles/service-tinc/templates/tinc-up.j2 @@ -0,0 +1,14 @@ +{% set ip4hex = icvpn_ipv4_transfer_net | ipaddr('net') | ipsubnet(24, 37) | ipaddr(magic) | ipaddr('address') | ip4_hex() -%} +{% set mac = '0220' + ip4hex -%} +#!/bin/sh +# +# {{ ansible_managed }} +# +/sbin/ifconfig ${INTERFACE} hw ether {{ mac | hwaddr('linux') }} +/sbin/ip link set dev ${INTERFACE} up + +/sbin/ip -4 route add {{ icvpn_ipv4_transfer_net }} proto static dev ${INTERFACE} table {{ routing_tables.icvpn }} +/sbin/ip -6 route add {{ icvpn_ipv6_transfer_net }} proto static dev ${INTERFACE} table {{ routing_tables.icvpn }} + +/sbin/ip addr add dev ${INTERFACE} {{ icvpn_ipv4_transfer_net | ipaddr('net') | ipsubnet(24, 37) | ipaddr(magic) | ipaddr('address') }}/16 broadcast {{ icvpn_ipv4_transfer_net | ipaddr('net') | ipaddr('broadcast') }} scope link +/sbin/ip -6 addr add dev ${INTERFACE} {{ icvpn_ipv6_transfer_net | ipaddr('net') | ipsubnet(112, 37) | ipaddr(magic) | ipaddr('address') }}/96 preferred_lft 0 diff --git a/roles/service-tinc/templates/tinc.conf.j2 b/roles/service-tinc/templates/tinc.conf.j2 new file mode 100644 index 0000000..15f2e96 --- /dev/null +++ b/roles/service-tinc/templates/tinc.conf.j2 @@ -0,0 +1,12 @@ +Name = {{ icvpn.prefix }}{{ magic }} +PrivateKeyFile = /etc/tinc/{{ icvpn.interface }}/rsa_key.priv +Mode = Switch +PingTimeout = 30 +Port = 10655 +Hostnames = yes +GraphDumpFile = /etc/tinc/{{ icvpn.interface }}/topo.dot +Interface = {{ icvpn.interface }} + +{% for metanode in metanodes.stdout_lines %} +ConnectTo = {{ metanode }} +{% endfor %}