README for wpi-ansible repository

What is this?

This is a set of ansible scripts to manage Lutra IT stepstone / management hosts

Usage

Configuration mgmt / deployment

To run all configuration for the WPI group on your test enviroment:

First install 3rd party ansible roles:

$ ansible-galaxy install -r roles/requirements.yml

Then :

$ ansible-playbook --vault-password-file=~/.vault_passwd -i inventories/production site.yml

VPN client setup

• Secret genereren voor nieuwe client:

wg genkey | tee privatekey | wg pubkey > publickey

• Template wireguard config:

[Interface]
PrivateKey = XXXXXXXXXXXXXX
Address = 10.45.45.XX/32

[Peer]
PublicKey = Fi2CB7p2iTkZ3FibgRU7kcJ9v0cubSwLL8Db2c2Vjl8=
AllowedIPs = 10.45.45.0/24, 185.233.34.0/24, 142.132.169.13/32, 46.23.92.48/32, 92.247.181.40/32, 86.105.244.7/32, 86.105.244.2/32, 185.206.232.42/32, 176.9.151.27/32, 176.9.151.179/32, 85.10.156.0/24, 88.99.149.207/32, 88.99.66.117/32, 65.21.105.159/32, 159.69.50.200/32, 49.13.28.252/32, 135.181.207.45/32, 95.217.153.4/32, 65.21.111.187/32
Endpoint = a[1-2].lutra.it:1194

Elke client krijgt twee configuraties: een die wijst naar a1.lutra.it en een die wijst naar a2.lutra.it

• client toevoegen aan server config in inventories/production/group_vars/all.yaml

wireguard:
  interfaces:
    - name: "wg0"
      private_key: !vault |
           [KNIP]
      ipv4_address: "10.45.45.1/24"
      port: "1194"
      peers:
        - public_key: "HoKdfmlWTRXxDZ1szcrIOHUQwBM1Vdy2D+SdnrmCbU4="
          ipv4_address: "10.45.45.6/32"
        - public_key: "qtWd0JliyhOBGH/KG3rgHH32SCm39Km+RP0ZjSIMl0U="
          ipv4_address: "10.45.45.8/32"
        - public_key: "YYYYYYYYYYYYYYYYYYYYYYYY"
          ipv4_address: "10.45.45.XX/32"

• ansible playbook opnieuw tegen de servers draaien:

ansible-playbook -i inventories/production/ site.yml --vault-password-file=~/.vault_lutra -t application