Mercurial > code > home > repos > infra
annotate wireguard.py @ 305:58d8e6072dcc
update syncthing
| author | drewp@bigasterisk.com |
|---|---|
| date | Sat, 24 Aug 2024 15:06:51 -0700 |
| parents | 65e28d2e0cd8 |
| children |
| rev | line source |
|---|---|
| 5 | 1 import subprocess |
| 2 | |
| 3 from pyinfra import host | |
| 4 from pyinfra.facts.files import FindInFile | |
| 259 | 5 from pyinfra.operations import files, systemd |
| 6 | |
|
215
db8787bd800e
wireguard now uses ditto (and prime) as hubs for home/remote
drewp@bigasterisk.com
parents:
115
diff
changeset
|
7 import wireguard_pubkey |
| 5 | 8 |
| 9 # other options: | |
| 10 # https://www.reddit.com/r/WireGuard/comments/fkr240/shortest_path_between_peers/ | |
| 11 # https://github.com/k4yt3x/wireguard-mesh-configurator | |
| 12 # https://github.com/mawalu/wireguard-private-networking | |
| 13 # | |
| 14 | |
| 15 | |
|
215
db8787bd800e
wireguard now uses ditto (and prime) as hubs for home/remote
drewp@bigasterisk.com
parents:
115
diff
changeset
|
16 def peer_block(hostname, allowed_ips, endpoint=None, keepalive=None): |
|
289
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
17 # allowed_ips should be determined mostly from host.data.wireguard_address |
|
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
76
diff
changeset
|
18 |
|
215
db8787bd800e
wireguard now uses ditto (and prime) as hubs for home/remote
drewp@bigasterisk.com
parents:
115
diff
changeset
|
19 public_key = wireguard_pubkey.pubkey[hostname] |
| 5 | 20 out = f'''\ |
| 21 | |
| 22 [Peer] | |
| 23 # {hostname} | |
| 24 PublicKey = {public_key} | |
| 25 AllowedIPs = {allowed_ips} | |
| 26 ''' | |
| 27 if endpoint is not None: | |
| 28 out += f'Endpoint = {endpoint}\n' | |
| 29 if keepalive is not None: | |
| 30 out += f'PersistentKeepalive = {keepalive}\n' | |
| 31 return out | |
| 32 | |
| 33 | |
|
289
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
34 def get_priv_key(wireguard_interface) -> str: |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
35 priv_key_lines = host.get_fact(FindInFile, path=f'/etc/wireguard/{wireguard_interface}.conf', pattern=r'PrivateKey.*') |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
36 if not priv_key_lines: |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
37 priv_key = subprocess.check_output(['wg', 'genkey']).strip().decode('ascii') |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
38 else: |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
39 priv_key = priv_key_lines[0].split(' = ')[1] |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
40 return priv_key |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
41 |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
42 |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
43 def compute_pub_key(priv_key: str) -> str: |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
44 pub_key = subprocess.check_output(['wg', 'pubkey'], input=priv_key.encode('ascii')).strip().decode('ascii') |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
45 # todo: if this was new, it should be added to a file of pubkeys that |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
46 # peer_block can refer to. meanwhile, edit the template. |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
47 return pub_key |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
48 |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
49 |
| 5 | 50 for wireguard_interface in ['wg0', 'bogasterisk']: |
| 51 if wireguard_interface == 'bogasterisk' and host.name != 'prime': | |
| 52 continue | |
| 53 | |
| 54 # note- this is specific to the wg0 setup. Other conf files don't use it. | |
| 259 | 55 wireguard_ip = host.host_data.get('wireguard_address') |
| 56 if wireguard_interface == 'wg0' and wireguard_ip is None: | |
| 57 continue | |
| 5 | 58 |
| 59 # new pi may fail with 'Unable to access interface: Protocol not supported'. reboot fixes. | |
| 60 | |
|
289
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
61 priv_key = get_priv_key(wireguard_interface) |
| 5 | 62 |
|
289
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
63 # unused since I still hand-maintain wireguard_pubkey.py :( |
|
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
272
diff
changeset
|
64 # pub_key = compute_pub_key(priv_key) |
| 5 | 65 |
| 66 files.template( | |
| 12 | 67 src=f'templates/wireguard/{wireguard_interface}.conf.j2', |
| 5 | 68 dest=f'/etc/wireguard/{wireguard_interface}.conf', |
| 69 mode='600', | |
| 70 wireguard_ip=wireguard_ip, | |
| 71 priv_key=priv_key, | |
| 72 peer_block=peer_block, | |
| 73 ) | |
| 74 svc = f'wg-quick@{wireguard_interface}.service' | |
|
76
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
75 |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
76 files.template(src='templates/wireguard/wg.service.j2', |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
77 dest=f'/etc/systemd/system/{svc}', |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
78 wireguard_interface=wireguard_interface) |
| 9 | 79 systemd.service(service=svc, daemon_reload=True, restarted=True, enabled=True) |