Mercurial > code > home > repos > infra
annotate wireguard.py @ 189:ef443257ae9c
new host 'squib'
| author | drewp@bigasterisk.com |
|---|---|
| date | Mon, 12 Jun 2023 13:01:59 -0700 |
| parents | 8012f6095220 |
| children | db8787bd800e |
| rev | line source |
|---|---|
| 5 | 1 import subprocess |
| 2 | |
| 3 from pyinfra import host | |
| 4 from pyinfra.facts.files import FindInFile | |
|
76
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
5 from pyinfra.operations import apt, files, server, systemd |
| 5 | 6 |
| 7 # other options: | |
| 8 # https://www.reddit.com/r/WireGuard/comments/fkr240/shortest_path_between_peers/ | |
| 9 # https://github.com/k4yt3x/wireguard-mesh-configurator | |
| 10 # https://github.com/mawalu/wireguard-private-networking | |
| 11 # | |
| 12 | |
| 13 | |
| 14 def peer_block(hostname, public_key, allowed_ips, endpoint=None, keepalive=None): | |
|
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
76
diff
changeset
|
15 # if allowed_ips.startswith('10.5'): |
|
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
76
diff
changeset
|
16 # # k3s nets also need to travel over wg |
|
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
76
diff
changeset
|
17 # allowed_ips += ', 10.42.0.0/24, 10.43.0.0/24' |
|
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
76
diff
changeset
|
18 |
| 5 | 19 out = f'''\ |
| 20 | |
| 21 [Peer] | |
| 22 # {hostname} | |
| 23 PublicKey = {public_key} | |
| 24 AllowedIPs = {allowed_ips} | |
| 25 ''' | |
| 26 if endpoint is not None: | |
| 27 out += f'Endpoint = {endpoint}\n' | |
| 28 if keepalive is not None: | |
| 29 out += f'PersistentKeepalive = {keepalive}\n' | |
| 30 return out | |
| 31 | |
| 32 | |
| 33 for wireguard_interface in ['wg0', 'bogasterisk']: | |
| 34 if wireguard_interface == 'bogasterisk' and host.name != 'prime': | |
| 35 continue | |
| 36 | |
| 37 # note- this is specific to the wg0 setup. Other conf files don't use it. | |
| 38 wireguard_ip = host.host_data['wireguard_address'] | |
| 39 | |
| 40 # new pi may fail with 'Unable to access interface: Protocol not supported'. reboot fixes. | |
| 41 | |
| 42 priv_key_lines = host.get_fact(FindInFile, path=f'/etc/wireguard/{wireguard_interface}.conf', pattern=r'PrivateKey.*') | |
| 43 if not priv_key_lines: | |
| 44 priv_key = subprocess.check_output(['wg', 'genkey']).strip().decode('ascii') | |
| 45 else: | |
| 46 priv_key = priv_key_lines[0].split(' = ')[1] | |
| 47 | |
| 48 pub_key = subprocess.check_output(['wg', 'pubkey'], input=priv_key.encode('ascii')).strip().decode('ascii') | |
| 115 | 49 # todo: if this was new, it should be added to a file of pubkeys that |
| 50 # peer_block can refer to. meanwhile, edit the template. | |
| 5 | 51 |
| 52 files.template( | |
| 12 | 53 src=f'templates/wireguard/{wireguard_interface}.conf.j2', |
| 5 | 54 dest=f'/etc/wireguard/{wireguard_interface}.conf', |
| 55 mode='600', | |
| 56 wireguard_ip=wireguard_ip, | |
| 57 priv_key=priv_key, | |
| 58 peer_block=peer_block, | |
| 59 ) | |
| 60 svc = f'wg-quick@{wireguard_interface}.service' | |
|
76
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
61 |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
62 files.template(src='templates/wireguard/wg.service.j2', |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
63 dest=f'/etc/systemd/system/{svc}', |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
64 wireguard_interface=wireguard_interface) |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
65 systemd.service(service=f'{svc}', enabled=True, restarted=True, daemon_reload=True) |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
66 |
|
de387eae06cf
still trying to sequence dhcp->wireguard->dns startup
drewp@bigasterisk.com
parents:
71
diff
changeset
|
67 # files.link(path=f'/etc/systemd/system/multi-user.target.wants/{svc}', target='/lib/systemd/system/wg-quick@.service') |
| 5 | 68 |
| 9 | 69 systemd.service(service=svc, daemon_reload=True, restarted=True, enabled=True) |
| 71 | 70 |
|
97
9b7d7ea79f16
stop trying separate dns on 10.5 net. just use names like 'bang5'
drewp@bigasterisk.com
parents:
89
diff
changeset
|
71 # if host.name == 'bang': |
|
9b7d7ea79f16
stop trying separate dns on 10.5 net. just use names like 'bang5'
drewp@bigasterisk.com
parents:
89
diff
changeset
|
72 # systemd.service(service=f'dnsmasq_10.5', enabled=True, restarted=True, daemon_reload=True) |