homeassistant and wireguard updates

2026-07-18 11:41:54 +02:00
parent d07446a879
commit 4daebed7e0
10 changed files with 165 additions and 394 deletions
@@ -0,0 +1,54 @@
+- name: Create /opt/homeassistant directory
+  file:
+    path: "/opt/homeassistant"
+    state: directory
+    owner: root
+    group: aurbis
+    mode: "0775"
+
+- name: Create mosquitto config directory
+  file:
+    path: "/opt/homeassistant/mosquitto/config"
+    state: directory
+    owner: root
+    group: aurbis
+    mode: "0775"
+
+- name: Create mosquitto data directory
+  file:
+    path: "/opt/homeassistant/mosquitto/data"
+    state: directory
+    owner: "1883"
+    group: "1883"
+    mode: "0755"
+
+- name: Create mosquitto log directory
+  file:
+    path: "/opt/homeassistant/mosquitto/log"
+    state: directory
+    owner: "1883"
+    group: "1883"
+    mode: "0755"
+
+- name: Copy mosquitto config
+  template:
+    src: homeassistant/mosquitto.conf.j2
+    dest: /opt/homeassistant/mosquitto/config/mosquitto.conf
+    group: aurbis
+    mode: "0644"
+
+- name: Include service vault
+  include_vars:
+    dir: homeassistant
+    files_matching: vault.yml
+
+- name: Copy docker-compose file
+  template:
+    src: homeassistant/docker-compose.yml.j2
+    dest: /opt/homeassistant/docker-compose.yml
+    group: aurbis
+    mode: "0775"
+
+- name: Start homeassistant service
+  community.docker.docker_compose_v2:
+    project_src: /opt/homeassistant
@@ -0,0 +1,42 @@
+services:
+  homeassistant:
+    container_name: homeassistant
+    image: ghcr.io/home-assistant/home-assistant:stable
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./config:/config
+      - /etc/localtime:/etc/localtime:ro
+    environment:
+      - TZ=Europe/Amsterdam
+    privileged: true
+
+  mosquitto:
+    container_name: mosquitto
+    image: eclipse-mosquitto:latest
+    restart: unless-stopped
+    ports:
+      - "1883:1883"
+      - "9001:9001"
+    volumes:
+      - ./mosquitto/config:/mosquitto/config
+      - ./mosquitto/data:/mosquitto/data
+      - ./mosquitto/log:/mosquitto/log
+    environment:
+      - TZ=Europe/Amsterdam
+
+  zigbee2mqtt:
+    container_name: zigbee2mqtt
+    image: ghcr.io/koenkk/zigbee2mqtt:latest
+    restart: unless-stopped
+    volumes:
+      - ./zigbee2mqtt:/app/data
+      - /run/udev:/run/udev:ro
+    ports:
+      - "8080:8080"
+    devices:
+      - /dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_dc3be1218711f011862f3707773d9da9-if00-port0:/dev/ttyUSB0
+    environment:
+      - TZ=Europe/Amsterdam
+    depends_on:
+      - mosquitto
@@ -0,0 +1,6 @@
+listener 1883
+allow_anonymous true
+persistence true
+persistence_location /mosquitto/data/
+log_dest file /mosquitto/log/mosquitto.log
+log_dest stdout
@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.1;AES256
+30376632353734363038306536663830306264626239303134646539646339326631303532313836
+3233346235363866376233653462326664313732373836620a633939353735383331653632633735
+62646434663936666464363661633166386331613932373538396366373763656234383838653565
+6162356463313831340a356232333763326162616365303930626132316534353464613964323663
+61323332636330323966376463373364643661343666323537626438396633623432
@@ -31,37 +31,6 @@
    - /etc/wireguard/clients
    - /etc/wireguard/keys

- name: Generate key generation script
-  copy:
-    dest: /etc/wireguard/generate_key.sh
-    mode: "0700"
-    content: |
-      #!/bin/bash
-      # Generate a WireGuard keypair
-      # Usage: ./generate_key.sh <output_prefix>
-
-      OUTPUT_PREFIX="$1"
-
-      if [ -z "$OUTPUT_PREFIX" ]; then
-        echo "Usage: $0 <output_file_prefix>"
-        exit 1
-      fi
-
-      echo "Generating WireGuard keypair..."
-      umask 077
-      wg genkey | tee "${OUTPUT_PREFIX}.key" | wg pubkey > "${OUTPUT_PREFIX}.pub"
-      chmod 600 "${OUTPUT_PREFIX}.key"
-      chmod 644 "${OUTPUT_PREFIX}.pub"
-      echo "Keys generated: ${OUTPUT_PREFIX}.key and ${OUTPUT_PREFIX}.pub"
-
- name: Deploy add_client.sh script
-  copy:
-    src: wireguard/add_client.sh
-    dest: /etc/wireguard/add_client.sh
-    mode: "0755"
-    owner: root
-    group: root
-
 - name: Create server private key file
  copy:
    content: "{{ wireguard_server.private_key }}"
@@ -138,7 +107,7 @@
  iptables:
    table: nat
    chain: POSTROUTING
-    out_interface: "{{ ansible_default_ipv4.interface }}"
+    out_interface: "enp2s0"
    source: 10.8.0.0/24
    jump: MASQUERADE
    comment: WireGuard masquerading
@@ -1,141 +0,0 @@
-#!/bin/bash
-# Helper script to add a new WireGuard client
-# Usage: ./add_client.sh <client_name> <ip_suffix>
-# Example: ./add_client.sh mylaptop 4
-
-set -e
-
-CLIENT_NAME="$1"
-IP_SUFFIX="$2"
-
-if [ -z "$CLIENT_NAME" ] || [ -z "$IP_SUFFIX" ]; then
-    echo "Usage: $0 <client_name> <ip_suffix>"
-    echo "Example: $0 mylaptop 4"
-    echo ""
-    echo "This will:"
-    echo "  - Generate WireGuard keys for the client"
-    echo "  - Assign IP 10.8.0.$IP_SUFFIX to the client"
-    echo "  - Add peer to WireGuard server config"
-    echo "  - Generate client config file and QR codes"
-    exit 1
-fi
-
-WG_DIR="/etc/wireguard"
-KEYS_DIR="$WG_DIR/keys"
-CLIENTS_DIR="$WG_DIR/clients"
-NETDEV_FILE="/etc/systemd/network/99-wg0.netdev"
-
-# Check if running as root
-if [ "$EUID" -ne 0 ]; then
-    echo "Please run as root"
-    exit 1
-fi
-
-# Check if client already exists
-if [ -f "$KEYS_DIR/${CLIENT_NAME}.key" ]; then
-    echo "Error: Client '$CLIENT_NAME' already exists!"
-    exit 1
-fi
-
-# Check if IP is already in use
-if grep -q "10.8.0.${IP_SUFFIX}/32" "$NETDEV_FILE"; then
-    echo "Error: IP 10.8.0.${IP_SUFFIX} is already assigned!"
-    echo "Choose a different IP suffix."
-    exit 1
-fi
-
-echo "=========================================="
-echo "Adding WireGuard Client: $CLIENT_NAME"
-echo "=========================================="
-echo "Client IP: 10.8.0.${IP_SUFFIX}"
-echo ""
-
-# Generate keys
-echo "Generating keys..."
-cd "$KEYS_DIR"
-"$WG_DIR/generate_key.sh" "$CLIENT_NAME"
-
-CLIENT_PRIVATE_KEY=$(cat "${KEYS_DIR}/${CLIENT_NAME}.key")
-CLIENT_PUBLIC_KEY=$(cat "${KEYS_DIR}/${CLIENT_NAME}.pub")
-SERVER_PUBLIC_KEY=$(cat "${KEYS_DIR}/server.pub")
-
-echo "Keys generated successfully!"
-echo "Public key: $CLIENT_PUBLIC_KEY"
-echo ""
-
-# Add peer to netdev file
-echo "Adding peer to server configuration..."
-cat >> "$NETDEV_FILE" << EOF
-
-# $CLIENT_NAME
-[WireGuardPeer]
-PublicKey=$CLIENT_PUBLIC_KEY
-AllowedIPs=10.8.0.${IP_SUFFIX}/32
-PersistentKeepalive=25
-EOF
-
-echo "Peer added to $NETDEV_FILE"
-echo ""
-
-# Get server endpoint (try to detect public IP)
-SERVER_ENDPOINT=$(curl -s ifconfig.me 2>/dev/null || echo "YOUR_PUBLIC_IP")
-if [ "$SERVER_ENDPOINT" = "YOUR_PUBLIC_IP" ]; then
-    # Fallback to ansible_host if available
-    SERVER_ENDPOINT=$(hostname -I | awk '{print $1}')
-fi
-
-# Create client config
-echo "Creating client configuration..."
-cat > "$CLIENTS_DIR/${CLIENT_NAME}.conf" << EOF
-[Interface]
-Address = 10.8.0.${IP_SUFFIX}/24
-PrivateKey = $CLIENT_PRIVATE_KEY
-DNS = 10.8.0.1
-
-[Peer]
-PublicKey = $SERVER_PUBLIC_KEY
-Endpoint = ${SERVER_ENDPOINT}:51820
-# Route home network traffic through WireGuard
-# To route ALL traffic (full VPN), change to: 0.0.0.0/0
-AllowedIPs = 192.168.178.0/24, 10.8.0.0/24
-PersistentKeepalive = 25
-EOF
-
-chmod 600 "$CLIENTS_DIR/${CLIENT_NAME}.conf"
-echo "Client config created at $CLIENTS_DIR/${CLIENT_NAME}.conf"
-echo ""
-
-# Generate QR codes
-echo "Generating QR codes..."
-qrencode -t ansiutf8 -r "$CLIENTS_DIR/${CLIENT_NAME}.conf" > "$CLIENTS_DIR/${CLIENT_NAME}.qr.txt"
-qrencode -t png -r "$CLIENTS_DIR/${CLIENT_NAME}.conf" -o "$CLIENTS_DIR/${CLIENT_NAME}.qr.png"
-echo "QR codes generated!"
-echo ""
-
-# Reload systemd-networkd
-echo "Reloading systemd-networkd..."
-networkctl reload
-sleep 2
-echo ""
-
-# Display summary
-echo "=========================================="
-echo "Client Added Successfully!"
-echo "=========================================="
-echo "Client name: $CLIENT_NAME"
-echo "Client IP: 10.8.0.${IP_SUFFIX}"
-echo "Public key: $CLIENT_PUBLIC_KEY"
-echo ""
-echo "Configuration files:"
-echo "  - $CLIENTS_DIR/${CLIENT_NAME}.conf"
-echo "  - $CLIENTS_DIR/${CLIENT_NAME}.qr.txt (terminal QR)"
-echo "  - $CLIENTS_DIR/${CLIENT_NAME}.qr.png (image QR)"
-echo ""
-echo "To view QR code in terminal:"
-echo "  cat $CLIENTS_DIR/${CLIENT_NAME}.qr.txt"
-echo ""
-echo "Next steps:"
-echo "  1. Copy the client config to your device"
-echo "  2. Import into WireGuard client app"
-echo "  3. Connect and test with: ping 10.8.0.1"
-echo "=========================================="
@@ -3,8 +3,3 @@ Name=wg0

 [Network]
 Address=10.8.0.1/24
-IPMasquerade=ipv4
-IPForward=yes
-
-[Route]
-Destination=192.168.178.0/24