wireguard, stash, docker debian, jellyfin
This commit is contained in:
@@ -17,5 +17,6 @@
|
||||
key: "{{ lookup('file', '/home/' + item + '/.ssh/id_rsa.pub')}}"
|
||||
when:
|
||||
- users is defined
|
||||
- lookup('first_found', '/home/' + item + '/.ssh/id_rsa.pub', errors='ignore')
|
||||
- lookup('first_found', dict(files=['/home/' + item + '/.ssh/id_rsa.pub'], skip=true)) | length > 0
|
||||
#- lookup('first_found', '/home/' + item + '/.ssh/id_rsa.pub', errors='ignore')
|
||||
loop: "{{ users }}"
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
block:
|
||||
- name: Include service vault
|
||||
include_vars:
|
||||
file: "{{ service_name }}/vault.yml"
|
||||
dir: "{{ service_name }}"
|
||||
files_matching: vault.yml
|
||||
- name: Create service directory
|
||||
file:
|
||||
path: "/opt/{{ service_name }}"
|
||||
|
||||
@@ -39,3 +39,6 @@
|
||||
name: nerevar
|
||||
groups: docker
|
||||
append: yes
|
||||
- name: Create reverse proxy network
|
||||
community.docker.docker_network:
|
||||
name: proxy
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
- name: Deploy Jellyfin
|
||||
include_tasks: tasks/docker_service.yml
|
||||
vars:
|
||||
service_name: jellyfin
|
||||
@@ -0,0 +1,22 @@
|
||||
services:
|
||||
jellyfin:
|
||||
image: jellyfin/jellyfin:10.11
|
||||
container_name: jellyfin
|
||||
# Optional - specify the uid and gid you would like Jellyfin to use instead of root
|
||||
user: 0:1003
|
||||
ports:
|
||||
- 8096:8096/tcp
|
||||
- 7359:7359/udp
|
||||
volumes:
|
||||
- ./config:/config
|
||||
- ./cache:/cache
|
||||
- type: bind
|
||||
source: /mnt/azura
|
||||
target: /media
|
||||
read_only: true
|
||||
devices:
|
||||
- /dev/dri:/dev/dri
|
||||
restart: 'unless-stopped'
|
||||
# Optional - may be necessary for docker healthcheck to pass if running in host network mode
|
||||
extra_hosts:
|
||||
- 'host.docker.internal:host-gateway'
|
||||
@@ -0,0 +1,6 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
35646162643235336465636563653039656633313038313138323630336162373163626139613763
|
||||
3862666462343762363332323231616666336339306138310a343666353834623430363535613866
|
||||
30623233643664393466373734633734323334363761616665636161316432373333613130333164
|
||||
3639636538353035620a396463666662373665613235373138623739613665656236633533646162
|
||||
3765
|
||||
+4
-52
@@ -1,52 +1,4 @@
|
||||
- name: Create temp directory
|
||||
tempfile:
|
||||
state: directory
|
||||
suffix: bininstall
|
||||
register: temp_dir
|
||||
|
||||
- name: Download binary
|
||||
get_url:
|
||||
url: "https://github.com/stashapp/stash/releases/latest/download/stash-linux"
|
||||
dest: "{{ temp_dir.path }}/stash"
|
||||
mode: 0755
|
||||
|
||||
- name: Move binary to system path
|
||||
copy:
|
||||
src: "{{ temp_dir.path }}/stash"
|
||||
dest: "/usr/local/bin/"
|
||||
mode: 0755
|
||||
remote_src: yes
|
||||
|
||||
- name: Copy service file
|
||||
copy:
|
||||
src: stash/stash.service
|
||||
dest: /etc/systemd/system/
|
||||
mode: 0644
|
||||
|
||||
- name: Stash user
|
||||
user:
|
||||
name: stash
|
||||
system: yes
|
||||
create_home: no
|
||||
shell: /sbin/nologin
|
||||
groups: aurbis
|
||||
|
||||
- name: Create config dir
|
||||
file:
|
||||
path: /var/lib/stash
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: "stash"
|
||||
group: "stash"
|
||||
|
||||
- name: Start and enable stash service
|
||||
systemd:
|
||||
name: stash
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Clean up temp directory
|
||||
file:
|
||||
path: "{{ temp_dir.path }}"
|
||||
state: absent
|
||||
- name: Deploy Stash
|
||||
include_tasks: tasks/docker_service.yml
|
||||
vars:
|
||||
service_name: stash
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
services:
|
||||
stash:
|
||||
image: stashapp/stash:latest
|
||||
container_name: stash
|
||||
restart: unless-stopped
|
||||
## the container's port must be the same with the STASH_PORT in the environment section
|
||||
ports:
|
||||
- "9999:9999"
|
||||
## If you intend to use stash's DLNA functionality uncomment the below network mode and comment out the above ports section
|
||||
# network_mode: host
|
||||
logging:
|
||||
driver: "json-file"
|
||||
options:
|
||||
max-file: "10"
|
||||
max-size: "2m"
|
||||
environment:
|
||||
- STASH_STASH=/data/
|
||||
- STASH_GENERATED=/generated/
|
||||
- STASH_METADATA=/metadata/
|
||||
- STASH_CACHE=/cache/
|
||||
## Adjust below to change default port (9999)
|
||||
- STASH_PORT=9999
|
||||
volumes:
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
## Adjust below paths (the left part) to your liking.
|
||||
## E.g. you can change ./config:/root/.stash to ./stash:/root/.stash
|
||||
## The left part is the path on your host, the right part is the path in the stash container.
|
||||
|
||||
## Keep configs, scrapers, and plugins here.
|
||||
- ./config:/root/.stash
|
||||
## Point this at your collection.
|
||||
## The left side is where your collection is on your host, the right side is where it will be in stash.
|
||||
- /mnt/nocturnal/share/downloads:/data
|
||||
## This is where your stash's metadata lives
|
||||
- ./metadata:/metadata
|
||||
## Any other cache content.
|
||||
- ./cache:/cache
|
||||
## Where to store binary blob data (scene covers, images)
|
||||
- ./blobs:/blobs
|
||||
## Where to store generated content (screenshots,previews,transcodes,sprites)
|
||||
- ./generated:/generated
|
||||
@@ -0,0 +1,211 @@
|
||||
- name: Load WireGuard keys from vault
|
||||
include_vars:
|
||||
file: vault/wireguard.yml
|
||||
|
||||
- name: Validate wireguard configuration
|
||||
assert:
|
||||
that:
|
||||
- wireguard_server is defined
|
||||
- wireguard_clients is defined
|
||||
- wireguard_clients | length > 0
|
||||
fail_msg: "wireguard_server and wireguard_clients must be defined in vault/wireguard.yml"
|
||||
|
||||
- name: Install WireGuard packages
|
||||
apt:
|
||||
name:
|
||||
- wireguard
|
||||
- wireguard-tools
|
||||
- qrencode
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Create WireGuard directory structure
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0700"
|
||||
loop:
|
||||
- /etc/wireguard
|
||||
- /etc/wireguard/clients
|
||||
- /etc/wireguard/keys
|
||||
|
||||
- name: Generate key generation script
|
||||
copy:
|
||||
dest: /etc/wireguard/generate_key.sh
|
||||
mode: "0700"
|
||||
content: |
|
||||
#!/bin/bash
|
||||
# Generate a WireGuard keypair
|
||||
# Usage: ./generate_key.sh <output_prefix>
|
||||
|
||||
OUTPUT_PREFIX="$1"
|
||||
|
||||
if [ -z "$OUTPUT_PREFIX" ]; then
|
||||
echo "Usage: $0 <output_file_prefix>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Generating WireGuard keypair..."
|
||||
umask 077
|
||||
wg genkey | tee "${OUTPUT_PREFIX}.key" | wg pubkey > "${OUTPUT_PREFIX}.pub"
|
||||
chmod 600 "${OUTPUT_PREFIX}.key"
|
||||
chmod 644 "${OUTPUT_PREFIX}.pub"
|
||||
echo "Keys generated: ${OUTPUT_PREFIX}.key and ${OUTPUT_PREFIX}.pub"
|
||||
|
||||
- name: Deploy add_client.sh script
|
||||
copy:
|
||||
src: wireguard/add_client.sh
|
||||
dest: /etc/wireguard/add_client.sh
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create server private key file
|
||||
copy:
|
||||
content: "{{ wireguard_server.private_key }}"
|
||||
dest: "/etc/wireguard/keys/server.key"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
no_log: true
|
||||
|
||||
- name: Create server public key file
|
||||
copy:
|
||||
content: "{{ wireguard_server.public_key }}"
|
||||
dest: "/etc/wireguard/keys/server.pub"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Create client private key files
|
||||
copy:
|
||||
content: "{{ item.private_key }}"
|
||||
dest: "/etc/wireguard/keys/{{ item.name }}.key"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
loop: "{{ wireguard_clients }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
no_log: true
|
||||
|
||||
- name: Create client public key files
|
||||
copy:
|
||||
content: "{{ item.public_key }}"
|
||||
dest: "/etc/wireguard/keys/{{ item.name }}.pub"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
loop: "{{ wireguard_clients }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
- name: Create systemd-networkd WireGuard netdev configuration
|
||||
template:
|
||||
src: wireguard/wg0.netdev.j2
|
||||
dest: /etc/systemd/network/99-wg0.netdev
|
||||
owner: root
|
||||
group: systemd-network
|
||||
mode: "0640"
|
||||
notify: reload systemd-networkd
|
||||
no_log: true
|
||||
|
||||
- name: Create systemd-networkd WireGuard network configuration
|
||||
template:
|
||||
src: wireguard/wg0.network.j2
|
||||
dest: /etc/systemd/network/99-wg0.network
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: reload systemd-networkd
|
||||
|
||||
- name: Enable IP forwarding
|
||||
sysctl:
|
||||
name: net.ipv4.ip_forward
|
||||
value: "1"
|
||||
state: present
|
||||
sysctl_set: yes
|
||||
reload: yes
|
||||
|
||||
- name: Install iptables-persistent for firewall rules
|
||||
apt:
|
||||
name: iptables-persistent
|
||||
state: present
|
||||
|
||||
- name: Configure iptables masquerading for WireGuard
|
||||
iptables:
|
||||
table: nat
|
||||
chain: POSTROUTING
|
||||
out_interface: "{{ ansible_default_ipv4.interface }}"
|
||||
source: 10.8.0.0/24
|
||||
jump: MASQUERADE
|
||||
comment: WireGuard masquerading
|
||||
notify: save iptables
|
||||
|
||||
- name: Configure iptables forwarding for WireGuard
|
||||
iptables:
|
||||
chain: FORWARD
|
||||
in_interface: wg0
|
||||
jump: ACCEPT
|
||||
comment: WireGuard forward in
|
||||
notify: save iptables
|
||||
|
||||
- name: Configure iptables forwarding from WireGuard
|
||||
iptables:
|
||||
chain: FORWARD
|
||||
out_interface: wg0
|
||||
jump: ACCEPT
|
||||
comment: WireGuard forward out
|
||||
notify: save iptables
|
||||
|
||||
- name: Enable and start systemd-networkd
|
||||
systemd:
|
||||
name: systemd-networkd
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: Generate client configuration files
|
||||
template:
|
||||
src: wireguard/client.conf.j2
|
||||
dest: "/etc/wireguard/clients/{{ item.name }}.conf"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
loop: "{{ wireguard_clients }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
no_log: true
|
||||
|
||||
- name: Generate QR codes for client configurations
|
||||
shell: |
|
||||
qrencode -t ansiutf8 -r /etc/wireguard/clients/{{ item.name }}.conf > /etc/wireguard/clients/{{ item.name }}.qr.txt
|
||||
qrencode -t png -r /etc/wireguard/clients/{{ item.name }}.conf -o /etc/wireguard/clients/{{ item.name }}.qr.png
|
||||
loop: "{{ wireguard_clients }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
- name: Display WireGuard setup information
|
||||
debug:
|
||||
msg:
|
||||
- "=============================================="
|
||||
- "WireGuard Server Setup Complete!"
|
||||
- "=============================================="
|
||||
- "Server public key: {{ wireguard_server.public_key }}"
|
||||
- "Server endpoint: {{ ansible_host }}:51820"
|
||||
- "WireGuard network: 10.8.0.0/24"
|
||||
- "Server IP: 10.8.0.1"
|
||||
- ""
|
||||
- "Configured clients ({{ wireguard_clients | length }}):"
|
||||
- "{% for client in wireguard_clients %} - {{ client.name }} ({{ client.ip_address }}) - {{ client.description }}{% endfor %}"
|
||||
- ""
|
||||
- "Client configurations:"
|
||||
- "{% for client in wireguard_clients %} - /etc/wireguard/clients/{{ client.name }}.conf{% endfor %}"
|
||||
- ""
|
||||
- "To view QR code in terminal, run:"
|
||||
- " cat /etc/wireguard/clients/<client_name>.qr.txt"
|
||||
- ""
|
||||
- "To generate additional client keys:"
|
||||
- " /etc/wireguard/generate_key.sh /etc/wireguard/keys/<clientname>"
|
||||
- "=============================================="
|
||||
@@ -0,0 +1,59 @@
|
||||
# WireGuard VPN Server
|
||||
|
||||
Configures Talos as a WireGuard VPN server providing access to home network (192.168.178.0/24).
|
||||
|
||||
## Configuration
|
||||
|
||||
Clients are defined in `vault/wireguard.yml`:
|
||||
|
||||
```yaml
|
||||
wireguard_server:
|
||||
private_key: "..."
|
||||
public_key: "..."
|
||||
|
||||
wireguard_clients:
|
||||
- name: masser
|
||||
private_key: "..."
|
||||
public_key: "..."
|
||||
ip_address: "10.8.0.2/24"
|
||||
description: "Masser phone"
|
||||
```
|
||||
|
||||
## Adding a Client
|
||||
|
||||
1. Generate vanity key:
|
||||
```bash
|
||||
timeout 120 wireguard-vanity-address --in 4 newc 2>&1 | grep "^private" | head -1
|
||||
```
|
||||
|
||||
2. Edit vault:
|
||||
```bash
|
||||
ansible-vault edit vault/wireguard.yml
|
||||
```
|
||||
|
||||
3. Add to `wireguard_clients` list:
|
||||
```yaml
|
||||
- name: newclient
|
||||
private_key: "paste_from_step_1"
|
||||
public_key: "paste_from_step_1"
|
||||
ip_address: "10.8.0.X/24"
|
||||
description: "Description"
|
||||
```
|
||||
|
||||
4. Deploy:
|
||||
```bash
|
||||
ansible-playbook -i inventory.yml playbook.yml --limit talos --tags leaf
|
||||
```
|
||||
|
||||
5. Get client config from server:
|
||||
```bash
|
||||
ssh nerevar@192.168.178.64 'sudo cat /etc/wireguard/clients/newclient.qr.txt'
|
||||
```
|
||||
|
||||
## Network Details
|
||||
|
||||
- WireGuard network: 10.8.0.0/24
|
||||
- Server IP: 10.8.0.1
|
||||
- Server endpoint: home.hoekveen.net:51820
|
||||
- Server public key stored in vault
|
||||
- Port forwarding required: UDP 51820 -> 192.168.178.64
|
||||
@@ -0,0 +1,141 @@
|
||||
#!/bin/bash
|
||||
# Helper script to add a new WireGuard client
|
||||
# Usage: ./add_client.sh <client_name> <ip_suffix>
|
||||
# Example: ./add_client.sh mylaptop 4
|
||||
|
||||
set -e
|
||||
|
||||
CLIENT_NAME="$1"
|
||||
IP_SUFFIX="$2"
|
||||
|
||||
if [ -z "$CLIENT_NAME" ] || [ -z "$IP_SUFFIX" ]; then
|
||||
echo "Usage: $0 <client_name> <ip_suffix>"
|
||||
echo "Example: $0 mylaptop 4"
|
||||
echo ""
|
||||
echo "This will:"
|
||||
echo " - Generate WireGuard keys for the client"
|
||||
echo " - Assign IP 10.8.0.$IP_SUFFIX to the client"
|
||||
echo " - Add peer to WireGuard server config"
|
||||
echo " - Generate client config file and QR codes"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
WG_DIR="/etc/wireguard"
|
||||
KEYS_DIR="$WG_DIR/keys"
|
||||
CLIENTS_DIR="$WG_DIR/clients"
|
||||
NETDEV_FILE="/etc/systemd/network/99-wg0.netdev"
|
||||
|
||||
# Check if running as root
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if client already exists
|
||||
if [ -f "$KEYS_DIR/${CLIENT_NAME}.key" ]; then
|
||||
echo "Error: Client '$CLIENT_NAME' already exists!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if IP is already in use
|
||||
if grep -q "10.8.0.${IP_SUFFIX}/32" "$NETDEV_FILE"; then
|
||||
echo "Error: IP 10.8.0.${IP_SUFFIX} is already assigned!"
|
||||
echo "Choose a different IP suffix."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "=========================================="
|
||||
echo "Adding WireGuard Client: $CLIENT_NAME"
|
||||
echo "=========================================="
|
||||
echo "Client IP: 10.8.0.${IP_SUFFIX}"
|
||||
echo ""
|
||||
|
||||
# Generate keys
|
||||
echo "Generating keys..."
|
||||
cd "$KEYS_DIR"
|
||||
"$WG_DIR/generate_key.sh" "$CLIENT_NAME"
|
||||
|
||||
CLIENT_PRIVATE_KEY=$(cat "${KEYS_DIR}/${CLIENT_NAME}.key")
|
||||
CLIENT_PUBLIC_KEY=$(cat "${KEYS_DIR}/${CLIENT_NAME}.pub")
|
||||
SERVER_PUBLIC_KEY=$(cat "${KEYS_DIR}/server.pub")
|
||||
|
||||
echo "Keys generated successfully!"
|
||||
echo "Public key: $CLIENT_PUBLIC_KEY"
|
||||
echo ""
|
||||
|
||||
# Add peer to netdev file
|
||||
echo "Adding peer to server configuration..."
|
||||
cat >> "$NETDEV_FILE" << EOF
|
||||
|
||||
# $CLIENT_NAME
|
||||
[WireGuardPeer]
|
||||
PublicKey=$CLIENT_PUBLIC_KEY
|
||||
AllowedIPs=10.8.0.${IP_SUFFIX}/32
|
||||
PersistentKeepalive=25
|
||||
EOF
|
||||
|
||||
echo "Peer added to $NETDEV_FILE"
|
||||
echo ""
|
||||
|
||||
# Get server endpoint (try to detect public IP)
|
||||
SERVER_ENDPOINT=$(curl -s ifconfig.me 2>/dev/null || echo "YOUR_PUBLIC_IP")
|
||||
if [ "$SERVER_ENDPOINT" = "YOUR_PUBLIC_IP" ]; then
|
||||
# Fallback to ansible_host if available
|
||||
SERVER_ENDPOINT=$(hostname -I | awk '{print $1}')
|
||||
fi
|
||||
|
||||
# Create client config
|
||||
echo "Creating client configuration..."
|
||||
cat > "$CLIENTS_DIR/${CLIENT_NAME}.conf" << EOF
|
||||
[Interface]
|
||||
Address = 10.8.0.${IP_SUFFIX}/24
|
||||
PrivateKey = $CLIENT_PRIVATE_KEY
|
||||
DNS = 10.8.0.1
|
||||
|
||||
[Peer]
|
||||
PublicKey = $SERVER_PUBLIC_KEY
|
||||
Endpoint = ${SERVER_ENDPOINT}:51820
|
||||
# Route home network traffic through WireGuard
|
||||
# To route ALL traffic (full VPN), change to: 0.0.0.0/0
|
||||
AllowedIPs = 192.168.178.0/24, 10.8.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
|
||||
chmod 600 "$CLIENTS_DIR/${CLIENT_NAME}.conf"
|
||||
echo "Client config created at $CLIENTS_DIR/${CLIENT_NAME}.conf"
|
||||
echo ""
|
||||
|
||||
# Generate QR codes
|
||||
echo "Generating QR codes..."
|
||||
qrencode -t ansiutf8 -r "$CLIENTS_DIR/${CLIENT_NAME}.conf" > "$CLIENTS_DIR/${CLIENT_NAME}.qr.txt"
|
||||
qrencode -t png -r "$CLIENTS_DIR/${CLIENT_NAME}.conf" -o "$CLIENTS_DIR/${CLIENT_NAME}.qr.png"
|
||||
echo "QR codes generated!"
|
||||
echo ""
|
||||
|
||||
# Reload systemd-networkd
|
||||
echo "Reloading systemd-networkd..."
|
||||
networkctl reload
|
||||
sleep 2
|
||||
echo ""
|
||||
|
||||
# Display summary
|
||||
echo "=========================================="
|
||||
echo "Client Added Successfully!"
|
||||
echo "=========================================="
|
||||
echo "Client name: $CLIENT_NAME"
|
||||
echo "Client IP: 10.8.0.${IP_SUFFIX}"
|
||||
echo "Public key: $CLIENT_PUBLIC_KEY"
|
||||
echo ""
|
||||
echo "Configuration files:"
|
||||
echo " - $CLIENTS_DIR/${CLIENT_NAME}.conf"
|
||||
echo " - $CLIENTS_DIR/${CLIENT_NAME}.qr.txt (terminal QR)"
|
||||
echo " - $CLIENTS_DIR/${CLIENT_NAME}.qr.png (image QR)"
|
||||
echo ""
|
||||
echo "To view QR code in terminal:"
|
||||
echo " cat $CLIENTS_DIR/${CLIENT_NAME}.qr.txt"
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo " 1. Copy the client config to your device"
|
||||
echo " 2. Import into WireGuard client app"
|
||||
echo " 3. Connect and test with: ping 10.8.0.1"
|
||||
echo "=========================================="
|
||||
@@ -0,0 +1,12 @@
|
||||
[Interface]
|
||||
Address = {{ item.ip_address }}
|
||||
PrivateKey = {{ item.private_key }}
|
||||
DNS = 10.8.0.1
|
||||
|
||||
[Peer]
|
||||
PublicKey = {{ wireguard_server.public_key }}
|
||||
Endpoint = home.hoekveen.net:51820
|
||||
# Route all home network traffic through WireGuard
|
||||
# To route ALL traffic (full VPN), change to: 0.0.0.0/0
|
||||
AllowedIPs = 192.168.178.0/24, 10.8.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
@@ -0,0 +1,17 @@
|
||||
[NetDev]
|
||||
Name=wg0
|
||||
Kind=wireguard
|
||||
Description=WireGuard VPN tunnel for home network access
|
||||
|
||||
[WireGuard]
|
||||
PrivateKey={{ wireguard_server.private_key }}
|
||||
ListenPort=51820
|
||||
|
||||
{% for client in wireguard_clients %}
|
||||
# {{ client.name }} - {{ client.description }}
|
||||
[WireGuardPeer]
|
||||
PublicKey={{ client.public_key }}
|
||||
AllowedIPs={{ client.ip_address | regex_replace('/\d+$', '/32') }}
|
||||
PersistentKeepalive=25
|
||||
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,10 @@
|
||||
[Match]
|
||||
Name=wg0
|
||||
|
||||
[Network]
|
||||
Address=10.8.0.1/24
|
||||
IPMasquerade=ipv4
|
||||
IPForward=yes
|
||||
|
||||
[Route]
|
||||
Destination=192.168.178.0/24
|
||||
Reference in New Issue
Block a user