wireguard, stash, docker debian, jellyfin

2026-03-21 13:17:20 +01:00
parent 473e8d4a8d
commit d07446a879
18 changed files with 767 additions and 54 deletions
@@ -0,0 +1,59 @@
+# WireGuard VPN Server
+
+Configures Talos as a WireGuard VPN server providing access to home network (192.168.178.0/24).
+
+## Configuration
+
+Clients are defined in `vault/wireguard.yml`:
+
+```yaml
+wireguard_server:
+  private_key: "..."
+  public_key: "..."
+
+wireguard_clients:
+  - name: masser
+    private_key: "..."
+    public_key: "..."
+    ip_address: "10.8.0.2/24"
+    description: "Masser phone"
+```
+
+## Adding a Client
+
+1. Generate vanity key:
+   ```bash
+   timeout 120 wireguard-vanity-address --in 4 newc 2>&1 | grep "^private" | head -1
+   ```
+
+2. Edit vault:
+   ```bash
+   ansible-vault edit vault/wireguard.yml
+   ```
+
+3. Add to `wireguard_clients` list:
+   ```yaml
+   - name: newclient
+     private_key: "paste_from_step_1"
+     public_key: "paste_from_step_1"
+     ip_address: "10.8.0.X/24"
+     description: "Description"
+   ```
+
+4. Deploy:
+   ```bash
+   ansible-playbook -i inventory.yml playbook.yml --limit talos --tags leaf
+   ```
+
+5. Get client config from server:
+   ```bash
+   ssh nerevar@192.168.178.64 'sudo cat /etc/wireguard/clients/newclient.qr.txt'
+   ```
+
+## Network Details
+
+- WireGuard network: 10.8.0.0/24
+- Server IP: 10.8.0.1
+- Server endpoint: home.hoekveen.net:51820
+- Server public key stored in vault
+- Port forwarding required: UDP 51820 -> 192.168.178.64
@@ -0,0 +1,141 @@
+#!/bin/bash
+# Helper script to add a new WireGuard client
+# Usage: ./add_client.sh <client_name> <ip_suffix>
+# Example: ./add_client.sh mylaptop 4
+
+set -e
+
+CLIENT_NAME="$1"
+IP_SUFFIX="$2"
+
+if [ -z "$CLIENT_NAME" ] || [ -z "$IP_SUFFIX" ]; then
+    echo "Usage: $0 <client_name> <ip_suffix>"
+    echo "Example: $0 mylaptop 4"
+    echo ""
+    echo "This will:"
+    echo "  - Generate WireGuard keys for the client"
+    echo "  - Assign IP 10.8.0.$IP_SUFFIX to the client"
+    echo "  - Add peer to WireGuard server config"
+    echo "  - Generate client config file and QR codes"
+    exit 1
+fi
+
+WG_DIR="/etc/wireguard"
+KEYS_DIR="$WG_DIR/keys"
+CLIENTS_DIR="$WG_DIR/clients"
+NETDEV_FILE="/etc/systemd/network/99-wg0.netdev"
+
+# Check if running as root
+if [ "$EUID" -ne 0 ]; then
+    echo "Please run as root"
+    exit 1
+fi
+
+# Check if client already exists
+if [ -f "$KEYS_DIR/${CLIENT_NAME}.key" ]; then
+    echo "Error: Client '$CLIENT_NAME' already exists!"
+    exit 1
+fi
+
+# Check if IP is already in use
+if grep -q "10.8.0.${IP_SUFFIX}/32" "$NETDEV_FILE"; then
+    echo "Error: IP 10.8.0.${IP_SUFFIX} is already assigned!"
+    echo "Choose a different IP suffix."
+    exit 1
+fi
+
+echo "=========================================="
+echo "Adding WireGuard Client: $CLIENT_NAME"
+echo "=========================================="
+echo "Client IP: 10.8.0.${IP_SUFFIX}"
+echo ""
+
+# Generate keys
+echo "Generating keys..."
+cd "$KEYS_DIR"
+"$WG_DIR/generate_key.sh" "$CLIENT_NAME"
+
+CLIENT_PRIVATE_KEY=$(cat "${KEYS_DIR}/${CLIENT_NAME}.key")
+CLIENT_PUBLIC_KEY=$(cat "${KEYS_DIR}/${CLIENT_NAME}.pub")
+SERVER_PUBLIC_KEY=$(cat "${KEYS_DIR}/server.pub")
+
+echo "Keys generated successfully!"
+echo "Public key: $CLIENT_PUBLIC_KEY"
+echo ""
+
+# Add peer to netdev file
+echo "Adding peer to server configuration..."
+cat >> "$NETDEV_FILE" << EOF
+
+# $CLIENT_NAME
+[WireGuardPeer]
+PublicKey=$CLIENT_PUBLIC_KEY
+AllowedIPs=10.8.0.${IP_SUFFIX}/32
+PersistentKeepalive=25
+EOF
+
+echo "Peer added to $NETDEV_FILE"
+echo ""
+
+# Get server endpoint (try to detect public IP)
+SERVER_ENDPOINT=$(curl -s ifconfig.me 2>/dev/null || echo "YOUR_PUBLIC_IP")
+if [ "$SERVER_ENDPOINT" = "YOUR_PUBLIC_IP" ]; then
+    # Fallback to ansible_host if available
+    SERVER_ENDPOINT=$(hostname -I | awk '{print $1}')
+fi
+
+# Create client config
+echo "Creating client configuration..."
+cat > "$CLIENTS_DIR/${CLIENT_NAME}.conf" << EOF
+[Interface]
+Address = 10.8.0.${IP_SUFFIX}/24
+PrivateKey = $CLIENT_PRIVATE_KEY
+DNS = 10.8.0.1
+
+[Peer]
+PublicKey = $SERVER_PUBLIC_KEY
+Endpoint = ${SERVER_ENDPOINT}:51820
+# Route home network traffic through WireGuard
+# To route ALL traffic (full VPN), change to: 0.0.0.0/0
+AllowedIPs = 192.168.178.0/24, 10.8.0.0/24
+PersistentKeepalive = 25
+EOF
+
+chmod 600 "$CLIENTS_DIR/${CLIENT_NAME}.conf"
+echo "Client config created at $CLIENTS_DIR/${CLIENT_NAME}.conf"
+echo ""
+
+# Generate QR codes
+echo "Generating QR codes..."
+qrencode -t ansiutf8 -r "$CLIENTS_DIR/${CLIENT_NAME}.conf" > "$CLIENTS_DIR/${CLIENT_NAME}.qr.txt"
+qrencode -t png -r "$CLIENTS_DIR/${CLIENT_NAME}.conf" -o "$CLIENTS_DIR/${CLIENT_NAME}.qr.png"
+echo "QR codes generated!"
+echo ""
+
+# Reload systemd-networkd
+echo "Reloading systemd-networkd..."
+networkctl reload
+sleep 2
+echo ""
+
+# Display summary
+echo "=========================================="
+echo "Client Added Successfully!"
+echo "=========================================="
+echo "Client name: $CLIENT_NAME"
+echo "Client IP: 10.8.0.${IP_SUFFIX}"
+echo "Public key: $CLIENT_PUBLIC_KEY"
+echo ""
+echo "Configuration files:"
+echo "  - $CLIENTS_DIR/${CLIENT_NAME}.conf"
+echo "  - $CLIENTS_DIR/${CLIENT_NAME}.qr.txt (terminal QR)"
+echo "  - $CLIENTS_DIR/${CLIENT_NAME}.qr.png (image QR)"
+echo ""
+echo "To view QR code in terminal:"
+echo "  cat $CLIENTS_DIR/${CLIENT_NAME}.qr.txt"
+echo ""
+echo "Next steps:"
+echo "  1. Copy the client config to your device"
+echo "  2. Import into WireGuard client app"
+echo "  3. Connect and test with: ping 10.8.0.1"
+echo "=========================================="
@@ -0,0 +1,12 @@
+[Interface]
+Address = {{ item.ip_address }}
+PrivateKey = {{ item.private_key }}
+DNS = 10.8.0.1
+
+[Peer]
+PublicKey = {{ wireguard_server.public_key }}
+Endpoint = home.hoekveen.net:51820
+# Route all home network traffic through WireGuard
+# To route ALL traffic (full VPN), change to: 0.0.0.0/0
+AllowedIPs = 192.168.178.0/24, 10.8.0.0/24
+PersistentKeepalive = 25
@@ -0,0 +1,17 @@
+[NetDev]
+Name=wg0
+Kind=wireguard
+Description=WireGuard VPN tunnel for home network access
+
+[WireGuard]
+PrivateKey={{ wireguard_server.private_key }}
+ListenPort=51820
+
+{% for client in wireguard_clients %}
+# {{ client.name }} - {{ client.description }}
+[WireGuardPeer]
+PublicKey={{ client.public_key }}
+AllowedIPs={{ client.ip_address | regex_replace('/\d+$', '/32') }}
+PersistentKeepalive=25
+
+{% endfor %}
@@ -0,0 +1,10 @@
+[Match]
+Name=wg0
+
+[Network]
+Address=10.8.0.1/24
+IPMasquerade=ipv4
+IPForward=yes
+
+[Route]
+Destination=192.168.178.0/24