wireguard, stash, docker debian, jellyfin

2026-03-21 13:17:20 +01:00
parent 473e8d4a8d
commit d07446a879
18 changed files with 767 additions and 54 deletions
@@ -0,0 +1,59 @@
+# WireGuard VPN Server
+
+Configures Talos as a WireGuard VPN server providing access to home network (192.168.178.0/24).
+
+## Configuration
+
+Clients are defined in `vault/wireguard.yml`:
+
+```yaml
+wireguard_server:
+  private_key: "..."
+  public_key: "..."
+
+wireguard_clients:
+  - name: masser
+    private_key: "..."
+    public_key: "..."
+    ip_address: "10.8.0.2/24"
+    description: "Masser phone"
+```
+
+## Adding a Client
+
+1. Generate vanity key:
+   ```bash
+   timeout 120 wireguard-vanity-address --in 4 newc 2>&1 | grep "^private" | head -1
+   ```
+
+2. Edit vault:
+   ```bash
+   ansible-vault edit vault/wireguard.yml
+   ```
+
+3. Add to `wireguard_clients` list:
+   ```yaml
+   - name: newclient
+     private_key: "paste_from_step_1"
+     public_key: "paste_from_step_1"
+     ip_address: "10.8.0.X/24"
+     description: "Description"
+   ```
+
+4. Deploy:
+   ```bash
+   ansible-playbook -i inventory.yml playbook.yml --limit talos --tags leaf
+   ```
+
+5. Get client config from server:
+   ```bash
+   ssh nerevar@192.168.178.64 'sudo cat /etc/wireguard/clients/newclient.qr.txt'
+   ```
+
+## Network Details
+
+- WireGuard network: 10.8.0.0/24
+- Server IP: 10.8.0.1
+- Server endpoint: home.hoekveen.net:51820
+- Server public key stored in vault
+- Port forwarding required: UDP 51820 -> 192.168.178.64