59 lines
1.3 KiB
Markdown
59 lines
1.3 KiB
Markdown
# WireGuard VPN Server
|
|
|
|
Configures Talos as a WireGuard VPN server providing access to home network (192.168.178.0/24).
|
|
|
|
## Configuration
|
|
|
|
Clients are defined in `vault/wireguard.yml`:
|
|
|
|
```yaml
|
|
wireguard_server:
|
|
private_key: "..."
|
|
public_key: "..."
|
|
|
|
wireguard_clients:
|
|
- name: masser
|
|
private_key: "..."
|
|
public_key: "..."
|
|
ip_address: "10.8.0.2/24"
|
|
description: "Masser phone"
|
|
```
|
|
|
|
## Adding a Client
|
|
|
|
1. Generate vanity key:
|
|
```bash
|
|
timeout 120 wireguard-vanity-address --in 4 newc 2>&1 | grep "^private" | head -1
|
|
```
|
|
|
|
2. Edit vault:
|
|
```bash
|
|
ansible-vault edit vault/wireguard.yml
|
|
```
|
|
|
|
3. Add to `wireguard_clients` list:
|
|
```yaml
|
|
- name: newclient
|
|
private_key: "paste_from_step_1"
|
|
public_key: "paste_from_step_1"
|
|
ip_address: "10.8.0.X/24"
|
|
description: "Description"
|
|
```
|
|
|
|
4. Deploy:
|
|
```bash
|
|
ansible-playbook -i inventory.yml playbook.yml --limit talos --tags leaf
|
|
```
|
|
|
|
5. Get client config from server:
|
|
```bash
|
|
ssh nerevar@192.168.178.64 'sudo cat /etc/wireguard/clients/newclient.qr.txt'
|
|
```
|
|
|
|
## Network Details
|
|
|
|
- WireGuard network: 10.8.0.0/24
|
|
- Server IP: 10.8.0.1
|
|
- Server endpoint: home.hoekveen.net:51820
|
|
- Server public key stored in vault
|
|
- Port forwarding required: UDP 51820 -> 192.168.178.64 |