diff options
Diffstat (limited to 'inventory/host_vars/ele-router-hmtsaal.yml')
| -rw-r--r-- | inventory/host_vars/ele-router-hmtsaal.yml | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/inventory/host_vars/ele-router-hmtsaal.yml b/inventory/host_vars/ele-router-hmtsaal.yml index becaf9fa..ffb76272 100644 --- a/inventory/host_vars/ele-router-hmtsaal.yml +++ b/inventory/host_vars/ele-router-hmtsaal.yml @@ -149,6 +149,7 @@ openwrt_packages_add: - mtr - iptraf-ng - sqm-scripts + - openvpn-openssl - prometheus-node-exporter-lua - prometheus-node-exporter-lua-nat_traffic - prometheus-node-exporter-lua-netstat @@ -166,6 +167,23 @@ openwrt_mixin: content: | {{ network_zones.lan.prefix | ansible.utils.ipaddr(network_zones.lan.offsets['ele-media']) | ansible.utils.ipaddr('address') }} media.elevate.at + /etc/hotplug.d/openvpn/10-mgmt: + content: | + #!/bin/sh + [ "$INSTANCE" != "mgmt" ] && exit 0 + [ "$ACTION" = "up" ] && ip link set up mtu "$3" dev "$2" master "br-mgmt" + exit 0 + + /etc/openvpn/mgmt-ca-cert.pem: + content: "{{ vault_ovpn_mgmt_ca_cert }}" + + /etc/openvpn/mgmt-cert.pem: + content: "{{ vault_ovpn_mgmt_certs[inventory_hostname] }}" + + /etc/openvpn/mgmt-key.pem: + content: "{{ vault_ovpn_mgmt_keys[inventory_hostname] }}" + mode: '0400' + /etc/rc.d/S21nftables: link: "../init.d/nftables" @@ -209,6 +227,7 @@ openwrt_mixin: ip protocol icmp accept ip6 nexthdr ipv6-icmp accept tcp dport { {{ ansible_port }} } accept + udp dport { 1194 } accept } chain input_internal { @@ -298,6 +317,33 @@ openwrt_uci: linklayer: 'ethernet' overhead: '44 mpu 84' + openvpn: + - name: openvpn mgmt + options: + enabled: '1' + port: '1194' + proto: 'udp' + dev: 'ovpn-mgmt' + dev_type: 'tap' + + server_bridge: 'nogw' + keepalive: '10 120' + persist_key: '1' + persist_tun: '1' + user: 'nobody' + + tls_version_min: '1.3' + ca: '/etc/openvpn/mgmt-ca-cert.pem' + cert: '/etc/openvpn/mgmt-cert.pem' + key: '/etc/openvpn/mgmt-key.pem' + dh: 'none' + remote_cert_tls: 'client' + data_ciphers: + - 'CHACHA20-POLY1305' + data_ciphers_fallback: 'AES-256-GCM' + allow_compression: 'no' + + prometheus_scrape_endpoint: "{{ network_mgmt_zone.prefix | ansible.utils.ipaddr(network_mgmt_zone.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}:9100" prometheus_exporters_default: - openwrt |