From 0f6cabbae37d2750a1841d2e1abd07eca064af29 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sun, 20 Nov 2022 23:30:00 +0100
Subject: add wireguard-based remote vpn connections to ch-(pan|mimas)

---
 inventory/host_vars/ch-mimas.yml  | 23 +++++++++++++++++++++++
 inventory/host_vars/ch-pan.yml    | 23 +++++++++++++++++++++++
 inventory/host_vars/ch-router.yml | 19 ++++++++++---------
 3 files changed, 56 insertions(+), 9 deletions(-)

(limited to 'inventory/host_vars')

diff --git a/inventory/host_vars/ch-mimas.yml b/inventory/host_vars/ch-mimas.yml
index 2bafafe1..32db8f65 100644
--- a/inventory/host_vars/ch-mimas.yml
+++ b/inventory/host_vars/ch-mimas.yml
@@ -47,6 +47,29 @@ zfs_sanoid_modules:
     process_children_only: yes
 
 
+wireguard_p2p_interface:
+  name: remote0
+  description: connection to chaos-at-home internal services
+  listen_port: 51820
+  addresses:
+  - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets[inventory_hostname]) }}"
+  static_routes:
+  - dest: "{{ network_zones.svc.prefix }}"
+    gw: "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-router']) | ansible.utils.ipaddr('address') }}"
+  - dest: "{{ network_zones.lan.prefix | ansible.utils.ipaddr(network_zones.lan.offsets['ch-prometheus-legacy']) | ansible.utils.ipaddr('address') }}/32"
+    gw: "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-router']) | ansible.utils.ipaddr('address') }}"
+
+wireguard_p2p_peers:
+  - pub_key: "9pUDet+les5aI9UnHHVgyw95hNBxlAX8DBCxTjigpEI="
+    endpoint:
+      host: "{{ network_zones.magenta.prefix | ansible.utils.ipaddr(network_zones.magenta.offsets['ch-router']) | ansible.utils.ipaddr('address') }}"
+      port: 51820
+    allowed_ips:
+    - "{{ network_zones.remote.prefix }}"
+    - "{{ network_zones.svc.prefix }}"
+    - "{{ network_zones.lan.prefix | ansible.utils.ipaddr(network_zones.lan.offsets['ch-prometheus-legacy']) | ansible.utils.ipaddr('address') }}/32"
+
+
 bind_option_empty_zones_enable: no
 bind_option_allow_transfer: []
 bind_option_allow_recursion:
diff --git a/inventory/host_vars/ch-pan.yml b/inventory/host_vars/ch-pan.yml
index 9f18ed93..5beabb31 100644
--- a/inventory/host_vars/ch-pan.yml
+++ b/inventory/host_vars/ch-pan.yml
@@ -41,6 +41,29 @@ sshd_allowusers_host: "{{ admin_users_host + ['dyndns'] }}"
 ntp_variant: systemd-timesyncd
 
 
+wireguard_p2p_interface:
+  name: remote0
+  description: connection to chaos-at-home internal services
+  listen_port: 51820
+  addresses:
+  - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets[inventory_hostname]) }}"
+  static_routes:
+  - dest: "{{ network_zones.svc.prefix }}"
+    gw: "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-router']) | ansible.utils.ipaddr('address') }}"
+  - dest: "{{ network_zones.lan.prefix | ansible.utils.ipaddr(network_zones.lan.offsets['ch-prometheus-legacy']) | ansible.utils.ipaddr('address') }}/32"
+    gw: "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-router']) | ansible.utils.ipaddr('address') }}"
+
+wireguard_p2p_peers:
+  - pub_key: "9pUDet+les5aI9UnHHVgyw95hNBxlAX8DBCxTjigpEI="
+    endpoint:
+      host: "{{ network_zones.magenta.prefix | ansible.utils.ipaddr(network_zones.magenta.offsets['ch-router']) | ansible.utils.ipaddr('address') }}"
+      port: 51820
+    allowed_ips:
+    - "{{ network_zones.remote.prefix }}"
+    - "{{ network_zones.svc.prefix }}"
+    - "{{ network_zones.lan.prefix | ansible.utils.ipaddr(network_zones.lan.offsets['ch-prometheus-legacy']) | ansible.utils.ipaddr('address') }}/32"
+
+
 nginx_server_names_hash_bucket_size: 64
 acmetool_directory_server: "{{ acmetool_directory_server_le_live_v2 }}"
 
diff --git a/inventory/host_vars/ch-router.yml b/inventory/host_vars/ch-router.yml
index 794ae485..ce4ed984 100644
--- a/inventory/host_vars/ch-router.yml
+++ b/inventory/host_vars/ch-router.yml
@@ -163,8 +163,9 @@ openwrt_mixin:
       define prefix_mgmt = {{ network_zones.mgmt.prefix }}
       define prefix_openvpn = 192.168.8.0/24
       define prefix_remote = 192.168.51.0/24
+      define prefix_svc = {{ network_zones.svc.prefix }}
       define prefixes_internal = { {{ network_zones.svc.prefix }}, {{ network_zones.lan.prefix }} }
-
+      define ip_prometheus_legacy = {{ network_zones.lan.prefix | ansible.utils.ipaddr(network_zones.lan.offsets['ch-prometheus-legacy']) | ansible.utils.ipaddr('address') }}
 
       table inet global {
         ## INPUT
@@ -213,8 +214,8 @@ openwrt_mixin:
           iif $nic_internal ip saddr $prefixes_internal oif $nic_magenta accept
           iif $nic_internal ip saddr $prefixes_internal oifname $nic_openvpn ip daddr $prefix_openvpn accept
           iifname $nic_openvpn ip saddr $prefix_openvpn oif $nic_internal ip daddr $prefixes_internal accept
-          iif $nic_internal ip saddr $prefixes_internal oifname $nic_remote ip daddr $prefix_remote accept
-          iifname $nic_remote ip saddr $prefix_remote oif $nic_internal ip daddr $prefixes_internal accept ## TODO: review allowed connections
+          iif $nic_internal ip saddr { $prefix_svc, $ip_prometheus_legacy } oifname $nic_remote ip daddr $prefix_remote accept
+          iifname $nic_remote ip saddr $prefix_remote oif $nic_internal ip daddr { $prefix_svc, $ip_prometheus_legacy } accept
       {% for name, svc in network_services.items() %}
           iif $nic_magenta oif $nic_internal ip daddr {{ svc.addr }} tcp dport { {{ svc.ports | join(', ') }} } accept comment "Service: {{ name }}"
       {% endfor %}
@@ -362,24 +363,24 @@ openwrt_uci:
         - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets[inventory_hostname]) }}"
         nohostroute: 1
 
-    - name: wireguard_remote 'ch-pan'
+    - name: wireguard_remote 'pan'
       options:
-        public_key: "" ## TODO
+        public_key: "sd/OqiO0hktuJ3FvIBnM8RJpqG0lkN7wWJjdKbU1TSw="
         # preshared_key: ""
         endpoint_host: "{{ hostvars['ch-pan'].network.primary.address | ansible.utils.ipaddr('address') }}"
         endpoint_port: 51820
         allowed_ips:
-        - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-pan']) }}"
+        - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-pan']) | ansible.utils.ipaddr('address') }}"
         persistent_keepalive: 60
 
-    - name: wireguard_remote 'ch-mimas'
+    - name: wireguard_remote 'mimas'
       options:
-        public_key: "" ## TODO
+        public_key: "ZpvJ3Myn/FSJTqsEkNB5AQaVAuTqfFFCAqLomkeZV3g="
         # preshared_key: ""
         endpoint_host: "{{ hostvars['ch-mimas'].external_ip }}"
         endpoint_port: 51820
         allowed_ips:
-        - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-mimas']) }}"
+        - "{{ network_zones.remote.prefix | ansible.utils.ipaddr(network_zones.remote.offsets['ch-mimas']) | ansible.utils.ipaddr('address') }}"
         persistent_keepalive: 60
 
   sqm:
-- 
cgit v1.2.3