vpnserver testsetup

site.yml

@@ -66,7 +66,12 @@
         basedir: "/srv/{{ servicename }}",
         domain: "tandoor.test-warpzone.de" 
       }
-
+    - { 
+        role: testserver/docker_vpnserver, tags: [ test_vpnserver, docker_services ],
+        servicename: "vpnserver",
+        basedir: "/srv/{{ servicename }}", 
+        domain: "vpn.test-warpzone.de"
+      }
 
 ##################################################
 # Produktive Server

testserver/docker_icinga/Documentation.md

@@ -3,6 +3,6 @@
 3.  uffd configurieren
     1. neuen Dienst erstellen
     2. OAuth2 Client-ID erstellen
-        - Client-ID: gitea
+        - Client-ID: icinga
         - Client-Secret: /srv/icinga/secrets/oauth_client_secret
-        - Redirect-URIs: https://<icingaß-domain>/user/oauth2/uffd/callback
\ No newline at end of file
+        - Redirect-URIs: https://<icinga-domain>/user/oauth2/uffd/callback
\ No newline at end of file

testserver/docker_vpnserver/Documentation.md

+1. /srv/vpnserver und /srv/vpnserver/secrets erstellen, "wg genkey > wg_private_key" in /srv/vpnserver/secrets
+2. deployen
+3.  uffd configurieren
+    1. neuen Dienst erstellen
+    2. OAuth2 Client-ID erstellen
+        - Client-ID: vpnserver
+        - Client-Secret: /srv/vpnserver/secrets/oauth_client_secret
+        - Redirect-URIs: https://<vpnserver-domain>/user/oauth2/uffd/callback
\ No newline at end of file

testserver/docker_vpnserver/tasks/main.yml

+---
+
+- include_tasks: ../functions/get_secret.yml
+  with_items:
+    - { path: "{{ basedir }}/secrets/wg_admin_pass",  length: 32 }
+    - { path: "{{ basedir }}/secrets/oauth_client_secret", length: 64 }
+    - { path: "{{ basedir }}/secrets/wg_private_key",  length: -1 } # 'wg genkey'
+
+
+- name: install wireguard
+  ansible.builtin.package:
+    name:
+      - wireguard
+      - iptables 
+    state: present
+
+- name: enable wireguard and iptables modules
+  community.general.modprobe:
+    name: "{{ item }}"
+    state: present
+    persistent: present
+  loop:
+    - wireguard
+    - iptables
+
+- name: create folder struct for vpnserver
+  file:
+    path: "{{ item }}"
+    state: "directory"
+  with_items:
+    - "{{ basedir }}"
+    - "{{ basedir }}/data"
+
+
+- name: "copy {{ servicename }} config files"
+  template:
+    src: "{{ item }}"
+    dest: "{{ basedir }}/{{ item }}"
+  with_items:
+    - docker-compose.yml
+    - config.yml
+  register: config
+
+
+- name: "stop {{ servicename }} docker"
+  community.docker.docker_compose_v2:
+    project_src: "{{ basedir }}"
+    state: absent
+  when: config.changed
+
+
+- name: "start {{ servicename }} docker"
+  community.docker.docker_compose_v2:
+    project_src: "{{ basedir }}"
+    state: present

testserver/docker_vpnserver/templates/config.yml

+# You can disable the builtin admin account by leaving out 'adminPassword'. Requires another backend to be configured.
+adminPassword: "{{ wg_admin_pass }}"
+# adminUsername sets the user for the Basic/Simple Auth admin account if adminPassword is set.
+# Every user of the basic and simple backend with a username matching adminUsername will have admin privileges.
+adminUsername: "vpnadmin"
+# Configure zero or more authentication backends
+auth:
+  oidc:
+    # A name for the backend (is shown on the login page and possibly in the devices list of the 'all devices' admin page)
+    name: "uffd"
+    # Should point to the OIDC Issuer (excluding /.well-known/openid-configuration)
+    issuer: "{{ oidc_global.provider_url }}"
+    # Your OIDC client credentials which would be provided by your OIDC provider
+    clientID: "{{ servicename }}"
+    clientSecret: "{{ oauth_client_secret }}"
+    # The full redirect URL
+    # The path can be almost anything as long as it doesn't
+    # conflict with a path that the web UI uses.
+    # /callback is recommended.
+    redirectURL: "{{ oidc_global.provider_url }}/callback"
+    # List of scopes to request claims for. Must include 'openid'.
+    # Must include 'email' if 'emailDomains' is used. Can include 'profile' to show the user's name in the UI.
+    # Add custom ones if required for 'claimMapping'.
+    # Defaults to ["openid"]
+    scopes:
+      - openid
+      - profile
+      - email
+    # You can optionally restrict access to users with an email address
+    # that matches an allowed domain.
+    # If empty or omitted then all email domains will be allowed.
+    # This is an advanced feature that allows you to define OIDC claim mapping expressions.
+    # This feature is used to define wg-access-server admins based off a claim in your OIDC token.
+    # A JSON-like object of claimKey: claimValue pairs as returned by the issuer is passed to the evaluation function. 
+    # See https://github.com/Knetic/govaluate/blob/9aa49832a739dcd78a5542ff189fb82c3e423116/MANUAL.md for the syntax.
+    claimMapping:
+      # This example works if you have a custom group_membership claim which is a list of strings 
+      admin: "'vpnserver_admin' in group_membership"
+      access: "'vpnserver_access' in group_membership"
+    # Let wg-access-server retrieve the claims from the ID Token instead of querying the UserInfo endpoint.
+    # Some OIDC authorization provider implementations (e.g. ADFS) only publish claims in the ID Token.
+    claimsFromIDToken: false
+    # require this claim to be "true" to allow access for the user
+    accessClaim: "access"
\ No newline at end of file

testserver/docker_vpnserver/templates/docker-compose.yml

+services:
+
+  app:
+    image: ghcr.io/freifunkmuc/wg-access-server:latest
+    restart: always
+    cap_add:
+      - NET_ADMIN
+    sysctls:
+      net.ipv6.conf.all.disable_ipv6: 0
+      net.ipv6.conf.all.forwarding: 1
+    volumes:
+      - "{{ basedir }}/data:/data"
+      - "{{ basedir }}/config.yaml:/config.yml" # if you have a custom config file
+    ports:
+    #  - "8000:8000/tcp"
+      - "51820:51820/udp"
+    devices:
+      - "/dev/net/tun:/dev/net/tun"
+    environment:
+      - "WG_WIREGUARD_PRIVATE_KEY={{ wg_private_key }}"
+      - "WG_VPN_CIDRV6=0" # to disable IPv6
+      - "WG_EXTERNAL_HOST={{ domain }}"
+      - "WG_DNS_ENABLED=true"
+      - "WG_DNS_UPSTREAM=10.0.0.1"
+      - "WG_LOG_LEVEL=info"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.{{ servicename }}.rule=Host(`{{ domain }}`)
+      - traefik.http.routers.{{ servicename }}.entrypoints=websecure
+      - traefik.http.services.{{ servicename }}.loadbalancer.server.port=8000
+    networks:
+      - default
+      - web
+
+
+networks:
+  web:
+    external: true