basic headscale installation
This commit is contained in:
Stefan Märkle
parent
3232483945
commit
9ff8149e24
@ -1,98 +0,0 @@
|
||||
_____ _
|
||||
| ___| __ ___ | |__ ___
|
||||
| |_ | '__/ _ \| '_ \ / _ \
|
||||
| _|| | | (_) | | | | __/
|
||||
|_| |_| \___/|_| |_|\___|
|
||||
|
||||
__ __ _ _ _ _ _
|
||||
\ \ / /__(_) |__ _ __ __ _ ___| |__ | |_ ___ _ __ | |
|
||||
\ \ /\ / / _ \ | '_ \| '_ \ / _` |/ __| '_ \| __/ _ \ '_ \| |
|
||||
\ V V / __/ | | | | | | | (_| | (__| | | | || __/ | | |_|
|
||||
\_/\_/ \___|_|_| |_|_| |_|\__,_|\___|_| |_|\__\___|_| |_(_)
|
||||
|
||||
|
||||
|
||||
Lieber Iljas,
|
||||
|
||||
Dein Weihnachtsgeschenk dieses Jahr ist mit Arbeit verbunden - Arbeit
|
||||
Deinerseits wohlgemerkt ;-)
|
||||
|
||||
Um es zu genießen mußt Du zuerst:
|
||||
- dem mächtigen amazon Konzern noch weiter in die Hände spielen und Dir
|
||||
einen aws Account einrichten
|
||||
- auf Deinem nagelneuen AWS Account unter Sicherheit/IAM einen Benutzer
|
||||
hinzufügen mit Zugriffstyp "Programmgesteuerter Zugriff"
|
||||
- die dabei generierten Tokens Dir merken und z.B. in Deine .bashrc
|
||||
eintragen als Umgebungsvariablen `AWS_ACCESS_KEY_ID` und `AWS_SECRET_ACCESS_KEY`
|
||||
- Dir ansible installieren - und da Du wahrscheinlich verstehen willst was
|
||||
passiert, ist das ansible lernen die eigentliche Arbeit ;-)
|
||||
- das ansible-Playbook anschauen und ausführen, dass Stefan erstellt hat und
|
||||
das unter wg-aws geclont ist
|
||||
- Dir auf Deinen Geräten wireguard als VPN Software installieren
|
||||
- die Konfigurationen, die das ansible Playbook erstellt hat auf Deinen
|
||||
Geräten importieren (als Datei oder qrcode)
|
||||
- Dich über Deinen neuen mini-Cloud-VPN-Server freuen auf dem Du auch sonst
|
||||
alles machen kannst was Du magst
|
||||
- mit der Inbetriebnahme den unten stehenden Gutschein bei uns einlösen
|
||||
;-) - leider bietet aws nämlich kein Prepaid an ...
|
||||
|
||||
_ _ _ ___
|
||||
__ _____ _ __ | | (_)_ __ __| | __ _ ( _ )
|
||||
\ \ / / _ \| '_ \ | | | | '_ \ / _` |/ _` | / _ \/\
|
||||
\ V / (_) | | | | | |___| | | | | (_| | (_| | | (_> <
|
||||
\_/ \___/|_| |_| |_____|_|_| |_|\__,_|\__,_| \___/\/
|
||||
|
||||
____ _ __
|
||||
/ ___|| |_ ___ / _| __ _ _ __
|
||||
\___ \| __/ _ \ |_ / _` | '_ \
|
||||
___) | || __/ _| (_| | | | |
|
||||
|____/ \__\___|_| \__,_|_| |_|
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
========================= X8 ================================ X8 ==========
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
____ _ _ _ _ _ _
|
||||
/ ___|_ _| |_ ___ ___| |__ ___(_)_ __ _ / | | | __ _| |__ _ __
|
||||
| | _| | | | __/ __|/ __| '_ \ / _ \ | '_ \(_) | | _ | |/ _` | '_ \| '__|
|
||||
| |_| | |_| | |_\__ \ (__| | | | __/ | | | |_ | | | |_| | (_| | | | | |
|
||||
\____|\__,_|\__|___/\___|_| |_|\___|_|_| |_(_) |_| \___/ \__,_|_| |_|_|
|
||||
|
||||
____ _ _
|
||||
/ ___|_ __ __ ___ _(_) |_ ___ _ __
|
||||
| | _| '__/ _` \ \ / / | __/ _ \| '_ \
|
||||
| |_| | | | (_| |\ V /| | || (_) | | | |
|
||||
\____|_| \__,_| \_/ |_|\__\___/|_| |_|
|
||||
|
||||
_ _ _ ____ _
|
||||
| |_| || | __ _ _ __ __ _ _ __ ___ / ___| _ __ ___ | |_
|
||||
| __| || |_ / _` | | '_ \ / _` | '_ \ / _ \ \___ \| '_ \ / _ \| __|
|
||||
| |_|__ _| (_| |_| | | | (_| | | | | (_) | ___) | |_) | (_) | |_
|
||||
\__| |_| \__, (_)_| |_|\__,_|_| |_|\___/ |____/| .__/ \___/ \__|
|
||||
|___/ |_|
|
||||
_ _ _ _
|
||||
(_)_ __ ___| |_ __ _ _ __ ___ ___ | |__ ___(_)
|
||||
| | '_ \/ __| __/ _` | '_ \ / __/ _ \ | '_ \ / _ \ |
|
||||
| | | | \__ \ || (_| | | | | (_| __/ | |_) | __/ |
|
||||
|_|_| |_|___/\__\__,_|_| |_|\___\___| |_.__/ \___|_|
|
||||
|
||||
_
|
||||
__ _ _ __ ___ __ _ _______ _ __ __ _____| |__
|
||||
/ _` | '_ ` _ \ / _` |_ / _ \| '_ \ \ \ /\ / / _ \ '_ \
|
||||
| (_| | | | | | | (_| |/ / (_) | | | | \ V V / __/ |_) |
|
||||
\__,_|_| |_| |_|\__,_/___\___/|_| |_| \_/\_/ \___|_.__/
|
||||
|
||||
_
|
||||
___ ___ _ ____ _(_) ___ ___
|
||||
/ __|/ _ \ '__\ \ / / |/ __/ _ \
|
||||
\__ \ __/ | \ V /| | (_| __/
|
||||
|___/\___|_| \_/ |_|\___\___|
|
||||
|
||||
@ -79,5 +79,5 @@
|
||||
|
||||
- name: Print public IP of this server
|
||||
debug:
|
||||
msg: Your instance has th public IP address {{ item.public_ip }}
|
||||
msg: Your instance has th public IP address {{ item.public_ip_address }}
|
||||
loop: "{{ graviton.instances }}"
|
||||
|
||||
25
roles/common-server/tasks/main.yml
Normal file
25
roles/common-server/tasks/main.yml
Normal file
@ -0,0 +1,25 @@
|
||||
---
|
||||
- name: Update APT package cache
|
||||
apt:
|
||||
update_cache: true
|
||||
upgrade: dist
|
||||
|
||||
- name: Install debian packages
|
||||
apt:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items:
|
||||
- "unattended-upgrades"
|
||||
- "joe"
|
||||
- "fail2ban"
|
||||
|
||||
- name: configure "fail2ban"
|
||||
template:
|
||||
src: jail.local
|
||||
dest: /etc/fail2ban/jail.local
|
||||
|
||||
- name: Restart fail2ban
|
||||
ansible.builtin.systemd:
|
||||
name: fail2ban.service
|
||||
state: restarted
|
||||
enabled: true
|
||||
@ -0,0 +1,36 @@
|
||||
---
|
||||
#- name: Download headscale .deb
|
||||
# get_url:
|
||||
# url="https://github.com/juanfont/headscale/releases/download/v0.22.3/headscale_0.22.3_linux_arm64.deb"
|
||||
# dest="/tmp/headscale.deb"
|
||||
|
||||
#- name: Install my_package
|
||||
# apt: deb="/tmp/headscale.deb"
|
||||
|
||||
- name: determine name of host
|
||||
ansible.builtin.set_fact:
|
||||
headscale_hostname: "{{ inventory_hostname }}"
|
||||
|
||||
- name: determine name of network
|
||||
ansible.builtin.set_fact:
|
||||
headscale_base_domain: "{{ headscale_hostname | regex_replace('^[\\w-]+\\.', '') }}"
|
||||
|
||||
- name: generate config
|
||||
template:
|
||||
src: "config.yaml"
|
||||
dest: "/etc/headscale/config.yaml"
|
||||
|
||||
- name: ensure directories are present
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
with_items:
|
||||
- /var/lib/headscale
|
||||
- /var/lib/headscale/cache
|
||||
|
||||
- name: Enable systemd service
|
||||
ansible.builtin.systemd:
|
||||
name: headscale.service
|
||||
state: started
|
||||
enabled: true
|
||||
38
roles/headscale-server/templates/config.yaml
Normal file
38
roles/headscale-server/templates/config.yaml
Normal file
@ -0,0 +1,38 @@
|
||||
---
|
||||
# Headscale configuration
|
||||
# addresses. ports and paths
|
||||
server_url: "https://{{ headscale_hostname }}"
|
||||
listen_addr: 0.0.0.0:443
|
||||
metrics_listen_addr: 127.0.0.1:9090
|
||||
grpc_listen_addr: 127.0.0.1:50443
|
||||
grpc_allow_insecure: false
|
||||
private_key_path: /var/lib/headscale/private.key
|
||||
noise:
|
||||
private_key_path: /var/lib/headscale/noise_private.key
|
||||
# IP ranges & dns
|
||||
ip_prefixes:
|
||||
- fd7a:115c:a1e0::/48
|
||||
- 10.13.100.0/24
|
||||
dns_config:
|
||||
override_local_dns: true
|
||||
nameservers:
|
||||
- 1.1.1.1
|
||||
magic_dns: true
|
||||
base_domain: {{ headscale_base_domain }}
|
||||
|
||||
# DERP
|
||||
derp:
|
||||
server:
|
||||
enabled: false
|
||||
|
||||
# DB
|
||||
db_type: sqlite3
|
||||
db_path: /var/lib/headscale/db.sqlite
|
||||
|
||||
# TLS
|
||||
acme_url: https://acme-v02.api.letsencrypt.org/directory
|
||||
acme_email: ""
|
||||
tls_letsencrypt_hostname: "{{ headscale_hostname }}"
|
||||
tls_letsencrypt_cache_dir: /var/lib/headscale/cache
|
||||
tls_letsencrypt_challenge_type: HTTP-01
|
||||
tls_letsencrypt_listen: ":http"
|
||||
Loading…
x
Reference in New Issue
Block a user