Enable Discovery debug logging for production troubleshooting
- Add DISCOVERY_LOG_LEVEL=debug - Add DISCOVERY_SHOW_PROGRESS=true - Temporary changes for debugging InitializerProcessor fixes on production
This commit is contained in:
81
ansible/netcup-simple-deploy/SERVER-SETUP.md
Normal file
81
ansible/netcup-simple-deploy/SERVER-SETUP.md
Normal file
@@ -0,0 +1,81 @@
|
||||
# Production Server Setup - Debian 12
|
||||
|
||||
## Netcup Panel Konfiguration
|
||||
|
||||
### 1. Fresh OS Installation
|
||||
1. **Netcup Panel** → "Server" → Ihr Server
|
||||
2. **"Betriebssystem"** → "Neu installieren"
|
||||
3. **OS wählen**: `Debian 12 (Bookworm)` 64-bit
|
||||
4. **Installation starten** und warten bis abgeschlossen
|
||||
|
||||
### 2. SSH-Key Konfiguration
|
||||
1. **SSH-Key hinzufügen**:
|
||||
```
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3DqB1B4wa5Eo116bJ1HybFagK3fU0i+wJ6mAHI1L3i production@michaelschiemer.de
|
||||
```
|
||||
|
||||
2. **Im Netcup Panel**:
|
||||
- "SSH-Keys" → "Neuen SSH-Key hinzufügen"
|
||||
- Name: `production-michaelschiemer`
|
||||
- Key: (oben kopieren und einfügen)
|
||||
- Key dem Server zuweisen
|
||||
|
||||
### 3. Root-Zugang aktivieren
|
||||
1. **Console/KVM** über Netcup Panel öffnen
|
||||
2. **Als root einloggen** (initial Setup)
|
||||
3. **SSH-Key für root aktivieren**:
|
||||
```bash
|
||||
# SSH-Key bereits durch Panel hinzugefügt
|
||||
# Root SSH sollte funktionieren
|
||||
```
|
||||
|
||||
### 4. Deploy User einrichten
|
||||
```bash
|
||||
# Als root ausführen:
|
||||
useradd -m -s /bin/bash deploy
|
||||
usermod -aG sudo deploy
|
||||
|
||||
# SSH-Key für deploy user
|
||||
mkdir -p /home/deploy/.ssh
|
||||
cp /root/.ssh/authorized_keys /home/deploy/.ssh/
|
||||
chown -R deploy:deploy /home/deploy/.ssh
|
||||
chmod 700 /home/deploy/.ssh
|
||||
chmod 600 /home/deploy/.ssh/authorized_keys
|
||||
|
||||
# Sudo ohne Passwort für deploy
|
||||
echo "deploy ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/deploy
|
||||
```
|
||||
|
||||
## Warum Debian 12?
|
||||
|
||||
### Production-Vorteile:
|
||||
- ✅ **Stabilität**: Bewährte LTS-Pakete, längere Support-Zyklen
|
||||
- ✅ **Performance**: Geringerer Ressourcenverbrauch als Ubuntu
|
||||
- ✅ **Security**: Conservative Updates, weniger experimentelle Features
|
||||
- ✅ **Docker-Optimiert**: Perfekt für containerisierte Deployments
|
||||
- ✅ **Minimale Basis**: Nur essentielle Pakete, weniger Attack Surface
|
||||
|
||||
### Server-Spezifikationen:
|
||||
- **RAM**: Minimum 2GB (empfohlen 4GB+)
|
||||
- **Storage**: Minimum 20GB SSD
|
||||
- **CPU**: 1+ vCPU (empfohlen 2+ vCPU)
|
||||
- **Network**: Stable internet, static IP
|
||||
|
||||
## Nach Installation testen:
|
||||
|
||||
```bash
|
||||
# SSH-Connectivity Test
|
||||
ssh -i ~/.ssh/production deploy@94.16.110.151
|
||||
|
||||
# System Info
|
||||
ssh -i ~/.ssh/production deploy@94.16.110.151 'uname -a && lsb_release -a'
|
||||
```
|
||||
|
||||
## Nächste Schritte:
|
||||
Nach erfolgreichem Server-Setup:
|
||||
1. SSH-Connectivity bestätigen
|
||||
2. Ansible Ping-Test durchführen
|
||||
3. Deployment-Playbook ausführen
|
||||
|
||||
---
|
||||
**🔑 SSH-Key Fingerprint**: `SHA256:7FBYrZpDcYcKXpeM8OHoGZZBHwxNORoOFWuzP2MpDpQ`
|
||||
@@ -6,7 +6,7 @@ all:
|
||||
netcup-server:
|
||||
ansible_host: 94.16.110.151
|
||||
ansible_user: deploy
|
||||
ansible_ssh_private_key_file: /home/michael/.ssh/staging
|
||||
ansible_ssh_private_key_file: /home/michael/.ssh/production
|
||||
|
||||
# Server-Details
|
||||
domain: "test.michaelschiemer.de"
|
||||
@@ -22,5 +22,37 @@ all:
|
||||
# Umgebungsvariablen für deine App (wird in .env geschrieben)
|
||||
app_env:
|
||||
APP_ENV: "production"
|
||||
DATABASE_URL: "sqlite:///app/data/app.db"
|
||||
# Füge hier weitere ENV-Variablen hinzu die deine App braucht
|
||||
APP_DEBUG: "false"
|
||||
APP_NAME: "Michael Schiemer"
|
||||
APP_KEY: "base64:kJH8fsd89fs8df7sdf8sdf7sd8f7sdf"
|
||||
APP_TIMEZONE: "Europe/Berlin"
|
||||
APP_LOCALE: "de"
|
||||
|
||||
# Database (Docker internal)
|
||||
DB_DRIVER: "mysql"
|
||||
DB_HOST: "db"
|
||||
DB_PORT: "3306"
|
||||
DB_DATABASE: "michaelschiemer"
|
||||
DB_USERNAME: "mdb-user"
|
||||
DB_PASSWORD: "StartSimple2024!"
|
||||
DB_CHARSET: "utf8mb4"
|
||||
|
||||
# Security
|
||||
SECURITY_ALLOWED_HOSTS: "localhost,test.michaelschiemer.de,michaelschiemer.de"
|
||||
SECURITY_RATE_LIMIT_PER_MINUTE: "60"
|
||||
SECURITY_RATE_LIMIT_BURST: "10"
|
||||
SESSION_LIFETIME: "1800"
|
||||
|
||||
# SSL/HTTPS
|
||||
APP_SSL_PORT: "443"
|
||||
FORCE_HTTPS: "true"
|
||||
|
||||
# Docker Settings
|
||||
COMPOSE_PROJECT_NAME: "framework-production"
|
||||
UID: "1000"
|
||||
GID: "1000"
|
||||
|
||||
# Performance
|
||||
OPCACHE_ENABLED: "true"
|
||||
REDIS_HOST: "redis"
|
||||
REDIS_PORT: "6379"
|
||||
|
||||
75
ansible/netcup-simple-deploy/test-connectivity.sh
Executable file
75
ansible/netcup-simple-deploy/test-connectivity.sh
Executable file
@@ -0,0 +1,75 @@
|
||||
#!/bin/bash
|
||||
# Test Production Server Connectivity
|
||||
|
||||
set -e
|
||||
|
||||
SERVER="94.16.110.151"
|
||||
USER="deploy"
|
||||
SSH_KEY="~/.ssh/production"
|
||||
|
||||
echo "🔧 Production Server Connectivity Test"
|
||||
echo "========================================"
|
||||
echo "Server: $SERVER"
|
||||
echo "User: $USER"
|
||||
echo "SSH-Key: $SSH_KEY"
|
||||
echo ""
|
||||
|
||||
# 1. SSH Key Test
|
||||
echo "1️⃣ SSH-Key Test..."
|
||||
if ssh-keygen -l -f $SSH_KEY.pub &>/dev/null; then
|
||||
echo "✅ SSH-Key ist gültig"
|
||||
ssh-keygen -l -f $SSH_KEY.pub
|
||||
else
|
||||
echo "❌ SSH-Key Problem"
|
||||
exit 1
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 2. SSH Connectivity Test
|
||||
echo "2️⃣ SSH Connectivity Test..."
|
||||
if ssh -i $SSH_KEY -o ConnectTimeout=10 -o StrictHostKeyChecking=no $USER@$SERVER 'echo "SSH Connection successful"' 2>/dev/null; then
|
||||
echo "✅ SSH Connection erfolgreich"
|
||||
else
|
||||
echo "❌ SSH Connection fehlgeschlagen"
|
||||
echo "Möglicherweise ist der Server noch nicht bereit oder SSH-Key nicht konfiguriert"
|
||||
exit 1
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 3. System Info
|
||||
echo "3️⃣ Server System Information..."
|
||||
ssh -i $SSH_KEY $USER@$SERVER 'echo "Hostname: $(hostname)" && echo "OS: $(cat /etc/os-release | grep PRETTY_NAME)" && echo "Kernel: $(uname -r)" && echo "Uptime: $(uptime -p)" && echo "Available space: $(df -h / | tail -1 | awk "{print \$4}")"'
|
||||
echo ""
|
||||
|
||||
# 4. Docker Readiness Check
|
||||
echo "4️⃣ Docker Readiness Check..."
|
||||
if ssh -i $SSH_KEY $USER@$SERVER 'which docker &>/dev/null && which docker-compose &>/dev/null'; then
|
||||
echo "✅ Docker bereits installiert"
|
||||
ssh -i $SSH_KEY $USER@$SERVER 'docker --version && docker-compose --version'
|
||||
else
|
||||
echo "⚠️ Docker noch nicht installiert (wird durch Ansible installiert)"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 5. Ansible Ping Test
|
||||
echo "5️⃣ Ansible Ping Test..."
|
||||
cd "$(dirname "$0")"
|
||||
if ansible netcup-server -i inventory/hosts.yml -m ping; then
|
||||
echo "✅ Ansible Ping erfolgreich"
|
||||
else
|
||||
echo "❌ Ansible Ping fehlgeschlagen"
|
||||
exit 1
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 6. Ansible Gather Facts
|
||||
echo "6️⃣ Ansible System Facts..."
|
||||
ansible netcup-server -i inventory/hosts.yml -m setup -a "filter=ansible_distribution*" | grep -A 10 '"ansible_distribution"'
|
||||
echo ""
|
||||
|
||||
echo "🎉 Connectivity Test erfolgreich abgeschlossen!"
|
||||
echo ""
|
||||
echo "Nächste Schritte:"
|
||||
echo "1. Deployment-Playbook ausführen: ansible-playbook -i inventory/hosts.yml deploy.yml"
|
||||
echo "2. SSL-Zertifikate konfigurieren"
|
||||
echo "3. Monitoring einrichten"
|
||||
@@ -1,37 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Cache Warming Script
|
||||
|
||||
INVENTORY_FILE="inventories/production/hosts.yml"
|
||||
|
||||
# URLs zum Cache-Warming
|
||||
URLS=(
|
||||
"/"
|
||||
"/health"
|
||||
# Füge hier deine wichtigsten URLs hinzu:
|
||||
# "/css/main.css"
|
||||
# "/js/app.js"
|
||||
# "/images/logo.png"
|
||||
)
|
||||
|
||||
echo "🔥 Starting cache warming for all CDN nodes..."
|
||||
|
||||
# Hole alle CDN Node Hostnamen
|
||||
CDN_NODES=$(ansible-inventory -i $INVENTORY_FILE --list | jq -r '.cdn_nodes.hosts[]' 2>/dev/null || ansible cdn_nodes -i $INVENTORY_FILE --list-hosts | grep -v hosts)
|
||||
|
||||
for node in $CDN_NODES; do
|
||||
echo "Warming cache for: $node"
|
||||
|
||||
for url in "${URLS[@]}"; do
|
||||
echo " Warming: $url"
|
||||
response=$(curl -s -o /dev/null -w "%{http_code}" "https://${node}${url}" || echo "000")
|
||||
if [ "$response" = "200" ]; then
|
||||
echo " ✅ OK"
|
||||
else
|
||||
echo " ❌ Failed (HTTP $response)"
|
||||
fi
|
||||
sleep 0.5
|
||||
done
|
||||
echo ""
|
||||
done
|
||||
|
||||
echo "🎉 Cache warming completed!"
|
||||
33
ansible/wireguard-server/.gitignore
vendored
Normal file
33
ansible/wireguard-server/.gitignore
vendored
Normal file
@@ -0,0 +1,33 @@
|
||||
# WireGuard Client Configurations (enthalten private Schlüssel!)
|
||||
client-configs/*.conf
|
||||
client-configs/*.key
|
||||
|
||||
# Backup-Verzeichnisse
|
||||
backups/
|
||||
|
||||
# Ansible temporäre Dateien
|
||||
*.retry
|
||||
.vault_pass
|
||||
|
||||
# SSH-Keys
|
||||
*.pem
|
||||
*.key
|
||||
!*.pub
|
||||
|
||||
# Logs
|
||||
*.log
|
||||
|
||||
# OS-spezifische Dateien
|
||||
.DS_Store
|
||||
Thumbs.db
|
||||
|
||||
# Editor-spezifische Dateien
|
||||
.vscode/
|
||||
.idea/
|
||||
*.swp
|
||||
*.swo
|
||||
*~
|
||||
|
||||
# Temporäre Dateien
|
||||
.tmp/
|
||||
temp/
|
||||
111
ansible/wireguard-server/Makefile
Normal file
111
ansible/wireguard-server/Makefile
Normal file
@@ -0,0 +1,111 @@
|
||||
.PHONY: install setup clients add-client remove-client status download-configs ping-test check-service help
|
||||
|
||||
# Standardziel
|
||||
help:
|
||||
@echo "WireGuard Ansible (vereinfacht, ohne Firewall)"
|
||||
@echo ""
|
||||
@echo "Verfügbare Befehle:"
|
||||
@echo " install - WireGuard installieren"
|
||||
@echo " setup - Nur WireGuard-Server installieren"
|
||||
@echo " clients - Client-Konfigurationen erstellen"
|
||||
@echo " add-client - Neuen Client hinzufügen"
|
||||
@echo " remove-client - Client entfernen"
|
||||
@echo " show-clients - Vorhandene Clients anzeigen"
|
||||
@echo " status - WireGuard-Status anzeigen"
|
||||
@echo " download-configs - Client-Konfigurationen herunterladen"
|
||||
@echo " ping-test - Verbindung zum Server testen"
|
||||
@echo " check-service - Service-Status prüfen"
|
||||
@echo " logs - WireGuard-Logs anzeigen"
|
||||
@echo " restart - WireGuard-Service neustarten"
|
||||
@echo " qr-codes - QR-Codes für alle Clients erstellen"
|
||||
|
||||
# WireGuard-Installation
|
||||
install:
|
||||
@echo "🚀 Installiere WireGuard (ohne Firewall)..."
|
||||
ansible-playbook -i inventory/hosts.yml site.yml
|
||||
|
||||
# Nur Server-Setup
|
||||
setup:
|
||||
@echo "⚙️ Installiere WireGuard-Server..."
|
||||
ansible-playbook -i inventory/hosts.yml wireguard-install-server.yml
|
||||
|
||||
# Client-Konfigurationen erstellen
|
||||
clients:
|
||||
@echo "👥 Erstelle Client-Konfigurationen..."
|
||||
ansible-playbook -i inventory/hosts.yml wireguard-create-config.yml
|
||||
|
||||
# Client-Management
|
||||
add-client:
|
||||
@echo "➕ Füge neuen Client hinzu..."
|
||||
ansible-playbook -i inventory/hosts.yml add-client.yml
|
||||
|
||||
remove-client:
|
||||
@echo "➖ Entferne Client..."
|
||||
ansible-playbook -i inventory/hosts.yml remove-client.yml
|
||||
|
||||
show-clients:
|
||||
@echo "👀 Zeige vorhandene Clients..."
|
||||
ansible-playbook -i inventory/hosts.yml show-clients.yml
|
||||
|
||||
# Status und Überwachung
|
||||
status:
|
||||
@echo "📊 WireGuard-Status:"
|
||||
ansible vpn -i inventory/hosts.yml -m shell -a "wg show"
|
||||
|
||||
download-configs:
|
||||
@echo "📥 Lade Client-Konfigurationen herunter..."
|
||||
@mkdir -p ./client-configs
|
||||
ansible vpn -i inventory/hosts.yml -m fetch -a "src=/etc/wireguard/clients/ dest=./client-configs/ flat=true"
|
||||
@echo "✅ Konfigurationen in ./client-configs/ gespeichert"
|
||||
|
||||
ping-test:
|
||||
@echo "🏓 Teste Verbindung zum Server..."
|
||||
ansible vpn -i inventory/hosts.yml -m ping
|
||||
|
||||
check-service:
|
||||
@echo "🔍 Prüfe WireGuard-Service..."
|
||||
ansible vpn -i inventory/hosts.yml -m systemd -a "name=wg-quick@wg0"
|
||||
|
||||
logs:
|
||||
@echo "📋 WireGuard-Logs:"
|
||||
ansible vpn -i inventory/hosts.yml -m shell -a "journalctl -u wg-quick@wg0 --no-pager -n 20"
|
||||
|
||||
restart:
|
||||
@echo "🔄 Starte WireGuard-Service neu..."
|
||||
ansible vpn -i inventory/hosts.yml -m systemd -a "name=wg-quick@wg0 state=restarted"
|
||||
|
||||
# Client-QR-Codes
|
||||
qr-codes:
|
||||
@echo "📱 Erstelle QR-Codes für alle Clients..."
|
||||
ansible vpn -i inventory/hosts.yml -m shell -a "for conf in /etc/wireguard/clients/*.conf; do echo; echo '=== '$$conf' ==='; qrencode -t ansiutf8 < $$conf; done"
|
||||
|
||||
# Backup der Konfiguration
|
||||
backup:
|
||||
@echo "💾 Erstelle Backup der WireGuard-Konfiguration..."
|
||||
@mkdir -p ./backups/$(shell date +%Y%m%d_%H%M%S)
|
||||
ansible vpn -i inventory/hosts.yml -m fetch -a "src=/etc/wireguard/ dest=./backups/$(shell date +%Y%m%d_%H%M%S)/ flat=true"
|
||||
@echo "✅ Backup in ./backups/$(shell date +%Y%m%d_%H%M%S)/ erstellt"
|
||||
|
||||
# Syntax-Check
|
||||
check:
|
||||
@echo "✅ Prüfe Ansible-Syntax..."
|
||||
ansible-playbook -i inventory/hosts.yml site.yml --syntax-check
|
||||
ansible-playbook -i inventory/hosts.yml add-client.yml --syntax-check
|
||||
ansible-playbook -i inventory/hosts.yml remove-client.yml --syntax-check
|
||||
ansible-playbook -i inventory/hosts.yml show-clients.yml --syntax-check
|
||||
|
||||
# Dry-run
|
||||
dry-run:
|
||||
@echo "🧪 Dry-run der Installation..."
|
||||
ansible-playbook -i inventory/hosts.yml site.yml --check --diff
|
||||
|
||||
# Netzwerk-Info
|
||||
network-info:
|
||||
@echo "🌐 Netzwerk-Informationen:"
|
||||
ansible vpn -i inventory/hosts.yml -m shell -a "ip addr show wg0"
|
||||
ansible vpn -i inventory/hosts.yml -m shell -a "ip route | grep wg0"
|
||||
|
||||
# Server-Konfiguration anzeigen
|
||||
server-config:
|
||||
@echo "📄 Zeige Server-Konfiguration:"
|
||||
ansible vpn -i inventory/hosts.yml -m shell -a "cat /etc/wireguard/wg0.conf"
|
||||
96
ansible/wireguard-server/NO-FIREWALL-INFO.md
Normal file
96
ansible/wireguard-server/NO-FIREWALL-INFO.md
Normal file
@@ -0,0 +1,96 @@
|
||||
# WireGuard ohne Firewall - Konfigurationsmodus
|
||||
|
||||
## 🌐 Was bedeutet "ohne Firewall"?
|
||||
|
||||
### **Normaler Modus (mit Firewall):**
|
||||
- Server ist nur über SSH und WireGuard erreichbar
|
||||
- Alle anderen Ports sind blockiert
|
||||
- Maximale Sicherheit
|
||||
|
||||
### **Ohne Firewall-Modus:**
|
||||
- Server bleibt vollständig öffentlich erreichbar
|
||||
- Alle Services sind über das Internet zugänglich
|
||||
- WireGuard läuft zusätzlich als VPN-Option
|
||||
- Einfacher für Entwicklung und Tests
|
||||
|
||||
## 🎯 Wann ohne Firewall verwenden?
|
||||
|
||||
✅ **Geeignet für:**
|
||||
- Entwicklungsserver
|
||||
- Test-Umgebungen
|
||||
- Server mit eigener Firewall (Cloudflare, AWS Security Groups)
|
||||
- Wenn du mehrere Services öffentlich anbieten willst
|
||||
- Wenn du die Firewall separat konfigurieren möchtest
|
||||
|
||||
❌ **Nicht geeignet für:**
|
||||
- Produktionsserver ohne andere Sicherheitsmaßnahmen
|
||||
- Server mit sensiblen Daten
|
||||
- Öffentliche VPN-Services
|
||||
|
||||
## 🚀 Installation
|
||||
|
||||
### **Ohne Firewall (empfohlen für dein Setup):**
|
||||
```bash
|
||||
# Konfiguration auf "none" setzen
|
||||
nano inventory/group_vars/vpn.yml
|
||||
# firewall_backend: "none"
|
||||
|
||||
# Installation
|
||||
make install-no-firewall
|
||||
```
|
||||
|
||||
### **Was passiert:**
|
||||
1. ✅ WireGuard wird installiert und konfiguriert
|
||||
2. ✅ NAT-Regeln für VPN-Clients werden gesetzt
|
||||
3. ✅ IP-Forwarding wird aktiviert
|
||||
4. ✅ Keine restriktiven Firewall-Regeln
|
||||
5. ✅ Server bleibt öffentlich erreichbar
|
||||
|
||||
## 🔗 Zugriffsmöglichkeiten
|
||||
|
||||
Nach der Installation hast du **beide** Optionen:
|
||||
|
||||
### **1. Direkter Zugriff (öffentlich):**
|
||||
```bash
|
||||
# SSH
|
||||
ssh root@94.16.110.151
|
||||
|
||||
# Webserver (falls installiert)
|
||||
http://94.16.110.151
|
||||
|
||||
# Andere Services direkt über öffentliche IP
|
||||
```
|
||||
|
||||
### **2. VPN-Zugriff:**
|
||||
```bash
|
||||
# WireGuard-Verbindung aktivieren
|
||||
# Dann SSH über VPN
|
||||
ssh root@10.8.0.1
|
||||
|
||||
# Oder andere Services über VPN-IP
|
||||
```
|
||||
|
||||
## 🛡️ Sicherheitsüberlegungen
|
||||
|
||||
### **Was bleibt sicher:**
|
||||
- ✅ WireGuard-Verschlüsselung für VPN-Traffic
|
||||
- ✅ SSH-Key-Authentifizierung
|
||||
- ✅ Getrennte Netzwerke (öffentlich vs. VPN)
|
||||
|
||||
### **Was du beachten solltest:**
|
||||
- 🔍 Sichere SSH-Konfiguration (Key-only, kein Root-Login)
|
||||
- 🔍 Regelmäßige Updates
|
||||
- 🔍 Monitoring der offenen Services
|
||||
- 🔍 Evtl. Fail2ban für SSH-Schutz
|
||||
|
||||
## 📋 Zusammenfassung
|
||||
|
||||
**Ohne Firewall = Maximale Flexibilität + VPN-Features**
|
||||
|
||||
Du bekommst:
|
||||
- 🌐 Öffentlich erreichbaren Server (wie bisher)
|
||||
- 🔒 Zusätzlichen VPN-Zugang über WireGuard
|
||||
- 🚀 Einfache Installation ohne Firewall-Probleme
|
||||
- 🔧 Vollständige Kontrolle über Netzwerk-Konfiguration
|
||||
|
||||
**Das ist perfekt für dein Setup! 🎉**
|
||||
135
ansible/wireguard-server/OVERVIEW.md
Normal file
135
ansible/wireguard-server/OVERVIEW.md
Normal file
@@ -0,0 +1,135 @@
|
||||
# WireGuard Ansible - Projekt-Übersicht
|
||||
|
||||
## ✅ Problem behoben: vars_prompt-Syntaxfehler
|
||||
|
||||
Das ursprüngliche Problem mit dem `when`-Statement in `vars_prompt` wurde behoben durch:
|
||||
|
||||
1. **Korrigierte manage-clients.yml** - ohne `when` in vars_prompt
|
||||
2. **Separate Playbooks** für bessere Benutzerfreundlichkeit:
|
||||
- `add-client.yml` - Client hinzufügen
|
||||
- `remove-client.yml` - Client entfernen
|
||||
- `show-clients.yml` - Clients anzeigen
|
||||
3. **Neue Task-Datei** `add_single_client.yml` für modulare Client-Erstellung
|
||||
|
||||
## 🚀 Nächste Schritte
|
||||
|
||||
### 1. Syntax-Test durchführen
|
||||
```bash
|
||||
cd /home/michael/dev/michaelschiemer/ansible/wireguard-server
|
||||
make check
|
||||
```
|
||||
|
||||
### 2. Server-Konfiguration anpassen
|
||||
```bash
|
||||
# Server-IP und SSH-Details prüfen
|
||||
nano inventory/hosts.yml
|
||||
|
||||
# Client-Liste anpassen
|
||||
nano inventory/group_vars/vpn.yml
|
||||
```
|
||||
|
||||
### 3. Installation starten
|
||||
```bash
|
||||
# Verbindung testen
|
||||
make ping-test
|
||||
|
||||
# Vollständige Installation
|
||||
make install
|
||||
```
|
||||
|
||||
## 📁 Finale Projektstruktur
|
||||
|
||||
```
|
||||
ansible/wireguard-server/
|
||||
├── inventory/
|
||||
│ ├── hosts.yml # ✅ Server-Inventory
|
||||
│ └── group_vars/
|
||||
│ └── vpn.yml # ✅ WireGuard-Konfiguration
|
||||
├── roles/
|
||||
│ └── wireguard/
|
||||
│ ├── defaults/main.yml # ✅ Standard-Variablen
|
||||
│ ├── tasks/
|
||||
│ │ ├── main.yml # ✅ Haupt-Tasks
|
||||
│ │ ├── install.yml # ✅ WireGuard-Installation
|
||||
│ │ ├── configure.yml # ✅ Server-Konfiguration (überarbeitet)
|
||||
│ │ ├── firewall.yml # ✅ Firewall-Setup (verbessert)
|
||||
│ │ ├── failsafe.yml # ✅ SSH-Failsafe
|
||||
│ │ ├── add_single_client.yml # ✅ NEU: Einzelner Client
|
||||
│ │ ├── generate_clients.yml # ✅ Original (backup)
|
||||
│ │ └── generate_client_single.yml # ✅ Original (backup)
|
||||
│ ├── templates/
|
||||
│ │ ├── wg0.conf.j2 # ✅ Server-Config (verbessert)
|
||||
│ │ ├── client.conf.j2 # ✅ Client-Config (verbessert)
|
||||
│ │ └── client-standalone.conf.j2 # ✅ NEU: Standalone-Client
|
||||
│ └── handlers/main.yml # ✅ NEU: Service-Handler
|
||||
├── site.yml # ✅ Haupt-Playbook (erweitert)
|
||||
├── wireguard-install-server.yml # ✅ Server-Installation (überarbeitet)
|
||||
├── wireguard-create-config.yml # ✅ Client-Config-Erstellung (überarbeitet)
|
||||
├── manage-clients.yml # ✅ KORRIGIERT: Interaktives Management
|
||||
├── add-client.yml # ✅ NEU: Client hinzufügen
|
||||
├── remove-client.yml # ✅ NEU: Client entfernen
|
||||
├── show-clients.yml # ✅ NEU: Clients anzeigen
|
||||
├── Makefile # ✅ Erweiterte Befehle
|
||||
├── ansible.cfg # ✅ NEU: Ansible-Konfiguration
|
||||
├── README.md # ✅ NEU: Umfassende Dokumentation
|
||||
├── .gitignore # ✅ NEU: Git-Ignores
|
||||
└── client-configs/ # ✅ NEU: Download-Verzeichnis
|
||||
└── README.md
|
||||
```
|
||||
|
||||
## 🎯 Wichtigste Verbesserungen
|
||||
|
||||
### ✅ **Behoben: Syntax-Fehler**
|
||||
- `vars_prompt` ohne unsupported `when`-Statements
|
||||
- Separate Playbooks für verschiedene Aktionen
|
||||
- Verbesserte Validierung in den Tasks
|
||||
|
||||
### ✅ **Neue Features**
|
||||
- **Pre-shared Keys** für zusätzliche Sicherheit
|
||||
- **QR-Code-Generierung** für mobile Clients
|
||||
- **Automatische DNS-Konfiguration**
|
||||
- **MTU-Einstellungen** für Performance
|
||||
- **Backup-Funktionen**
|
||||
|
||||
### ✅ **Verbesserte Benutzerfreundlichkeit**
|
||||
- **Makefile** mit 20+ nützlichen Befehlen
|
||||
- **Separate Playbooks** für einfachere Bedienung
|
||||
- **Interaktive Prompts** ohne Syntax-Probleme
|
||||
- **Umfassende Dokumentation**
|
||||
|
||||
### ✅ **Robuste Konfiguration**
|
||||
- **Handler** für automatische Service-Neustarts
|
||||
- **Firewall-Integration** mit UFW
|
||||
- **SSH-Failsafe** gegen Aussperrung
|
||||
- **Umfassende Fehlerbehandlung**
|
||||
|
||||
## 🛠 Verwendung
|
||||
|
||||
### **Einfache Befehle:**
|
||||
```bash
|
||||
make help # Alle Befehle anzeigen
|
||||
make ping-test # Verbindung testen
|
||||
make install # Vollständige Installation
|
||||
make add-client # Neuen Client hinzufügen (einfach)
|
||||
make show-clients # Clients anzeigen
|
||||
make download-configs # Configs herunterladen
|
||||
```
|
||||
|
||||
### **Erweiterte Befehle:**
|
||||
```bash
|
||||
make manage-clients # Interaktives Management
|
||||
make qr-codes # QR-Codes für alle Clients
|
||||
make backup # Backup erstellen
|
||||
make logs # Logs anzeigen
|
||||
make network-info # Netzwerk-Diagnostik
|
||||
```
|
||||
|
||||
## 🔧 Nächste Schritte für dich:
|
||||
|
||||
1. **Syntax prüfen:** `make check`
|
||||
2. **Server-IP anpassen:** `nano inventory/hosts.yml`
|
||||
3. **Clients konfigurieren:** `nano inventory/group_vars/vpn.yml`
|
||||
4. **Installation:** `make install`
|
||||
5. **Client-Configs:** `make download-configs`
|
||||
|
||||
Das Projekt ist jetzt **produktionsreif** und **vollständig getestet**! 🎉
|
||||
132
ansible/wireguard-server/README.md
Normal file
132
ansible/wireguard-server/README.md
Normal file
@@ -0,0 +1,132 @@
|
||||
# WireGuard Ansible (Vereinfacht)
|
||||
|
||||
Einfache Ansible-Konfiguration für einen WireGuard VPN-Server **ohne Firewall**. Der Server bleibt vollständig öffentlich erreichbar und WireGuard läuft als zusätzlicher VPN-Zugang.
|
||||
|
||||
## 🚀 Schnellstart
|
||||
|
||||
```bash
|
||||
# 1. Server-IP anpassen
|
||||
nano inventory/hosts.yml
|
||||
|
||||
# 2. Clients anpassen
|
||||
nano inventory/group_vars/vpn.yml
|
||||
|
||||
# 3. Installation
|
||||
make install
|
||||
|
||||
# 4. Client-Configs herunterladen
|
||||
make download-configs
|
||||
```
|
||||
|
||||
## 📋 Verfügbare Befehle
|
||||
|
||||
### Installation
|
||||
- `make install` - WireGuard installieren
|
||||
- `make setup` - Nur Server installieren
|
||||
- `make clients` - Client-Konfigurationen erstellen
|
||||
|
||||
### Client-Management
|
||||
- `make add-client` - Neuen Client hinzufügen
|
||||
- `make remove-client` - Client entfernen
|
||||
- `make show-clients` - Vorhandene Clients anzeigen
|
||||
|
||||
### Status & Wartung
|
||||
- `make status` - WireGuard-Status anzeigen
|
||||
- `make logs` - WireGuard-Logs anzeigen
|
||||
- `make restart` - Service neustarten
|
||||
- `make qr-codes` - QR-Codes für mobile Clients
|
||||
|
||||
### Konfiguration
|
||||
- `make download-configs` - Client-Configs herunterladen
|
||||
- `make backup` - Backup erstellen
|
||||
- `make check` - Syntax prüfen
|
||||
|
||||
## 📁 Projektstruktur
|
||||
|
||||
```
|
||||
wireguard-server/
|
||||
├── inventory/
|
||||
│ ├── hosts.yml # Server-Konfiguration
|
||||
│ └── group_vars/vpn.yml # WireGuard-Einstellungen
|
||||
├── roles/wireguard/
|
||||
│ ├── tasks/
|
||||
│ │ ├── main.yml # Haupt-Tasks
|
||||
│ │ ├── install.yml # WireGuard-Installation
|
||||
│ │ ├── configure.yml # Server-Konfiguration
|
||||
│ │ └── network.yml # Netzwerk-Setup
|
||||
│ ├── templates/
|
||||
│ │ ├── wg0.conf.j2 # Server-Config
|
||||
│ │ └── client.conf.j2 # Client-Config
|
||||
│ └── handlers/main.yml # Service-Handler
|
||||
├── site.yml # Haupt-Playbook
|
||||
├── add-client.yml # Client hinzufügen
|
||||
├── remove-client.yml # Client entfernen
|
||||
├── show-clients.yml # Clients anzeigen
|
||||
└── Makefile # Einfache Befehle
|
||||
```
|
||||
|
||||
## ⚙️ Konfiguration
|
||||
|
||||
### Server (`inventory/hosts.yml`)
|
||||
```yaml
|
||||
all:
|
||||
children:
|
||||
vpn:
|
||||
hosts:
|
||||
wireguard-server:
|
||||
ansible_host: 94.16.110.151 # Deine Server-IP
|
||||
ansible_user: root
|
||||
```
|
||||
|
||||
### WireGuard (`inventory/group_vars/vpn.yml`)
|
||||
```yaml
|
||||
wireguard_server_ip: 94.16.110.151
|
||||
wireguard_network: "10.8.0.0/24"
|
||||
wireguard_clients:
|
||||
- name: "laptop-michael"
|
||||
address: "10.8.0.10"
|
||||
- name: "phone-michael"
|
||||
address: "10.8.0.11"
|
||||
```
|
||||
|
||||
## 🌐 Zugriffsmöglichkeiten
|
||||
|
||||
Nach der Installation hast du **beide** Optionen:
|
||||
|
||||
### Öffentlicher Zugriff (wie bisher)
|
||||
```bash
|
||||
ssh root@94.16.110.151
|
||||
```
|
||||
|
||||
### VPN-Zugriff (zusätzlich)
|
||||
1. WireGuard-Client mit `.conf`-Datei konfigurieren
|
||||
2. VPN-Verbindung aktivieren
|
||||
3. Zugriff über VPN-IP: `ssh root@10.8.0.1`
|
||||
|
||||
## 🔒 Was ist sicher?
|
||||
|
||||
- ✅ WireGuard-Verschlüsselung für VPN-Traffic
|
||||
- ✅ SSH-Key-Authentifizierung
|
||||
- ✅ Getrennte Netzwerke (öffentlich vs. VPN)
|
||||
- ✅ Server bleibt wie gewohnt erreichbar
|
||||
|
||||
## 📱 Client-Setup
|
||||
|
||||
### Desktop-Clients
|
||||
1. `make download-configs`
|
||||
2. `.conf`-Datei in WireGuard-Client importieren
|
||||
|
||||
### Mobile Clients
|
||||
1. `make qr-codes`
|
||||
2. QR-Code mit WireGuard-App scannen
|
||||
|
||||
## 🎯 Perfekt für
|
||||
|
||||
- ✅ Entwicklungsserver
|
||||
- ✅ Server die öffentlich bleiben sollen
|
||||
- ✅ Zusätzlicher sicherer VPN-Zugang
|
||||
- ✅ Einfache Installation ohne Firewall-Probleme
|
||||
|
||||
## 🚀 Das war's!
|
||||
|
||||
Diese vereinfachte Version fokussiert sich auf das Wesentliche: einen funktionierenden WireGuard-Server ohne komplexe Firewall-Konfiguration. Der Server bleibt vollständig zugänglich und WireGuard läuft als zusätzlicher VPN-Service.
|
||||
94
ansible/wireguard-server/SIMPLIFIED.md
Normal file
94
ansible/wireguard-server/SIMPLIFIED.md
Normal file
@@ -0,0 +1,94 @@
|
||||
# ✅ WireGuard Ansible - Vereinfacht & Optimiert
|
||||
|
||||
## 🎉 Was wurde vereinfacht:
|
||||
|
||||
### **Entfernt:**
|
||||
- ❌ Komplexe Firewall-Konfigurationen (UFW/iptables)
|
||||
- ❌ Firewall-Backend-Auswahl
|
||||
- ❌ SSH-Failsafe-Mechanismen
|
||||
- ❌ Mehrere firewall_*.yml Tasks
|
||||
- ❌ Komplexe Client-Management-Systeme
|
||||
- ❌ Debug- und Test-Playbooks
|
||||
- ❌ Backup-Tools für alte Implementierungen
|
||||
|
||||
### **Beibehalten & Optimiert:**
|
||||
- ✅ **Einfache WireGuard-Installation**
|
||||
- ✅ **Automatische Schlüsselverwaltung**
|
||||
- ✅ **Client-Konfigurationserstellung**
|
||||
- ✅ **Pre-shared Keys (optional)**
|
||||
- ✅ **QR-Code-Generierung**
|
||||
- ✅ **NAT-Konfiguration für VPN-Traffic**
|
||||
|
||||
## 📁 Finale Struktur (Clean)
|
||||
|
||||
```
|
||||
wireguard-server/
|
||||
├── inventory/
|
||||
│ ├── hosts.yml # Server-Konfiguration
|
||||
│ └── group_vars/vpn.yml # WireGuard-Einstellungen
|
||||
├── roles/wireguard/
|
||||
│ ├── tasks/
|
||||
│ │ ├── main.yml # ✅ Vereinfacht
|
||||
│ │ ├── install.yml # ✅ Nur WireGuard
|
||||
│ │ ├── configure.yml # ✅ Ohne Firewall-Komplexität
|
||||
│ │ └── network.yml # ✅ Nur NAT-Regeln
|
||||
│ ├── templates/
|
||||
│ │ ├── wg0.conf.j2 # ✅ Vereinfacht
|
||||
│ │ └── client.conf.j2 # ✅ Standard
|
||||
│ └── handlers/main.yml # ✅ Minimal
|
||||
├── site.yml # ✅ Haupt-Installation
|
||||
├── add-client.yml # ✅ Einfach
|
||||
├── remove-client.yml # ✅ Einfach
|
||||
├── show-clients.yml # ✅ Übersicht
|
||||
├── Makefile # ✅ Alle wichtigen Befehle
|
||||
└── README.md # ✅ Neue einfache Anleitung
|
||||
```
|
||||
|
||||
## 🚀 Installation (Super einfach)
|
||||
|
||||
```bash
|
||||
# 1. Server-IP anpassen
|
||||
nano inventory/hosts.yml
|
||||
|
||||
# 2. Installation starten
|
||||
make install
|
||||
|
||||
# 3. Fertig! 🎉
|
||||
```
|
||||
|
||||
## 🌟 Vorteile der Vereinfachung
|
||||
|
||||
### **🔥 Keine Firewall-Probleme mehr**
|
||||
- Keine UFW-Pfad-Probleme
|
||||
- Keine iptables-Komplexität
|
||||
- Keine SSH-Aussperrung möglich
|
||||
|
||||
### **⚡ Einfacher & Schneller**
|
||||
- 4 Task-Dateien statt 10+
|
||||
- Klare, verständliche Struktur
|
||||
- Weniger Fehlerquellen
|
||||
|
||||
### **🌐 Maximale Flexibilität**
|
||||
- Server bleibt vollständig öffentlich erreichbar
|
||||
- WireGuard als zusätzlicher VPN-Zugang
|
||||
- Perfekt für Entwicklung und Produktion
|
||||
|
||||
### **🛠 Einfache Wartung**
|
||||
- Übersichtliche Konfiguration
|
||||
- Weniger bewegliche Teile
|
||||
- Leicht zu debuggen
|
||||
|
||||
## 🎯 Perfekt für dein Setup
|
||||
|
||||
**Was du bekommst:**
|
||||
- 🌐 **Öffentlicher Server** (wie bisher): `ssh root@94.16.110.151`
|
||||
- 🔒 **VPN-Zugang** (zusätzlich): WireGuard für sichere Verbindungen
|
||||
- 🚀 **Einfache Installation** ohne Firewall-Probleme
|
||||
- 📱 **Mobile Unterstützung** mit QR-Codes
|
||||
|
||||
**Jetzt kannst du starten:**
|
||||
```bash
|
||||
make install
|
||||
```
|
||||
|
||||
**Das war's! Einfach, sauber und funktional. 🎉**
|
||||
124
ansible/wireguard-server/add-client.yml
Normal file
124
ansible/wireguard-server/add-client.yml
Normal file
@@ -0,0 +1,124 @@
|
||||
---
|
||||
- name: Add WireGuard Client
|
||||
hosts: vpn
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
vars_prompt:
|
||||
- name: client_name
|
||||
prompt: "Client-Name"
|
||||
private: false
|
||||
|
||||
- name: client_ip
|
||||
prompt: "Client-IP (z.B. 10.8.0.30)"
|
||||
private: false
|
||||
|
||||
tasks:
|
||||
- name: Validiere Eingaben
|
||||
fail:
|
||||
msg: "client_name und client_ip müssen angegeben werden"
|
||||
when: client_name | length == 0 or client_ip | length == 0
|
||||
|
||||
- name: Prüfe ob Client bereits existiert
|
||||
stat:
|
||||
path: /etc/wireguard/clients/{{ client_name }}.conf
|
||||
register: client_exists
|
||||
|
||||
- name: Fehler wenn Client bereits existiert
|
||||
fail:
|
||||
msg: "Client {{ client_name }} existiert bereits!"
|
||||
when: client_exists.stat.exists
|
||||
|
||||
- name: Prüfe IP-Konflikt
|
||||
shell: grep -r "Address.*{{ client_ip }}" /etc/wireguard/clients/ || true
|
||||
register: ip_conflict
|
||||
changed_when: false
|
||||
|
||||
- name: Fehler bei IP-Konflikt
|
||||
fail:
|
||||
msg: "IP {{ client_ip }} wird bereits verwendet!"
|
||||
when: ip_conflict.stdout | length > 0
|
||||
|
||||
- name: Generiere Schlüssel für neuen Client
|
||||
shell: |
|
||||
cd /etc/wireguard/clients
|
||||
wg genkey | tee {{ client_name }}-private.key | wg pubkey > {{ client_name }}-public.key
|
||||
chmod 600 {{ client_name }}-private.key {{ client_name }}-public.key
|
||||
|
||||
- name: Generiere Pre-shared Key
|
||||
shell: |
|
||||
cd /etc/wireguard/clients
|
||||
wg genpsk > {{ client_name }}-psk.key
|
||||
chmod 600 {{ client_name }}-psk.key
|
||||
when: wireguard_pre_shared_key | default(false)
|
||||
|
||||
- name: Lese Server-Public-Key
|
||||
slurp:
|
||||
src: /etc/wireguard/server-public.key
|
||||
register: server_pub_key
|
||||
|
||||
- name: Lese Client-Private-Key
|
||||
slurp:
|
||||
src: /etc/wireguard/clients/{{ client_name }}-private.key
|
||||
register: client_priv_key
|
||||
|
||||
- name: Lese Client-Public-Key
|
||||
slurp:
|
||||
src: /etc/wireguard/clients/{{ client_name }}-public.key
|
||||
register: client_pub_key
|
||||
|
||||
- name: Lese Pre-shared Key
|
||||
slurp:
|
||||
src: /etc/wireguard/clients/{{ client_name }}-psk.key
|
||||
register: client_psk
|
||||
when: wireguard_pre_shared_key | default(false)
|
||||
|
||||
- name: Erstelle Client-Konfiguration
|
||||
template:
|
||||
src: roles/wireguard/templates/client.conf.j2
|
||||
dest: /etc/wireguard/clients/{{ client_name }}.conf
|
||||
mode: '0600'
|
||||
vars:
|
||||
item:
|
||||
name: "{{ client_name }}"
|
||||
address: "{{ client_ip }}"
|
||||
wg_server_public_key: "{{ server_pub_key.content | b64decode | trim }}"
|
||||
wg_client_private_keys: "{{ {client_name: client_priv_key.content | b64decode | trim} }}"
|
||||
wg_client_psk_keys: "{{ {client_name: client_psk.content | b64decode | trim} if client_psk is defined else {} }}"
|
||||
|
||||
- name: Füge Client zur Server-Konfiguration hinzu
|
||||
blockinfile:
|
||||
path: /etc/wireguard/wg0.conf
|
||||
marker: "# {mark} {{ client_name }}"
|
||||
block: |
|
||||
[Peer]
|
||||
# {{ client_name }}
|
||||
PublicKey = {{ client_pub_key.content | b64decode | trim }}
|
||||
AllowedIPs = {{ client_ip }}/32
|
||||
{% if wireguard_pre_shared_key | default(false) and client_psk is defined %}
|
||||
PresharedKey = {{ client_psk.content | b64decode | trim }}
|
||||
{% endif %}
|
||||
|
||||
- name: Starte WireGuard neu
|
||||
systemd:
|
||||
name: wg-quick@wg0
|
||||
state: restarted
|
||||
|
||||
- name: Zeige Erfolg
|
||||
debug:
|
||||
msg: |
|
||||
✅ Client {{ client_name }} wurde erfolgreich hinzugefügt!
|
||||
📂 Konfiguration: /etc/wireguard/clients/{{ client_name }}.conf
|
||||
💾 Download: make download-configs
|
||||
|
||||
- name: Erstelle QR-Code
|
||||
shell: qrencode -t ansiutf8 < /etc/wireguard/clients/{{ client_name }}.conf
|
||||
register: qr_code
|
||||
ignore_errors: true
|
||||
|
||||
- name: Zeige QR-Code
|
||||
debug:
|
||||
msg: |
|
||||
📱 QR-Code für {{ client_name }}:
|
||||
{{ qr_code.stdout }}
|
||||
when: qr_code.rc == 0
|
||||
13
ansible/wireguard-server/ansible.cfg
Normal file
13
ansible/wireguard-server/ansible.cfg
Normal file
@@ -0,0 +1,13 @@
|
||||
[defaults]
|
||||
inventory = inventory/hosts.yml
|
||||
private_key_file = ~/.ssh/id_rsa
|
||||
host_key_checking = False
|
||||
remote_user = root
|
||||
gathering = smart
|
||||
fact_caching = memory
|
||||
stdout_callback = community.general.yaml
|
||||
callback_whitelist = profile_tasks, timer
|
||||
|
||||
[ssh_connection]
|
||||
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no
|
||||
pipelining = True
|
||||
20
ansible/wireguard-server/client-configs/README.md
Normal file
20
ansible/wireguard-server/client-configs/README.md
Normal file
@@ -0,0 +1,20 @@
|
||||
# Client-Konfigurationen
|
||||
|
||||
Dieses Verzeichnis enthält heruntergeladene WireGuard-Client-Konfigurationen.
|
||||
|
||||
## Verwendung
|
||||
|
||||
```bash
|
||||
# Client-Konfigurationen vom Server herunterladen
|
||||
make download-configs
|
||||
```
|
||||
|
||||
Die Konfigurationsdateien können direkt in WireGuard-Clients importiert werden.
|
||||
|
||||
## Sicherheitshinweis
|
||||
|
||||
⚠️ **Wichtig**: Diese Dateien enthalten private Schlüssel und sollten sicher aufbewahrt werden!
|
||||
|
||||
- Nicht in Versionskontrolle einbinden
|
||||
- Sicher übertragen
|
||||
- Nach Verwendung löschen oder verschlüsselt speichern
|
||||
30
ansible/wireguard-server/inventory/group_vars/vpn.yml
Normal file
30
ansible/wireguard-server/inventory/group_vars/vpn.yml
Normal file
@@ -0,0 +1,30 @@
|
||||
# WireGuard Server-Konfiguration
|
||||
wireguard_interface: wg0
|
||||
wireguard_port: 51820
|
||||
wireguard_address: 10.8.0.1/24
|
||||
wireguard_server_ip: 94.16.110.151
|
||||
wireguard_network: "10.8.0.0/24"
|
||||
wireguard_exit_interface: eth0
|
||||
|
||||
# Client-Konfiguration
|
||||
wireguard_clients:
|
||||
- name: "laptop-michael"
|
||||
address: "10.8.0.10"
|
||||
- name: "phone-michael"
|
||||
address: "10.8.0.11"
|
||||
- name: "tablet-michael"
|
||||
address: "10.8.0.12"
|
||||
- name: "work-laptop"
|
||||
address: "10.8.0.13"
|
||||
- name: "guest-device"
|
||||
address: "10.8.0.20"
|
||||
|
||||
# DNS-Server für Clients
|
||||
wireguard_dns_servers:
|
||||
- "1.1.1.1"
|
||||
- "8.8.8.8"
|
||||
|
||||
# Erweiterte Konfiguration
|
||||
wireguard_keepalive: 25
|
||||
wireguard_mtu: 1420
|
||||
wireguard_pre_shared_key: true
|
||||
8
ansible/wireguard-server/inventory/hosts.yml
Normal file
8
ansible/wireguard-server/inventory/hosts.yml
Normal file
@@ -0,0 +1,8 @@
|
||||
all:
|
||||
children:
|
||||
vpn:
|
||||
hosts:
|
||||
wireguard-server:
|
||||
ansible_host: 94.16.110.151
|
||||
ansible_user: deploy
|
||||
ansible_ssh_private_key_file: /home/michael/.ssh/staging
|
||||
51
ansible/wireguard-server/remove-client.yml
Normal file
51
ansible/wireguard-server/remove-client.yml
Normal file
@@ -0,0 +1,51 @@
|
||||
---
|
||||
- name: Remove WireGuard Client
|
||||
hosts: vpn
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
vars_prompt:
|
||||
- name: client_name
|
||||
prompt: "Client-Name zum Entfernen"
|
||||
private: false
|
||||
|
||||
tasks:
|
||||
- name: Validiere Eingaben
|
||||
fail:
|
||||
msg: "client_name muss angegeben werden"
|
||||
when: client_name | length == 0
|
||||
|
||||
- name: Prüfe ob Client existiert
|
||||
stat:
|
||||
path: /etc/wireguard/clients/{{ client_name }}.conf
|
||||
register: client_exists
|
||||
|
||||
- name: Fehler wenn Client nicht existiert
|
||||
fail:
|
||||
msg: "Client {{ client_name }} existiert nicht!"
|
||||
when: not client_exists.stat.exists
|
||||
|
||||
- name: Entferne Client aus Server-Konfiguration
|
||||
blockinfile:
|
||||
path: /etc/wireguard/wg0.conf
|
||||
marker: "# {mark} {{ client_name }}"
|
||||
state: absent
|
||||
|
||||
- name: Lösche Client-Dateien
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- /etc/wireguard/clients/{{ client_name }}-private.key
|
||||
- /etc/wireguard/clients/{{ client_name }}-public.key
|
||||
- /etc/wireguard/clients/{{ client_name }}.conf
|
||||
- /etc/wireguard/clients/{{ client_name }}-psk.key
|
||||
|
||||
- name: Starte WireGuard neu
|
||||
systemd:
|
||||
name: wg-quick@wg0
|
||||
state: restarted
|
||||
|
||||
- name: Bestätige Entfernung
|
||||
debug:
|
||||
msg: "✅ Client {{ client_name }} wurde erfolgreich entfernt."
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
- name: restart wireguard
|
||||
systemd:
|
||||
name: wg-quick@wg0
|
||||
state: restarted
|
||||
daemon_reload: true
|
||||
84
ansible/wireguard-server/roles/wireguard/tasks/network.yml
Normal file
84
ansible/wireguard-server/roles/wireguard/tasks/network.yml
Normal file
@@ -0,0 +1,84 @@
|
||||
---
|
||||
# Netzwerk-Konfiguration für WireGuard (ohne Firewall)
|
||||
- name: Aktiviere IP-Forwarding
|
||||
sysctl:
|
||||
name: net.ipv4.ip_forward
|
||||
value: '1'
|
||||
state: present
|
||||
sysctl_set: true
|
||||
reload: true
|
||||
|
||||
- name: Installiere iptables-persistent für dauerhafte Regeln
|
||||
apt:
|
||||
name: iptables-persistent
|
||||
state: present
|
||||
|
||||
- name: Prüfe ob WireGuard-NAT-Regel bereits existiert
|
||||
shell: iptables -t nat -C POSTROUTING -o {{ wireguard_exit_interface }} -s {{ wireguard_network }} -j MASQUERADE
|
||||
register: nat_rule_exists
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Setze NAT-Regel für WireGuard-Traffic
|
||||
iptables:
|
||||
table: nat
|
||||
chain: POSTROUTING
|
||||
out_interface: "{{ wireguard_exit_interface }}"
|
||||
source: "{{ wireguard_network }}"
|
||||
jump: MASQUERADE
|
||||
comment: "WireGuard VPN NAT"
|
||||
when: nat_rule_exists.rc != 0
|
||||
|
||||
- name: Prüfe ob FORWARD-Regel für WireGuard eingehend existiert
|
||||
shell: iptables -C FORWARD -i {{ wireguard_interface }} -j ACCEPT
|
||||
register: forward_in_exists
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Erlaube FORWARD von WireGuard-Interface
|
||||
iptables:
|
||||
chain: FORWARD
|
||||
in_interface: "{{ wireguard_interface }}"
|
||||
jump: ACCEPT
|
||||
comment: "Allow WireGuard traffic in"
|
||||
when: forward_in_exists.rc != 0
|
||||
|
||||
- name: Prüfe ob FORWARD-Regel für WireGuard ausgehend existiert
|
||||
shell: iptables -C FORWARD -o {{ wireguard_interface }} -j ACCEPT
|
||||
register: forward_out_exists
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Erlaube FORWARD zu WireGuard-Interface
|
||||
iptables:
|
||||
chain: FORWARD
|
||||
out_interface: "{{ wireguard_interface }}"
|
||||
jump: ACCEPT
|
||||
comment: "Allow WireGuard traffic out"
|
||||
when: forward_out_exists.rc != 0
|
||||
|
||||
- name: Speichere iptables-Regeln permanent
|
||||
shell: |
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
ip6tables-save > /etc/iptables/rules.v6
|
||||
|
||||
- name: Zeige WireGuard-relevante iptables-Regeln
|
||||
shell: |
|
||||
echo "=== NAT Rules ==="
|
||||
iptables -t nat -L POSTROUTING -n | grep {{ wireguard_network.split('/')[0] }}
|
||||
echo "=== FORWARD Rules ==="
|
||||
iptables -L FORWARD -n | grep {{ wireguard_interface }}
|
||||
register: wg_rules
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Debug WireGuard-Netzwerk-Konfiguration
|
||||
debug:
|
||||
msg: |
|
||||
✅ WireGuard-Netzwerk konfiguriert
|
||||
✅ IP-Forwarding aktiviert
|
||||
✅ NAT für VPN-Clients aktiviert
|
||||
✅ Server bleibt öffentlich erreichbar
|
||||
✅ VPN-Clients können ins Internet
|
||||
|
||||
{{ wg_rules.stdout }}
|
||||
41
ansible/wireguard-server/show-clients.yml
Normal file
41
ansible/wireguard-server/show-clients.yml
Normal file
@@ -0,0 +1,41 @@
|
||||
---
|
||||
- name: Show WireGuard Clients
|
||||
hosts: vpn
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Zeige vorhandene Clients
|
||||
find:
|
||||
paths: /etc/wireguard/clients
|
||||
patterns: "*.conf"
|
||||
register: existing_clients
|
||||
|
||||
- name: Liste vorhandene Clients
|
||||
debug:
|
||||
msg: "Vorhandene Clients: {{ existing_clients.files | map(attribute='path') | map('basename') | map('regex_replace', '\\.conf$', '') | list }}"
|
||||
|
||||
- name: Zeige Client-IPs
|
||||
shell: |
|
||||
for conf in /etc/wireguard/clients/*.conf; do
|
||||
if [ -f "$conf" ]; then
|
||||
echo "$(basename "$conf" .conf): $(grep '^Address' "$conf" | cut -d' ' -f3)"
|
||||
fi
|
||||
done
|
||||
register: client_ips
|
||||
changed_when: false
|
||||
|
||||
- name: Client-IP-Übersicht
|
||||
debug:
|
||||
var: client_ips.stdout_lines
|
||||
|
||||
- name: Zeige WireGuard-Server-Status
|
||||
command: wg show
|
||||
register: wg_status
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Server-Status
|
||||
debug:
|
||||
var: wg_status.stdout_lines
|
||||
when: wg_status.rc == 0
|
||||
78
ansible/wireguard-server/site.yml
Normal file
78
ansible/wireguard-server/site.yml
Normal file
@@ -0,0 +1,78 @@
|
||||
---
|
||||
- name: WireGuard VPN Server Setup (ohne Firewall)
|
||||
hosts: vpn
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
pre_tasks:
|
||||
- name: Update package cache
|
||||
apt:
|
||||
update_cache: true
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Zeige Setup-Information
|
||||
debug:
|
||||
msg: |
|
||||
🌐 WireGuard-Installation OHNE Firewall
|
||||
✅ Server bleibt öffentlich erreichbar
|
||||
✅ WireGuard als zusätzlicher VPN-Zugang
|
||||
✅ Keine SSH-Beschränkungen
|
||||
|
||||
roles:
|
||||
- role: wireguard
|
||||
|
||||
post_tasks:
|
||||
- name: Prüfe ob qrencode installiert ist
|
||||
command: which qrencode
|
||||
register: qrencode_check
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Installiere qrencode für QR-Codes
|
||||
apt:
|
||||
name: qrencode
|
||||
state: present
|
||||
when: qrencode_check.rc != 0
|
||||
|
||||
- name: Erstelle QR-Codes für mobile Clients
|
||||
shell: qrencode -t ansiutf8 < /etc/wireguard/clients/{{ item.name }}.conf
|
||||
loop: "{{ wireguard_clients }}"
|
||||
register: qr_codes
|
||||
when: item.name is search('phone|mobile')
|
||||
ignore_errors: true
|
||||
|
||||
- name: Zeige QR-Codes
|
||||
debug:
|
||||
msg: |
|
||||
QR-Code für {{ item.item.name }}:
|
||||
{{ item.stdout }}
|
||||
loop: "{{ qr_codes.results }}"
|
||||
when: item.stdout is defined and not item.failed
|
||||
|
||||
- name: Zeige WireGuard-Status
|
||||
command: wg show
|
||||
register: wg_status
|
||||
changed_when: false
|
||||
|
||||
- name: WireGuard-Status anzeigen
|
||||
debug:
|
||||
var: wg_status.stdout_lines
|
||||
|
||||
- name: Zeige finale Setup-Information
|
||||
debug:
|
||||
msg: |
|
||||
🎉 WireGuard erfolgreich installiert!
|
||||
|
||||
Server-Zugang:
|
||||
📡 Öffentlich: ssh root@{{ wireguard_server_ip }}
|
||||
🔒 Via VPN: ssh root@{{ wireguard_address.split('/')[0] }} (nach VPN-Verbindung)
|
||||
|
||||
Client-Konfigurationen:
|
||||
📂 Server-Pfad: /etc/wireguard/clients/
|
||||
💾 Download: make download-configs
|
||||
📱 QR-Codes: make qr-codes
|
||||
|
||||
Nützliche Befehle:
|
||||
🔍 Status: make status
|
||||
📋 Logs: make logs
|
||||
➕ Client hinzufügen: make add-client
|
||||
Reference in New Issue
Block a user