refactor(deployment): Remove WireGuard VPN dependency and restore public service access
Remove WireGuard integration from production deployment to simplify infrastructure: - Remove docker-compose-direct-access.yml (VPN-bound services) - Remove VPN-only middlewares from Grafana, Prometheus, Portainer - Remove WireGuard middleware definitions from Traefik - Remove WireGuard IPs (10.8.0.0/24) from Traefik forwarded headers All monitoring services now publicly accessible via subdomains: - grafana.michaelschiemer.de (with Grafana native auth) - prometheus.michaelschiemer.de (with Basic Auth) - portainer.michaelschiemer.de (with Portainer native auth) All services use Let's Encrypt SSL certificates via Traefik.
This commit is contained in:
370
deployment/wireguard/CLIENT-IMPORT-GUIDE.md
Normal file
370
deployment/wireguard/CLIENT-IMPORT-GUIDE.md
Normal file
@@ -0,0 +1,370 @@
|
||||
# WireGuard Client Import & Connection Guide
|
||||
|
||||
Anleitung zum Importieren und Verbinden der generierten WireGuard Client-Konfiguration.
|
||||
|
||||
## Generierte Konfiguration
|
||||
|
||||
**Client Name**: michael-pc
|
||||
**Config File**: `/home/michael/dev/michaelschiemer/deployment/ansible/wireguard/configs/michael-pc.conf`
|
||||
**Client IP**: 10.8.0.2/32
|
||||
**Server Endpoint**: 94.16.110.151:51820
|
||||
**VPN Network**: 10.8.0.0/24
|
||||
|
||||
---
|
||||
|
||||
## Import auf verschiedenen Plattformen
|
||||
|
||||
### Linux (Ubuntu/Debian)
|
||||
|
||||
```bash
|
||||
# 1. Konfiguration nach /etc/wireguard/ kopieren
|
||||
sudo cp /home/michael/dev/michaelschiemer/deployment/ansible/wireguard/configs/michael-pc.conf /etc/wireguard/
|
||||
|
||||
# 2. Berechtigungen setzen
|
||||
sudo chmod 600 /etc/wireguard/michael-pc.conf
|
||||
|
||||
# 3. VPN-Verbindung starten
|
||||
sudo wg-quick up michael-pc
|
||||
|
||||
# 4. Status prüfen
|
||||
sudo wg show michael-pc
|
||||
|
||||
# 5. Bei Boot automatisch starten (optional)
|
||||
sudo systemctl enable wg-quick@michael-pc
|
||||
```
|
||||
|
||||
**Verbindung trennen**:
|
||||
```bash
|
||||
sudo wg-quick down michael-pc
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### macOS
|
||||
|
||||
```bash
|
||||
# 1. WireGuard installieren (falls nicht vorhanden)
|
||||
brew install wireguard-tools
|
||||
|
||||
# 2. Konfiguration importieren
|
||||
sudo cp /home/michael/dev/michaelschiemer/deployment/ansible/wireguard/configs/michael-pc.conf /etc/wireguard/
|
||||
|
||||
# 3. VPN starten
|
||||
sudo wg-quick up michael-pc
|
||||
|
||||
# 4. Status prüfen
|
||||
sudo wg show michael-pc
|
||||
```
|
||||
|
||||
**Alternative**: WireGuard GUI App für macOS verwenden
|
||||
- Download: https://apps.apple.com/app/wireguard/id1451685025
|
||||
- "Add Tunnel from File" → `michael-pc.conf` auswählen
|
||||
- Verbindung aktivieren
|
||||
|
||||
---
|
||||
|
||||
### Windows
|
||||
|
||||
**Via WireGuard GUI** (empfohlen):
|
||||
|
||||
1. **WireGuard GUI installieren**:
|
||||
- Download: https://www.wireguard.com/install/
|
||||
- Installer ausführen
|
||||
|
||||
2. **Konfiguration importieren**:
|
||||
- WireGuard GUI öffnen
|
||||
- "Import tunnel(s) from file"
|
||||
- `michael-pc.conf` auswählen
|
||||
|
||||
3. **Verbindung aktivieren**:
|
||||
- Tunnel "michael-pc" in der Liste anklicken
|
||||
- "Activate" Button drücken
|
||||
|
||||
4. **Status prüfen**:
|
||||
- Status sollte "Active" zeigen
|
||||
- Transfer-Statistiken werden angezeigt
|
||||
|
||||
---
|
||||
|
||||
### Android
|
||||
|
||||
**Via WireGuard App**:
|
||||
|
||||
1. **WireGuard App installieren**:
|
||||
- Google Play Store: "WireGuard"
|
||||
|
||||
2. **Konfiguration importieren**:
|
||||
- Option 1: `michael-pc.conf` auf Gerät übertragen und importieren
|
||||
- Option 2: QR Code scannen (falls generiert)
|
||||
|
||||
3. **Verbindung aktivieren**:
|
||||
- Tunnel antippen
|
||||
- Toggle aktivieren
|
||||
|
||||
---
|
||||
|
||||
### iOS
|
||||
|
||||
**Via WireGuard App**:
|
||||
|
||||
1. **WireGuard App installieren**:
|
||||
- App Store: "WireGuard"
|
||||
|
||||
2. **Konfiguration importieren**:
|
||||
- Option 1: `michael-pc.conf` via AirDrop/iCloud übertragen
|
||||
- Option 2: QR Code scannen (falls generiert)
|
||||
|
||||
3. **Verbindung aktivieren**:
|
||||
- Tunnel antippen
|
||||
- Toggle aktivieren
|
||||
|
||||
---
|
||||
|
||||
## Konnektivitätstest
|
||||
|
||||
Nach erfolgreicher Verbindung:
|
||||
|
||||
### 1. VPN Gateway Ping
|
||||
|
||||
```bash
|
||||
ping 10.8.0.1
|
||||
```
|
||||
|
||||
**Erwartete Ausgabe**:
|
||||
```
|
||||
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
|
||||
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=1.23 ms
|
||||
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=1.15 ms
|
||||
```
|
||||
|
||||
✅ **Erfolg**: VPN-Verbindung funktioniert
|
||||
|
||||
---
|
||||
|
||||
### 2. Admin Services Zugriff
|
||||
|
||||
**Traefik Dashboard** (HTTPS):
|
||||
```bash
|
||||
curl -k https://10.8.0.1:8080
|
||||
```
|
||||
|
||||
**Prometheus** (HTTP):
|
||||
```bash
|
||||
curl http://10.8.0.1:9090
|
||||
```
|
||||
|
||||
**Grafana** (HTTPS):
|
||||
```bash
|
||||
curl -k https://10.8.0.1:3001
|
||||
```
|
||||
|
||||
**Portainer** (HTTP):
|
||||
```bash
|
||||
curl http://10.8.0.1:9000
|
||||
```
|
||||
|
||||
**Redis Insight** (HTTP):
|
||||
```bash
|
||||
curl http://10.8.0.1:8001
|
||||
```
|
||||
|
||||
**Browser-Zugriff**:
|
||||
- Traefik: https://10.8.0.1:8080
|
||||
- Prometheus: http://10.8.0.1:9090
|
||||
- Grafana: https://10.8.0.1:3001
|
||||
- Portainer: http://10.8.0.1:9000
|
||||
- Redis Insight: http://10.8.0.1:8001
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Problem: Keine Verbindung zum Server
|
||||
|
||||
**Symptome**:
|
||||
- `ping 10.8.0.1` timeout
|
||||
- WireGuard Status zeigt "Handshake failed"
|
||||
|
||||
**Lösungen**:
|
||||
|
||||
1. **Server Endpoint prüfen**:
|
||||
```bash
|
||||
# Prüfe ob Server erreichbar ist
|
||||
ping 94.16.110.151
|
||||
|
||||
# Prüfe ob Port 51820 offen ist
|
||||
nc -zvu 94.16.110.151 51820
|
||||
```
|
||||
|
||||
2. **Firewall auf Server prüfen**:
|
||||
```bash
|
||||
# Auf Server ausführen
|
||||
sudo nft list ruleset | grep 51820
|
||||
```
|
||||
|
||||
3. **WireGuard Server Status prüfen**:
|
||||
```bash
|
||||
# Auf Server ausführen
|
||||
sudo systemctl status wg-quick@wg0
|
||||
sudo wg show wg0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Problem: VPN verbindet, aber kein Zugriff auf Admin Services
|
||||
|
||||
**Symptome**:
|
||||
- `ping 10.8.0.1` funktioniert
|
||||
- `curl http://10.8.0.1:9090` timeout
|
||||
|
||||
**Lösungen**:
|
||||
|
||||
1. **Routing prüfen**:
|
||||
```bash
|
||||
# Auf Client
|
||||
ip route | grep 10.8.0
|
||||
```
|
||||
|
||||
2. **Firewall-Rules auf Server prüfen**:
|
||||
```bash
|
||||
# Auf Server
|
||||
sudo nft list table inet wireguard_firewall
|
||||
```
|
||||
|
||||
3. **Service-Status prüfen**:
|
||||
```bash
|
||||
# Auf Server - Services sollten laufen
|
||||
docker ps | grep prometheus
|
||||
docker ps | grep grafana
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Problem: DNS funktioniert nicht
|
||||
|
||||
**Symptome**:
|
||||
- Kann keine Domains auflösen
|
||||
|
||||
**Lösung**:
|
||||
```bash
|
||||
# DNS-Server in Client-Config prüfen
|
||||
grep DNS /etc/wireguard/michael-pc.conf
|
||||
# Sollte sein: DNS = 1.1.1.1, 8.8.8.8
|
||||
|
||||
# DNS-Resolver testen
|
||||
nslookup google.com 1.1.1.1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Problem: Verbindung bricht ständig ab
|
||||
|
||||
**Symptome**:
|
||||
- Verbindung disconnected nach einigen Minuten
|
||||
|
||||
**Lösungen**:
|
||||
|
||||
1. **PersistentKeepalive prüfen**:
|
||||
```bash
|
||||
grep PersistentKeepalive /etc/wireguard/michael-pc.conf
|
||||
# Sollte sein: PersistentKeepalive = 25
|
||||
```
|
||||
|
||||
2. **NAT/Router-Timeout**:
|
||||
- PersistentKeepalive verhindert NAT-Timeout
|
||||
- Wert auf 25 Sekunden gesetzt
|
||||
|
||||
---
|
||||
|
||||
## Firewall-Validierung
|
||||
|
||||
### Public Access sollte blockiert sein
|
||||
|
||||
**Von außerhalb des VPNs testen** (z.B. vom Internet):
|
||||
|
||||
```bash
|
||||
# Diese Requests sollten FEHLSCHLAGEN (timeout oder connection refused):
|
||||
curl --max-time 5 http://94.16.110.151:9090 # Prometheus
|
||||
curl --max-time 5 http://94.16.110.151:8080 # Traefik Dashboard
|
||||
curl --max-time 5 http://94.16.110.151:9000 # Portainer
|
||||
|
||||
# Nur Public Services sollten erreichbar sein:
|
||||
curl http://94.16.110.151:80 # HTTP (funktioniert)
|
||||
curl https://94.16.110.151:443 # HTTPS (funktioniert)
|
||||
```
|
||||
|
||||
**Erwartetes Ergebnis**:
|
||||
- ❌ Admin-Ports (8080, 9090, 3001, 9000, 8001): Timeout oder Connection Refused
|
||||
- ✅ Public-Ports (80, 443): Erreichbar
|
||||
|
||||
### Firewall-Logs prüfen
|
||||
|
||||
**Auf Server**:
|
||||
```bash
|
||||
# Geblockte Zugriffe auf Admin-Services loggen
|
||||
sudo journalctl -k | grep "BLOCKED_ADMIN_SERVICE"
|
||||
|
||||
# Beispiel-Ausgabe:
|
||||
# [ 123.456] BLOCKED_ADMIN_SERVICE: IN=eth0 OUT= SRC=203.0.113.42 DST=94.16.110.151 PROTO=TCP DPT=8080
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Sicherheitshinweise
|
||||
|
||||
### ✅ Best Practices
|
||||
|
||||
1. **Private Keys schützen**:
|
||||
- Niemals Private Keys committen oder teilen
|
||||
- Berechtigungen: `chmod 600` für .conf Dateien
|
||||
|
||||
2. **Regelmäßige Key-Rotation**:
|
||||
- Empfohlen: Jährlich neue Keys generieren
|
||||
- Bei Kompromittierung: Sofort neue Keys erstellen
|
||||
|
||||
3. **Client-Zugriff widerrufen**:
|
||||
```bash
|
||||
# Auf Server: Peer aus Konfiguration entfernen
|
||||
sudo nano /etc/wireguard/wg0.conf
|
||||
# [Peer]-Block für michael-pc entfernen
|
||||
|
||||
# WireGuard neu laden
|
||||
sudo wg syncconf wg0 <(wg-quick strip wg0)
|
||||
```
|
||||
|
||||
4. **VPN-Monitoring**:
|
||||
```bash
|
||||
# Aktive Verbindungen prüfen
|
||||
sudo wg show wg0
|
||||
|
||||
# Letzte Handshake-Zeit prüfen
|
||||
sudo wg show wg0 latest-handshakes
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Nächste Schritte
|
||||
|
||||
Nach erfolgreicher VPN-Verbindung:
|
||||
|
||||
1. ✅ **VPN-Zugriff verifizieren**: Gateway ping + Admin Services Zugriff
|
||||
2. ✅ **Firewall-Rules validieren**: Public Access blockiert, VPN Access erlaubt
|
||||
3. ⏭️ **Weitere Clients hinzufügen** (optional):
|
||||
```bash
|
||||
ansible-playbook playbooks/generate-wireguard-client.yml -e "client_name=laptop"
|
||||
ansible-playbook playbooks/generate-wireguard-client.yml -e "client_name=phone"
|
||||
```
|
||||
|
||||
4. ⏭️ **Backup der Client-Configs**:
|
||||
```bash
|
||||
# Configs sind in .gitignore - manuelles Backup notwendig
|
||||
tar -czf wireguard-client-configs-backup-$(date +%Y%m%d).tar.gz \
|
||||
/home/michael/dev/michaelschiemer/deployment/ansible/wireguard/configs/
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**Erstellt**: 2025-11-05
|
||||
**Client Config**: michael-pc (10.8.0.2/32)
|
||||
**Server Endpoint**: 94.16.110.151:51820
|
||||
**VPN Network**: 10.8.0.0/24
|
||||
Reference in New Issue
Block a user