Michael Schiemer
95147ff23e
Remove WireGuard integration from production deployment to simplify infrastructure: - Remove docker-compose-direct-access.yml (VPN-bound services) - Remove VPN-only middlewares from Grafana, Prometheus, Portainer - Remove WireGuard middleware definitions from Traefik - Remove WireGuard IPs (10.8.0.0/24) from Traefik forwarded headers All monitoring services now publicly accessible via subdomains: - grafana.michaelschiemer.de (with Grafana native auth) - prometheus.michaelschiemer.de (with Basic Auth) - portainer.michaelschiemer.de (with Portainer native auth) All services use Let's Encrypt SSL certificates via Traefik.
260 lines
6.1 KiB
Markdown
260 lines
6.1 KiB
Markdown
# WireGuard Setup - Dokumentations-Index
|
|
|
|
Kompletter Index aller Dokumentation und Scripts für das minimalistic WireGuard Setup.
|
|
|
|
## 📚 Dokumentation
|
|
|
|
### Haupt-Dokumentation
|
|
|
|
| Datei | Zweck | Zielgruppe |
|
|
|-------|-------|------------|
|
|
| **README.md** | Vollständige Dokumentation mit Architektur, Setup, Troubleshooting | Alle Nutzer |
|
|
| **QUICKSTART.md** | 5-Minuten Quick Start Guide | Neue Nutzer |
|
|
| **INSTALLATION-LOG.md** | Schritt-für-Schritt Installations-Log | Systemadministratoren |
|
|
| **INDEX.md** (diese Datei) | Übersicht aller Dateien | Navigation |
|
|
|
|
### Client-Dokumentation
|
|
|
|
| Datei | Zweck |
|
|
|-------|-------|
|
|
| **configs/README.md** | Client Config Verzeichnis Dokumentation und Sicherheitshinweise |
|
|
| **configs/.gitignore** | Verhindert Commit von sensitiven Client Configs |
|
|
|
|
## 🛠️ Scripts
|
|
|
|
### Setup Scripts
|
|
|
|
| Script | Zweck | Ausführung |
|
|
|--------|-------|------------|
|
|
| **scripts/manual-wireguard-setup.sh** | Manuelles Setup-Script für Host-Installation | `sudo ./manual-wireguard-setup.sh` |
|
|
| **scripts/generate-client-config.sh** | Client Config Generator mit QR Codes | `sudo ./generate-client-config.sh <client-name>` |
|
|
| **scripts/cleanup-old-wireguard.sh** | Cleanup des alten Docker-basierten Setups | `sudo ./cleanup-old-wireguard.sh` |
|
|
|
|
### Ansible Automation
|
|
|
|
| Datei | Zweck |
|
|
|-------|-------|
|
|
| **ansible/playbooks/setup-wireguard-host.yml** | Vollständiges Ansible Playbook für automatisches Deployment |
|
|
| **ansible/templates/wg0.conf.j2** | WireGuard Server Config Template |
|
|
| **ansible/templates/wireguard-host-firewall.nft.j2** | nftables Firewall Rules Template |
|
|
|
|
## 🚀 Quick Start - Welche Datei nutzen?
|
|
|
|
### Für Anfänger: QUICKSTART.md
|
|
```bash
|
|
cat deployment/wireguard/QUICKSTART.md
|
|
```
|
|
- 5-Minuten Setup
|
|
- Einfache Schritt-für-Schritt Anleitung
|
|
- Für Linux, Windows, macOS, iOS, Android
|
|
|
|
### Für Erfahrene: README.md
|
|
```bash
|
|
cat deployment/wireguard/README.md
|
|
```
|
|
- Vollständige Architektur-Übersicht
|
|
- Detaillierte Konfigurationsoptionen
|
|
- Troubleshooting-Guide
|
|
- Sicherheits-Best-Practices
|
|
|
|
### Für Automatisierung: Ansible
|
|
```bash
|
|
cd deployment/ansible
|
|
ansible-playbook playbooks/setup-wireguard-host.yml
|
|
```
|
|
- Vollautomatisches Deployment
|
|
- Idempotent und wiederholbar
|
|
- Backup und Rollback-Support
|
|
|
|
### Für manuelle Installation: manual-wireguard-setup.sh
|
|
```bash
|
|
cd deployment/scripts
|
|
sudo ./manual-wireguard-setup.sh
|
|
```
|
|
- Interaktives Setup
|
|
- Zeigt alle Schritte
|
|
- Verifikation nach jedem Schritt
|
|
|
|
## 📋 Installations-Workflow
|
|
|
|
### Methode 1: Automatisiert (Empfohlen)
|
|
|
|
```bash
|
|
# 1. Cleanup altes Setup (falls vorhanden)
|
|
cd deployment/scripts
|
|
sudo ./cleanup-old-wireguard.sh
|
|
|
|
# 2. Automatisches Deployment
|
|
cd ../ansible
|
|
ansible-playbook playbooks/setup-wireguard-host.yml
|
|
|
|
# 3. Client Config generieren
|
|
cd ../scripts
|
|
sudo ./generate-client-config.sh michael-laptop
|
|
|
|
# 4. Client verbinden und testen
|
|
# (Siehe QUICKSTART.md)
|
|
```
|
|
|
|
### Methode 2: Manuell
|
|
|
|
```bash
|
|
# 1. Setup-Script ausführen
|
|
cd deployment/scripts
|
|
sudo ./manual-wireguard-setup.sh
|
|
|
|
# 2. INSTALLATION-LOG.md durchgehen
|
|
cat ../wireguard/INSTALLATION-LOG.md
|
|
|
|
# 3. Client Config generieren
|
|
sudo ./generate-client-config.sh michael-laptop
|
|
|
|
# 4. Client verbinden und testen
|
|
# (Siehe QUICKSTART.md)
|
|
```
|
|
|
|
## 🔍 Nach Installation
|
|
|
|
### Verifikation
|
|
|
|
```bash
|
|
# WireGuard Status
|
|
sudo wg show wg0
|
|
|
|
# Service Status
|
|
sudo systemctl status wg-quick@wg0
|
|
|
|
# Firewall Rules
|
|
sudo nft list table inet wireguard_firewall
|
|
|
|
# IP Forwarding
|
|
cat /proc/sys/net/ipv4/ip_forward
|
|
```
|
|
|
|
### Client Zugriff testen
|
|
|
|
Nach VPN-Verbindung:
|
|
|
|
```bash
|
|
# VPN-Gateway ping
|
|
ping 10.8.0.1
|
|
|
|
# Admin Services
|
|
curl -k https://10.8.0.1:8080 # Traefik Dashboard
|
|
curl http://10.8.0.1:9090 # Prometheus
|
|
curl https://10.8.0.1:3001 # Grafana
|
|
curl http://10.8.0.1:9000 # Portainer
|
|
curl http://10.8.0.1:8001 # Redis Insight
|
|
```
|
|
|
|
## 🛡️ Sicherheit
|
|
|
|
### Vor Deployment lesen
|
|
|
|
1. **README.md → Security Architecture**
|
|
- Defense in Depth Strategie
|
|
- Zero Trust Network Prinzipien
|
|
- Moderne Kryptographie
|
|
|
|
2. **README.md → Security Best Practices**
|
|
- Key Rotation
|
|
- Client Config Sicherung
|
|
- Firewall Monitoring
|
|
|
|
3. **configs/.gitignore**
|
|
- Client Configs NIEMALS committen
|
|
- Private Keys schützen
|
|
|
|
## 📊 Monitoring & Troubleshooting
|
|
|
|
### Logs überwachen
|
|
|
|
```bash
|
|
# WireGuard Service Logs
|
|
sudo journalctl -u wg-quick@wg0 -f
|
|
|
|
# Firewall Block Logs
|
|
sudo journalctl -k | grep "BLOCKED"
|
|
|
|
# System Logs
|
|
sudo dmesg | grep wireguard
|
|
```
|
|
|
|
### Häufige Probleme
|
|
|
|
Siehe **README.md → Troubleshooting Section** für:
|
|
- Connection refused
|
|
- Firewall blockiert Zugriff
|
|
- Routing-Probleme
|
|
- Performance-Issues
|
|
|
|
## 🔄 Wartung
|
|
|
|
### Regelmäßige Tasks
|
|
|
|
```bash
|
|
# Client Config generieren (neue Geräte)
|
|
cd deployment/scripts
|
|
sudo ./generate-client-config.sh <device-name>
|
|
|
|
# Client revoken
|
|
# (Siehe README.md → Revoke Client Access)
|
|
|
|
# Backup durchführen
|
|
tar -czf wireguard-backup-$(date +%Y%m%d).tar.gz /etc/wireguard/
|
|
|
|
# Firewall Rules updaten
|
|
# (Siehe README.md → Firewall Configuration)
|
|
```
|
|
|
|
### Updates
|
|
|
|
```bash
|
|
# WireGuard Update
|
|
sudo apt update && sudo apt upgrade wireguard wireguard-tools
|
|
|
|
# Konfiguration reload
|
|
sudo systemctl reload wg-quick@wg0
|
|
|
|
# Oder restart
|
|
sudo systemctl restart wg-quick@wg0
|
|
```
|
|
|
|
## 📖 Weitere Ressourcen
|
|
|
|
### Externe Dokumentation
|
|
|
|
- [WireGuard Official Docs](https://www.wireguard.com/)
|
|
- [nftables Wiki](https://wiki.nftables.org/)
|
|
- [systemd Documentation](https://www.freedesktop.org/software/systemd/man/)
|
|
|
|
### Framework Integration
|
|
|
|
- **Event System**: WireGuard-Events können über Framework Event System geloggt werden
|
|
- **Monitoring**: Integration mit Framework Performance Monitoring
|
|
- **Alerts**: Benachrichtigungen bei VPN-Problemen über Framework Alert System
|
|
|
|
## 🎯 Nächste Schritte (Phase 2 - Optional)
|
|
|
|
Falls DNS gewünscht:
|
|
|
|
1. **CoreDNS Minimal Setup**
|
|
- Siehe User's CoreDNS Konfigurationsbeispiel
|
|
- Integration mit WireGuard
|
|
- `.internal` Domain für Services
|
|
|
|
2. **Service Discovery**
|
|
- Automatische DNS-Einträge für Docker Services
|
|
- Load Balancing über DNS
|
|
|
|
3. **Monitoring**
|
|
- DNS Query Logs
|
|
- Performance Metriken
|
|
|
|
---
|
|
|
|
**Erstellt**: 2025-11-05
|
|
**Framework Version**: 2.x
|
|
**WireGuard Version**: 1.0.20210914
|
|
**Zielplattform**: Debian/Ubuntu Linux mit systemd
|