diff --git a/docs/guides/wiregueard-admin-vpn.md b/docs/guides/wiregueard-admin-vpn.md new file mode 100644 index 00000000..4d08bd51 --- /dev/null +++ b/docs/guides/wiregueard-admin-vpn.md @@ -0,0 +1,43 @@ +--- +title: "Wiregard Admin VPN" +summary: How to configure your Wireguard client to access the Z9 network +--- + +# Onboarding + +tbd. where to add your key + +# Local Client Configuration + +## Example Config + +Replace `YOUR_IP_IN_DEC` with your IP in decimal, and `YOUR_IP_IN_HEX` with your IP in hexadecimal. + +See [resources/z9/z9-router/systemd_networkd/10-wg56.netdev](resources/z9/z9-router/systemd_networkd/10-wg56.netdev) for the Wireguard endpoints configured on the router. + +``` +[Interface] +PrivateKey = YOUR_PRIVATE_KEY +Address = 10.89.214.YOUR_IP_IN_DEC/32, 2a07:c481:1:37::YOUR_IP_IN_HEX/128 + +[Peer] +PublicKey = fmlxjh3iOfpgrHQQpK3dyOD0BvDppGCUkFuMSroqQR4= +AllowedIPs = 10.89.208.0/20, 2a07:c481:1::/48, 212.12.48.120/29, 2a00:14b0:4200:3000::/64, 212.12.50.208/29, 2a00:14b0:42:100::/56, 212.12.51.128/28, 2a00:14b0:f000:23::/64 +Endpoint = rt-wan.ccchh.net:51820 +``` + +## AllowedIDs + +The following prefixes should be tunneled to gain access to both CCCHH Z9 resources as well as Chaosknoten. It is also possible to run a default route through wireguard, but please do not abuse this as a general VPN for purposes other than admin tasks. + +| Prefix | Description | +|--|--| +| [10.89.208.0/20](https://netbox.hamburg.ccc.de/ipam/prefixes/114/prefixes/) | prefix for CCCHH Z9 local networks | +| [2a07:c481:1::/48](https://netbox.hamburg.ccc.de/ipam/prefixes/50/) | prefix for CCCHH Z9 local networks | +| 212.12.48.120/29 | Fakep refix for hosts that come from [212.12.48.0/24](https://netbox.hamburg.ccc.de/ipam/prefixes/12/) | +| [2a00:14b0:4200:3000::/64](https://netbox.hamburg.ccc.de/ipam/prefixes/36/) | Public IPv6 in Wieske's shared network | +| [212.12.50.208/29](https://netbox.hamburg.ccc.de/ipam/prefixes/13/) | Public IPv4 for VMs on chaosknoten, routed by router | +| [2a00:14b0:42:100::/56](https://netbox.hamburg.ccc.de/ipam/prefixes/46/) | Public IPv6 for VMs on chaosknoten, routed by router | +| [212.12.51.128/28](https://netbox.hamburg.ccc.de/ipam/prefixes/15/) | IPv4 for VMs on chaosknoten, routed by Wieske | +| [2a00:14b0:f000:23::/64](https://netbox.hamburg.ccc.de/ipam/prefixes/35/) |IPv6 for VMs on chaosknoten, routed by Wieske | + diff --git a/inventories/chaosknoten/host_vars/git-pages.yaml b/inventories/chaosknoten/host_vars/git-pages.yaml new file mode 100644 index 00000000..a5c8c822 --- /dev/null +++ b/inventories/chaosknoten/host_vars/git-pages.yaml @@ -0,0 +1,2 @@ +# renovate: datasource=docker depName=codeberg.org/git-pages/git-pages +git_pages__version: latest diff --git a/inventories/z9/host_vars/yate.yaml b/inventories/z9/host_vars/yate.yaml index fecacb1e..ce296c42 100644 --- a/inventories/z9/host_vars/yate.yaml +++ b/inventories/z9/host_vars/yate.yaml @@ -6,3 +6,9 @@ docker_compose__configuration_files: content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/regexroute.conf.j2') }}" - name: regfile.conf content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/regfile.conf.j2') }}" + - name: rmanager.conf + content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/rmanager.conf.j2') }}" + - name: yrtpchan.conf + content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/yrtpchan.conf.j2') }}" + - name: ysipchan.conf + content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/ysipchan.conf.j2') }}" diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 66519db7..ebbab18f 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -15,7 +15,7 @@ all: ansible_host: waybackproxy.ccchh.net ansible_user: chaos yate: - ansible_host: yate.ccchh.net + ansible_host: yate.z9.ccchh.net ansible_user: chaos z9-router: ansible_host: z9-router.ccchh.net diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index f6194cb3..b4372c05 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -72,7 +72,7 @@ services: restart: unless-stopped command: ["uv", "run", "main.py", "sync"] environment: - - DRY_RUN=true + - DRY_RUN=false - KEYCLOAK_CLIENT_ID=mailman-sync - KEYCLOAK_CLIENT_SECRET={{ secret__lists__keycloak_client_secret }} - KEYCLOAK_REALM=ccchh diff --git a/resources/chaosknoten/zammad/docker_compose/compose.yaml b/resources/chaosknoten/zammad/docker_compose/compose.yaml index fb6837d4..70106c55 100644 --- a/resources/chaosknoten/zammad/docker_compose/compose.yaml +++ b/resources/chaosknoten/zammad/docker_compose/compose.yaml @@ -57,7 +57,7 @@ x-shared: LETSENCRYPT_HOST: LETSENCRYPT_EMAIL: - image: ${IMAGE_REPO:-ghcr.io/zammad/zammad}:${VERSION:-6.5.3} + image: ${IMAGE_REPO:-ghcr.io/zammad/zammad}:${VERSION:-7.1.2} restart: ${RESTART:-always} volumes: - zammad-storage:/opt/zammad/storage @@ -76,7 +76,7 @@ services: user: 0:0 zammad-elasticsearch: - image: elasticsearch:${ELASTICSEARCH_VERSION:-8.19.13} + image: elasticsearch:${ELASTICSEARCH_VERSION:-8.19.19} restart: ${RESTART:-always} volumes: - elasticsearch-data:/usr/share/elasticsearch/data diff --git a/resources/z9/yate/docker_compose/rmanager.conf.j2 b/resources/z9/yate/docker_compose/rmanager.conf.j2 new file mode 100644 index 00000000..fec08817 --- /dev/null +++ b/resources/z9/yate/docker_compose/rmanager.conf.j2 @@ -0,0 +1,4 @@ +; https://github.com/eventphone/yate/blob/master/conf.d/rmanager.conf.sample +[general] +; password: string: Password required to authenticate as admin, default empty! +;password= diff --git a/resources/z9/yate/docker_compose/yrtpchan.conf.j2 b/resources/z9/yate/docker_compose/yrtpchan.conf.j2 new file mode 100644 index 00000000..ac2c275d --- /dev/null +++ b/resources/z9/yate/docker_compose/yrtpchan.conf.j2 @@ -0,0 +1,4 @@ +; https://github.com/eventphone/yate/blob/master/conf.d/yrtpchan.conf.sample +[general] +minport=42000 +maxport=42999 diff --git a/resources/z9/yate/docker_compose/ysipchan.conf.j2 b/resources/z9/yate/docker_compose/ysipchan.conf.j2 new file mode 100644 index 00000000..32cfa762 --- /dev/null +++ b/resources/z9/yate/docker_compose/ysipchan.conf.j2 @@ -0,0 +1,6 @@ +; Setting for all SIP channels +; https://github.com/eventphone/yate/blob/master/conf.d/ysipchan.conf.sample + +[general] +; try to avoid `Transport(general) received likely truncated packet with length 1500, try to increase maxpkt` +maxpkt=8192 diff --git a/roles/dooris/meta/argument_specs.yml b/roles/dooris/meta/argument_specs.yml index 2d2726ac..134292d8 100644 --- a/roles/dooris/meta/argument_specs.yml +++ b/roles/dooris/meta/argument_specs.yml @@ -45,4 +45,3 @@ argument_specs: apiKey: required: true type: str -