Sergei Poljanski
c8e8212b48
With asxpio-services described in nixos/, Ansible only has asxpio-ops left. Drop the runner, SillyTavern and Minecraft roles, the services host from both inventories, and the WireGuard client play. The s3fs role and playbook go as well: the mounts were switched off on asxpio-ops, and on asxpio-services nothing read them. The credentials file the role once wrote on asxpio-ops stays, because the backup script there reads it. site.yaml against asxpio-ops still changes nothing. Assisted-by: Claude:fable-5-2
123 lines
4.2 KiB
YAML
123 lines
4.2 KiB
YAML
---
|
|
# Stage 1: WireGuard VPN Setup
|
|
#
|
|
# This playbook must be run FIRST to establish the WireGuard VPN network.
|
|
# After this playbook completes:
|
|
# 1. WireGuard will be running on all hosts
|
|
# 2. Client configs will be generated in playbooks/wireguard-configs/
|
|
# 3. You MUST manually update inventory/hosts.yaml to use WireGuard IPs (10.20.0.x)
|
|
# 4. Then you can run playbook 02-full-deployment.yaml
|
|
#
|
|
# Usage:
|
|
# ansible-playbook playbooks/01-wireguard-setup.yaml
|
|
#
|
|
|
|
- name: Deploy WireGuard VPN Server
|
|
hosts: ops_servers
|
|
become: true
|
|
gather_facts: true
|
|
|
|
pre_tasks:
|
|
- name: Validate required variables
|
|
ansible.builtin.assert:
|
|
that:
|
|
- wireguard_network is defined
|
|
- vpc_network is defined
|
|
- ansible_host is defined
|
|
fail_msg: "Required network variables are missing. Check group_vars/all/"
|
|
success_msg: "Network variables validated successfully"
|
|
|
|
- name: Display pre-deployment information
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
========================================
|
|
WireGuard VPN Server Deployment
|
|
========================================
|
|
Target: {{ inventory_hostname }} (VPN Hub)
|
|
WireGuard network: {{ wireguard_network }}
|
|
VPC network: {{ vpc_network }}
|
|
|
|
This will deploy WireGuard VPN server and generate client configs.
|
|
========================================
|
|
|
|
roles:
|
|
- role: wireguard
|
|
|
|
- name: Post-deployment verification
|
|
hosts: localhost
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Display post-deployment instructions
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
========================================
|
|
WireGuard VPN Deployment Complete!
|
|
========================================
|
|
|
|
Infrastructure deployed:
|
|
✅ asxpio-ops: WireGuard VPN Server (hub)
|
|
|
|
Server-to-server connectivity:
|
|
- asxpio-services is a peer too; its side is configured in ../nixos
|
|
|
|
IMPORTANT NEXT STEPS FOR YOUR WORKSTATION:
|
|
|
|
1. Client configurations for your machine are in:
|
|
playbooks/wireguard-configs/asxpio-ops/
|
|
|
|
2. Import a client config to connect your workstation:
|
|
- Linux/Mac: sudo wg-quick up ./playbooks/wireguard-configs/asxpio-ops/<client>.conf
|
|
- Windows: Import the .conf file in WireGuard GUI
|
|
|
|
3. Test connectivity from your workstation:
|
|
ping {{ asxpio_ops_wireguard_ip }}
|
|
ping {{ asxpio_services_wireguard_ip }}
|
|
|
|
4. After connecting to WireGuard, run Stage 2:
|
|
ansible-playbook playbooks/02-full-deployment.yaml
|
|
|
|
NOTE: Stage 2 automatically uses WireGuard IPs.
|
|
No manual configuration changes needed!
|
|
|
|
========================================
|
|
|
|
- name: Test WireGuard connectivity from controller
|
|
ansible.builtin.wait_for:
|
|
host: "{{ asxpio_ops_wireguard_ip }}"
|
|
port: 22
|
|
timeout: 5
|
|
state: started
|
|
register: wg_connectivity_test
|
|
failed_when: false
|
|
|
|
- name: Display connectivity test results
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
========================================
|
|
WireGuard Connectivity Test
|
|
========================================
|
|
|
|
{% if wg_connectivity_test.failed %}
|
|
❌ Cannot reach servers via WireGuard from your workstation yet
|
|
|
|
This is NORMAL if you haven't connected your workstation to WireGuard.
|
|
|
|
To connect:
|
|
1. Import client config: playbooks/wireguard-configs/asxpio-ops/<client>.conf
|
|
2. Start WireGuard connection on your workstation
|
|
3. Verify with: ping {{ asxpio_ops_wireguard_ip }}
|
|
4. Run Stage 2: ansible-playbook playbooks/02-full-deployment.yaml
|
|
|
|
{% else %}
|
|
✅ WireGuard is reachable from your workstation!
|
|
|
|
Server-to-server VPN: Connected
|
|
Workstation-to-server VPN: Connected
|
|
|
|
You can now run Stage 2:
|
|
ansible-playbook playbooks/02-full-deployment.yaml
|
|
|
|
Stage 2 automatically uses WireGuard IPs - no manual configuration needed!
|
|
{% endif %}
|
|
|
|
========================================
|