Check loclhost instead of external in case firewalls block external connections

_deprecated/netmaker/meta/main.yml

@@ -1,3 +0,0 @@
----
-  dependencies: []
-    #- role: docker

_deprecated/netmaker/tasks/main.yml

@@ -1,8 +0,0 @@
-- import_tasks: ./certs.yml
-
-- import_tasks: ./install.yml
-
-- import_tasks: ./join-network.yml
-
-- name: Gather facts to get changes
-  ansible.builtin.gather_facts:

common/defaults/main.yml

@@ -1 +0,0 @@
-ipv6_stable_secret: 1111:2222:3333:4444:5555:6666:7777:8888

common/tasks/main.yml

@@ -5,5 +5,3 @@
 - import_tasks: ./packages.yml
 
 - import_tasks: ./aliases.yml
-
-- import_tasks: ./networking.yml

common/tasks/networking.yml

@@ -1,22 +0,0 @@
-- name: Set sysctl settings for ip-forwarding
-  copy:
-      dest: "/etc/sysctl.d/ip-forwarding.conf"
-      content: |
-          net.ipv4.ip_forward           = 1
-          net.ipv6.conf.all.forwarding  = 1
-  notify: reload_sysctl
-
-- name: Set sysctl settings for ipv6-address-generation
-  copy:
-      dest: "/etc/sysctl.d/ipv6-slaac-address-generation.conf"
-      content: |
-          net.ipv6.conf.default.addr_gen_mode = 2
-          net.ipv6.conf.default.stable_secret = {{ ipv6_stable_secret }}
-  notify: reload_sysctl
-
-- name: Set sysctl settings to override ipv6-slaac with enabled forwarding
-  copy:
-      dest: "/etc/sysctl.d/ipv6-slaac-override.conf"
-      content: |
-          net.ipv6.conf.all.accept_ra = 2
-  notify: reload_sysctl

kubernetes/tasks/install/server/install_k3s.yml

@@ -12,7 +12,7 @@
 
 - name: Waiting for K3s-server to accept connections
   ansible.builtin.wait_for:
-    host: "{{ inventory_hostname }}"
+    host: "127.0.0.1"
     port: 6443
     state: started
   when: "inventory_hostname == groups['kubernetes'][0]"
@@ -34,7 +34,7 @@
 
 - name: Waiting for K3s-server to accept connections on other nodes
   ansible.builtin.wait_for:
-    host: "{{ inventory_hostname }}"
+    host: "127.0.0.1"
     port: 6443
     state: started
   when: "inventory_hostname != groups['kubernetes'][0]"

netbird_client/defaults/netbird_client.yml

@@ -1,6 +0,0 @@
-netbird_client:
-  # Key and url to join a network
-  #  leave empty to ignore
-  join_network:
-    setup_key: 
-    management_url: 

netbird_client/tasks/install.yml

@@ -1,26 +0,0 @@
-- name: Install Packages
-#  when: docker_file.stat.exists == False
-  package:
-    name:
-      - ca-certificates
-      - curl
-      - gnupg
-
-- name: Add netbird-key
-  apt_key:
-    url: https://pkgs.wiretrustee.com/debian/public.key
-    state: present
-
-- name: Add netbird-repository
-  apt_repository:
-    repo: "deb https://pkgs.wiretrustee.com/debian stable main"
-    state: present
-    filename: netbird
-    update_cache: yes
-
-- name: Install wireguard & netbird
-  package:
-    name:
-      - wireguard
-      - netbird
-    state: latest

netbird_client/tasks/join-network.yml

@@ -1,16 +0,0 @@
-- name: Join netbird-network
-  when: "netbird_client.join_network.setup_key is defined"
-  command: "netbird up --management-url {{ netbird_client.join_network.management_url }} --setup-key {{ netbird_client.join_network.setup_key }}"
-  failed_when: command.rc != 0
-  changed_when: "'Connected' in command.stdout"
-  register: command
-
-- name: Wait for netbird-interface to exist
-  wait_for:
-    path: "/sys/class/net/wt0"
-    state: present
-  when: command.changed
-
-- name: Gather facts to get changes
-  ansible.builtin.gather_facts:
-  when: command.changed

netmaker/meta/main.yml

@@ -0,0 +1,3 @@
+---
+  dependencies:
+    - role: docker

netmaker/tasks/join-network.yml

@@ -2,6 +2,4 @@
   when: "netclient.join_network_token is defined"
   command: "netclient join -t {{ netclient.join_network_token }}"
   failed_when: command.rc != 0
-  changed_when: "'starting wireguard' in command.stdout"
   register: command
-  throttle: 1

netmaker/tasks/main.yml

@@ -1,4 +1,5 @@
+- import_tasks: ./certs.yml
+
 - import_tasks: ./install.yml
 
 - import_tasks: ./join-network.yml
-

netmaker_server/files/opt/netmaker_server/docs/architecture.puml

@@ -30,7 +30,7 @@ component netmaker_server {
   component nm_api
   nm_api -down- nm_api_http
   ng_http --( nm_api_http
-  nm_api .up.( ng_TLS : db-connection to rqlite-master
+  nm_api -up-( ng_TLS : db-connection to rqlite-master
   nm_api --( mq_plain
 }
 

netmaker_server/files/opt/netmaker_server/mosquitto/config/mosquitto.conf

@@ -1,11 +1,11 @@
 per_listener_settings false
 
 listener 8883
-protocol websockets
 allow_anonymous false
+certfile /certs/node.crt
+keyfile /certs/node.key
 
 listener 1883
-protocol websockets
 allow_anonymous false
 
 plugin /usr/lib/mosquitto_dynamic_security.so

netmaker_server/tasks/netmaker.yml

@@ -30,7 +30,7 @@
     headers:
       Authorization: 'Bearer {{ netmaker_creds.master_key }}'
       Content-Type: application/json
-  when: "inventory_hostname == groups['netmaker_server'][0]"
+  when: "inventory_hostname == groups['netmaker'][0]"
   register: default_mesh
   until: "default_mesh is not failed"
   retries: 2
@@ -50,7 +50,7 @@
     headers:
       Authorization: 'Bearer {{ netmaker_creds.master_key }}'
       Content-Type: application/json
-  when: "inventory_hostname == groups['netmaker_server'][0]"
+  when: "inventory_hostname == groups['netmaker'][0]"
   register: default_mesh_key
   until: "default_mesh_key is not failed"
   retries: 2

netmaker_server/templates/docker-compose.yml.template

@@ -33,15 +33,15 @@ services:
 
     -auth         /config.json
 
-{% if inventory_hostname != groups['netmaker_server'][0] %}
+{% if inventory_hostname != groups['netmaker'][0] %}
     -join-as  netmaker
-    -join     https://{{  netmaker_rqlite.http_host }}.{{ groups['netmaker_server'][0] }}:{{ netmaker_nginx.advertise_port }}
+    -join     https://{{  netmaker_rqlite.http_host }}.{{ groups['netmaker'][0] }}:{{ netmaker_nginx.advertise_port }}
 {% endif %}
     "
     # FIXME: /\ \/ Change http -> https
 
   netmaker: # The Primary Server for running Netmaker
-    image: gravitl/netmaker:v0.17.1
+    image: gravitl/netmaker:v0.16.1
     depends_on:
       - rqlite
     cap_add: 
@@ -104,7 +104,7 @@ services:
       - "51821-51830:51821-51830/udp" # wireguard ports
 
   netmaker-ui:  # The Netmaker UI Component
-    image: gravitl/netmaker-ui:v0.17.1
+    image: gravitl/netmaker-ui:v0.16.1
     depends_on:
       - netmaker
     links:
@@ -120,6 +120,7 @@ services:
       - ./mosquitto/config:/mosquitto/config
       - ./mosquitto/data:/mosquitto/data
       - ./mosquitto/logs:/mosquitto/log
+      - "./certs:/certs:ro"
     depends_on:
       - netmaker
     command: ["/mosquitto/config/wait.sh"]

netmaker_server/templates/nginx/passthrough.conf.template

@@ -6,7 +6,7 @@ stream{
         {{ netmaker_ui.host }}.{{ netmaker_base_domain }}   127.0.0.1:8443;
         {{ netmaker_api.host }}.{{ netmaker_base_domain }}  127.0.0.1:8443;
 
-        {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}   127.0.0.1:8443;
+        {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}   mosquitto:8883; # todo: tls-terminate?
 
         {{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}    127.0.0.1:8443;
         {{ netmaker_rqlite.cluster_host }}.{{ ansible_facts.nodename }}   rqlite:4002;

netmaker_server/templates/nginx/proxy.conf.template

@@ -3,9 +3,7 @@ map $host    $proxy_name {
     
     {{ netmaker_ui.host }}.{{ netmaker_base_domain }}               netmaker-ui:80;
     {{ netmaker_api.host }}.{{ netmaker_base_domain }}              netmaker:8081;
-
-    {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}       mosquitto:8883;
-
+    
     {{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}    rqlite:4001;
 
     default         444;

nftables/defaults/nftables.yml

@@ -1,29 +0,0 @@
-nftables:
-  # Rules to add
-  #  Handled as templates
-  #  Creates separate files for each entry.
-  # The identifier is necessary for ansible to be able to merge the keys (when 'hash_behaviour = merge')
-  #  rule-ids have to be unique across files and raw
-  rules:
-    # Files with Rules to add
-    files:
-      #'<group_identifier>': '<relative-location>'
-      #'<group_identifier>':
-      #  main: <relative-location>
-      #  '<identifier>': '<relative-location>'
-
-    # Rules to add
-    raw:
-      #'<group_identifier>': '<content>'
-      #'<group_identifier>':
-      #  main: <content>
-      #  '<identifier>': '<content>'
-
-  # Decides if /etc/nftables.conf is applied or separate files which have changed
-  #  Separate changes require the files to be self-tyding to not end up with duplicate rules
-  #  e.g.
-  #   table ip mytable
-  #   flush table ip mytable
-  #   delete table ip mytable
-  #   table ip mytable {} ...
-  apply_global: false

nftables/tasks/apply-files.yml

@@ -1,8 +0,0 @@
-- name: Load group rules
-  command: "nft -f /etc/nftables/ansible-managed/{{ item }}.nft"
-  loop: "{{ combined_rules | list }}"
-  when: not nftables.apply_global
-
-- name: Load global rule file
-  command: "nft -f /etc/nftables.nft"
-  when: nftables.apply_global

nftables/tasks/deploy-rules/main.yml

@@ -1,11 +0,0 @@
-- name: Deploying group files
-  include_tasks: ./per-group-template-file.yml
-  with_items:
-    - "{{ nftables.rules.files | list }}"
-
-- name: Deploying group raw-files
-  include_tasks: ./per-group-template.yml
-  with_items:
-    - "{{ nftables.rules.raw | list }}"
-
-- include_tasks: ./remove-files.yml

nftables/tasks/deploy-rules/per-group-template-file.yml

@@ -1,51 +0,0 @@
-- set_fact:
-    group_identifier: "{{ item }}"
-    value: "{{ nftables.rules.files[item] }}"
-  when: "item is defined"
-
-  #'<group_identifier>': '<relative-location>'
-- block:
-  - name: Create main rule file
-    template:
-      src: "{{ value }}"
-      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-  when: value is string
-
-  #'<group_identifier>':
-  #  main: <relative-location>
-  #  '<identifier>': '<relative-location>'
-- block:
-  - set_fact:
-      items: "{{ nftables.rules.files[item] }}"
-    
-  - block:
-    - name: Create main rule file
-      template:
-        src: "{{ items['main'] }}"
-        dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-
-    - name: Include rule files
-      lineinfile:
-        path: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-        regexp: "include\\s+(\"|')\\/etc\\/nftables\\/ansible-managed\\/{{ group_identifier }}\\/.*$"
-        line: 'include "/etc/nftables/ansible-managed/{{ group_identifier }}/*.nft"'
-    when: items['main'] is defined
-
-  - name: Create group folder
-    file:
-      path: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
-      state: directory
-    when: items|length > 0
-
-  - set_fact:
-      test: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
-
-  - name: Create included rule files
-    template:
-      src: "{{ fileItem.value }}"
-      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}/{{ fileItem.key }}.nft"
-    loop: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
-    loop_control:
-      loop_var: fileItem
-
-  when: value is mapping

nftables/tasks/deploy-rules/per-group-template.yml

@@ -1,48 +0,0 @@
-- set_fact:
-    group_identifier: "{{ item }}"
-    value: "{{ nftables.rules.raw[item] }}"
-  when: "item is defined"
-
-  #'<group_identifier>': '<content>'
-- block:
-  - name: Create main rule file
-    copy:
-      content: "{{ value }}"
-      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-  when: value is string
-
-  #'<group_identifier>':
-  #  main: <content>
-  #  '<identifier>': '<content>'
-- block:
-  - set_fact:
-      items: "{{ nftables.rules.raw[item] }}"
-  
-  - block:
-    - name: Create main rule file
-      copy:
-        content: "{{ items['main'] }}"
-        dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-
-    - name: Include rule files
-      lineinfile:
-        path: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-        regexp: "include\\s+(\"|')\\/etc\\/nftables\\/ansible-managed\\/{{ group_identifier }}\\/.*$"
-        line: 'include "/etc/nftables/ansible-managed/{{ group_identifier }}/*.nft"'
-    when: items['main'] is defined
-
-  - name: Create group folder
-    file:
-      path: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
-      state: directory
-    when: items|length > 0
-
-  - name: Create included rule files
-    copy:
-      content: "{{ included_item.value }}"
-      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}/{{ included_item.key }}.nft"
-    loop: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
-    loop_control:
-      loop_var: included_item
-
-  when: value is mapping

nftables/tasks/install-package.yml

@@ -1,4 +0,0 @@
-- name: Install Packages
-  package:
-    name:
-      - nftables

nftables/tasks/main.yml

@@ -1,7 +0,0 @@
-- import_tasks: ./prerequisites.yml
-
-- import_tasks: ./setup-packages.yml
-
-- import_tasks: ./deploy-rules/main.yml
-
-- import_tasks: ./apply-files.yml

nftables/tasks/prerequisites.yml

@@ -1,13 +0,0 @@
-# Defaults if missing
-- name: Set defaults if missing
-  set_fact:
-    nftables:
-      rules:
-        files: "{{ nftables.rules.files | default({}) | combine({}) }}"
-        raw: "{{ nftables.rules.raw | default({}) | combine({}) }}"
-    combined_rules: "{{ nftables.rules.raw | combine(nftables.rules.files, recursive=true) }}"
-
-#- name: Check items for consistency
-#  assert:
-#    that: "{{ nftables.rules.files.values() | length }} + {{ nftables.rules.raw.values() | length }} == {{ combined_rules.values() | length }}"
-#    fail_msg: "files and raw rules share the same identifier"

nftables/tasks/remove-files.yml

@@ -1,21 +0,0 @@
-- name: Handle removed group files
-  block:
-  - find:
-      paths: /etc/nftables/ansible-managed/
-      file_type: 'any'
-      excludes: '{% for item in combined_rules %}{{ item }},{{ item }}.nft,{% endfor %}'
-      depth: 1
-    register: removeFiles
-
-  - file:
-      path: "{{ fileItem.path }}"
-      state: absent
-    loop: "{{ removeFiles.files }}"
-    loop_control:
-      label: "{{ fileItem.path }}"
-      loop_var: fileItem
-
-- name: Handle removed included files per group
-  include_tasks: ./remove-per-group.yml
-  with_items:
-  - "{{ combined_rules | list }}"

nftables/tasks/remove-per-group.yml

@@ -1,20 +0,0 @@
-- set_fact:
-    group_identifier: "{{ item }}"
-    group_items: "{{ combined_rules[item] }}"
-
-- block:
-  - find:
-      paths: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
-      file_type: 'any'
-      excludes: '{% for item in group_items %}{{ item }}.nft,{% endfor %}'
-    register: removeFiles
-
-  - file:
-      path: "{{ fileItem.path }}"
-      state: absent
-    loop: "{{ removeFiles.files }}"
-    loop_control:
-      label: "{{ fileItem.path }}"
-      loop_var: fileItem
-
-  when: group_items is mapping

nftables/tasks/setup-packages.yml

@@ -1,15 +0,0 @@
-- name: Install nftables
-  package:
-    name:
-      - nftables
-
-- name: Create /etc/nftables/ansible-managed
-  file:
-    path: /etc/nftables/ansible-managed
-    state: directory
-
-- name: Include files in /etc/nftables/ansible-managed/ from /etc/nftables.conf
-  blockinfile:
-    path: /etc/nftables.conf
-    marker: "# {mark} ANSIBLE MANAGED BLOCK - nftables"
-    content: 'include "/etc/nftables/ansible-managed/*.nft"'

wireguard-ipv6-converter/defaults/wireguard-ipv6-converter.yml

@@ -1,12 +0,0 @@
-wireguard_ipv6_converter:
-  version: latest
-
-  # see https://github.com/Ruakij/wg-ipv6-converter#31-environment
-  setup:
-    interface: wg0
-    #ipv6_format: fc12::%02x%02x:%02x%02x/%d
-    #filter_prefix: 100.100
-    #recheck_interval: 60s
-
-  service:
-    #bindTo: netbird.service

wireguard-ipv6-converter/tasks/deploy.yml

@@ -1,11 +0,0 @@
-- name: Get architecture
-  set_fact:
-    arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else 'arm64' }}"
-    versionUri: "{% if wireguard_ipv6_converter.version == 'latest' %}latest/download{% else %}download/{{ wireguard_ipv6_converter.version }}{% endif %}"
-
-- name: Download binary
-  get_url:
-    url: https://github.com/Ruakij/wg-ipv6-converter/releases/{{ versionUri }}/wg-ipv6-converter_{{ arch }}
-    dest: /usr/local/bin/wg-ipv6-converter
-    mode: "744"
-  register: deployDownload

wireguard-ipv6-converter/tasks/main.yml

@@ -1,3 +0,0 @@
-- import_tasks: ./deploy.yml
-
-- import_tasks: ./setup-service.yml

wireguard-ipv6-converter/tasks/setup-service.yml

@@ -1,27 +0,0 @@
-- name: Deploy service
-  ansible.builtin.template:
-    src: wg-ipv6-conv.service.jinja2
-    dest: /etc/systemd/system/wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}.service
-  register: serviceFile
-
-- name: Enable service
-  ansible.builtin.service:
-    name: wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}
-    daemon-reload: true
-    enabled: true
-
-- name: Start service if interface exists already
-  ansible.builtin.service:
-    name: wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}
-    state: "{{ 'restarted' if deployDownload.changed or serviceFile.changed else 'started' }}"
-  register: service
-  when: "wireguard_ipv6_converter.setup.interface in ansible_interfaces"
-
-- name: Pause for 5s to wait for program to have run
-  ansible.builtin.pause:
-    seconds: 5
-  when: "service.changed"
-
-- name: Gather facts to get changes
-  ansible.builtin.gather_facts:
-  when: "service.changed"

wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2

@@ -1,29 +0,0 @@
-[Unit]
-Description=WireGuard IPv6 converter for {{ wireguard_ipv6_converter.setup.interface }}
-{% if wireguard_ipv6_converter.service.bindTo is defined %}
-BindsTo={{ wireguard_ipv6_converter.service.bindTo }}
-After={{ wireguard_ipv6_converter.service.bindTo }}
-{% endif %}
-
-[Service]
-Type=simple
-{% if wireguard_ipv6_converter.service.bindTo is defined %}
-ExecStartPre=/bin/sleep 10
-{% endif %}
-ExecStart=/usr/local/bin/wg-ipv6-converter
-Restart=always
-RestartSec=30
-
-Environment="INTERFACE={{ wireguard_ipv6_converter.setup.interface }}"
-{% if wireguard_ipv6_converter.setup.ipv6_format is defined %}
-Environment="IPV6_FORMAT={{ wireguard_ipv6_converter.setup.ipv6_format }}"
-{% endif %}
-{% if wireguard_ipv6_converter.setup.filter_prefix is defined %}
-Environment="FILTER_PREFIX={{ wireguard_ipv6_converter.setup.filter_prefix }}"
-{% endif %}
-{% if wireguard_ipv6_converter.setup.recheck_interval is defined %}
-Environment="RECHECK_INTERVAL={{ wireguard_ipv6_converter.setup.recheck_interval }}"
-{% endif %}
-
-[Install]
-WantedBy=multi-user.target