Merge branch 'role_nftables'

This also sets up tls-termination for mosquitto

_deprecated/netmaker/meta/main.yml

@@ -0,0 +1,3 @@
+---
+  dependencies: []
+    #- role: docker

_deprecated/netmaker/tasks/join-network.yml

@@ -2,4 +2,6 @@
   when: "netclient.join_network_token is defined"
   command: "netclient join -t {{ netclient.join_network_token }}"
   failed_when: command.rc != 0
+  changed_when: "'starting wireguard' in command.stdout"
   register: command
+  throttle: 1

_deprecated/netmaker/tasks/main.yml

@@ -0,0 +1,8 @@
+- import_tasks: ./certs.yml
+
+- import_tasks: ./install.yml
+
+- import_tasks: ./join-network.yml
+
+- name: Gather facts to get changes
+  ansible.builtin.gather_facts:

_deprecated/netmaker_server/docs/architecture.puml

@@ -30,7 +30,7 @@ component netmaker_server {
   component nm_api
   nm_api -down- nm_api_http
   ng_http --( nm_api_http
-  nm_api -up-( ng_TLS : db-connection to rqlite-master
+  nm_api .up.( ng_TLS : db-connection to rqlite-master
   nm_api --( mq_plain
 }
 

_deprecated/netmaker_server/files/opt/netmaker_server/mosquitto/config/mosquitto.conf

@@ -1,11 +1,11 @@
 per_listener_settings false
 
 listener 8883
+protocol websockets
 allow_anonymous false
-certfile /certs/node.crt
-keyfile /certs/node.key
 
 listener 1883
+protocol websockets
 allow_anonymous false
 
 plugin /usr/lib/mosquitto_dynamic_security.so

_deprecated/netmaker_server/tasks/netmaker.yml

@@ -30,7 +30,7 @@
     headers:
       Authorization: 'Bearer {{ netmaker_creds.master_key }}'
       Content-Type: application/json
-  when: "inventory_hostname == groups['netmaker'][0]"
+  when: "inventory_hostname == groups['netmaker_server'][0]"
   register: default_mesh
   until: "default_mesh is not failed"
   retries: 2
@@ -50,7 +50,7 @@
     headers:
       Authorization: 'Bearer {{ netmaker_creds.master_key }}'
       Content-Type: application/json
-  when: "inventory_hostname == groups['netmaker'][0]"
+  when: "inventory_hostname == groups['netmaker_server'][0]"
   register: default_mesh_key
   until: "default_mesh_key is not failed"
   retries: 2

_deprecated/netmaker_server/templates/docker-compose.yml.template

@@ -33,15 +33,15 @@ services:
 
     -auth         /config.json
 
-{% if inventory_hostname != groups['netmaker'][0] %}
+{% if inventory_hostname != groups['netmaker_server'][0] %}
     -join-as  netmaker
-    -join     https://{{  netmaker_rqlite.http_host }}.{{ groups['netmaker'][0] }}:{{ netmaker_nginx.advertise_port }}
+    -join     https://{{  netmaker_rqlite.http_host }}.{{ groups['netmaker_server'][0] }}:{{ netmaker_nginx.advertise_port }}
 {% endif %}
     "
     # FIXME: /\ \/ Change http -> https
 
   netmaker: # The Primary Server for running Netmaker
-    image: gravitl/netmaker:v0.16.1
+    image: gravitl/netmaker:v0.17.1
     depends_on:
       - rqlite
     cap_add: 
@@ -104,7 +104,7 @@ services:
       - "51821-51830:51821-51830/udp" # wireguard ports
 
   netmaker-ui:  # The Netmaker UI Component
-    image: gravitl/netmaker-ui:v0.16.1
+    image: gravitl/netmaker-ui:v0.17.1
     depends_on:
       - netmaker
     links:
@@ -120,7 +120,6 @@ services:
       - ./mosquitto/config:/mosquitto/config
       - ./mosquitto/data:/mosquitto/data
       - ./mosquitto/logs:/mosquitto/log
-      - "./certs:/certs:ro"
     depends_on:
       - netmaker
     command: ["/mosquitto/config/wait.sh"]

_deprecated/netmaker_server/templates/nginx/passthrough.conf.template

@@ -6,7 +6,7 @@ stream{
         {{ netmaker_ui.host }}.{{ netmaker_base_domain }}   127.0.0.1:8443;
         {{ netmaker_api.host }}.{{ netmaker_base_domain }}  127.0.0.1:8443;
 
-        {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}   mosquitto:8883; # todo: tls-terminate?
+        {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}   127.0.0.1:8443;
 
         {{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}    127.0.0.1:8443;
         {{ netmaker_rqlite.cluster_host }}.{{ ansible_facts.nodename }}   rqlite:4002;

_deprecated/netmaker_server/templates/nginx/proxy.conf.template

@@ -3,7 +3,9 @@ map $host    $proxy_name {
     
     {{ netmaker_ui.host }}.{{ netmaker_base_domain }}               netmaker-ui:80;
     {{ netmaker_api.host }}.{{ netmaker_base_domain }}              netmaker:8081;
-    
+
+    {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}       mosquitto:8883;
+
     {{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}    rqlite:4001;
 
     default         444;

common/defaults/main.yml

@@ -0,0 +1 @@
+ipv6_stable_secret: 1111:2222:3333:4444:5555:6666:7777:8888

common/tasks/main.yml

@@ -5,3 +5,5 @@
 - import_tasks: ./packages.yml
 
 - import_tasks: ./aliases.yml
+
+- import_tasks: ./networking.yml

common/tasks/networking.yml

@@ -0,0 +1,22 @@
+- name: Set sysctl settings for ip-forwarding
+  copy:
+      dest: "/etc/sysctl.d/ip-forwarding.conf"
+      content: |
+          net.ipv4.ip_forward           = 1
+          net.ipv6.conf.all.forwarding  = 1
+  notify: reload_sysctl
+
+- name: Set sysctl settings for ipv6-address-generation
+  copy:
+      dest: "/etc/sysctl.d/ipv6-slaac-address-generation.conf"
+      content: |
+          net.ipv6.conf.default.addr_gen_mode = 2
+          net.ipv6.conf.default.stable_secret = {{ ipv6_stable_secret }}
+  notify: reload_sysctl
+
+- name: Set sysctl settings to override ipv6-slaac with enabled forwarding
+  copy:
+      dest: "/etc/sysctl.d/ipv6-slaac-override.conf"
+      content: |
+          net.ipv6.conf.all.accept_ra = 2
+  notify: reload_sysctl

netbird_client/defaults/netbird_client.yml

@@ -0,0 +1,6 @@
+netbird_client:
+  # Key and url to join a network
+  #  leave empty to ignore
+  join_network:
+    setup_key: 
+    management_url: 

netbird_client/tasks/install.yml

@@ -0,0 +1,26 @@
+- name: Install Packages
+#  when: docker_file.stat.exists == False
+  package:
+    name:
+      - ca-certificates
+      - curl
+      - gnupg
+
+- name: Add netbird-key
+  apt_key:
+    url: https://pkgs.wiretrustee.com/debian/public.key
+    state: present
+
+- name: Add netbird-repository
+  apt_repository:
+    repo: "deb https://pkgs.wiretrustee.com/debian stable main"
+    state: present
+    filename: netbird
+    update_cache: yes
+
+- name: Install wireguard & netbird
+  package:
+    name:
+      - wireguard
+      - netbird
+    state: latest

netbird_client/tasks/join-network.yml

@@ -0,0 +1,16 @@
+- name: Join netbird-network
+  when: "netbird_client.join_network.setup_key is defined"
+  command: "netbird up --management-url {{ netbird_client.join_network.management_url }} --setup-key {{ netbird_client.join_network.setup_key }}"
+  failed_when: command.rc != 0
+  changed_when: "'Connected' in command.stdout"
+  register: command
+
+- name: Wait for netbird-interface to exist
+  wait_for:
+    path: "/sys/class/net/wt0"
+    state: present
+  when: command.changed
+
+- name: Gather facts to get changes
+  ansible.builtin.gather_facts:
+  when: command.changed

netbird_client/tasks/main.yml

@@ -1,5 +1,4 @@
-- import_tasks: ./certs.yml
-
 - import_tasks: ./install.yml
 
 - import_tasks: ./join-network.yml
+

netmaker/meta/main.yml

@@ -1,3 +0,0 @@
----
-  dependencies:
-    - role: docker

nftables/defaults/nftables.yml

@@ -0,0 +1,29 @@
+nftables:
+  # Rules to add
+  #  Handled as templates
+  #  Creates separate files for each entry.
+  # The identifier is necessary for ansible to be able to merge the keys (when 'hash_behaviour = merge')
+  #  rule-ids have to be unique across files and raw
+  rules:
+    # Files with Rules to add
+    files:
+      #'<group_identifier>': '<relative-location>'
+      #'<group_identifier>':
+      #  main: <relative-location>
+      #  '<identifier>': '<relative-location>'
+
+    # Rules to add
+    raw:
+      #'<group_identifier>': '<content>'
+      #'<group_identifier>':
+      #  main: <content>
+      #  '<identifier>': '<content>'
+
+  # Decides if /etc/nftables.conf is applied or separate files which have changed
+  #  Separate changes require the files to be self-tyding to not end up with duplicate rules
+  #  e.g.
+  #   table ip mytable
+  #   flush table ip mytable
+  #   delete table ip mytable
+  #   table ip mytable {} ...
+  apply_global: false

nftables/tasks/apply-files.yml

@@ -0,0 +1,8 @@
+- name: Load group rules
+  command: "nft -f /etc/nftables/ansible-managed/{{ item }}.nft"
+  loop: "{{ combined_rules | list }}"
+  when: not nftables.apply_global
+
+- name: Load global rule file
+  command: "nft -f /etc/nftables.nft"
+  when: nftables.apply_global

nftables/tasks/deploy-rules/main.yml

@@ -0,0 +1,11 @@
+- name: Deploying group files
+  include_tasks: ./per-group-template-file.yml
+  with_items:
+    - "{{ nftables.rules.files | list }}"
+
+- name: Deploying group raw-files
+  include_tasks: ./per-group-template.yml
+  with_items:
+    - "{{ nftables.rules.raw | list }}"
+
+- include_tasks: ./remove-files.yml

nftables/tasks/deploy-rules/per-group-template-file.yml

@@ -0,0 +1,51 @@
+- set_fact:
+    group_identifier: "{{ item }}"
+    value: "{{ nftables.rules.files[item] }}"
+  when: "item is defined"
+
+  #'<group_identifier>': '<relative-location>'
+- block:
+  - name: Create main rule file
+    template:
+      src: "{{ value }}"
+      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+  when: value is string
+
+  #'<group_identifier>':
+  #  main: <relative-location>
+  #  '<identifier>': '<relative-location>'
+- block:
+  - set_fact:
+      items: "{{ nftables.rules.files[item] }}"
+    
+  - block:
+    - name: Create main rule file
+      template:
+        src: "{{ items['main'] }}"
+        dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+
+    - name: Include rule files
+      lineinfile:
+        path: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+        regexp: "include\\s+(\"|')\\/etc\\/nftables\\/ansible-managed\\/{{ group_identifier }}\\/.*$"
+        line: 'include "/etc/nftables/ansible-managed/{{ group_identifier }}/*.nft"'
+    when: items['main'] is defined
+
+  - name: Create group folder
+    file:
+      path: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
+      state: directory
+    when: items|length > 0
+
+  - set_fact:
+      test: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
+
+  - name: Create included rule files
+    template:
+      src: "{{ fileItem.value }}"
+      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}/{{ fileItem.key }}.nft"
+    loop: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
+    loop_control:
+      loop_var: fileItem
+
+  when: value is mapping

nftables/tasks/deploy-rules/per-group-template.yml

@@ -0,0 +1,48 @@
+- set_fact:
+    group_identifier: "{{ item }}"
+    value: "{{ nftables.rules.raw[item] }}"
+  when: "item is defined"
+
+  #'<group_identifier>': '<content>'
+- block:
+  - name: Create main rule file
+    copy:
+      content: "{{ value }}"
+      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+  when: value is string
+
+  #'<group_identifier>':
+  #  main: <content>
+  #  '<identifier>': '<content>'
+- block:
+  - set_fact:
+      items: "{{ nftables.rules.raw[item] }}"
+  
+  - block:
+    - name: Create main rule file
+      copy:
+        content: "{{ items['main'] }}"
+        dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+
+    - name: Include rule files
+      lineinfile:
+        path: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
+        regexp: "include\\s+(\"|')\\/etc\\/nftables\\/ansible-managed\\/{{ group_identifier }}\\/.*$"
+        line: 'include "/etc/nftables/ansible-managed/{{ group_identifier }}/*.nft"'
+    when: items['main'] is defined
+
+  - name: Create group folder
+    file:
+      path: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
+      state: directory
+    when: items|length > 0
+
+  - name: Create included rule files
+    copy:
+      content: "{{ included_item.value }}"
+      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}/{{ included_item.key }}.nft"
+    loop: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
+    loop_control:
+      loop_var: included_item
+
+  when: value is mapping

nftables/tasks/install-package.yml

@@ -0,0 +1,4 @@
+- name: Install Packages
+  package:
+    name:
+      - nftables

nftables/tasks/main.yml

@@ -0,0 +1,7 @@
+- import_tasks: ./prerequisites.yml
+
+- import_tasks: ./setup-packages.yml
+
+- import_tasks: ./deploy-rules/main.yml
+
+- import_tasks: ./apply-files.yml

nftables/tasks/prerequisites.yml

@@ -0,0 +1,13 @@
+# Defaults if missing
+- name: Set defaults if missing
+  set_fact:
+    nftables:
+      rules:
+        files: "{{ nftables.rules.files | default({}) | combine({}) }}"
+        raw: "{{ nftables.rules.raw | default({}) | combine({}) }}"
+    combined_rules: "{{ nftables.rules.raw | combine(nftables.rules.files, recursive=true) }}"
+
+#- name: Check items for consistency
+#  assert:
+#    that: "{{ nftables.rules.files.values() | length }} + {{ nftables.rules.raw.values() | length }} == {{ combined_rules.values() | length }}"
+#    fail_msg: "files and raw rules share the same identifier"

nftables/tasks/remove-files.yml

@@ -0,0 +1,21 @@
+- name: Handle removed group files
+  block:
+  - find:
+      paths: /etc/nftables/ansible-managed/
+      file_type: 'any'
+      excludes: '{% for item in combined_rules %}{{ item }},{{ item }}.nft,{% endfor %}'
+      depth: 1
+    register: removeFiles
+
+  - file:
+      path: "{{ fileItem.path }}"
+      state: absent
+    loop: "{{ removeFiles.files }}"
+    loop_control:
+      label: "{{ fileItem.path }}"
+      loop_var: fileItem
+
+- name: Handle removed included files per group
+  include_tasks: ./remove-per-group.yml
+  with_items:
+  - "{{ combined_rules | list }}"

nftables/tasks/remove-per-group.yml

@@ -0,0 +1,20 @@
+- set_fact:
+    group_identifier: "{{ item }}"
+    group_items: "{{ combined_rules[item] }}"
+
+- block:
+  - find:
+      paths: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
+      file_type: 'any'
+      excludes: '{% for item in group_items %}{{ item }}.nft,{% endfor %}'
+    register: removeFiles
+
+  - file:
+      path: "{{ fileItem.path }}"
+      state: absent
+    loop: "{{ removeFiles.files }}"
+    loop_control:
+      label: "{{ fileItem.path }}"
+      loop_var: fileItem
+
+  when: group_items is mapping

nftables/tasks/setup-packages.yml

@@ -0,0 +1,15 @@
+- name: Install nftables
+  package:
+    name:
+      - nftables
+
+- name: Create /etc/nftables/ansible-managed
+  file:
+    path: /etc/nftables/ansible-managed
+    state: directory
+
+- name: Include files in /etc/nftables/ansible-managed/ from /etc/nftables.conf
+  blockinfile:
+    path: /etc/nftables.conf
+    marker: "# {mark} ANSIBLE MANAGED BLOCK - nftables"
+    content: 'include "/etc/nftables/ansible-managed/*.nft"'

wireguard-ipv6-converter/defaults/wireguard-ipv6-converter.yml

@@ -0,0 +1,12 @@
+wireguard_ipv6_converter:
+  version: latest
+
+  # see https://github.com/Ruakij/wg-ipv6-converter#31-environment
+  setup:
+    interface: wg0
+    #ipv6_format: fc12::%02x%02x:%02x%02x/%d
+    #filter_prefix: 100.100
+    #recheck_interval: 60s
+
+  service:
+    #bindTo: netbird.service

wireguard-ipv6-converter/tasks/deploy.yml

@@ -0,0 +1,11 @@
+- name: Get architecture
+  set_fact:
+    arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else 'arm64' }}"
+    versionUri: "{% if wireguard_ipv6_converter.version == 'latest' %}latest/download{% else %}download/{{ wireguard_ipv6_converter.version }}{% endif %}"
+
+- name: Download binary
+  get_url:
+    url: https://github.com/Ruakij/wg-ipv6-converter/releases/{{ versionUri }}/wg-ipv6-converter_{{ arch }}
+    dest: /usr/local/bin/wg-ipv6-converter
+    mode: "744"
+  register: deployDownload

wireguard-ipv6-converter/tasks/main.yml

@@ -0,0 +1,3 @@
+- import_tasks: ./deploy.yml
+
+- import_tasks: ./setup-service.yml

wireguard-ipv6-converter/tasks/setup-service.yml

@@ -0,0 +1,27 @@
+- name: Deploy service
+  ansible.builtin.template:
+    src: wg-ipv6-conv.service.jinja2
+    dest: /etc/systemd/system/wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}.service
+  register: serviceFile
+
+- name: Enable service
+  ansible.builtin.service:
+    name: wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}
+    daemon-reload: true
+    enabled: true
+
+- name: Start service if interface exists already
+  ansible.builtin.service:
+    name: wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}
+    state: "{{ 'restarted' if deployDownload.changed or serviceFile.changed else 'started' }}"
+  register: service
+  when: "wireguard_ipv6_converter.setup.interface in ansible_interfaces"
+
+- name: Pause for 5s to wait for program to have run
+  ansible.builtin.pause:
+    seconds: 5
+  when: "service.changed"
+
+- name: Gather facts to get changes
+  ansible.builtin.gather_facts:
+  when: "service.changed"

wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2

@@ -0,0 +1,29 @@
+[Unit]
+Description=WireGuard IPv6 converter for {{ wireguard_ipv6_converter.setup.interface }}
+{% if wireguard_ipv6_converter.service.bindTo is defined %}
+BindsTo={{ wireguard_ipv6_converter.service.bindTo }}
+After={{ wireguard_ipv6_converter.service.bindTo }}
+{% endif %}
+
+[Service]
+Type=simple
+{% if wireguard_ipv6_converter.service.bindTo is defined %}
+ExecStartPre=/bin/sleep 10
+{% endif %}
+ExecStart=/usr/local/bin/wg-ipv6-converter
+Restart=always
+RestartSec=30
+
+Environment="INTERFACE={{ wireguard_ipv6_converter.setup.interface }}"
+{% if wireguard_ipv6_converter.setup.ipv6_format is defined %}
+Environment="IPV6_FORMAT={{ wireguard_ipv6_converter.setup.ipv6_format }}"
+{% endif %}
+{% if wireguard_ipv6_converter.setup.filter_prefix is defined %}
+Environment="FILTER_PREFIX={{ wireguard_ipv6_converter.setup.filter_prefix }}"
+{% endif %}
+{% if wireguard_ipv6_converter.setup.recheck_interval is defined %}
+Environment="RECHECK_INTERVAL={{ wireguard_ipv6_converter.setup.recheck_interval }}"
+{% endif %}
+
+[Install]
+WantedBy=multi-user.target