Add pause & gather_facts at end when service was started

This also sets up tls-termination for mosquitto

_deprecated/netmaker/meta/main.yml

@@ -0,0 +1,3 @@
+---
+  dependencies: []
+    #- role: docker

_deprecated/netmaker/tasks/join-network.yml

@@ -2,4 +2,6 @@
   when: "netclient.join_network_token is defined"
   command: "netclient join -t {{ netclient.join_network_token }}"
   failed_when: command.rc != 0
+  changed_when: "'starting wireguard' in command.stdout"
   register: command
+  throttle: 1

_deprecated/netmaker/tasks/main.yml

@@ -0,0 +1,8 @@
+- import_tasks: ./certs.yml
+
+- import_tasks: ./install.yml
+
+- import_tasks: ./join-network.yml
+
+- name: Gather facts to get changes
+  ansible.builtin.gather_facts:

_deprecated/netmaker_server/docs/architecture.puml

@@ -30,7 +30,7 @@ component netmaker_server {
   component nm_api
   nm_api -down- nm_api_http
   ng_http --( nm_api_http
-  nm_api -up-( ng_TLS : db-connection to rqlite-master
+  nm_api .up.( ng_TLS : db-connection to rqlite-master
   nm_api --( mq_plain
 }
 

_deprecated/netmaker_server/files/opt/netmaker_server/mosquitto/config/mosquitto.conf

@@ -1,11 +1,11 @@
 per_listener_settings false
 
 listener 8883
+protocol websockets
 allow_anonymous false
-certfile /certs/node.crt
-keyfile /certs/node.key
 
 listener 1883
+protocol websockets
 allow_anonymous false
 
 plugin /usr/lib/mosquitto_dynamic_security.so

_deprecated/netmaker_server/tasks/netmaker.yml

@@ -30,7 +30,7 @@
     headers:
       Authorization: 'Bearer {{ netmaker_creds.master_key }}'
       Content-Type: application/json
-  when: "inventory_hostname == groups['netmaker'][0]"
+  when: "inventory_hostname == groups['netmaker_server'][0]"
   register: default_mesh
   until: "default_mesh is not failed"
   retries: 2
@@ -50,7 +50,7 @@
     headers:
       Authorization: 'Bearer {{ netmaker_creds.master_key }}'
       Content-Type: application/json
-  when: "inventory_hostname == groups['netmaker'][0]"
+  when: "inventory_hostname == groups['netmaker_server'][0]"
   register: default_mesh_key
   until: "default_mesh_key is not failed"
   retries: 2

_deprecated/netmaker_server/templates/docker-compose.yml.template

@@ -33,15 +33,15 @@ services:
 
     -auth         /config.json
 
-{% if inventory_hostname != groups['netmaker'][0] %}
+{% if inventory_hostname != groups['netmaker_server'][0] %}
     -join-as  netmaker
-    -join     https://{{  netmaker_rqlite.http_host }}.{{ groups['netmaker'][0] }}:{{ netmaker_nginx.advertise_port }}
+    -join     https://{{  netmaker_rqlite.http_host }}.{{ groups['netmaker_server'][0] }}:{{ netmaker_nginx.advertise_port }}
 {% endif %}
     "
     # FIXME: /\ \/ Change http -> https
 
   netmaker: # The Primary Server for running Netmaker
-    image: gravitl/netmaker:v0.16.1
+    image: gravitl/netmaker:v0.17.1
     depends_on:
       - rqlite
     cap_add: 
@@ -104,7 +104,7 @@ services:
       - "51821-51830:51821-51830/udp" # wireguard ports
 
   netmaker-ui:  # The Netmaker UI Component
-    image: gravitl/netmaker-ui:v0.16.1
+    image: gravitl/netmaker-ui:v0.17.1
     depends_on:
       - netmaker
     links:
@@ -120,7 +120,6 @@ services:
       - ./mosquitto/config:/mosquitto/config
       - ./mosquitto/data:/mosquitto/data
       - ./mosquitto/logs:/mosquitto/log
-      - "./certs:/certs:ro"
     depends_on:
       - netmaker
     command: ["/mosquitto/config/wait.sh"]

_deprecated/netmaker_server/templates/nginx/passthrough.conf.template

@@ -6,7 +6,7 @@ stream{
         {{ netmaker_ui.host }}.{{ netmaker_base_domain }}   127.0.0.1:8443;
         {{ netmaker_api.host }}.{{ netmaker_base_domain }}  127.0.0.1:8443;
 
-        {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}   mosquitto:8883; # todo: tls-terminate?
+        {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}   127.0.0.1:8443;
 
         {{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}    127.0.0.1:8443;
         {{ netmaker_rqlite.cluster_host }}.{{ ansible_facts.nodename }}   rqlite:4002;

_deprecated/netmaker_server/templates/nginx/proxy.conf.template

@@ -4,6 +4,8 @@ map $host    $proxy_name {
     {{ netmaker_ui.host }}.{{ netmaker_base_domain }}               netmaker-ui:80;
     {{ netmaker_api.host }}.{{ netmaker_base_domain }}              netmaker:8081;
 
+    {{ netmaker_broker.tls_host }}.{{ netmaker_base_domain }}       mosquitto:8883;
+
     {{ netmaker_rqlite.http_host }}.{{ ansible_facts.nodename }}    rqlite:4001;
 
     default         444;

common/defaults/main.yml

@@ -0,0 +1 @@
+ipv6_stable_secret: 1111:2222:3333:4444:5555:6666:7777:8888

common/tasks/main.yml

@@ -5,3 +5,5 @@
 - import_tasks: ./packages.yml
 
 - import_tasks: ./aliases.yml
+
+- import_tasks: ./networking.yml

common/tasks/networking.yml

@@ -0,0 +1,22 @@
+- name: Set sysctl settings for ip-forwarding
+  copy:
+      dest: "/etc/sysctl.d/ip-forwarding.conf"
+      content: |
+          net.ipv4.ip_forward           = 1
+          net.ipv6.conf.all.forwarding  = 1
+  notify: reload_sysctl
+
+- name: Set sysctl settings for ipv6-address-generation
+  copy:
+      dest: "/etc/sysctl.d/ipv6-slaac-address-generation.conf"
+      content: |
+          net.ipv6.conf.default.addr_gen_mode = 2
+          net.ipv6.conf.default.stable_secret = {{ ipv6_stable_secret }}
+  notify: reload_sysctl
+
+- name: Set sysctl settings to override ipv6-slaac with enabled forwarding
+  copy:
+      dest: "/etc/sysctl.d/ipv6-slaac-override.conf"
+      content: |
+          net.ipv6.conf.all.accept_ra = 2
+  notify: reload_sysctl

kubernetes/tasks/install/agent/install_k3s.yml

@@ -1,12 +1,13 @@
 - name: Install K3s agent
   command: /root/k3s_install.sh {{ type }}
   register: command
-  changed_when: "'No change detected' not in command.stdout"
+  changed_when: "'No change detected' in command.stdout"
   until: "command is not failed"
   retries: 2
   delay: 10
 
-- name: Make sure service is started / restarted on config change
+- name: Restart when config changed, but install already done
   service:
-    name: k3s-agent
-    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"
+    name: k3s
+    status: restarted
+  when: "inventory_hostname != groups['kubernetes'][0] and not command.changed and config.changed"

kubernetes/tasks/install/server/install_k3s.yml

@@ -2,17 +2,17 @@
   command: /root/k3s_install.sh {{ type }}
   when: "inventory_hostname == groups['kubernetes'][0]"
   register: command
-  changed_when: "'No change detected' not in command.stdout"
+  changed_when: "'No change detected' in command.stdout"
 
-- name: Make sure service is started / restarted on config change
+- name: Restart when config changed, but install already done
   service:
     name: k3s
-    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"
-  when: "inventory_hostname == groups['kubernetes'][0]"
+    status: restarted
+  when: "inventory_hostname == groups['kubernetes'][0] and not command.changed and config.changed"
 
 - name: Waiting for K3s-server to accept connections
   ansible.builtin.wait_for:
-    host: "127.0.0.1"
+    host: "{{ inventory_hostname }}"
     port: 6443
     state: started
   when: "inventory_hostname == groups['kubernetes'][0]"
@@ -21,20 +21,20 @@
   command: /root/k3s_install.sh {{ type }}
   when: "inventory_hostname != groups['kubernetes'][0]"
   register: command
-  changed_when: "'No change detected' not in command.stdout"
+  changed_when: "'No change detected' in command.stdout"
   until: "command is not failed"
   retries: 2
   delay: 10
 
-- name: Make sure service is started / restarted on config change
+- name: Restart when config changed, but install already done
   service:
     name: k3s
-    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"
-  when: "inventory_hostname != groups['kubernetes'][0]"
+    status: restarted
+  when: "inventory_hostname != groups['kubernetes'][0] and not command.changed and config.changed"
 
 - name: Waiting for K3s-server to accept connections on other nodes
   ansible.builtin.wait_for:
-    host: "127.0.0.1"
+    host: "{{ inventory_hostname }}"
     port: 6443
     state: started
   when: "inventory_hostname != groups['kubernetes'][0]"

kubernetes/tasks/install/server/network-plugin/deploy_calico.yml

@@ -3,8 +3,6 @@
   register: command
   changed_when: "'created' in command.stdout"
   run_once: true
-  failed_when:
-  - "command.rc == 1 and 'AlreadyExists' not in command.stderr"
 
 - name: Deploy calico ressource template
   ansible.builtin.template:

kubernetes/templates/k3s/agent/config.yaml.jinja2

@@ -1,8 +1,11 @@
-server: https://{{ hostvars[groups['kubernetes'][0]]['nodeip_ipv4'] }}:6443
+server: https://{{ kubernetes.control_plane.dns_name }}:6443
 token: '{{ kubernetes.token }}'
 
 {% if nodeip_ipv6 != "" and kubernetes.ipPool.ipv6 is defined %}
 node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }} 
+
+# FIXME: Workaround for bug in Kubernetes 1.24/1.25 ignoring node IPv6 addresses
+kubelet-arg: "--node-ip=0.0.0.0"
 {% else %}
 node-ip: {{ nodeip_ipv4 }}
 {% endif %}

kubernetes/templates/k3s/server/config.yaml.jinja2

@@ -15,6 +15,9 @@ tls-san:
 node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }}
 cluster-cidr: {{ kubernetes.ipPool.ipv4.cluster_cidr }},{{ kubernetes.ipPool.ipv6.cluster_cidr }}
 service-cidr: {{ kubernetes.ipPool.ipv4.service_cidr }},{{ kubernetes.ipPool.ipv6.service_cidr }}  
+
+# FIXME: Workaround for bug in Kubernetes 1.24/1.25 ignoring node IPv6 addresses
+kubelet-arg: "--node-ip=0.0.0.0"
 {% else %}
 node-ip: {{ nodeip_ipv4 }}
 cluster-cidr: {{ kubernetes.ipPool.ipv4.cluster_cidr }}
@@ -24,7 +27,7 @@ service-cidr: {{ kubernetes.ipPool.ipv4.service_cidr }}
 egress-selector-mode: disabled
 
 # Network-plugin
-{% if kubernetes.network.plugin == "flannel" %}
+{% if kubernetes.network_plugin == "flannel" %}
 flannel-backend: vxlan
 {% else %}
 disable-network-policy: true

netbird_client/defaults/netbird_client.yml

@@ -0,0 +1,6 @@
+netbird_client:
+  # Key and url to join a network
+  #  leave empty to ignore
+  join_network:
+    setup_key: 
+    management_url: 

netbird_client/tasks/install.yml

@@ -0,0 +1,26 @@
+- name: Install Packages
+#  when: docker_file.stat.exists == False
+  package:
+    name:
+      - ca-certificates
+      - curl
+      - gnupg
+
+- name: Add netbird-key
+  apt_key:
+    url: https://pkgs.wiretrustee.com/debian/public.key
+    state: present
+
+- name: Add netbird-repository
+  apt_repository:
+    repo: "deb https://pkgs.wiretrustee.com/debian stable main"
+    state: present
+    filename: netbird
+    update_cache: yes
+
+- name: Install wireguard & netbird
+  package:
+    name:
+      - wireguard
+      - netbird
+    state: latest

netbird_client/tasks/join-network.yml

@@ -0,0 +1,16 @@
+- name: Join netbird-network
+  when: "netbird_client.join_network.setup_key is defined"
+  command: "netbird up --management-url {{ netbird_client.join_network.management_url }} --setup-key {{ netbird_client.join_network.setup_key }}"
+  failed_when: command.rc != 0
+  changed_when: "'Connected' in command.stdout"
+  register: command
+
+- name: Wait for netbird-interface to exist
+  wait_for:
+    path: "/sys/class/net/wt0"
+    state: present
+  when: command.changed
+
+- name: Gather facts to get changes
+  ansible.builtin.gather_facts:
+  when: command.changed

netbird_client/tasks/main.yml

@@ -1,5 +1,4 @@
-- import_tasks: ./certs.yml
-
 - import_tasks: ./install.yml
 
 - import_tasks: ./join-network.yml
+

netmaker/meta/main.yml

@@ -1,3 +0,0 @@
----
-  dependencies:
-    - role: docker

wireguard-ipv6-converter/defaults/wireguard-ipv6-converter.yml

@@ -0,0 +1,12 @@
+wireguard_ipv6_converter:
+  version: latest
+
+  # see https://github.com/Ruakij/wg-ipv6-converter#31-environment
+  setup:
+    interface: wg0
+    #ipv6_format: fc12::%02x%02x:%02x%02x/%d
+    #filter_prefix: 100.100
+    #recheck_interval: 60s
+
+  service:
+    #bindTo: netbird.service

wireguard-ipv6-converter/tasks/deploy.yml

@@ -0,0 +1,11 @@
+- name: Get architecture
+  set_fact:
+    arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else 'arm64' }}"
+    versionUri: "{% if wireguard_ipv6_converter.version == 'latest' %}latest/download{% else %}download/{{ wireguard_ipv6_converter.version }}{% endif %}"
+
+- name: Download binary
+  get_url:
+    url: https://github.com/Ruakij/wg-ipv6-converter/releases/{{ versionUri }}/wg-ipv6-converter_{{ arch }}
+    dest: /usr/local/bin/wg-ipv6-converter
+    mode: "744"
+  register: deployDownload

wireguard-ipv6-converter/tasks/main.yml

@@ -0,0 +1,3 @@
+- import_tasks: ./deploy.yml
+
+- import_tasks: ./setup-service.yml

wireguard-ipv6-converter/tasks/setup-service.yml

@@ -0,0 +1,27 @@
+- name: Deploy service
+  ansible.builtin.template:
+    src: wg-ipv6-conv.service.jinja2
+    dest: /etc/systemd/system/wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}.service
+  register: serviceFile
+
+- name: Enable service
+  ansible.builtin.service:
+    name: wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}
+    daemon-reload: true
+    enabled: true
+
+- name: Start service if interface exists already
+  ansible.builtin.service:
+    name: wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}
+    state: "{{ 'restarted' if deployDownload.changed or serviceFile.changed else 'started' }}"
+  register: service
+  when: "wireguard_ipv6_converter.setup.interface in ansible_interfaces"
+
+- name: Pause for 5s to wait for program to have run
+  ansible.builtin.pause:
+    seconds: 5
+  when: "service.changed"
+
+- name: Gather facts to get changes
+  ansible.builtin.gather_facts:
+  when: "service.changed"

wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2

@@ -0,0 +1,29 @@
+[Unit]
+Description=WireGuard IPv6 converter for {{ wireguard_ipv6_converter.setup.interface }}
+{% if wireguard_ipv6_converter.service.bindTo is defined %}
+BindsTo={{ wireguard_ipv6_converter.service.bindTo }}
+After={{ wireguard_ipv6_converter.service.bindTo }}
+{% endif %}
+
+[Service]
+Type=simple
+{% if wireguard_ipv6_converter.service.bindTo is defined %}
+ExecStartPre=/bin/sleep 10
+{% endif %}
+ExecStart=/usr/local/bin/wg-ipv6-converter
+Restart=always
+RestartSec=30
+
+Environment="INTERFACE={{ wireguard_ipv6_converter.setup.interface }}"
+{% if wireguard_ipv6_converter.setup.ipv6_format is defined %}
+Environment="IPV6_FORMAT={{ wireguard_ipv6_converter.setup.ipv6_format }}"
+{% endif %}
+{% if wireguard_ipv6_converter.setup.filter_prefix is defined %}
+Environment="FILTER_PREFIX={{ wireguard_ipv6_converter.setup.filter_prefix }}"
+{% endif %}
+{% if wireguard_ipv6_converter.setup.recheck_interval is defined %}
+Environment="RECHECK_INTERVAL={{ wireguard_ipv6_converter.setup.recheck_interval }}"
+{% endif %}
+
+[Install]
+WantedBy=multi-user.target