恢复 OCI Terraform 与站点网络 IaC

2026-09-17 13:22:49 +00:00
parent a08c8a7303
commit 71eea7d8fc
41 changed files with 1786 additions and 10 deletions
@@ -0,0 +1,80 @@
+{% set v4_peer = bgp_transport_peer | default(wg_peer_address) %}
+{% set v6_peer = bgp_transport_peer | default(wg_peer_ipv6 | default("")) %}
+! vtysh -f 使用配置模式，write memory 由独立 handler 执行。
+! 只重建本角色拥有的邻居和过滤器，保留既有 BGP/OSPF。
+router bgp {{ bgp_asn }}
+ no neighbor {{ v4_peer }}
+{% for peer in bgp_retired_peers | default([]) %}
+ no neighbor {{ peer }}
+{% endfor %}
+exit
+no ip prefix-list OCI-WG-IN
+no ip prefix-list OCI-WG-OUT
+{% for prefix in bgp_import %}
+ip prefix-list OCI-WG-IN seq {{ loop.index * 10 }} permit {{ prefix }}
+{% endfor %}
+{% for prefix in bgp_export + (bgp_summary | default([])) %}
+ip prefix-list OCI-WG-OUT seq {{ loop.index * 10 }} permit {{ prefix }}
+{% endfor %}
+router bgp {{ bgp_asn }}
+ bgp router-id {{ bgp_router_id }}
+ neighbor {{ v4_peer }} remote-as {{ bgp_peer_asn }}
+ neighbor {{ v4_peer }} description OCI-WireGuard
+ neighbor {{ v4_peer }} update-source {{ wg_interface }}
+{% if bgp_transport_peer is defined %}
+ neighbor {{ v4_peer }} interface {{ wg_interface }}
+ neighbor {{ v4_peer }} capability extended-nexthop
+{% endif %}
+ address-family ipv4 unicast
+{% for prefix in bgp_summary | default([]) %}
+  aggregate-address {{ prefix }}
+{% endfor %}
+{% for prefix in bgp_export %}
+  network {{ prefix }}
+{% endfor %}
+  neighbor {{ v4_peer }} activate
+  neighbor {{ v4_peer }} prefix-list OCI-WG-IN in
+  neighbor {{ v4_peer }} prefix-list OCI-WG-OUT out
+  neighbor {{ v4_peer }} maximum-prefix {{ bgp_import | length }}
+ exit-address-family
+exit
+! 仅为这些 BGP 路由选择本机业务 IP；转发报文源地址保持不变，不是 NAT。
+route-map OCI-WG-SOURCE permit 10
+ match ip address prefix-list OCI-WG-IN
+ set src {{ bgp_router_id }}
+exit
+route-map OCI-WG-SOURCE permit 100
+exit
+ip protocol bgp route-map OCI-WG-SOURCE
+
+{% if bgp_export6 is defined %}
+no ipv6 prefix-list OCI-WG6-IN
+no ipv6 prefix-list OCI-WG6-OUT
+{% for prefix in bgp_import6 %}
+ipv6 prefix-list OCI-WG6-IN seq {{ loop.index * 10 }} permit {{ prefix }}
+{% endfor %}
+{% for prefix in bgp_export6 + (bgp_summary6 | default([])) %}
+ipv6 prefix-list OCI-WG6-OUT seq {{ loop.index * 10 }} permit {{ prefix }}
+{% endfor %}
+router bgp {{ bgp_asn }}
+ neighbor {{ v6_peer }} remote-as {{ bgp_peer_asn }}
+ neighbor {{ v6_peer }} update-source {{ wg_interface }}
+{% if bgp_transport_peer is not defined %}
+ address-family ipv4 unicast
+  no neighbor {{ v6_peer }} activate
+ exit-address-family
+{% endif %}
+ address-family ipv6 unicast
+{% for prefix in bgp_summary6 | default([]) %}
+  aggregate-address {{ prefix }}
+{% endfor %}
+{% for prefix in bgp_export6 %}
+  network {{ prefix }}
+{% endfor %}
+  neighbor {{ v6_peer }} activate
+  neighbor {{ v6_peer }} prefix-list OCI-WG6-IN in
+  neighbor {{ v6_peer }} prefix-list OCI-WG6-OUT out
+  neighbor {{ v6_peer }} maximum-prefix {{ bgp_import6 | length }}
+ exit-address-family
+exit
+{% endif %}
@@ -0,0 +1,43 @@
+#!/bin/sh
+set -eu
+# 仅重建专用链，不保存/覆盖 Docker、k3s、Tailscale 或 OCI 的其他动态规则。
+for chain in OCI-WG-IN OCI-WG-FWD; do
+  iptables -w -nL "$chain" >/dev/null 2>&1 || iptables -w -N "$chain"
+  iptables -w -F "$chain"
+done
+iptables -w -A OCI-WG-IN -p udp --dport {{ wg_port }} -j ACCEPT
+{% for prefix in [wg_peer_address ~ '/32'] + bgp_import %}
+iptables -w -A OCI-WG-IN -i {{ wg_interface }} -s {{ prefix }} -j ACCEPT
+{% endfor %}
+{% for local_prefix in bgp_export %}
+{% for remote_prefix in bgp_import %}
+iptables -w -A OCI-WG-FWD -i {{ wg_interface }} -o {{ wg_lan_interface }} -s {{ remote_prefix }} -d {{ local_prefix }} -j ACCEPT
+iptables -w -A OCI-WG-FWD -i {{ wg_lan_interface }} -o {{ wg_interface }} -s {{ local_prefix }} -d {{ remote_prefix }} -j ACCEPT
+{% endfor %}
+{% endfor %}
+{% if dn42_external_interface is defined %}
+# 仅允许注册地址在内部隧道与外部 DN42 之间转发，保持无 NAT。
+iptables -w -A OCI-WG-FWD -i {{ wg_interface }} -o {{ dn42_external_interface }} -s {{ dn42_ipv4 }} -d 172.20.0.0/14 -j ACCEPT
+iptables -w -A OCI-WG-FWD -i {{ dn42_external_interface }} -o {{ wg_interface }} -s 172.20.0.0/14 -d {{ dn42_ipv4 }} -j ACCEPT
+{% endif %}
+iptables -w -A OCI-WG-FWD -i {{ wg_interface }} -j DROP
+iptables -w -A OCI-WG-FWD -o {{ wg_interface }} -j DROP
+iptables -w -C INPUT -j OCI-WG-IN 2>/dev/null || iptables -w -I INPUT 1 -j OCI-WG-IN
+iptables -w -C FORWARD -j OCI-WG-FWD 2>/dev/null || iptables -w -I FORWARD 1 -j OCI-WG-FWD
+
+{% if bgp_import6 is defined %}
+ip6tables -w -nL OCI-WG6-IN >/dev/null 2>&1 || ip6tables -w -N OCI-WG6-IN
+ip6tables -w -F OCI-WG6-IN
+ip6tables -w -A OCI-WG6-IN -i {{ wg_interface }} -s {{ dn42_ipv6 }} -j ACCEPT
+ip6tables -w -C INPUT -j OCI-WG6-IN 2>/dev/null || ip6tables -w -I INPUT 1 -j OCI-WG6-IN
+{% endif %}
+
+{% if dn42_external_interface is defined %}
+ip6tables -w -nL OCI-DN42-FWD >/dev/null 2>&1 || ip6tables -w -N OCI-DN42-FWD
+ip6tables -w -F OCI-DN42-FWD
+ip6tables -w -A OCI-DN42-FWD -i {{ wg_interface }} -o {{ dn42_external_interface }} -s {{ dn42_ipv6 }} -d fd00::/8 -j ACCEPT
+ip6tables -w -A OCI-DN42-FWD -i {{ dn42_external_interface }} -o {{ wg_interface }} -s fd00::/8 -d {{ dn42_ipv6 }} -j ACCEPT
+ip6tables -w -A OCI-DN42-FWD -i {{ dn42_external_interface }} -j DROP
+ip6tables -w -A OCI-DN42-FWD -o {{ dn42_external_interface }} -j DROP
+ip6tables -w -C FORWARD -j OCI-DN42-FWD 2>/dev/null || ip6tables -w -I FORWARD 1 -j OCI-DN42-FWD
+{% endif %}
@@ -0,0 +1,16 @@
+[Interface]
+Address = {{ wg_address }}{% if wg_ipv6_address is defined %}, {{ wg_ipv6_address }}, {{ wg_linklocal_address }}{% endif %}
+
+ListenPort = {{ wg_port }}
+MTU = {{ wg_mtu }}
+Table = off
+# 私钥在本机生成和读取；配置模板与控制机不保存私钥。
+PostUp = wg set %i private-key /etc/wireguard/{{ wg_interface }}.key
+
+[Peer]
+PublicKey = {{ hostvars[wg_peer_host].wg_public_key.stdout }}
+AllowedIPs = {{ ([wg_peer_address ~ '/32'] + bgp_import + (bgp_import6 | default([])) + (['fe80::/64'] if bgp_import6 is defined else [])) | join(', ') }}
+{% if wg_endpoint %}
+Endpoint = {{ wg_endpoint }}
+{% endif %}
+PersistentKeepalive = {{ wg_keepalive }}