99 lines
3.5 KiB
YAML
99 lines
3.5 KiB
YAML
---
|
||
# 首个外部 peer：RoutedBits Osaka，IPv6 link-local MP-BGP。
|
||
- name: 准备 AMD DN42 WireGuard 监听
|
||
hosts: oci_amd
|
||
become: true
|
||
vars:
|
||
dn42_interface: wg-dn42-1
|
||
dn42_port: 51821
|
||
dn42_linklocal: fe80::1811:2/64
|
||
dn42_peer_linklocal: fe80::207
|
||
dn42_peer_asn: 4242420207
|
||
dn42_peer_endpoint: router.osa1.routedbits.com:51811
|
||
dn42_peer_public_key: 96PwUEGi/ijdmKO+IjuZ+J6DeykuTRukZD5atajfeH4=
|
||
tasks:
|
||
- name: 准备 FRR link-local 支持
|
||
ansible.builtin.import_tasks: tasks/frr-dn42.yml
|
||
- name: 创建受限密钥目录
|
||
ansible.builtin.file:
|
||
path: /etc/wireguard
|
||
state: directory
|
||
owner: root
|
||
group: root
|
||
mode: '0700'
|
||
- name: 在 AMD 本机生成独立私钥
|
||
ansible.builtin.shell: umask 077; wg genkey > /etc/wireguard/{{ dn42_interface }}.key
|
||
args:
|
||
creates: /etc/wireguard/{{ dn42_interface }}.key
|
||
no_log: true
|
||
- name: 写入监听配置
|
||
ansible.builtin.copy:
|
||
dest: /etc/wireguard/{{ dn42_interface }}.conf
|
||
owner: root
|
||
group: root
|
||
mode: '0600'
|
||
content: |
|
||
# Ansible 管理；首个 peer 使用 IPv6 link-local MP-BGP + extended next hop。
|
||
[Interface]
|
||
Address = {{ dn42_linklocal }}
|
||
ListenPort = {{ dn42_port }}
|
||
MTU = 1380
|
||
Table = off
|
||
PostUp = wg set %i private-key /etc/wireguard/{{ dn42_interface }}.key
|
||
PostUp = iptables -w -C INPUT -p udp --dport {{ dn42_port }} -j ACCEPT 2>/dev/null || iptables -w -I INPUT 1 -p udp --dport {{ dn42_port }} -j ACCEPT
|
||
PostDown = iptables -w -D INPUT -p udp --dport {{ dn42_port }} -j ACCEPT
|
||
|
||
[Peer]
|
||
PublicKey = {{ dn42_peer_public_key }}
|
||
Endpoint = {{ dn42_peer_endpoint }}
|
||
AllowedIPs = fe80::/64, 172.20.0.0/14, 10.0.0.0/8, 172.31.0.0/16, fd00::/8
|
||
PersistentKeepalive = 25
|
||
notify: 重启 DN42 接口
|
||
- name: 启用 DN42 监听
|
||
ansible.builtin.systemd_service:
|
||
name: wg-quick@{{ dn42_interface }}
|
||
enabled: true
|
||
state: started
|
||
- name: 应用配置
|
||
ansible.builtin.meta: flush_handlers
|
||
- name: 写入外部 BGP 配置片段
|
||
ansible.builtin.template:
|
||
src: templates/dn42-bgp.conf.j2
|
||
dest: /etc/frr/dn42-routedbits.vtysh
|
||
owner: root
|
||
group: frr
|
||
mode: '0640'
|
||
register: dn42_bgp_config
|
||
changed_when: dn42_bgp_config.changed or ('(deleted)' in frr_running.stdout)
|
||
notify: 应用 DN42 BGP
|
||
- name: 应用 BGP 配置
|
||
ansible.builtin.meta: flush_handlers
|
||
- name: 读取公开信息
|
||
ansible.builtin.command: wg show {{ dn42_interface }} {{ item }}
|
||
loop:
|
||
- public-key
|
||
- listen-port
|
||
changed_when: false
|
||
register: dn42_public_info
|
||
- name: 显示公钥和端口
|
||
ansible.builtin.debug:
|
||
msg: '{{ dn42_public_info.results | map(attribute="stdout") | list }}'
|
||
handlers:
|
||
- name: 重启 FRR
|
||
ansible.builtin.systemd_service:
|
||
name: frr
|
||
state: restarted
|
||
when: not ansible_check_mode
|
||
- name: 重启 DN42 接口
|
||
ansible.builtin.systemd_service:
|
||
name: wg-quick@{{ dn42_interface }}
|
||
state: restarted
|
||
when: not ansible_check_mode
|
||
- name: 应用 DN42 BGP
|
||
ansible.builtin.command: vtysh -f /etc/frr/dn42-routedbits.vtysh
|
||
notify: 保存 FRR 配置
|
||
when: not ansible_check_mode
|
||
- name: 保存 FRR 配置
|
||
ansible.builtin.command: vtysh -c 'write memory'
|
||
when: not ansible_check_mode
|