deviceplan["parameters"] = {
"mode" => interface[:bond][:mode] || "active-backup",
- "primary" => interface[:bond][:slaves].first,
"mii-monitor-interval" => interface[:bond][:miimon] || 100,
"down-delay" => interface[:bond][:downdelay] || 200,
"up-delay" => interface[:bond][:updelay] || 200
}
+ deviceplan["parameters"]["primary"] = interface[:bond][:slaves].first if deviceplan["parameters"]["mode"] == "active-backup"
deviceplan["parameters"]["transmit-hash-policy"] = interface[:bond][:xmithashpolicy] if interface[:bond][:xmithashpolicy]
deviceplan["parameters"]["lacp-rate"] = interface[:bond][:lacprate] if interface[:bond][:lacprate]
end
package "wireguard-tools" do
compile_time true
+ options "--no-install-recommends"
end
directory "/var/lib/systemd/wireguard" do
}
end
- search(:node, "roles:mail OR roles:prometheus") do |server|
+ search(:node, "roles:prometheus") do |server|
allowed_ips = server.interfaces(:role => :internal).map do |interface|
"#{interface[:network]}/#{interface[:prefix]}"
end
:endpoint => "gate.compton.nu:51820"
}
+ # Grant home
node.default[:networking][:wireguard][:peers] << {
:public_key => "RofATnvlWxP3mt87+QKRXFE5MVxtoCcTsJ+yftZYEE4=",
:allowed_ips => "10.89.122.1/32",
:endpoint => "gate.firefishy.com:51820"
}
+
+ # Grant roaming
+ node.default[:networking][:wireguard][:peers] << {
+ :public_key => "YbUkREE9TAmomqgL/4Fh2e5u2Hh7drN/2o5qg3ndRxg=",
+ :allowed_ips => "10.89.123.1/32",
+ :endpoint => "roaming.firefishy.com:51820"
+ }
+ elsif node[:roles].include?("shenron")
+ search(:node, "roles:gateway") do |gateway|
+ allowed_ips = gateway.interfaces(:role => :internal).map do |interface|
+ "#{interface[:network]}/#{interface[:prefix]}"
+ end
+
+ node.default[:networking][:wireguard][:peers] << {
+ :public_key => gateway[:networking][:wireguard][:public_key],
+ :allowed_ips => allowed_ips,
+ :endpoint => "#{gateway.name}:51820"
+ }
+ end
end
template "/etc/systemd/network/wireguard.netdev" do
end
end
+file "/etc/shorewall/masq" do
+ action :delete
+end
+
+file "/etc/shorewall/masq.bak" do
+ action :delete
+end
+
if node[:roles].include?("gateway")
- template "/etc/shorewall/masq" do
- source "shorewall-masq.erb"
+ template "/etc/shorewall/snat" do
+ source "shorewall-snat.erb"
owner "root"
group "root"
mode "644"
notifies :restart, "service[shorewall]"
end
else
- file "/etc/shorewall/masq" do
+ file "/etc/shorewall/snat" do
action :delete
notifies :restart, "service[shorewall]"
end