X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/002b60653876baaaf093d14f0e83ec6207fce519..7ed52aa26:/cookbooks/networking/recipes/default.rb

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index 13fd2252b..0989d8d11 100644
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -37,8 +37,6 @@ netplan = {
   }
 }
 
-node.rm_normal(:networking)
-
 node[:networking][:interfaces].each do |name, interface|
   if interface[:interface]
     if interface[:role] && (role = node[:networking][:roles][interface[:role]])
@@ -237,6 +235,28 @@ if node[:networking][:wireguard][:enabled]
         :endpoint => "#{gateway.name}:51820"
       }
     end
+
+    search(:node, "roles:mail") do |server|
+      allowed_ips = server.interfaces(:role => :internal).map do |interface|
+        "#{interface[:network]}/#{interface[:prefix]}"
+      end
+
+      if server[:networking][:private_address]
+        allowed_ips << "#{server[:networking][:private_address]}/32"
+      end
+
+      node.default[:networking][:wireguard][:peers] << {
+        :public_key => server[:networking][:wireguard][:public_key],
+        :allowed_ips => allowed_ips,
+        :endpoint => "#{server.name}:51820"
+      }
+    end
+
+    node.default[:networking][:wireguard][:peers] << {
+      :public_key => "7Oj9ufNlgidyH/xDc+aHQKMjJPqTmD/ab13agMh6AxA=",
+      :allowed_ips => "10.0.16.1/32",
+      :endpoint => "gate.compton.nu:51820"
+    }
   end
 
   template "/etc/systemd/network/wireguard.netdev" do
@@ -456,9 +476,15 @@ firewall_rule "limit-icmp-echo" do
 end
 
 if node[:networking][:wireguard][:enabled]
+  wireguard_source = if node[:roles].include?("gateway")
+                       "net"
+                     else
+                       "osm"
+                     end
+
   firewall_rule "accept-wireguard" do
     action :accept
-    source "osm"
+    source wireguard_source
     dest "fw"
     proto "udp"
     dest_ports "51820"