Estabish tunnels between shenron and gateway machines

diff --git a/cookbooks/exim/recipes/default.rb b/cookbooks/exim/recipes/default.rb
index 6234aa96412ab3034b1f5cbf3b0a6540efaef7a4..994e9454b5caa1d5e093dc4c176927698daef855 100644 (file)
--- a/cookbooks/exim/recipes/default.rb
+++ b/cookbooks/exim/recipes/default.rb
@@ -76,6 +76,18 @@ end
 relay_from_hosts = node[:exim][:relay_from_hosts]
 
 if node[:exim][:smarthost_name]
+  search(:node, "roles:gateway") do |gateway|
+    allowed_ips = gateway.interfaces(:role => :internal).map do |interface|
+      "#{interface[:network]}/#{interface[:prefix]}"
+    end
+
+    node.default[:networking][:wireguard][:peers] << {
+      :public_key => gateway[:networking][:wireguard][:public_key],
+      :allowed_ips => allowed_ips,
+      :endpoint => "#{gateway.name}:51820"
+    }
+  end
+
   search(:node, "exim_smarthost_via:#{node[:exim][:smarthost_name]}\\:*").each do |host|
     relay_from_hosts |= host.ipaddresses(:role => :external)
   end

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index 4fc08a61bf8d043fc818b64f0883d4c99c4475dd..0989d8d11bdcadfed3cd61e8f61ebcae0a7a1aa2 100644 (file)
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -236,6 +236,22 @@ if node[:networking][:wireguard][:enabled]
       }
     end
 
+    search(:node, "roles:mail") do |server|
+      allowed_ips = server.interfaces(:role => :internal).map do |interface|
+        "#{interface[:network]}/#{interface[:prefix]}"
+      end
+
+      if server[:networking][:private_address]
+        allowed_ips << "#{server[:networking][:private_address]}/32"
+      end
+
+      node.default[:networking][:wireguard][:peers] << {
+        :public_key => server[:networking][:wireguard][:public_key],
+        :allowed_ips => allowed_ips,
+        :endpoint => "#{server.name}:51820"
+      }
+    end
+
     node.default[:networking][:wireguard][:peers] << {
       :public_key => "7Oj9ufNlgidyH/xDc+aHQKMjJPqTmD/ab13agMh6AxA=",
       :allowed_ips => "10.0.16.1/32",

diff --git a/cookbooks/networking/templates/default/wireguard.network.erb b/cookbooks/networking/templates/default/wireguard.network.erb
index 2d3469cf16741a16f4c144aabfb99aea77cd156f..5e215b18401b960d31141281148070210635cf3b 100644 (file)
--- a/cookbooks/networking/templates/default/wireguard.network.erb
+++ b/cookbooks/networking/templates/default/wireguard.network.erb
@@ -5,6 +5,9 @@ Name=wg0
 <% if node.internal_ipaddress -%>
 Address=<%= node.internal_ipaddress %>/32
 <% end -%>
+<% if node[:networking][:private_address] -%>
+Address=<%= node[:networking][:private_address] %>/32
+<% end -%>
 Address=<%= node[:networking][:wireguard][:address] %>/128
 
 [Route]

diff --git a/roles/shenron.rb b/roles/shenron.rb
index 1caa61018bc23b0d0efd9a17ef9a3e15209bbf34..e614a33262ff39b6eb2882d112388979ff4d0d02 100644 (file)
--- a/roles/shenron.rb
+++ b/roles/shenron.rb
@@ -39,7 +39,8 @@ override_attributes(
         :gateway => "fe80::1"
       }
     },
-    :nameservers => ["89.16.162.20", "2001:41c9:2:d6::20"]
+    :nameservers => ["89.16.162.20", "2001:41c9:2:d6::20"],
+    :private_address => "10.0.16.100"
   }
 )