59 lines
2.0 KiB
Plaintext
59 lines
2.0 KiB
Plaintext
#cloud-config
|
|
hostname: ${hostname}
|
|
fqdn: ${fqdn}
|
|
prefer_fqdn_over_hostname: true
|
|
|
|
write_files:
|
|
- path: /etc/wireguard/wg0.conf
|
|
permissions: "0600"
|
|
content: |
|
|
[Interface]
|
|
Address = ${wg_address}/24
|
|
ListenPort = ${wg_port}
|
|
PrivateKey = ${wg_private_key}
|
|
|
|
[Peer]
|
|
PublicKey = ${hub_public_key}
|
|
Endpoint = ${hub_endpoint}
|
|
AllowedIPs = ${allowed_ips}
|
|
PersistentKeepalive = 25
|
|
- path: /usr/local/sbin/wg-bootstrap
|
|
permissions: "0755"
|
|
content: |
|
|
#!/bin/sh
|
|
set -e
|
|
wg show wg0 latest-handshakes | awk '$2 > 0 { ok = 1 } END { exit !ok }'
|
|
printf '[main]\ndns=none\n' > /etc/NetworkManager/conf.d/90-dns-none.conf
|
|
systemctl reload NetworkManager
|
|
printf 'search main.unkin.net\nnameserver 198.18.200.7\n' > /etc/resolv.conf
|
|
systemctl enable --now puppet
|
|
systemctl disable wg-bootstrap
|
|
- path: /etc/systemd/system/wg-bootstrap.service
|
|
content: |
|
|
[Unit]
|
|
Description=Switch to internal DNS and start puppet once wg0 has a handshake
|
|
After=wg-quick@wg0.service
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/wg-bootstrap
|
|
Restart=on-failure
|
|
RestartSec=30
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
runcmd:
|
|
- dnf install -y wireguard-tools
|
|
- systemctl enable --now wg-quick@wg0
|
|
- rpm -q openvox-agent || dnf install -y https://yum.voxpupuli.org/openvox7-release-el-9.noarch.rpm
|
|
- dnf install -y openvox-agent
|
|
- /opt/puppetlabs/bin/puppet config set --section main certname ${fqdn}
|
|
- /opt/puppetlabs/bin/puppet config set --section main server puppet.k8s.syd1.au.unkin.net
|
|
- /opt/puppetlabs/bin/puppet config set --section main ca_server puppetca.k8s.syd1.au.unkin.net
|
|
- /opt/puppetlabs/bin/puppet config set --section main report_server puppet.k8s.syd1.au.unkin.net
|
|
- /opt/puppetlabs/bin/puppet config set --section main environment production
|
|
- systemctl daemon-reload
|
|
- systemctl enable --now --no-block wg-bootstrap
|