atlas/atlas
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

vyos: wire wireguard keys dynamically from vault single source of truth

Browse source
This commit is contained in:
v 2026-11-02 22:20:26 +03:00
parent da30835b67
commit 5011b893bd
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ansible/playbooks/02_vyos.yml
View file

@ -13,6 +13,10 @@
return_content: true
register: n2_vault_secrets_raw
- name: Register decrypted kontur secrets in memory
ansible.builtin.set_fact:
n2_secrets: "{{ n2_vault_secrets_raw.json.data.data }}"
- name: Stop and disable FRPC container service
ansible.builtin.systemd:
name: vyos-container-frpc
@ -317,9 +321,10 @@
vyos.vyos.vyos_config:
lines:
- set interfaces wireguard wg0 address '10.8.0.2/24'
- set interfaces wireguard wg0 private-key '{{ n2_secrets.awg_router_private_key }}'
- set interfaces wireguard wg0 peer VPS address '127.0.0.1'
- set interfaces wireguard wg0 peer VPS port '51821'
- set interfaces wireguard wg0 peer VPS public-key 'tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY='
- set interfaces wireguard wg0 peer VPS public-key '{{ n2_secrets.awg_server_public_key }}'
- set interfaces wireguard wg0 peer VPS allowed-ips '10.8.0.0/24'
- set interfaces wireguard wg0 peer VPS persistent-keepalive '25'
save: true