travel router

ansible/group_vars/vpnhub.example.yml

@@ -39,6 +39,16 @@ technitium_admin_password: ""
 # "" to disable registration.
 vpn_dns_zone: roam.atlashorizon.net
 
+# ── Travel routers (GL.iNet etc.) as roaming WireGuard peers ──
+# Each gets a /32 from 172.31.9.0/24 (hub is 172.31.9.1). Generate the
+# keypair on the router (or wg genkey) and paste the PUBLIC key here.
+# The init job also registers <name>.<vpn_dns_zone> A + PTR records.
+wg_travel_peers: []
+#wg_travel_peers:
+#  - { name: glinet-1, public_key: "xxxx=", ip: 172.31.9.11 }
+#  - { name: glinet-2, public_key: "yyyy=", ip: 172.31.9.12 }
+#  - { name: glinet-3, public_key: "zzzz=", ip: 172.31.9.13 }
+
 # ── Optional ──
 # Pin for deterministic Duo updates (e.g. "6.5.1"); bumping it forces a
 # refetch of the tarball on the next rebuild.

ansible/site.yml

@@ -219,15 +219,23 @@
       ansible.builtin.debug:
         msg: "RackNerd WG public key: {{ wg_pubkey.stdout }}"
 
-    - name: Deploy wg0.conf (rendered from host/wg0.conf.example)
+    - name: Deploy wg0.conf (rendered from host/wg0.conf.example + travel peers)
       tags: [host, wireguard]
       ansible.builtin.copy:
         dest: /etc/wireguard/wg0.conf
         mode: "0600"
-        content: "{{ lookup('file', playbook_dir ~ '/../host/wg0.conf.example')
-          | replace('<RACKNERD_WG_PRIVATE_KEY>', wg_key_raw.content | b64decode | trim)
-          | replace('<TROCHALAKIS_WG_PUBLIC_KEY>', troch_wg_public_key | default('<TROCHALAKIS_WG_PUBLIC_KEY>', true))
-          | replace('<OSWALD_WG_PUBLIC_KEY>', oswald_wg_public_key | default('<OSWALD_WG_PUBLIC_KEY>', true)) }}\n"
+        content: |
+          {{ lookup('file', playbook_dir ~ '/../host/wg0.conf.example')
+             | replace('<RACKNERD_WG_PRIVATE_KEY>', wg_key_raw.content | b64decode | trim)
+             | replace('<TROCHALAKIS_WG_PUBLIC_KEY>', troch_wg_public_key | default('<TROCHALAKIS_WG_PUBLIC_KEY>', true))
+             | replace('<OSWALD_WG_PUBLIC_KEY>', oswald_wg_public_key | default('<OSWALD_WG_PUBLIC_KEY>', true)) }}
+          {% for p in wg_travel_peers | default([]) %}
+
+          # ── Travel router: {{ p.name }} (roaming /32, appended by Ansible) ──
+          [Peer]
+          PublicKey = {{ p.public_key }}
+          AllowedIPs = {{ p.ip }}/32
+          {% endfor %}
       no_log: true
       notify: restart wireguard
 

ansible/templates/env.j2

@@ -19,6 +19,7 @@ RADIUS_SECRET={{ radius_secret }}
 TECHNITIUM_ADMIN_PASSWORD={{ technitium_admin_password }}
 
 VPN_DNS_ZONE={{ vpn_dns_zone | default('roam.atlashorizon.net') }}
+VPN_TRAVEL_PEERS={% for p in wg_travel_peers | default([]) %}{{ p.name }}:{{ p.ip }}{{ "," if not loop.last else "" }}{% endfor %}
 
 DUO_AUTHPROXY_VERSION={{ duo_authproxy_version | default('latest') }}