# RackNerd VPN Hub

Client VPN entry point + DNS forwarder for the AtlasHorizon AD environment.
Roaming clients terminate here (OpenVPN + Duo MFA) and are routed over
WireGuard to the two sites. Inter-site traffic stays on the existing direct
Oswald↔Trochalakis tunnel — this box never carries it.

```
                          ┌────────────── RackNerd VPS ──────────────┐
 roaming client ══ovpn══▶ │ tun0 172.31.8.1                          │
 (172.31.8.x)             │   openvpn ─▶ duo-authproxy ─▶ Duo cloud  │
   DNS/routes pushed      │      (127.0.0.1:1812)   └──LDAPS 636──┐  │
                          │   technitium :53 / console :5380      │  │
                          │ wg0 172.31.255.1 ─────────────────────┼──┤
                          └──────────┬──────────────────┬─────────┘  │
                            wg   .255.2            wg .255.3     (via wg0)
                        Trochalakis 192.168.20/24   Oswald 192.168.7/24
                        AHDC01, AHDC03 ◀━━ direct s2s ━━▶ AH-OSWLDC
```

## Address plan

| Net                  | Subnet            | Notes                            |
|----------------------|-------------------|----------------------------------|
| Trochalakis LAN      | `192.168.20.0/24` | AHDC01, AHDC03                   |
| Oswald LAN           | `192.168.7.0/24`  | AH-OSWLDC                        |
| WG transfer          | `172.31.255.0/24` | hub .1, Troch .2, Oswald .3      |
| OpenVPN clients      | `172.31.8.0/24`   | routed (not NATed) to both sites |

Public endpoint: `vpn.atlashorizon.net` — only 22/tcp (SSH), 51820/udp
(WireGuard) and 1194/udp (OpenVPN) are open. RADIUS binds loopback only;
Technitium's DNS (:53) and web console (:5380) are firewalled to the
tunnels and additionally guarded by its recursion ACL.

## Layout

- [docker-compose.yml](docker-compose.yml) — openvpn, duo-authproxy, technitium (all `network_mode: host`)
- [openvpn/](openvpn/) — server.conf, PAM→RADIUS glue, offline-CA workflow in [pki/README.md](openvpn/pki/README.md)
- [duo-authproxy/](duo-authproxy/) — built from Duo's source tarball; cfg rendered from `.env`
- [technitium/](technitium/) — Technitium DNS: AD conditional-forwarder zones created by an idempotent API init job ([configure.sh](technitium/configure.sh)), everything else public recursion; web console on :5380 (VPN/tunnel only)
- [host/](host/) — `setup.sh` (sysctl, iptables, wg keygen), `wg0.conf.example`, firewall template
- [client/](client/) — `.ovpn` template for end users
- [ansible/](ansible/) — one idempotent playbook for setup **and** updates, deploys to `/opt/<service>` (see [ansible/README.md](ansible/README.md))
- [docs/](docs/) — [SITE-SIDE.md](docs/SITE-SIDE.md) (DC/firewall work at the sites), [TESTPLAN.md](docs/TESTPLAN.md)

## Deploy: Ansible (preferred)

`ansible/site.yml` does everything in the manual list below — Docker
install, sysctl, firewall, WireGuard keygen, and the compose stack under
`/opt` — and re-running it is the update mechanism. See
[ansible/README.md](ansible/README.md). Site-side work
([docs/SITE-SIDE.md](docs/SITE-SIDE.md)) and the offline CA stay manual
either way.

## Deploy: manual

1. **Host**: `sudo host/setup.sh` — installs wireguard + iptables rules,
   generates the WG key, prints the public key for the sites.
2. **Sites**: do [docs/SITE-SIDE.md](docs/SITE-SIDE.md) (WG peers, return
   routes, DC firewall, Duo app, LDAPS CA export). Paste site pubkeys into
   `/etc/wireguard/wg0.conf`, then `systemctl enable --now wg-quick@wg0`.
3. **Secrets**: `cp .env.example .env && chmod 600 .env`, fill in DC IPs,
   Duo keys, service account, `RADIUS_SECRET`.
4. **PKI**: offline CA per [openvpn/pki/README.md](openvpn/pki/README.md);
   copy server cert/key + `ta.key` into `openvpn/pki/`. Drop the AD CA
   chain in `duo-authproxy/certs/ad-ldaps-ca.pem`.
5. **Stack**: `docker compose up -d --build`.
6. **Verify**: [docs/TESTPLAN.md](docs/TESTPLAN.md), stages 0→6.

## Design notes / gotchas

- **WireGuard is host-level** (`wg-quick@wg0`), not containerized — tun0
  and wg0 share the host netns so the kernel routes between them with no
  Docker bridge/NAT tricks, and the tunnel survives Docker restarts.
- **Routed, not NATed**: DCs see real `172.31.8.x` client IPs. Requires the
  site-side return routes in SITE-SIDE.md. Fallback masquerade snippet is
  commented at the bottom of [host/rules.v4.template](host/rules.v4.template).
- **No hairpin**: RackNerd's peer AllowedIPs only carry each site's own
  LAN; the sites' RackNerd peer only carries `172.31.8.0/24` + the hub IP.
- **MTU**: OpenVPN `tun-mtu 1400` / `mssfix 1360` keeps client packets
  inside wg0's 1420 so nothing fragments on the middle leg.
- **Technitium is stateful**: `DNS_SERVER_*` env vars seed config on the
  *first* start only; after that its state lives in
  `/opt/technitium/config` (persists `down`/`up`, backed up like data).
  The init job only creates *missing* forwarder zones — console edits are
  never overwritten. Changed a DC IP in `.env`? Delete the zone in the
  console and rerun `docker compose up technitium-init`.
- **Port 53 on the host**: systemd-resolved's stub listener is disabled
  (setup.sh/Ansible) — Technitium binds wildcard :53 and would collide;
  `/etc/resolv.conf` is repointed at resolved's upstream file.
- **Duo flow**: password → push; `password,passcode` → offline fallback
  (`allow_concat=true`). `reneg-sec 0` + `auth-gen-token` prevent surprise
  re-prompts mid-session. `failmode=safe` fails *open* if Duo cloud is
  down — flip to `secure` in the template if you'd rather fail closed.
- **TCP/443 fallback**: if client networks block 1194/udp, add a second
  server instance (`proto tcp4`, `port 443`, separate `dev tun1` +
  firewall rule). Not enabled by default.
- **Firewall reloads**: `netfilter-persistent reload` flushes Docker's
  chains — restart docker afterwards (setup.sh/Ansible handler do this).
- **IPv6 is locked down too**: [host/rules.v6.template](host/rules.v6.template)
  default-drops the public v6 address (SSH/WG/OpenVPN only, ICMPv6
  allowed) since Technitium and the console bind dual-stack wildcard.