48 lines
1.9 KiB
YAML
48 lines
1.9 KiB
YAML
---
|
|
# ===========================================================================
|
|
# Site A. Everything that differs between sites lives in this file.
|
|
#
|
|
# ansible-playbook wg-relay.yml -e @vars/site-a.yml
|
|
#
|
|
# Site B's file is the mirror image: swap the two tunnel addresses, point
|
|
# the targets at its own service, and list Site A as the peer.
|
|
# ===========================================================================
|
|
|
|
# --- which box to configure ------------------------------------------------
|
|
# Set to the relay VM's address to configure it over SSH, or leave as
|
|
# localhost to configure the machine you're running this on.
|
|
relay_host: 192.168.1.10
|
|
relay_user: admin
|
|
|
|
# --- this side of the tunnel -----------------------------------------------
|
|
wg_address: 10.99.0.1/32
|
|
wg_listen_port: 51820
|
|
|
|
# --- the other side --------------------------------------------------------
|
|
wg_peers:
|
|
- name: site-b
|
|
public_key: "PASTE_SITE_B_PUBLIC_KEY_HERE"
|
|
# Omit endpoint on whichever side isn't reachable from outside; the
|
|
# other side dials in and keepalives hold the path open.
|
|
endpoint: site-b.example.com:51820
|
|
allowed_ips: 10.99.0.2/32
|
|
keepalive: 25
|
|
|
|
# --- what is reachable, in each direction ----------------------------------
|
|
relays:
|
|
# Site B reaching the service on Site A's LAN.
|
|
- name: in-site-b
|
|
direction: inbound
|
|
listen_address: 10.99.0.1 # this box's tunnel address
|
|
listen_port: 9000
|
|
target: 192.168.1.50:9000 # the one host:port Site B may reach
|
|
source_allow: 10.99.0.2/32 # Site B's tunnel address only
|
|
|
|
# Site A reaching the service on Site B's LAN. Local clients point at
|
|
# this box's LAN address and never need to know a tunnel exists.
|
|
- name: out-site-b
|
|
direction: outbound
|
|
listen_address: 192.168.1.10 # this box's LAN address
|
|
listen_port: 9001
|
|
target: 10.99.0.2:9000 # Site B's inbound relay
|
|
source_allow: 192.168.1.50/32 # the one local client allowed to use it |