Murat ÖZDEMİR
ed51b6eedd
- Add new Ansible role `wireguard` to set up WireGuard VPN server on DB node with key generation, firewalld rules, and client peer config. - Introduce `pg-proxy` and `mongo-proxy` socat containers in db_stack to expose PostgreSQL (15432) and MongoDB (17017) on host ports, restricted to WireGuard subnet via firewalld. - Update test environment group_vars with WireGuard client entry for `murat-inspiron-15-3525`. - Modify act_runner config: set `docker_host` to unix socket, remove explicit socket mount from options, and change runner label image to `catthehacker/ubuntu:act-22.04`. - Open UDP port 51820 in Hetzner firewall for WireGuard inbound. - Adjust test-db-post-stack playbook to include wireguard role (tagged). - Update roadmap document with APISIX init step order.
27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
storagebox_account: "u469968"
|
||
storagebox_user: "{{ storagebox_account }}-sub4"
|
||
storagebox_url: "https://{{ storagebox_user }}.your-storagebox.de/"
|
||
storagebox_mount_point: "/mnt/storagebox"
|
||
storagebox_password: "{{ vault_storagebox_password }}"
|
||
iklim_password: "{{ vault_iklim_password }}"
|
||
swarm_manager_ip: "10.10.10.11"
|
||
admin_allowed_cidrs: "78.187.87.109/32 95.70.151.248/32"
|
||
admin_ssh_public_key_path: "~/.ssh/id_rsa.pub"
|
||
timezone: "Europe/Istanbul"
|
||
|
||
# WireGuard
|
||
# Her client için: name, public_key, allowed_ips
|
||
# public_key: client makinasında `wg genkey | tee client.key | wg pubkey` ile üretilir
|
||
wireguard_clients:
|
||
- name: murat-inspiron-15-3525
|
||
public_key: "8nYHZvSwxCr2uwOYohLG3DlC85NbVNhKnPxYtOEKvE0="
|
||
allowed_ips: 10.8.0.2/32
|
||
|
||
# DB Stack
|
||
db_postgres_image: "postgis/postgis:17-3.5"
|
||
db_mongo_image: "mongo:8"
|
||
db_postgres_root_user: "{{ vault_postgres_root_user }}"
|
||
db_postgres_password: "{{ vault_postgres_password }}"
|
||
db_mongo_root_user: "{{ vault_mongo_root_user }}"
|
||
db_mongo_root_password: "{{ vault_mongo_root_password }}"
|