Murat ÖZDEMİR
ed51b6eedd
- Add new Ansible role `wireguard` to set up WireGuard VPN server on DB node with key generation, firewalld rules, and client peer config. - Introduce `pg-proxy` and `mongo-proxy` socat containers in db_stack to expose PostgreSQL (15432) and MongoDB (17017) on host ports, restricted to WireGuard subnet via firewalld. - Update test environment group_vars with WireGuard client entry for `murat-inspiron-15-3525`. - Modify act_runner config: set `docker_host` to unix socket, remove explicit socket mount from options, and change runner label image to `catthehacker/ubuntu:act-22.04`. - Open UDP port 51820 in Hetzner firewall for WireGuard inbound. - Adjust test-db-post-stack playbook to include wireguard role (tagged). - Update roadmap document with APISIX init step order.
14 lines
401 B
YAML
14 lines
401 B
YAML
---
|
||
wireguard_interface: wg0
|
||
wireguard_address: "10.8.0.1/24"
|
||
wireguard_port: 51820
|
||
wireguard_subnet: "10.8.0.0/24"
|
||
|
||
# DB proxy portları — host ağında dinlenecek, sadece wireguard_subnet'ten erişilebilir
|
||
wireguard_db_pg_proxy_port: 15432
|
||
wireguard_db_mongo_proxy_port: 17017
|
||
|
||
# Her client için: name, public_key, allowed_ips
|
||
# group_vars/all/vars.yml içinde tanımlanır
|
||
wireguard_clients: []
|