Page MenuHomeDevCentral
Files F24881719

D3988.id10385.diff
No OneTemporary
Actions

D3988.id10385.diff
View Options

diff --git a/pillar/core/network.sls b/pillar/core/network.sls
--- a/pillar/core/network.sls
+++ b/pillar/core/network.sls
@@ -54,45 +54,23 @@
node:
addr: 172.27.27.35
+# -------------------------------------------------------------
+# IPsec configuration - strongSwan
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-# IPsec configuration for strongswan
-
-drake_IPsec_tunnels:
- router-002:
- local_ip: 172.27.27.11
- remote_ip: 172.27.27.12
- local_ts: 172.27.27.11/28
- remote_ts: 172.27.27.12/28
-
- router-003:
- local_ip: 172.27.27.12
- remote_ip: 172.27.27.11
- local_ts: 172.27.27.12/28
- remote_ts: 172.27.27.11/28
-
-#drake_IPsec_tunnels:
-# router-002:
-# tunnels:
-# to_router003:
-# remote_ip: "172.27.27.12"
-# local_ts: "172.27.27.11/32"
-# remote_ts: "172.27.27.12/32"
-# to_windriver:
-# remote_ip: "172.27.27.35"
-# local_ts: "172.27.27.11/32"
-# remote_ts: "172.27.27.35/32"
-# to_ysul:
-# remote_ip: "172.27.27.X"
-# local_ts: "172.27.27.11/32"
-# remote_ts: "172.27.27.X/32"
-# local_ip: "172.27.27.11"
-
-
-
+drake_IPsec_tunnels_service:
+ vip_carp: 51.68.252.230
+ tunnels:
+ to_windriver:
+ remote_ip: 195.154.30.15
+ remote_ts: 195.154.30.15/32
-# IPsec configuration IKE + ESP
+ to_ysul:
+ remote_ip: 163.172.49.16
+ remote_ts: 163.172.49.16/32
drake_IPsec_config:
router:
ike_proposals: "aes256-sha256-modp2048"
esp_proposals: "aes256-sha256"
+ child_mode: "tunnel"
diff --git a/roles/core/strongswan/config.sls b/roles/core/strongswan/config.sls
--- a/roles/core/strongswan/config.sls
+++ b/roles/core/strongswan/config.sls
@@ -9,24 +9,21 @@
# Strongswan(IPsec) configuration
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+{% set psk = salt["credentials.get_password"]('network/ipsec/key') %}
+
{{ dirs.etc }}/swanctl/swanctl.conf:
file.managed:
- - source: salt://roles/core/network/files/swanctl.conf
+ - source: salt://roles/core/strongswan/files/swanctl.conf
- user: root
- group: wheel
- mode: 600
- template: jinja
- context:
- tunnel_name: "IPsec"
- ike_proposals: {{ pillar.drake_IPsec_config('ike_proposals') }}
- local_ip: {{ pillar.drake_IPsec_tunnels['router-002']['local_ip'] }}
- remote_ip: {{ pillar.drake_IPsec_tunnels['router-003']['local_ip'] }}
- child_name: "gre"
- child_mode: "transport"
- esp_proposals: {{ pillar.drake_IPsec_config('esp_proposals') }}
- local_ts: {{ pillar.drake_IPsec_tunnels['router-002']['local_ts'] }}
- remote_ts: {{ pillar.drake_IPsec_tunnels['router-003']['remote_ts'] }}
- psk_secret: {{ salt["credentials.get_password"]( 'network/ipsec/key') }}
+ ipsec: {{ pillar['drake_IPsec_tunnels_service'] }}
+ conf: {{ pillar['drake_IPsec_config']['router'] }}
+ tunnels: {{ pillar.drake_IPsec_tunnels_service.tunnels }}
+ vip_carp: {{ pillar.drake_IPsec_tunnels_service.vip_carp }}
+ psk_secret: {{ psk }}
strongswan_reload:
cmd.run:
diff --git a/roles/core/strongswan/files/swanctl.conf b/roles/core/strongswan/files/swanctl.conf
--- a/roles/core/strongswan/files/swanctl.conf
+++ b/roles/core/strongswan/files/swanctl.conf
@@ -1,38 +1,55 @@
+# -------------------------------------------------------------
+#
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# Source file:
+# -------------------------------------------------------------
+#
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
-connections {
- {{ tunnel_name }} {
- version = 2
- proposals = {{ ike_proposals }}
-
- local_addrs = {{ local_ip }}
- remote_addrs = {{ remote_ip }}
+# -------------------------------------------------------------
+# Strongswan configuration for swanctl
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- local {
- auth = psk
- id = {{ local_ip }}
- }
+connections {
+{% for name, data in ipsec['tunnels'].items() %}
+ IPsec_{{ name }} {
+ version = 2
+ proposals = {{ conf.ike_proposals }}
- remote {
- auth = psk
- id = {{ remote_ip }}
- }
+ local_addrs = {{ ipsec.vip_carp }}
+ remote_addrs = {{ data.remote_ip }}
- children {
- {{ child_name }} {
- mode = {{ child_mode }}
- esp_proposals = {{ esp_proposals }}
- local_ts = {{ local_ts }}
- remote_ts = {{ remote_ts }}
- start_action = start
+ local {
+ auth = psk
+ id = {{ ipsec.vip_carp }}
+ }
+ remote {
+ auth = psk
+ id = {{ data.remote_ip }}
+ }
+ children {
+ tunnel-{{ name }} {
+ mode = {{ conf.child_mode }}
+ esp_proposals = {{ conf.esp_proposals }}
+ local_ts = {{ ipsec.vip_carp }}/32
+ remote_ts = {{ data.remote_ts }}
+ start_action = trap
+ }
}
- }
- }
+ }
+{% endfor %}
}
secrets {
- ike-psk {
- id-1 = {{ local_ip }}
- id-2 = {{ remote_ip }}
- secret = "{{ psk_secret }}"
- }
+{% for name, data in ipsec['tunnels'].items() %}
+ ike-{{ name }} {
+ id-1 = {{ data.remote_ip }}
+ secret = {{ psk_secret }}
+ }
+{% endfor %}
}
diff --git a/roles/core/strongswan/service.sls b/roles/core/strongswan/init.sls
copy from roles/core/strongswan/service.sls
copy to roles/core/strongswan/init.sls
--- a/roles/core/strongswan/service.sls
+++ b/roles/core/strongswan/init.sls
@@ -1,24 +1,21 @@
# -------------------------------------------------------------
-# Salt — Provision strongswan
+# Author: Nasqueron Team
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Project: Nasqueron
# License: Trivial work, not eligible to copyright
+# Source file:
# -------------------------------------------------------------
-
-{% from "map.jinja" import services with context %}
+#
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
# -------------------------------------------------------------
-# strongswan service
+# Strongswan init
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-{% if services.manager == "rc" %}
-
-/etc/rc.conf.d/strongswan:
- file.managed:
- - source: salt://roles/core/strongswan/files/rc/strongswan.conf
-
-strongswan_running:
- service.running:
- - name: strongswan
-
-{% endif %}
+include:
+ - .config
+ - .service
+ - .strongswan
diff --git a/roles/core/strongswan/service.sls b/roles/core/strongswan/service.sls
--- a/roles/core/strongswan/service.sls
+++ b/roles/core/strongswan/service.sls
@@ -1,5 +1,5 @@
# -------------------------------------------------------------
-# Salt — Provision strongswan
+# Salt — Provisions strongswan
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Project: Nasqueron
# License: Trivial work, not eligible to copyright

File Metadata

Mime Type
text/plain
Expires
Mon, Mar 16, 15:25 (14 h, 14 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
3537351
Default Alt Text
D3988.id10385.diff (7 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator