Page MenuHomeDevCentral

Configure strongSwan as IPsec implementation
Needs ReviewPublic

Authored by Duranzed on Mar 2 2026, 19:29.
Tags
None
Referenced Files
F25280986: D3988.id10385.diff
Wed, Apr 8, 17:59
F25279592: D3988.id10457.diff
Wed, Apr 8, 17:14
F25276675: D3988.id10538.diff
Wed, Apr 8, 14:58
Unknown Object (File)
Wed, Apr 8, 01:59
Unknown Object (File)
Tue, Apr 7, 14:30
Unknown Object (File)
Tue, Apr 7, 10:53
Unknown Object (File)
Tue, Apr 7, 09:29
Unknown Object (File)
Tue, Apr 7, 02:21
Subscribers
None

Details

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Passed
Unit
No Test Coverage
Branch
GRE-tunnel
Build Status
Buildable 6491
Build 6775: arc lint + arc unit

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
pillar/core/network.sls
58 ↗(On Diff #10353)

We can use the banner format here, to be coherent with the repository style.

73 ↗(On Diff #10353)

You can provision them as a follow-up change, uncommented instead.

93 ↗(On Diff #10353)

That comment can be safely removed: the pillar name and the ike_ esp_ keys make that clear what is it.

roles/core/strongswan/config.sls
21 ↗(On Diff #10353)

Jinja syntax allows to use dots as separator to access dictionary keys.

We can use it, but in that case, it's really coherent to use it everywhere.

22 ↗(On Diff #10353)

Won't really work beyond the scope of a test tunnel between those two links. You need a more flexible way to pass the info according the node.

Besides, if you deploy this on both router-002 and router-003 you would get twice the config router-002 to router-003 it seems.

roles/core/strongswan/files/swanctl.conf
1 ↗(On Diff #10353)
roles/core/strongswan/init.sls
1 ↗(On Diff #10353)

Header missing

4 ↗(On Diff #10353)

That one doesn't exist in the change it seems

This revision now requires changes to proceed.Mar 4 2026, 07:14

Updated strongswan config files and using a for loop for a more readable code

Duranzed marked 4 inline comments as done.

Modified Ysul IP adress in network.sls

Updated config files to use node.resolve_gre_tunnels

Improved configuration files and headers

Added software.sls and modified init.sls

dereckson requested changes to this revision.Thu, Mar 12, 21:59
dereckson added inline comments.
roles/core/strongswan/files/swanctl.conf
50 ↗(On Diff #10401)
This revision now requires changes to proceed.Thu, Mar 12, 21:59

Test to deploy this final version on Complector with a test=True to see if it's still no-op.

  • Modified to create tunnels from router-003
  • Roles: update network pillar

using for loop to create GRE tunnel on router-002 and 003

Added IP canonical IP addresses to router-002 and router-003

Duranzed marked an inline comment as done.

Removed cloudhugger

pillar/core/network.sls
37 ↗(On Diff #10513)

We can use explicit variable names.

One letter variables is an historical artefact, from the era where the maximal length for a specific code line was fixed.

See for example for COBOL this IBM documentation:
https://www.ibm.com/docs/en/developer-for-zos/15.0.x?topic=editing-setting-language-specific-maximum-line-length

Nowadays, best practice is to use clear variable name to facilitate reading the code.

9 ↗(On Diff #10453)

What's the role of the router? I think it's to get public IP for that node.

testing list format for routers

removed canonical ipv4 from network.sls and corrected node function

yousra added a reviewer: yousra.

Configuration deployed and running on router-002/router-003 and WindRiver

roles/core/strongswan/software.sls
9 ↗(On Diff #10537)