Document network operations and WireGuard maintenance
This commit is contained in:
windyboy
@@ -0,0 +1,62 @@
|
||||
---
|
||||
# This owns the non-secret Compose declaration only. WireGuard key material
|
||||
# remains under the server-local /opt/wireguard/config bind mount.
|
||||
- name: Apply the reviewed WireGuard Compose hardening
|
||||
hosts: wireguard
|
||||
become: true
|
||||
gather_facts: false
|
||||
serial: 1
|
||||
vars:
|
||||
wireguard_harden_confirm: false
|
||||
wireguard_compose_candidate: "{{ compose_project_dir }}/compose.yml.candidate"
|
||||
tasks:
|
||||
- name: Require explicit WireGuard hardening confirmation
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- wireguard_harden_confirm | bool
|
||||
fail_msg: >-
|
||||
This operation replaces the non-secret Compose declaration. Run only
|
||||
during the approved maintenance window after a rollback archive exists.
|
||||
|
||||
- name: Verify that a protected pre-change archive exists
|
||||
ansible.builtin.find:
|
||||
paths: "{{ compose_project_dir }}/backups"
|
||||
patterns: 'pre-hardening-*.tar.gz'
|
||||
file_type: file
|
||||
register: wireguard_pre_hardening_archives
|
||||
|
||||
- name: Require a pre-change rollback archive
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- wireguard_pre_hardening_archives.matched | int > 0
|
||||
fail_msg: >-
|
||||
Create a protected pre-hardening archive before replacing compose.yml.
|
||||
|
||||
- name: Render the candidate non-secret Compose declaration
|
||||
ansible.builtin.template:
|
||||
src: ../templates/wireguard-compose.yml.j2
|
||||
dest: "{{ wireguard_compose_candidate }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Validate the candidate Compose declaration
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- compose
|
||||
- --project-directory
|
||||
- "{{ compose_project_dir }}"
|
||||
- --file
|
||||
- "{{ wireguard_compose_candidate }}"
|
||||
- config
|
||||
- --quiet
|
||||
changed_when: false
|
||||
|
||||
- name: Atomically activate the validated Compose declaration
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- mv
|
||||
- "{{ wireguard_compose_candidate }}"
|
||||
- "{{ compose_project_dir }}/compose.yml"
|
||||
changed_when: true
|
||||
@@ -0,0 +1,114 @@
|
||||
---
|
||||
# Deliberately narrow maintenance path for the us4 WireGuard service. The
|
||||
# Compose file and all private key material remain on the server; this playbook
|
||||
# only pulls its declared immutable image and recreates the named service.
|
||||
- name: Update and recreate the approved WireGuard service
|
||||
hosts: wireguard
|
||||
become: true
|
||||
gather_facts: false
|
||||
serial: 1
|
||||
vars:
|
||||
wireguard_maintenance_confirm: false
|
||||
tasks:
|
||||
- name: Require explicit WireGuard maintenance confirmation
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- wireguard_maintenance_confirm | bool
|
||||
fail_msg: >-
|
||||
This operation pulls the image declared in /opt/wireguard/compose.yml
|
||||
and briefly recreates WireGuard. Set wireguard_maintenance_confirm=true
|
||||
only during the approved maintenance window.
|
||||
|
||||
- name: Create the local WireGuard rollback directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ compose_project_dir }}/backups"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0700"
|
||||
|
||||
- name: Create a timestamp for the rollback archive
|
||||
ansible.builtin.command:
|
||||
argv: [date, +%Y%m%dT%H%M%SZ]
|
||||
changed_when: false
|
||||
register: wireguard_backup_timestamp
|
||||
|
||||
- name: Create a protected local rollback archive of WireGuard configuration
|
||||
ansible.builtin.shell:
|
||||
cmd: >-
|
||||
umask 077 && tar --create --gzip
|
||||
--file={{ compose_project_dir }}/backups/config-{{ wireguard_backup_timestamp.stdout }}.tar.gz
|
||||
--directory={{ compose_project_dir }} config
|
||||
executable: /bin/bash
|
||||
changed_when: true
|
||||
|
||||
- name: Verify the compose declaration uses an immutable image digest
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- compose
|
||||
- --project-directory
|
||||
- "{{ compose_project_dir }}"
|
||||
- config
|
||||
changed_when: false
|
||||
register: wireguard_compose_config
|
||||
|
||||
- name: Reject mutable WireGuard image declarations
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "'@sha256:' in wireguard_compose_config.stdout"
|
||||
fail_msg: >-
|
||||
Pin the WireGuard image to an approved immutable digest before using
|
||||
this maintenance playbook.
|
||||
|
||||
- name: Pull the declared WireGuard image
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- compose
|
||||
- --project-directory
|
||||
- "{{ compose_project_dir }}"
|
||||
- pull
|
||||
- wireguard
|
||||
changed_when: true
|
||||
|
||||
- name: Recreate the WireGuard container
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- compose
|
||||
- --project-directory
|
||||
- "{{ compose_project_dir }}"
|
||||
- up
|
||||
- -d
|
||||
- --no-deps
|
||||
- --force-recreate
|
||||
- wireguard
|
||||
changed_when: true
|
||||
|
||||
- name: Verify WireGuard container state
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- compose
|
||||
- --project-directory
|
||||
- "{{ compose_project_dir }}"
|
||||
- ps
|
||||
- --all
|
||||
changed_when: false
|
||||
register: wireguard_compose_ps
|
||||
|
||||
- name: Display WireGuard container state
|
||||
ansible.builtin.debug:
|
||||
var: wireguard_compose_ps.stdout_lines
|
||||
|
||||
- name: Run the deployed WireGuard health check
|
||||
ansible.builtin.command:
|
||||
argv: [/usr/local/lib/vps-health/run]
|
||||
changed_when: false
|
||||
register: wireguard_health_report
|
||||
failed_when: wireguard_health_report.rc not in [0, 1]
|
||||
|
||||
- name: Display sanitized WireGuard health result
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ wireguard_health_report.stdout | default(wireguard_health_report.stderr, true) }}"
|
||||
Reference in New Issue
Block a user