Reengineed the code. Generalized the package. Cloud configurators are modules.

2026-08-10 09:02:45 +02:00
parent be4bb34bb0
commit 083ad9a596
40 changed files with 2367 additions and 650 deletions
@@ -0,0 +1,4 @@
+[Resolve]
+{% for address in local_addr_list -%}
+DNSStubListenerExtra={{ address }}
+{% endfor -%}
@@ -0,0 +1,46 @@
+connections {
+  remote-site {
+    version = 2
+    proposals = aes256-sha256-modp2048,aes256-sha1-modp1024
+    reauth_time = 28800
+    unique = replace
+
+    local_addrs  = {{ local_addrs }}
+    remote_addrs = {{ remote_addrs }}
+
+    local {
+      id = {{ local_id }}
+      auth = psk
+    }
+
+    remote {
+      id = @{{ remote_id }}
+      auth = psk
+    }
+
+    children {
+      site2site {
+        mode = tunnel
+        local_ts = {{ local_ts }}
+        remote_ts = {{ remote_cidrs }}
+        esp_proposals = aes256-sha256,aes256-sha1
+        life_time = 3600
+        dpd_action = restart
+        start_action = start
+        close_action = none
+      }
+    }
+
+    rekey_time = 10800
+    dpd_delay = 10
+    dpd_timeout = 120
+  }
+}
+
+secrets {
+  ike-psk {
+    id-1 = {{ local_id }}
+    id-2 = @{{ remote_id }}
+    secret = "{{ psk }}"
+  }
+}
@@ -0,0 +1,43 @@
+connections {
+  road-warrior {
+    version = 2
+    proposals = aes256-sha256-modp2048,aes256-sha1-modp1024
+    reauth_time = 28800
+    dpd_delay = 10
+    dpd_timeout = 120
+
+    local {
+      auth = pubkey
+      certs = server.pem
+      id = @{{ local_fqdn }}
+    }
+
+    remote {
+      auth = eap-tls
+      cacerts = ca.pem
+      eap_id = %any
+    }
+
+    children {
+      road-warrior {
+        mode = tunnel
+        local_ts = {{ local_ts }}
+        remote_ts = dynamic
+        esp_proposals = aes256-sha256,aes256-sha1
+        life_time = 3600
+        dpd_action = clear
+        start_action = none
+        close_action = none
+      }
+    }
+
+    pools = rw-pool
+  }
+}
+
+pools {
+  rw-pool {
+    addrs = {{ p2s_address_pool }}
+    dns   = {{ p2s_dns }}
+  }
+}
@@ -0,0 +1,4 @@
+[Interface]
+PostUp = wg set %i private-key /etc/wireguard/wg0.key
+ListenPort = {{ wg_listen_port }}
+Address = {{ wg_address }}