Merge remote-tracking branch 'tigerfell/pr257'

[chef.git] / cookbooks / networking / recipes / default.rb

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index 4fbf463f219f48651c9c38722e2b4eab55a9292d..81437acc0869664f0213ce50759b2ec22465c03e 100644 (file)
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -156,7 +156,7 @@ end
 
 netplan["network"]["bonds"].each_value do |bond|
   bond["interfaces"].each do |interface|
-    netplan["network"]["ethernets"][interface] ||= { "accept-ra" => false }
+    netplan["network"]["ethernets"][interface] ||= { "accept-ra" => false, "optional" => true }
   end
 end
 
@@ -261,6 +261,20 @@ if node[:networking][:wireguard][:enabled]
       :allowed_ips => "10.0.16.1/32",
       :endpoint => "gate.compton.nu:51820"
     }
+
+    # Grant home
+    node.default[:networking][:wireguard][:peers] << {
+      :public_key => "RofATnvlWxP3mt87+QKRXFE5MVxtoCcTsJ+yftZYEE4=",
+      :allowed_ips => "10.89.122.1/32",
+      :endpoint => "gate.firefishy.com:51820"
+    }
+
+    # Grant roaming
+    node.default[:networking][:wireguard][:peers] << {
+      :public_key => "YbUkREE9TAmomqgL/4Fh2e5u2Hh7drN/2o5qg3ndRxg=",
+      :allowed_ips => "10.89.123.1/32",
+      :endpoint => "roaming.firefishy.com:51820"
+    }
   end
 
   template "/etc/systemd/network/wireguard.netdev" do
@@ -289,7 +303,7 @@ if node[:networking][:wireguard][:enabled]
       action :nothing
       subscribes :restart, "template[/etc/systemd/network/wireguard.netdev]"
       subscribes :restart, "template[/etc/systemd/network/wireguard.network]"
-      not_if { ENV.key?("TEST_KITCHEN") }
+      not_if { kitchen? }
     end
   else
     execute "networkctl-delete-wg0" do
@@ -304,7 +318,7 @@ if node[:networking][:wireguard][:enabled]
       command "networkctl reload"
       subscribes :run, "template[/etc/systemd/network/wireguard.netdev]"
       subscribes :run, "template[/etc/systemd/network/wireguard.network]"
-      not_if { ENV.key?("TEST_KITCHEN") }
+      not_if { kitchen? }
     end
   end
 end
@@ -317,7 +331,7 @@ end
 execute "hostnamectl-set-hostname" do
   command "hostnamectl set-hostname #{node[:networking][:hostname]}"
   notifies :reload, "ohai[reload-hostname]"
-  not_if { ENV.key?("TEST_KITCHEN") || node[:hostnamectl][:static_hostname] == node[:networking][:hostname] }
+  not_if { kitchen? || node[:hostnamectl][:static_hostname] == node[:networking][:hostname] }
 end
 
 template "/etc/hosts" do
@@ -506,16 +520,24 @@ if node[:networking][:wireguard][:enabled]
   end
 end
 
+file "/etc/shorewall/masq" do
+  action :delete
+end
+
+file "/etc/shorewall/masq.bak" do
+  action :delete
+end
+
 if node[:roles].include?("gateway")
-  template "/etc/shorewall/masq" do
-    source "shorewall-masq.erb"
+  template "/etc/shorewall/snat" do
+    source "shorewall-snat.erb"
     owner "root"
     group "root"
     mode "644"
     notifies :restart, "service[shorewall]"
   end
 else
-  file "/etc/shorewall/masq" do
+  file "/etc/shorewall/snat" do
     action :delete
     notifies :restart, "service[shorewall]"
   end