Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
67 lines
3.4 KiB
YAML
67 lines
3.4 KiB
YAML
---
|
|
# Part of role: pia-gateway
|
|
# Included by: tasks/main.yaml
|
|
# Description: The one thing this file does now: permit VLAN 50 clients
|
|
# to reach the local Technitium listener on minisforum. Everything
|
|
# else the kill switch needs (the dedicated FORWARD-chain scoping, the
|
|
# routing-table unreachable fallback) lives in tasks/routing.yaml /
|
|
# templates/pia-killswitch.sh.j2 — see those for the actual fail-closed
|
|
# layers.
|
|
#
|
|
# Two corrections from an earlier version of this file, both from code
|
|
# review against the live topology rather than assumption:
|
|
#
|
|
# 1. Technitium (10.10.40.53) IS minisforum's own address — traffic from
|
|
# a VLAN 50 client to it terminates LOCALLY on minisforum. That's
|
|
# INPUT traffic, not FORWARD/routed traffic, so it needs a normal UFW
|
|
# input allow, not `route: true` (which adds a FORWARD-chain rule for
|
|
# traffic passing *through* the host to some other destination — the
|
|
# wrong chain for a locally-terminated flow, and it would never
|
|
# actually have matched real Technitium queries).
|
|
#
|
|
# 2. This file used to also force UFW's DEFAULT_FORWARD_POLICY to DROP,
|
|
# intended as a second kill-switch layer. That was never actually
|
|
# proven safe: minisforum is the k3s server and runs Flannel, which
|
|
# depends on the FORWARD chain for pod-to-pod and pod-to-internet
|
|
# traffic (source 10.42.0.0/16) — changing the chain-wide default
|
|
# policy risked breaking that, for a benefit (fail-closed for VLAN 50
|
|
# specifically) that's already fully covered by the dedicated
|
|
# {{ pia_iptables_chain }} chain in pia-killswitch.sh.j2, which is
|
|
# scoped to source {{ pia_vlan50_subnet }} only and can structurally
|
|
# never see Flannel's traffic (disjoint source CIDR). Removed rather
|
|
# than shipped unproven.
|
|
#
|
|
# Inspection commands (read-only):
|
|
# sudo iptables -S FORWARD | head -3 # confirm the single
|
|
# # jump to {{ pia_iptables_chain }}
|
|
# # at position 1, and that
|
|
# # the chain-wide policy
|
|
# # is still whatever it
|
|
# # was before this role
|
|
# # (ACCEPT, typically)
|
|
# sudo iptables -S {{ pia_iptables_chain }} # the kill-switch chain
|
|
# # itself: ACCEPT pair
|
|
# # when pia-wg is up,
|
|
# # LOG+DROP catch-all
|
|
# # always present
|
|
# sudo ufw status verbose | grep 53 # the Technitium INPUT
|
|
# # allow, both protocols
|
|
#
|
|
# Rollback (this file's part only — see routing.yaml/README.md for the
|
|
# rest of the role's rollback):
|
|
# sudo ufw delete allow from 10.10.50.0/24 to 10.10.40.53 port 53 proto tcp
|
|
# sudo ufw delete allow from 10.10.50.0/24 to 10.10.40.53 port 53 proto udp
|
|
|
|
- name: Allow VLAN 50 clients to reach Technitium DNS (local INPUT traffic)
|
|
community.general.ufw:
|
|
rule: allow
|
|
direction: in
|
|
src: "{{ pia_vlan50_subnet }}"
|
|
dest: "{{ k3s_dns_resolver }}"
|
|
port: "53"
|
|
proto: "{{ item }}"
|
|
comment: VLAN 50 clients to Technitium (local, not routed)
|
|
loop:
|
|
- tcp
|
|
- udp
|