Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
15 lines
1.1 KiB
YAML
15 lines
1.1 KiB
YAML
# Host vars for: minisforum (k3s server)
|
|
ansible_python_interpreter: /usr/bin/python3.13
|
|
|
|
# ── pia-gateway ────────────────────────────────────────────────────────────────
|
|
# Read directly from the repo-root .env (same PIA_USER/PIA_PASSWORD keys
|
|
# manifests/media/pia-secret.sh already uses) rather than ansible-vault —
|
|
# .env is already the established, gitignored, plaintext-at-rest secret
|
|
# source for this account elsewhere in the repo, and lookups run on the
|
|
# control node, so this never touches minisforum or gets committed.
|
|
# playbook_dir is always ansible/playbooks for every playbook in this
|
|
# repo, so ../../.env resolves to the repo root regardless of which
|
|
# playbook triggers evaluation of these two vars.
|
|
pia_user: "{{ lookup('ansible.builtin.file', playbook_dir + '/../../.env') | regex_search('^PIA_USER=(.*)$', '\\1', multiline=True) | first }}"
|
|
pia_password: "{{ lookup('ansible.builtin.file', playbook_dir + '/../../.env') | regex_search('^PIA_PASSWORD=(.*)$', '\\1', multiline=True) | first }}"
|