Switch to terraform
This commit is contained in:
Prox
258
ansible/netbird/playbook-ssl-ip.yml
Normal file
258
ansible/netbird/playbook-ssl-ip.yml
Normal file
@@ -0,0 +1,258 @@
|
||||
---
|
||||
# =============================================================================
|
||||
# NetBird v1.6 Deployment - SSL Mode with Public IP (Self-Signed)
|
||||
# =============================================================================
|
||||
# Uses Caddy's internal CA with self-signed certificates for HTTPS on IP.
|
||||
# Browser will show certificate warning - this is expected.
|
||||
#
|
||||
# Note: Let's Encrypt supports IP certificates now, but Caddy's implementation
|
||||
# is incomplete (GitHub issue #7399). Using self-signed as reliable fallback.
|
||||
#
|
||||
# Prerequisites:
|
||||
# 1. VPS with public IP address
|
||||
# 2. Port 80 and 443 accessible
|
||||
# 3. Create group_vars/vault.yml from vault.yml.example
|
||||
#
|
||||
# Run:
|
||||
# ansible-playbook -i inventory.yml playbook-ssl-ip.yml --ask-vault-pass
|
||||
# =============================================================================
|
||||
|
||||
- name: Deploy NetBird v1.6 (SSL Mode - Public IP Self-Signed)
|
||||
hosts: netbird_servers
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars_files:
|
||||
- group_vars/netbird_servers.yml
|
||||
- group_vars/vault.yml
|
||||
|
||||
pre_tasks:
|
||||
- name: Set SSL-IP variables (override group_vars)
|
||||
ansible.builtin.set_fact:
|
||||
netbird_domain: "{{ ansible_default_ipv4.address }}"
|
||||
netbird_protocol: "https"
|
||||
relay_protocol: "rels"
|
||||
relay_port: 443
|
||||
signal_port: 443
|
||||
single_account_domain: "netbird.local"
|
||||
|
||||
tasks:
|
||||
# =========================================================================
|
||||
# Prerequisites
|
||||
# =========================================================================
|
||||
- name: Update apt cache
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install prerequisites
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- jq
|
||||
state: present
|
||||
|
||||
# =========================================================================
|
||||
# Docker Installation
|
||||
# =========================================================================
|
||||
- name: Check if Docker is installed
|
||||
ansible.builtin.command: docker --version
|
||||
register: docker_installed
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Create keyrings directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
when: docker_installed.rc != 0
|
||||
|
||||
- name: Add Docker GPG key
|
||||
ansible.builtin.shell: |
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
||||
chmod a+r /etc/apt/keyrings/docker.gpg
|
||||
args:
|
||||
creates: /etc/apt/keyrings/docker.gpg
|
||||
when: docker_installed.rc != 0
|
||||
|
||||
- name: Add Docker repository
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
when: docker_installed.rc != 0
|
||||
|
||||
- name: Install Docker packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
update_cache: true
|
||||
when: docker_installed.rc != 0
|
||||
|
||||
- name: Start and enable Docker
|
||||
ansible.builtin.systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# =========================================================================
|
||||
# NetBird Directory Structure
|
||||
# =========================================================================
|
||||
- name: Create NetBird directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ netbird_base_dir }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
# =========================================================================
|
||||
# Deploy Configuration Files
|
||||
# =========================================================================
|
||||
- name: Deploy docker-compose.yml
|
||||
ansible.builtin.template:
|
||||
src: templates/docker-compose.yml.j2
|
||||
dest: "{{ netbird_base_dir }}/docker-compose.yml"
|
||||
mode: "0644"
|
||||
|
||||
- name: Deploy Caddyfile (SSL-IP mode)
|
||||
ansible.builtin.template:
|
||||
src: templates/Caddyfile-ssl-ip.j2
|
||||
dest: "{{ netbird_base_dir }}/Caddyfile"
|
||||
mode: "0644"
|
||||
|
||||
- name: Deploy management.json
|
||||
ansible.builtin.template:
|
||||
src: templates/management.json.j2
|
||||
dest: "{{ netbird_base_dir }}/management.json"
|
||||
mode: "0644"
|
||||
|
||||
- name: Deploy dashboard.env
|
||||
ansible.builtin.template:
|
||||
src: templates/dashboard.env.j2
|
||||
dest: "{{ netbird_base_dir }}/dashboard.env"
|
||||
mode: "0640"
|
||||
|
||||
- name: Deploy relay.env
|
||||
ansible.builtin.template:
|
||||
src: templates/relay.env.j2
|
||||
dest: "{{ netbird_base_dir }}/relay.env"
|
||||
mode: "0640"
|
||||
|
||||
- name: Deploy turnserver.conf
|
||||
ansible.builtin.template:
|
||||
src: templates/turnserver.conf.j2
|
||||
dest: "{{ netbird_base_dir }}/turnserver.conf"
|
||||
mode: "0644"
|
||||
|
||||
# =========================================================================
|
||||
# Firewall (UFW)
|
||||
# =========================================================================
|
||||
- name: Install UFW
|
||||
ansible.builtin.apt:
|
||||
name: ufw
|
||||
state: present
|
||||
|
||||
- name: Allow SSH
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "22"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow HTTP (for ACME challenge)
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "80"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow HTTPS
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "443"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow HTTPS UDP (HTTP/3)
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "443"
|
||||
proto: udp
|
||||
|
||||
- name: Allow TURN UDP
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "3478"
|
||||
proto: udp
|
||||
|
||||
- name: Allow TURN TCP
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "3478"
|
||||
proto: tcp
|
||||
|
||||
- name: Enable UFW
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
policy: deny
|
||||
|
||||
# =========================================================================
|
||||
# Start Services
|
||||
# =========================================================================
|
||||
- name: Pull Docker images
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose pull
|
||||
chdir: "{{ netbird_base_dir }}"
|
||||
changed_when: true
|
||||
|
||||
- name: Start NetBird services
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose up -d
|
||||
chdir: "{{ netbird_base_dir }}"
|
||||
changed_when: true
|
||||
|
||||
# =========================================================================
|
||||
# Wait for Services
|
||||
# =========================================================================
|
||||
- name: Wait for Management API to be available
|
||||
ansible.builtin.uri:
|
||||
url: "https://{{ netbird_domain }}/api/users"
|
||||
method: GET
|
||||
status_code: [200, 401, 403]
|
||||
validate_certs: false
|
||||
register: api_check
|
||||
until: api_check.status in [200, 401, 403]
|
||||
retries: 30
|
||||
delay: 10
|
||||
|
||||
# =========================================================================
|
||||
# Display Summary
|
||||
# =========================================================================
|
||||
- name: Display deployment status
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
============================================
|
||||
NetBird v1.6 Deployed Successfully! (SSL-IP)
|
||||
============================================
|
||||
|
||||
Dashboard: https://{{ netbird_domain }}
|
||||
|
||||
Note: Using self-signed certificate (Caddy internal CA).
|
||||
Your browser will show a certificate warning - accept it to proceed.
|
||||
|
||||
Initial Setup:
|
||||
1. Access the dashboard (accept certificate warning)
|
||||
2. Create your first user (admin)
|
||||
3. Generate setup keys for battalions
|
||||
|
||||
Connect peers with:
|
||||
netbird up --management-url https://{{ netbird_domain }} --setup-key <KEY>
|
||||
|
||||
View logs:
|
||||
ssh root@{{ ansible_host }} "cd {{ netbird_base_dir }} && docker compose logs -f"
|
||||
============================================
|
||||
Reference in New Issue
Block a user