ansible-nebula
ansible-nebula copied to clipboard
ansible-nebula
This role installs and deploys a configuration for Nebula
Requirements
Currently you need to generate and deploy certificates before running this (see example)
Supported Nebula Version
Currently this role is tested against version 1.5.0
Role Variables
Variable Name | Type | Purpose | Default | Required |
---|---|---|---|---|
nebula_version |
String | Version to download | 1.5.0 |
Yes |
nebula_force_install |
Boolean | Force overwrite of the existing nebula binary | false |
No |
ca |
String | Path to CA file | NA | Yes |
cert |
String | Path to Certificate | NA | Yes |
key |
String | Path to Certificate Key | NA | Yes |
blocklist |
List | List of Blocklisted certificate hashes | NA | No |
lighthouses |
String | Static hosts for discovery | "{{ groups['nebula_lighthouses'] }}" | No |
lighthouses_override |
List | List of static hosts for discovery | NA | No |
lighthouse.am_lighthouse |
Boolean | Is this instance a Lighthouse | false |
Yes |
lighthouse.serve_dns |
Boolean | Should this instance serve DNS | false |
Yes |
lighthouse.interval |
Integer | Report interval to lighthouses | 60 |
No |
listen.host |
String | IP to listen on | 0.0.0.0 |
Yes |
listen.port |
Integer | Port to listen on | 4242 |
Yes |
listen.batch |
Integer | Sets the max number of packets to pull from the kernel for each syscall | 64 |
Yes |
listen.read_buffer |
Integer | Configure socket buffers for the udp side | NA | No |
listen.write_buffer |
Integer | Configure socket buffers for the udp side | NA | No |
punchy |
Boolean | Punchy continues to punch inbound/outbound at a regular interval to avoid expiration of firewall nat mappings | true |
Yes |
punch_back |
Boolean | punch_back means that a node you are trying to reach will connect back out to you if your hole punching fails | true |
Yes |
cipher |
String | Cipher allows you to choose between the available ciphers for your network. | NA | No |
local_range |
String | Local range is used to define a hint about the local network range | NA | No |
sshd.enabled |
Boolean | sshd can expose informational and administrative functions via ssh | NA | No |
sshd.listen |
String | IP / Port for admin SSH functions | NA | No |
relay.relays |
List | IP of hosts to use as a relay | NA | No |
relay.am_relay |
String | Indicate whether host should act as a relay | false |
No |
relay.use_relays |
String | Indicate whether host should attempt to connect through relays | true |
No |
metrics.prometheus |
Boolean | Enables prometheus server | NA | No |
outbound |
List | Outbound rules for the built in firewall | See Below |
Yes |
inbound |
List | Inbound rules for the built in firewall | See Below |
Yes |
Firewall rule example
outbound:
- port: any
proto: any
host: any
inbound:
- port: any
proto: icmp
host: any
Dependencies
None
Example Playbook
---
- hosts: all
remote_user: root
vars:
lighthouses:
- nebula_ip: 10.255.0.1
external_addr: 123.231.1.2
lighthouse:
nodes:
- 10.255.0.1
pre_tasks:
- name: Create Nebula directory
file:
path: /etc/nebula
state: directory
mode: '0750'
- name: Deploy Nebula certificates
copy:
src: files/{{item}}
dest: /etc/nebula/{{item}}
owner: root
group: root
mode: '0600'
with_items:
- ca.crt
- host.crt
- host.key
roles:
- ansible-nebula
---
- hosts: all
remote_user: root
vars:
lighthouses:
- nebula_ip: 10.255.0.1
external_addr: 123.231.1.2
roles:
- ansible-nebula
Optionally you may declare a lighthouse with a non-default external port
---
- hosts: all
remote_user: root
vars:
lighthouse:
am_lighthouse: yes
lighthouses:
- nebula_ip: 10.255.0.1
external_addr: 123.231.1.2
external_port: 4242
roles:
- ansible-nebula
License
MIT
Author Information
This role is provided as is, Nebula is maintained by Slack and the community