initial commit

README.md

@@ -0,0 +1,55 @@
+# nbops-ansible-router
+
+Ansible framework for building a Debian 13 BIRD router VM from an initial Debian 12 install.
+
+The first stage performs the Debian 12 to Debian 13 dist upgrade. Router configuration then installs WireGuard and BIRD, applies forwarding sysctl values, and renders configs from variables.
+
+## Layout
+
+- `site.yml` - main entry point.
+- `inventories/production/hosts.yml` - VM inventory placeholder.
+- `group_vars/routers.yml` - shared router variables.
+- `roles/debian_dist_upgrade` - Debian 12 to Debian 13 upgrade workflow.
+- `roles/bird_router` - WireGuard, sysctl forwarding, CZ.NIC BIRD packages, and BIRD configuration.
+
+## Usage
+
+Edit `inventories/production/hosts.yml`, then run:
+
+```sh
+ansible-playbook site.yml
+```
+
+To run only the OS upgrade stage:
+
+```sh
+ansible-playbook site.yml --tags debian_upgrade
+```
+
+The upgrade role expects the VM to start on Debian 12/bookworm and upgrades it to Debian 13/trixie.
+
+## Router Secrets
+
+WireGuard private keys are read from environment variables by default:
+
+```sh
+export WG1_PRIVATEKEY='...'
+export WG2_PRIVATEKEY='...'
+ansible-playbook site.yml
+```
+
+For production, prefer Ansible Vault group vars instead of committing secrets. Public keys, allowed IPs, BGP peers, package track, and package version are defined in `group_vars/routers.yml`.
+
+## BIRD Package Track
+
+The router role configures the CZ.NIC Labs apt repository for BIRD. Defaults:
+
+- `bird_track: bird2`
+- `bird_package_version: 2.19.1-cznic.1~trixie`
+
+To test BIRD 3 later, set:
+
+```yaml
+bird_track: bird3
+bird_package_version: ""
+```