56 lines
1.5 KiB
Markdown
56 lines
1.5 KiB
Markdown
# nbops-ansible-router
|
|
|
|
Ansible framework for building a Debian 13 BIRD router VM from an initial Debian 12 install.
|
|
|
|
The first stage performs the Debian 12 to Debian 13 dist upgrade. Router configuration then installs WireGuard and BIRD, applies forwarding sysctl values, and renders configs from variables.
|
|
|
|
## Layout
|
|
|
|
- `site.yml` - main entry point.
|
|
- `inventories/production/hosts.yml` - VM inventory placeholder.
|
|
- `group_vars/routers.yml` - shared router variables.
|
|
- `roles/debian_dist_upgrade` - Debian 12 to Debian 13 upgrade workflow.
|
|
- `roles/bird_router` - WireGuard, sysctl forwarding, CZ.NIC BIRD packages, and BIRD configuration.
|
|
|
|
## Usage
|
|
|
|
Edit `inventories/production/hosts.yml`, then run:
|
|
|
|
```sh
|
|
ansible-playbook site.yml
|
|
```
|
|
|
|
To run only the OS upgrade stage:
|
|
|
|
```sh
|
|
ansible-playbook site.yml --tags debian_upgrade
|
|
```
|
|
|
|
The upgrade role expects the VM to start on Debian 12/bookworm and upgrades it to Debian 13/trixie.
|
|
|
|
## Router Secrets
|
|
|
|
WireGuard private keys are read from environment variables by default:
|
|
|
|
```sh
|
|
export WG1_PRIVATEKEY='...'
|
|
export WG2_PRIVATEKEY='...'
|
|
ansible-playbook site.yml
|
|
```
|
|
|
|
For production, prefer Ansible Vault group vars instead of committing secrets. Public keys, allowed IPs, BGP peers, package track, and package version are defined in `group_vars/routers.yml`.
|
|
|
|
## BIRD Package Track
|
|
|
|
The router role configures the CZ.NIC Labs apt repository for BIRD. Defaults:
|
|
|
|
- `bird_track: bird2`
|
|
- `bird_package_version: 2.19.1-cznic.1~trixie`
|
|
|
|
To test BIRD 3 later, set:
|
|
|
|
```yaml
|
|
bird_track: bird3
|
|
bird_package_version: ""
|
|
```
|