talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Set up the cloak jail to run wireguard.

Browse Source
This commit is contained in:
Tom Alexander 2022-10-29 21:29:00 -04:00
parent 464d873b31
commit 016ed08440
Signed by: talexander
GPG Key ID: D3A179C9A53C0EDE
5 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/environments/laptop/host_vars/odofreebsd
View File

@ -34,7 +34,7 @@ users:
- backup_fido - backup_fido
- homeassistant - homeassistant
gitconfig: "gitconfig_home" gitconfig: "gitconfig_home"
# devfs_rules: "odo_devfs.rules" devfs_rules: "odo_devfs.rules"
# devfs_system_ruleset: "localrules" # devfs_system_ruleset: "localrules"
# jail_conf: "jail.conf" # jail_conf: "jail.conf"
jail_zfs_dataset: zroot/freebsd/release/jails jail_zfs_dataset: zroot/freebsd/release/jails

10
ansible/roles/devfs/files/odo_devfs.rules
View File

@ -1,3 +1,13 @@
[localrules=10] [localrules=10]
add path 'input/*' mode 0660 group video add path 'input/*' mode 0660 group video
add path 'usb/*' mode 0660 group usb add path 'usb/*' mode 0660 group usb
[tajailwg=13]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path 'bpf*' unhide
add path pf unhide
add path pflog unhide
add path pfsynv unhide
add path 'tun*' unhide

6
ansible/roles/firewall/files/odofreebsd_pf.conf
View File

@ -2,7 +2,7 @@ ext_if = "{ igb0 igb1 ix0 ix1 wlan0 }"
jail_net_v4 = "10.193.223.0/24" jail_net_v4 = "10.193.223.0/24"
dhcp = "{ bootpc, bootps }" dhcp = "{ bootpc, bootps }"
allow = "{ nat_uplink0 }" # allow = "{ nat_uplink0 }"
tcp_pass_in = "{ 22 }" tcp_pass_in = "{ 22 }"
udp_pass_in = "{ 53 51820 }" udp_pass_in = "{ 53 51820 }"
@ -27,7 +27,7 @@ pass out on $ext_if
# `service pf reload` but interfaces that we `skip` will not update (I # `service pf reload` but interfaces that we `skip` will not update (I
# forget if its from adding, removing, or both. TODO: test to figure # forget if its from adding, removing, or both. TODO: test to figure
# it out) # it out)
pass quick on $allow # pass quick on $allow
pass on $ext_if proto icmp all pass on $ext_if proto icmp all
pass on $ext_if proto icmp6 all pass on $ext_if proto icmp6 all
@ -36,3 +36,5 @@ pass in on $ext_if proto tcp to any port $tcp_pass_in
pass in on $ext_if proto udp to any port $udp_pass_in pass in on $ext_if proto udp to any port $udp_pass_in
pass quick on $ext_if proto udp from any port $dhcp to any port $dhcp pass quick on $ext_if proto udp from any port $dhcp to any port $dhcp
pass in on nat_uplink0 proto udp from any to any port { 53 51820 }

2
ansible/roles/jail/files/jails/cloak.conf
View File

@ -2,6 +2,8 @@ cloak {
path = "/jail/main/jails/cloak"; path = "/jail/main/jails/cloak";
vnet; vnet;
vnet.interface += "nat_link2"; vnet.interface += "nat_link2";
devfs_ruleset = 13;
mount.devfs; # To expose tun device
exec.start += "/bin/sh /etc/rc"; exec.start += "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown jail"; exec.stop = "/bin/sh /etc/rc.shutdown jail";

2
ansible/roles/jail/meta/main.yaml Normal file
View File

@ -0,0 +1,2 @@
dependencies:
- devfs # To expose /dev entries like tun for wireguard