Ansible ya ce an fara, amma WireGuard yana aiki da tsohon tsarin

Tafiyar playbook tana ƙarewa da kore, rukunin WireGuard yana aiki, handshake yana aiki, amma sabon peer ɗin ba ya isa ko'ina. Kallon playbook yana bayar da rahoton nasara yayin da uwar garken ke aiki da tsarin jiya wani baƙin ciki ne na musamman, domin babu abin da ba daidai ba a cikin fitarwar. Ansible ya yi daidai abin da aka tambaye shi: ya tabbatar an fara rukunin, kuma an riga an fara shi. Amfani da fayil ɗin tsari da aka sake rubutawa wani aiki ne na daban, kuma yana faruwa ne kawai idan wani ya ce wa sabis ɗin ya sake karanta shi.

Duba abin da tafiya ta biyu ke bayarwa da gaske

Gudanar da playbook sau biyu tare da canza tsarin a wurin sannan ka kwatanta taƙaitawar. Tafiya ta biyu ya kamata ta nuna aikin rukunin a matsayin ok maimakon changed, domin sabis ɗin da ke aiki an bar shi shi kaɗai bisa ƙira. Wannan ita ce idempotence da ke aiki daidai, kuma ita ce dalilin da ya sa sabon fayil ɗin ba ya taɓa isa kernel.

Ƙara tafiyar dubawa tare da fitarwar diff don ganin waɗɗan ayyuka za su taɓa wani abu kwata-kwata.

ansible-playbook -i inventory site.yml --check --diff
systemctl show wg-quick@wg0 -p ActiveEnterTimestamp -p NRestarts
stat -c '%y %n' /etc/wireguard/wg0.conf

Bayanan lokaci uku suna ba da labarin kafin ka karanta layin log ɗaya. Idan fayil ɗin tsarin ya fi sabo fiye da lokacin da rukunin ya zama mai aiki, an gina hanyar da ke aiki daga tsohon fayil, kuma kowace alama ta gaba ta biyo daga haka.

Wannan ba lahani ba ne na Ansible. Irin wannan ɗabi'a tana bayyana a kowane kayan aikin sarrafa tsari wanda ya raba «tabbatar yana aiki» da «tabbatar yana aiki da wannan». Bambancin yana kama da tsantsa har sai ya ci maka rana ɗaya.

Farawa yanayi ne, ba sake lodi ba

state: started yana tabbatar da sharadi game da rukunin. Ba ya yi alkawarin cewa sabis ɗin zai sake karanta abubuwan da ke shiga, kuma ba zai iya sanin cewa fayil ɗin da bai taɓa buɗewa ba ya canza. A tura wg-quick abubuwan da ke shiga sun haɗa da tsarin hanyar sadarwa, adireshi, hanyoyi, bayanan DNS da duk wani post-up hook.

Shi ya sa fayil ɗin da aka sabunta zai iya ƙunsar sabon peer, wani adireshi ko canza umarnin hanya yayin da hanyar da ke aiki ke ci gaba da ba da tsohon saitin. Handshake ɗin har yanzu yana cin nasara domin maɓallan da aka loda da wuraren ƙarshe har yanzu suna da inganci. Wannan ne ainihin abin da ke sa gazawar ta yi wuya a gani, kuma dalilin da ya sa mutane ke bin DNS awa ɗaya kafin su duba tambarin lokaci.

Wasu zaɓuɓɓukan module guda biyu ana ɗaukarsu a matsayin magani. daemon_reload yana sa systemd ya sake karanta fayilolin rukuni, wanda ba shi da alaƙa da fayil ɗin tsarin WireGuard. state: reloaded yana roƙon rukunin ya gudanar da aikin sake lodawa, kuma ko hakan yana yin abin da kake buƙata ya dogara gaba ɗaya da rukunin. Babu ɗayansu da zai maye gurbin sanin waɗɗe abubuwan da ke shiga aikin da ke gudana ya karanta da gaske.

Sanya fayil ɗin, sannan ka sanar da handler

Tsarin da ke kiyaye idempotence kuma yana amfani da canje-canje shine na yau da kullum: aikin da ke rubuta fayil ɗin yana sanar da handler, kuma handler ɗin yana gudana ne kawai lokacin da fayil ɗin ya canza da gaske. Tafiya ta biyu ba tare da gyare-gyare ba ta yin komai, kuma shine abin da kake so.

- name: write the interface configuration
  ansible.builtin.template:
    src: wg0.conf.j2
    dest: /etc/wireguard/wg0.conf
    owner: root
    mode: "0600"
  notify: apply wg0

- name: ensure the interface unit is enabled
  ansible.builtin.systemd_service:
    name: wg-quick@wg0
    enabled: true
    state: started

- name: apply wg0
  listen: apply wg0
  ansible.builtin.systemd_service:
    name: wg-quick@wg0
    state: restarted

Handler ɗin suna gudana a ƙarshen wasan, bayan ayyukan da suka sanar da su, don haka wani aiki daga baya a cikin wannan wasan zai iya ganin tsohuwar hanya. Idan tsari yana da mahimmanci, share handler ɗin a fili da meta: flush_handlers kafin aikin da ya dogara da sabon tsarin.

Yi amfani da restart maimakon reload sai dai idan ka tabbatar da aikin sake lodawa na rukunin. Rukunin wg-quick na asali yana goyan bayan ɗaya, kuma yana daidaita tsarin WireGuard, amma ba ya sake gudanar da saitin adireshi, hanya, DNS ko hooks. Saboda haka reload bayan ƙara umarnin hanya yana kama da ya yi nasara kuma ba ya canza komai.

Kwatanta na'urar da ke aiki da fayil ɗin

Duba da ke rufe wannan nau'in kuskure shine kwatance tsakanin abin da kernel ke riƙe da abin da fayil ɗin ya ce. Umarni biyu suna bayar da fitarwa da za a kwatanta, kuma bambancin shine karkata.

sudo wg showconf wg0
sudo wg-quick strip wg0
sudo diff <(sudo wg showconf wg0) <(sudo wg-quick strip wg0)

wg showconf yana buga na'urar da ke aiki, har da maɓallin sirri, don haka ɗauki wannan fitarwar a matsayin sirri kuma kada ka liƙa a tikiti. wg-quick strip yana buga fayil ɗin ba tare da maɓallan wg-quick ba, kuma shi ya sa za a iya kwatanta su biyu.

Bambanci a jerin peer yana nufin ba a taɓa amfani da fayil ɗin ba. Bambanci kawai a maɓallai ko wuraren ƙarshe da ka yi tsammanin za su canza yana nufin wani abu ya yi amfani da shi a wani ɓangare. Babu bambanci yana nufin tsarin na yanzu ne kuma laifin yana wani wuri, wanda shi kansa sakamako ne mai amfani.

Biya kuɗin sake farawa da gangan

Sake farawa da hanyar sadarwa yana zubar da tunnel, kuma idan wannan tunnel ɗin yana ɗauke da zamanka na gudanarwa, sake farawa yana ƙare zaman da ya nema. Sanya handler a bayan taga canji, ko gudanar da playbook daga hanyar gudanarwa wadda ba ta dogara da sake farawa ba.

Kuɗin shine dalilin da ya sa mutane ke neman reload. Wannan dabi'a ce mai ma'ana, kuma tana zama daidai da zarar ka san waɗɗe canje-canje reload ke amfani da su. Ga canje-canjen peer da maɓalli a rukunin wg-quick na asali ya isa; ga adireshi, hanya da hooks bai isa ba. Daidaita wannan sau ɗaya ya fi arha fiye da gano shi a lokacin taga canji.

Takardun module systemd_service sun bayyana bambanci tsakanin started, restarted da reloaded, kuma ya cancanci karantawa sau ɗaya maimakon hasashe daga taƙaitawa mai kore. Komai a cikin wannan jagorar ya biyo daga wannan bambanci ɗaya.