Ansible wuxuu leeyahay waa la bilaabay, laakiin WireGuard weli wuxuu ku shaqeeyaa qaabkii hore

state: started ma taabto unit hore u shaqeynayay, sidaas darteed wg0.conf dib loo qoray marnaba lama fuliyo. Ku dar handler isbeddel, ka dibna isbarbar dhig qalabka nool iyo faylka.

Socodka playbook wuxuu ku dhammaadaa cagaar, unit WireGuard waa firfircoon, handshake way shaqaysaa, peer-ka cusub weli waxba ma gaaro. Inaad aragto playbook oo sheegaya guul halka serverku ku shaqeynayo qaabkii shalay waa niyad-jab gaar ah, sababtoo ah waxba khalad kuma jira natiijada. Ansible waxay samaysay si sax ah wixii la weyddiistay: waxay hubisay in unit la bilaabay, mana uu hore u bilaabmay. Codsi fayl qaab-dhismeed dib loo qoray waa hawl kale, waxayna dhacdaa kaliya haddii wax u sheegaan adeegga inuu dib u akhriyo.

Eeg waxa socodka labaad run ahaantii soo sheegayo

Ku socodsii playbook laba jeer qaabka la beddelay oo isbarbar dhig soo-koobka. Socodka labaad waa inuu muujiyaa hawsha unit sida ok, ma aha changed, sababtoo ah adeegga hore u shaqeynaya si ula kac ah ayaa loo daayaa. Taasi waa idempotence si sax ah u shaqeynaya, waana sababta faylka cusub marnaba uusan gaarin kernel.

Ku dar socod hubin oo leh natiijo diff si aad u aragto hawlo noocee ah ay wax taabtaan.

ansible-playbook -i inventory site.yml --check --diff
systemctl show wg-quick@wg0 -p ActiveEnterTimestamp -p NRestarts
stat -c '%y %n' /etc/wireguard/wg0.conf

Saddexda calaamadood ee waqtiga ayaa sheegaya sheekada ka hor inta aadan akhrin hal sadar log. Haddii faylka qaabka uu ka cusub yahay waqtigii unit uu firfircoon noqday, interface-ka shaqeynaya waxaa laga dhisay fayl hore, calaamad kasta oo xigtaana halkaas ayay ka timaaddaa.

Tani maaha cillad Ansible. Isla dabeecadda waxay ka muuqataa qalab kasta oo maareynta qaab-dhismeedka oo kala sooca «hubi inuu shaqeynayo» iyo «hubi inuu tan shaqeynayo». Farqiga wuxuu u muuqdaa mid xad-dhaaf ah ilaa uu kaa qaato galab.

La bilaabay waa xaalad, maaha dib u rarid

state: started wuxuu sheegaya shuruud ku saabsan unit-ka. Ma ballanqaado in adeeggu dib u akhriyo gelidiisa, mana ogaan karo in fayl uusan marnaba furin uu isbeddelay. Marka la dhigayo wg-quick, gelidda waxaa ka mid ah qaabka interface-ka, cinwaannada, waddooyinka, diiwaannada DNS iyo hook kasta oo post-up ah.

Sidaas darteed fayl la cusboonaysiiyay wuxuu yeelan karaa peer cusub, cinwaan kale ama tilmaan waddo oo isbeddelay halka interface-ka nool uu weli u adeegayo kooxdii hore. Handshake weli way guulaysataa sababtoo ah furayaasha iyo bartaheeda dambe ee la raray weli waa ansax. Taasi waa tan ka dhigaysa cilladda mid adag in la arko, iyo sababta ay dadku saacad u eryanayaan DNS ka hor inta aysan hubin calaamad waqti.

Laba ikhtiyaar oo kale oo module-ka ayaa inta badan loo arkaa xal. daemon_reload wuxuu systemd ka dhigaa inuu dib u akhriyo faylalka unit, taas oo aan khuseyn faylka qaabka WireGuard. state: reloaded wuxuu unit-ka weyddiinayaa inuu fuliyo ficilkiisa dib u rarid, iyo inuu sameeyo wixii aad u baahnayd waxay si buuxda ugu xiran tahay unit-ka. Midkoodna ma beddelayo ogaanista gelidda noocee ah ee habsocodka shaqeynaya uu run ahaantii akhriyay.

Ku rakib faylka, ka dibna ogeysii handler

Qaabka ilaaliya idempotence oo weli fuliya isbeddellada waa kan caadiga ah: hawsha qorta faylka waxay ogeysiisaa handler, handler-kuna wuxuu shaqeeyaa kaliya marka faylku run ahaantii isbeddelo. Socodka labaad ee aan wax ka beddelin waxba ma sameeyo, waana taas waxa aad rabto.

- name: write the interface configuration
  ansible.builtin.template:
    src: wg0.conf.j2
    dest: /etc/wireguard/wg0.conf
    owner: root
    mode: "0600"
  notify: apply wg0

- name: ensure the interface unit is enabled
  ansible.builtin.systemd_service:
    name: wg-quick@wg0
    enabled: true
    state: started

- name: apply wg0
  listen: apply wg0
  ansible.builtin.systemd_service:
    name: wg-quick@wg0
    state: restarted

Handler-yadu waxay shaqeeyaan dhammaadka play-ga, ka dib hawlihii ogeysiiyay, sidaas darteed hawl dambe oo isla play-ga dhexdiisa ah waxay weli arki kartaa interface-kii hore. Haddii nidaamku muhiim yahay, si cad u faaruqi handler-yada meta: flush_handlers ka hor hawsha ku xiran qaabka cusub.

Isticmaal restart halkii reload, haddii aadan hubin ficilka dib u raridda unit-ka. Unit-ka wg-quick ee upstream wuxuu taageeraa mid, wuxuuna isku-dhajiyaa qaabka WireGuard, laakiin dib uma fuliyo dejinta cinwaannada, waddooyinka, DNS ama hook-yada. Sidaas darteed reload ka dib marka lagu daro tilmaan waddo wuxuu u muuqdaa mid guulaystay waxbana ma beddelo.

Isbarbar dhig qalabka nool iyo faylka

Hubinta xidha kooxdan khaladaadka waa isbarbardhigga waxa kernel-ku hayo iyo waxa faylku sheegayo. Laba amar waxay soo saaraan natiijo la isbarbardhigi karo, farqiguna waa weecashada.

sudo wg showconf wg0
sudo wg-quick strip wg0
sudo diff <(sudo wg showconf wg0) <(sudo wg-quick strip wg0)

wg showconf wuxuu daabacaa qalabka nool, oo ay ku jirto furaha gaarka ah, sidaas darteed natiijadaas u qaado sir oo ha ku dhejin tikit. wg-quick strip wuxuu daabacaa faylka isagoo ka saaray furayaasha gaarka u ah wg-quick, sababtaas darteed labaduba waa la isbarbardhigi karaa.

Farqi ku jira liiska peer macneheedu waa faylka marnaba lama fulin. Farqi ku eg furayaasha ama bartaheeda dambe ee aad filaysay inay isbeddelaan macneheedu waa wax baa qayb ahaan fuliyay. Farqi la'aan macneheedu waa qaabku waa mid hadda socda oo cilladdu meel kale tahay, taas oo yar tahay natiijo faa'iido leh.

Bixi kharashka dib u bilaabista si miyir leh

Dib u bilaabista interface-ka waxay jabisaa tunnel-ka, haddii tunnel-kaasi qaado fadhi maamulkaaga, dib u bilaabistu waxay dhamaysaa fadhigii codsaday. Handler-ka dhig ka dambeeya daaqad isbeddel, ama playbook ka socodsii waddo maamul oo aan ku xirnayn dib u bilaabista interface-ka.

Kharashkaas ayaa dadka u jiitay reload. Waa dareen macquul ah, wuxuuna noqdaa mid sax ah markaad ogaato isbeddellada reload uu run ahaantii fuliyo. Unit-ka wg-quick ee upstream, isbeddellada peer iyo fure wuu ku filan yahay; cinwaannada, waddooyinka iyo hook-yada ma filna. Hal mar in tan la caddeeyo waa ka jaban tahay in la ogaado inta daaqadda isbeddelka.

Dukumeentiga module-ka systemd_service wuxuu sharraxayaa farqiga u dhexeeya started, restarted iyo reloaded, waana mudan in hal mar la akhriyo halkii laga malayn lahaa soo-koob cagaar. Wax kasta oo ku jira hagegan waxay ka yimaadaan isla farqigaas.

Maqaallo la xiriira