I-Ansible ithi isiqalile, kodwa i-WireGuard isasebenzisa ikhonsifigureshini endala

I-state: started ayithinti i-unit esivele isebenza, ngakho i-wg0.conf ebhalwe kabusha ayilokothi isetshenziswe. Engeza i-handler yoshintsho, bese uqhathanisa idivayisi ekhona nefayela.

Ukuqhubeka kwe-playbook kuphela kuluhlaza, i-unit ye-WireGuard iyasebenza, i-handshake iyasebenza, futhi i-peer entsha ayifinyeleli lutho. Ukubona i-playbook ibika impumelelo ngesikhathi iseva isebenzisa ikhonsifigureshini yayizolo kuyakhathaza ngokukhethekile, ngoba akukho okungalungile ekuphumeni. I-Ansible yenza ngqo okwakuceliwe: yaqinisekisa ukuthi i-unit iqalisiwe, futhi yayivele iqaliwe. Ukusebenzisa ifayela lekhosthifigureshini elibhalwe kabusha kuwumsebenzi ohlukile, futhi kwenzeka kuphela uma okuthile kutshela insizakalo ukuthi iyifunde futhi.

Bheka ukuthi umjikelezo wesibili ubika ini ngempela

Qhuba i-playbook kabili ngekhonsifigureshini eshintshiwe bese uqhathanisa isifinyezo. Umjikelezo wesibili kufanele ukhombise umsebenzi we-unit njengo-ok, hhayi i-changed, ngoba insizakalo esivele isebenza iyekwa ngokuthula ngokomklamo. Lokho yi-idempotence esebenza ngendlela efanele, futhi yiso isizathu sokuthi ifayela elisha alifinyeleli i-kernel.

Engeza umjikelezo wokuhlola onokuphuma kwe-diff ukuze ubone ukuthi imiphi imisebenzi eyothinta okuthile.

ansible-playbook -i inventory site.yml --check --diff
systemctl show wg-quick@wg0 -p ActiveEnterTimestamp -p NRestarts
stat -c '%y %n' /etc/wireguard/wg0.conf

Izimpawu ezintathu zesikhathi zixoxa indaba ngaphambi kokuthi ufunde ngisho umugqa owodwa we-log. Uma ifayela lekhonsifigureshini lisha kunomzuzu i-unit eyaba khona ngawo, isixhumi esisebenzayo sakhiwe ngefayela elidala, futhi zonke izimpawu ezilandelayo zivela lapho.

Lokhu akulona iphutha le-Ansible. Ukuziphatha okufanayo kuvela kunoma yiliphi ithuluzi lokuphatha ikhosthifigureshini elihlukanisa «qinisekisa ukuthi kuyasebenza» kokuthi «qinisekisa ukuthi kusebenzisa lokhu». Umehluko ubonakala uncane kwaze kube yilapho kukubiza intambama.

Ukuqalisa kuyisimo, hhayi ukulayisha kabusha

state: started isho umbandela mayelana ne-unit. Akuthembisi ukuthi insizakalo izofunda kabusha okokufaka kwayo, futhi ayikwazi ukwazi ukuthi ifayela engakaze ilivule lishintshile. Ekusetshenzisweni kwe-wg-quick okokufaka kuhlanganisa ikhosthifigureshini yesixhumi, amakheli, imizila, amarekhodi e-DNS nanoma yiziphi izihloko ze-post-up.

Ngakho ifayela elibuyekeziwe lingaqukatha i-peer entsha, ikheli elihlukile noma umyalo womzila oshintshiwe kuyilapho isixhumi esisebenzayo siqhubeka nokuhlinzeka isethi endala. I-handshake isaphumelela ngoba okhiye namaphoyinti okugcina alayishiwe kusasebenza. Yikho lokho okwenza ukwehluleka kube nzima ukukubona, futhi kungakho abantu bejaha i-DNS ihora ngaphambi kokuhlola uphawu lwesikhathi.

Ezinye izinketho ezimbili zemojuli zivame ukuthathwa njengesixazululo. daemon_reload yenza i-systemd ifunde kabusha amafayela e-unit, okungahlobene nefayela lekhonsifigureshini ye-WireGuard. state: reloaded icela i-unit ukuthi yenze isenzo sayo sokulayisha kabusha, futhi ukuthi ikwenza yini okudingayo kuncike ngokuphelele ku-unit. Akukho kuzo okungena esikhundleni sokwazi ukuthi inqubo esebenzayo ifunde okokufaka okukuphi ngempela.

Faka ifayela, bese wazisa i-handler

Iphethini egcina i-idempotence futhi isebenzise izinguquko ijwayelekile: umsebenzi obhala ifayela wazisa i-handler, futhi i-handler isebenza kuphela uma ifayela lishintshile ngempela. Umjikelezo wesibili ngaphandle kokuhlela awenzi lutho, futhi yilokho okukufunayo.

- name: write the interface configuration
  ansible.builtin.template:
    src: wg0.conf.j2
    dest: /etc/wireguard/wg0.conf
    owner: root
    mode: "0600"
  notify: apply wg0

- name: ensure the interface unit is enabled
  ansible.builtin.systemd_service:
    name: wg-quick@wg0
    enabled: true
    state: started

- name: apply wg0
  listen: apply wg0
  ansible.builtin.systemd_service:
    name: wg-quick@wg0
    state: restarted

Ama-handler asebenza ekupheleni kwe-play, ngemuva kwemisebenzi eyawazisile, ngakho umsebenzi ovela kamuva kuleyo play usengabona isixhumi esidala. Uma ukulandelana kubalulekile, khipha ama-handler ngokucacile nge-meta: flush_handlers ngaphambi komsebenzi oncike ekhonsifigureshini entsha.

Sebenzisa i-restart esikhundleni se-reload ngaphandle uma uqinisekisile isenzo sokulayisha kabusha se-unit. I-unit ye-wg-quick yangenhla iyayisekela futhi ivumelanisa ikhosthifigureshini ye-WireGuard, kodwa ayiphindeli iqhubise ukusethwa kwamakheli, imizila, i-DNS noma izihloko. Ngakho i-reload ngemuva kokwengeza umyalo womzila ibonakala iphumelela futhi ayishintshi lutho.

Qhathanisa idivayisi ekhona nefayela

Ukuhlola okuvala leli qembu lamaphutha ukuqhathanisa okuphethwe yi-kernel nalokho okushiwo yifayela. Imiyalo emibili ikhiqiza umphumela oqhathanisekayo, futhi umehluko uyiziphambeko.

sudo wg showconf wg0
sudo wg-quick strip wg0
sudo diff <(sudo wg showconf wg0) <(sudo wg-quick strip wg0)

wg showconf iprinta idivayisi ekhona, kuhlanganise nokhiye wangasese, ngakho thatha lowo mphumela njengemfihlo futhi ungawunamathiseli ethikithini. wg-quick strip iprinta ifayela ngaphandle kokhiye abakhethekile be-wg-quick, futhi yikho kokubili okungaqhathaniseka.

Umehluko ohlwini lwama-peer usho ukuthi ifayela alizange lisetshenziswe. Umehluko okhulunywe kuphela kokhiye noma emaphoyintini okugcina obewulindele ukuthi ashintshe usho ukuthi okuthile kulisebenzisile ingxenye. Ukungabikho komehluko kusho ukuthi ikhosthifigureshini yamanje futhi iphutha likwenye indawo, lokho ngokwako kuwumphumela owusizo.

Khokha izindleko zokuqalisa kabusha ngamabomu

Ukuqalisa kabusha isixhumi kuphula ithuneli, futhi uma leyo thuneli ithwala isikhathi sakho sokuphatha, ukuqalisa kabusha kuqeda isikhathi esikucelile. Beka i-handler ngemuva kwewindi loshintsho, noma qhuba i-playbook endleleni yokuphatha enganciki ekuqalisweni kabusha kwesixhumi.

Izindleko yiso isizathu esenza abantu baphendukele ku-reload. Ingqondo efanele, futhi iba nguqobo uma wazi ukuthi i-reload isebenzisa ziphi izinguquko ngempela. Ku-unit ye-wg-quick yangenhla kuyanele ukushintsha kwama-peer nokhiye; ekukhethweni kwamakheli, emizileni nasezihlokweni akwanele. Ukukucacisa kanye kushibhile kunokukuthola ngesikhathi sewindi loshintsho.

Idokhumenti yemojuli ye-systemd_service ichaza umehluko phakathi kwe-started, restarted ne-reloaded, futhi kufanele ifundwe kanye esikhundleni sokuqagela kusifinyezo esiluhlaza. Konke okukule mhlahlandlela kuvela kulowo mehluko owodwa.

Izihloko ezihlobene