ansible-nebula

This role installs and deploys a configuration for Nebula

Requirements

Currently you need to generate and deploy certificates before running this (see example)

Supported Nebula Version

Currently this role is tested against version 1.5.0

Role Variables

Variable Name	Type	Purpose	Default	Required
`nebula_version`	String	Version to download	`1.5.0`	Yes
`nebula_force_install`	Boolean	Force overwrite of the existing nebula binary	`false`	No
`ca`	String	Path to CA file	NA	Yes
`cert`	String	Path to Certificate	NA	Yes
`key`	String	Path to Certificate Key	NA	Yes
`blocklist`	List	List of Blocklisted certificate hashes	NA	No
`lighthouses`	String	Static hosts for discovery	"{{ groups['nebula_lighthouses'] }}"	No
`lighthouses_override`	List	List of static hosts for discovery	NA	No
`lighthouse.am_lighthouse`	Boolean	Is this instance a Lighthouse	`false`	Yes
`lighthouse.serve_dns`	Boolean	Should this instance serve DNS	`false`	Yes
`lighthouse.interval`	Integer	Report interval to lighthouses	`60`	No
`listen.host`	String	IP to listen on	`0.0.0.0`	Yes
`listen.port`	Integer	Port to listen on	`4242`	Yes
`listen.batch`	Integer	Sets the max number of packets to pull from the kernel for each syscall	`64`	Yes
`listen.read_buffer`	Integer	Configure socket buffers for the udp side	NA	No
`listen.write_buffer`	Integer	Configure socket buffers for the udp side	NA	No
`punchy`	Boolean	Punchy continues to punch inbound/outbound at a regular interval to avoid expiration of firewall nat mappings	`true`	Yes
`punch_back`	Boolean	punch_back means that a node you are trying to reach will connect back out to you if your hole punching fails	`true`	Yes
`cipher`	String	Cipher allows you to choose between the available ciphers for your network.	NA	No
`local_range`	String	Local range is used to define a hint about the local network range	NA	No
`sshd.enabled`	Boolean	sshd can expose informational and administrative functions via ssh	NA	No
`sshd.listen`	String	IP / Port for admin SSH functions	NA	No
`relay.relays`	List	IP of hosts to use as a relay	NA	No
`relay.am_relay`	String	Indicate whether host should act as a relay	`false`	No
`relay.use_relays`	String	Indicate whether host should attempt to connect through relays	`true`	No
`metrics.prometheus`	Boolean	Enables prometheus server	NA	No
`outbound`	List	Outbound rules for the built in firewall	`See Below`	Yes
`inbound`	List	Inbound rules for the built in firewall	`See Below`	Yes

Firewall rule example

outbound:
  - port: any
    proto: any
    host: any

inbound:
  - port: any
    proto: icmp
    host: any

Dependencies

None

Example Playbook

---
- hosts: all
  remote_user: root
  vars:
    lighthouses:
      - nebula_ip: 10.255.0.1
        external_addr: 123.231.1.2
    lighthouse:
      nodes:
        - 10.255.0.1
  pre_tasks:
    - name: Create Nebula directory
      file:
        path: /etc/nebula
        state: directory
        mode: '0750'
    - name: Deploy Nebula certificates
      copy:
        src: files/{{item}}
        dest: /etc/nebula/{{item}}
        owner: root
        group: root
        mode: '0600'
      with_items:
        - ca.crt
        - host.crt
        - host.key
  roles:
    - ansible-nebula

---
- hosts: all
  remote_user: root
  vars:
    lighthouses:
      - nebula_ip: 10.255.0.1
        external_addr: 123.231.1.2
  roles:
    - ansible-nebula

Optionally you may declare a lighthouse with a non-default external port

---
- hosts: all
  remote_user: root
  vars:
  lighthouse:
    am_lighthouse: yes
  lighthouses:
    - nebula_ip: 10.255.0.1
      external_addr: 123.231.1.2
      external_port: 4242
  roles:
    - ansible-nebula

License

MIT

Author Information

This role is provided as is, Nebula is maintained by Slack and the community

Trozz/ansible-nebula