Initial Commit

build_docker.yml

@@ -0,0 +1,65 @@
+---
+- hosts: docker_hosts
+  become: true
+  tasks:
+    - name: Install required system packages
+      apt:
+        name: "{{item}}"
+        state: present
+        update_cache: yes
+      loop:
+        - apt-transport-https
+        - ca-certificates
+        - curl
+        - gnupg-agent
+        - software-properties-common
+
+    - name: Add Docker GPG apt Key
+      apt_key:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        state: present
+
+    - name: Add Docker Repository
+      apt_repository:
+        repo: deb https://download.docker.com/linux/ubuntu focal stable
+        state: present
+
+    - name: installa docker
+      apt:
+        name: "{{item}}"
+        state: latest
+        update_cache: yes
+      loop:
+        - docker-ce 
+        - docker-ce-cli 
+        - containerd.io
+        - docker-compose-plugin
+
+    - name: Creates directory
+      file:
+        path: /etc/systemd/system/docker.service.d
+        state: directory
+
+#    - name: copy config files
+    - name: copying files
+      copy:
+        src: nebula-v2/remote-api.conf
+        dest: /etc/systemd/system/docker.service.d/remote-api.conf
+
+    - name: Allow TCP 4243
+      ansible.builtin.iptables:
+        action: insert 
+        chain: INPUT
+        protocol:  tcp
+        match: tcp
+        destination_port: 4243
+        jump: ACCEPT
+
+
+
+    - name: assicurati che docker sia attivo
+      service:
+        name: docker
+        state: started
+        enabled: yes
+    

install-nebula-lighthouses.yml

@@ -0,0 +1,21 @@
+---
+- hosts: lighthouses
+  become: true
+  tasks:
+    - name: Allow UDP 4242
+      ansible.builtin.iptables:
+        action: insert 
+        chain: INPUT
+        protocol:  udp
+        match: udp
+        destination_port: 4242
+        jump: ACCEPT
+
+    - name: Allow TCP 4242
+      ansible.builtin.iptables:
+        action: insert 
+        chain: INPUT
+        protocol:  tcp
+        match: tcp
+        destination_port: 4242
+        jump: ACCEPT

install-nebula.yml

@@ -0,0 +1,66 @@
+---
+- hosts: docker_hosts
+  become: true
+  tasks:
+    - name: copy binanries
+      ansible.builtin.copy:
+        src: nebula-linux-arm64/nebula
+        dest: /usr/local/bin/nebula
+        mode: '0755'
+    - name: Creates directory
+      file:
+        path: /etc/nebula
+        state: directory
+
+#    - name: copy config files
+    - name: copying files
+      copy:
+        src: nebula-v2/config.yml.node
+        dest: /etc/nebula/config.yml
+
+    - name: replace line
+      lineinfile: 
+        path: /etc/nebula/config.yml 
+        regexp: '^(.*)cert: /etc(.*)$' 
+        line: '  cert: /etc/nebula/{{ ansible_hostname }}.crt'
+        backrefs: yes
+
+    - name: replace line
+      lineinfile: 
+        path: /etc/nebula/config.yml 
+        regexp: '^(.*)key: /etc(.*)$' 
+        line: '  key: /etc/nebula/{{ ansible_hostname }}.key'
+        backrefs: yes
+
+#    - name: copy certs and keys
+    - name: copying files
+      copy:
+        src: nebula-v2/{{ ansible_hostname }}.crt
+        dest: /etc/nebula/{{ ansible_hostname }}.crt
+
+    - name: copying files
+      copy:
+        src: nebula-v2/{{ ansible_hostname }}.key
+        dest: /etc/nebula/{{ ansible_hostname }}.key
+
+    - name: copying files
+      copy:
+        src: nebula-v2/ca.crt
+        dest: /etc/nebula/ca.crt
+
+
+#    - name: create systemd service 
+    - name: install  nebula systemd startup script
+      copy: 
+        src: nebula-v2/nebula.service
+        dest: /etc/systemd/system/nebula.service
+        owner: root 
+        group: root 
+        mode: 0644
+
+#    - name: enable nebuka service
+    - name: install  nebula systemd startup script
+      service:
+        name: nebula
+        state: started
+        enabled: yes

nebula-v2/aria.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmIKBGFyaWESCo2s2OAKgP7//w8oybfljAYw9ruVowc6IHrdPsf7LhmiV8UZ9PNO
+L1Unvi+ncxurfn/KoQ5VNOx5SiA1LgXGkvoNK7zt/RJcNjJg3us9Z0y77qtMHgtm
+Ee6EjBJAH2nrnXdVUVjqMORuy1Gs9wgj7xZXb39F2/zNPz1ej/Z0s5/SuqU8Sz6J
+iQ6bStqAu02uD1Ula9Wig0Grg7gFCg==
+-----END NEBULA CERTIFICATE-----

nebula-v2/aria.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+c7NtutRj8E2VTp0ya+U7aeak5Erp4jP1wmyVwCT9e5g=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/ca.crt

@@ -0,0 +1,5 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CkIKEEJhcnRlY2ggTmV0d29ya3Mo97XljAYw97uVowc6IK1wm+OiZ30nM/GciANE
+aylGxKRWDHesNnYtap7o7GYYQAESQFNj7AVMUYbC40RjccW8Q8fcLE6HgEJNV3OZ
+bGpTozYq/KK/I41DQkeEvT6yVBIblTRI/9dc3/5yrsldIr4YRQ0=
+-----END NEBULA CERTIFICATE-----

nebula-v2/ca.key

@@ -0,0 +1,4 @@
+-----BEGIN NEBULA ED25519 PRIVATE KEY-----
+PIBqsqkezwz7cWMpAtqPMrsGBi/RbAbFnv5lZbJKb82tcJvjomd9JzPxnIgDRGsp
+RsSkVgx3rDZ2LWqe6OxmGA==
+-----END NEBULA ED25519 PRIVATE KEY-----

nebula-v2/clouddock1.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmcKCWFybWNsb3VkMRIK+azY4AqA/v//DyiPueWMBjD2u5WjBzogcLhk5pKkeB/p
+dnlVHe9zvG2++I++8C+7Cjepdyh/n11KIDUuBcaS+g0rvO39Elw2MmDe6z1nTLvu
+q0weC2YR7oSMEkAAN7q4lHtGCqF2G/O5A8jpXMKbq83uD5qaqRLMJLdhXYPbkQ/s
+34MBgnYO2cAEHsi3i4lwKBgcKTWfK8ylH3oC
+-----END NEBULA CERTIFICATE-----

nebula-v2/clouddock1.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+YZSTfYIhxCVr2cX3Yn4mqCYIsVgP8D6n4fU3pj/ZVfs=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/clouddock2.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmcKCWFybWNsb3VkMhIK+qzY4AqA/v//DyiYueWMBjD2u5WjBzogEo4ETTS15J1/
+s+rMFOHYouQLMDn2O4k97FuyLXAksQFKIDUuBcaS+g0rvO39Elw2MmDe6z1nTLvu
+q0weC2YR7oSMEkCObgsZjRF2W1W5QFxzcSzuhueZnqshLn0eXwNSYQ9L6/23nPV4
+8ZjzloHzzQQsHinD1bAmzKDPuv/bE1tqzy4G
+-----END NEBULA CERTIFICATE-----

nebula-v2/clouddock2.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+a7XYnUR8hUx4+V0RzNDS5H4rVswjcSQJKMiwJPJABvo=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/config.yml.node

@@ -0,0 +1,96 @@
+# This is Ars Technica's sample Nebula config file for non-lighthouse nodes.
+#
+
+pki:
+  # every node needs a copy of the CA certificate,
+  # and its own certificate and key, ONLY.
+  #
+  ca: /etc/nebula/ca.crt
+  cert: /etc/nebula/hawa.crt
+  key: /etc/nebula/hawa.key
+
+static_host_map:
+ # how to find one or more lighthouse nodes
+ # you do NOT need every node to be listed here!
+ #
+ # format "Nebula IP": ["public IP or hostname:port"]
+ # 
+ "172.22.22.1": ["light1.bartrip.me.uk:4242"]
+ "172.22.22.2": ["light2.bartrip.me.uk:4242"]
+
+lighthouse:
+  interval: 60
+
+  # if you're a lighthouse, say you're a lighthouse
+  #
+  am_lighthouse: false
+
+  hosts:
+    # If you're a lighthouse, this section should be EMPTY
+    # or commented out. If you're NOT a lighthouse, list 
+    # lighthouse nodes here, one per line, in the following
+    # format:
+    #
+    - "172.22.22.1"
+    - "172.22.22.2"
+
+listen:
+  # 0.0.0.0 means "all interfaces," which is probably what you want
+  #
+  host: 0.0.0.0
+  port: 4242
+
+# "punchy" basically means "send frequent keepalive packets"
+# so that your router won't expire and close your NAT tunnels.
+#
+punchy: true
+
+# "punch_back" allows the other node to try punching out to you,
+# if you're having trouble punching out to it. Useful for stubborn
+# networks with symmetric NAT, etc.
+#
+punch_back: true
+
+tun:
+  # sensible defaults. don't monkey with these unless
+  # you're CERTAIN you know what you're doing.
+  #
+  dev: nebula1
+  drop_local_broadcast: false
+  drop_multicast: false
+  tx_queue: 500
+  mtu: 1300
+  routes:
+
+logging:
+  level: info
+  format: text
+
+# you NEED this firewall section.
+#
+# Nebula has its own firewall in addition to anything
+# your system has in place, and it's all default deny.
+#
+# So if you don't specify some rules here, you'll drop
+# all traffic, and curse and wonder why you can't ping
+# one node from another.
+# 
+firewall:
+  conntrack:
+    tcp_timeout: 120h
+    udp_timeout: 3m
+    default_timeout: 10m
+    max_connections: 100000
+
+# since everything is default deny, all rules you
+# actually SPECIFY here are allow rules.
+#
+  outbound:
+    - port: any
+      proto: any
+      host: any
+
+  inbound:
+    - port: any
+      proto: any
+      host: any

nebula-v2/daria.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmMKBWRhcmlhEgqMrNjgCoD+//8PKL235YwGMPa7laMHOiDZYUiydiJdj3MQoYqx
+wFk5LJZCkD9DcJdAC7C1Uu9lSEogNS4FxpL6DSu87f0SXDYyYN7rPWdMu+6rTB4L
+ZhHuhIwSQK4H5GLsAQPFqhy52afQm5xWfhCfM6rM1imWzDYTTiiz0VEDKHwvtsyM
+x1DQSAddd7BGESVdP+cVrlRm07gXiQc=
+-----END NEBULA CERTIFICATE-----

nebula-v2/daria.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+GgbJomqaCYIkjkPJroLN11SdR4Fl/Z4yzMsJam+QD1U=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/diana.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmMKBWRpYW5hEgqLrNjgCoD+//8PKKq35YwGMPa7laMHOiDSUMYiWGBNXRQaEw38
+FsNLXyolH8AkbZsBkmktkdfGVkogNS4FxpL6DSu87f0SXDYyYN7rPWdMu+6rTB4L
+ZhHuhIwSQF5+4y/dfog66AHzeFFDhI4+wopn/kspMhSUqh+7qBE/DZo5n5ntefaz
+iH+D4zsbacxXfim7ckRyoH1auWqIaQQ=
+-----END NEBULA CERTIFICATE-----

nebula-v2/diana.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+ll7sa0JmwHdK+4+XE9rLtlSr5JtKzvAq2fffksyWdd8=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/glenda.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmQKBmdsZW5kYRIK5qzY4AqA/v//DyiGuOWMBjD2u5WjBzogPMWW/Zqw464E4zyd
+swVoSsQRZ1yDPgcm1mGliBK+5DRKIDUuBcaS+g0rvO39Elw2MmDe6z1nTLvuq0we
+C2YR7oSMEkAeyFto1bdryAYwbFzD2ZML7/47e7m28iUGPEuTRz/dN7WOtu5YFyqi
+kw3gbgXlVtWos+YRetR7cnqtn4y0EpYC
+-----END NEBULA CERTIFICATE-----

nebula-v2/glenda.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+7Tf+QgBiqpnZdVM/hYWLswq4xAMVwbmtSrEOxPh8KvU=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/hadeya.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmQKBmhhZGV5YRIK5KzY4AqA/v//Dyjwt+WMBjD2u5WjBzogLDBuEgjSGTX5HAQS
+m6q03WPQ9pqd2/hX7sRZDXzICB5KIDUuBcaS+g0rvO39Elw2MmDe6z1nTLvuq0we
+C2YR7oSMEkA4HEvz5+R6IVG/AO1GtWsyNk6Y8eGCuTn6WWsg/sq1WIRHn/MEi6P6
+tKYjzYdj955WEKNmVF26L9trTZugPqcN
+-----END NEBULA CERTIFICATE-----

nebula-v2/hadeya.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+JbuEGfU/UHrR/cGTIEHgfw8UzAKozVeOzucfk2V+aDg=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/hawa.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmIKBGhhd2ESCoqs2OAKgP7//w8oorfljAYw9ruVowc6IHpFQoVO0MX+g7yM9B74
+FBCUQWYa3bzpUXwoRmJvX8l1SiA1LgXGkvoNK7zt/RJcNjJg3us9Z0y77qtMHgtm
+Ee6EjBJAWfcy6muWk9U8o0I28I1yTJlibdMyut0pnxFKPXXOh0tXBccVkYtZ68EN
+nhnxQbt4enuFfbgXlDg7SWHuuzCNBw==
+-----END NEBULA CERTIFICATE-----

nebula-v2/hawa.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+pzFXm6qGKLxJw7LOJm3rTJSeMQ7p31GubyOT9ybQQiQ=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/lighthouse1.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmkKC2xpZ2h0aG91c2UxEgqBrNjgCoD+//8PKKi25YwGMPa7laMHOiAeATCDnN7+
+ZuyDOSg7LU6KXxtPOThMZ0m5nBfR9+ojeEogNS4FxpL6DSu87f0SXDYyYN7rPWdM
+u+6rTB4LZhHuhIwSQAHLyZ1mi9wFbQxCN/2t4UTh30PjeDSMyicwte3W6lzECKzz
+q/jWq5N79W7csPOl6cv4+qZMbhTlsFf0D0p2YAc=
+-----END NEBULA CERTIFICATE-----

nebula-v2/lighthouse1.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+5LORxeoqRffvxmqm7+YKP7UqkyRT1i8mClB0lqS1Q9s=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/lighthouse2.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmkKC2xpZ2h0aG91c2UyEgqCrNjgCoD+//8PKLK25YwGMPa7laMHOiBaHwfzKQ8+
+BPJgcSeVyhR8nRsm0XSGKnLcXncDZYbSIUogNS4FxpL6DSu87f0SXDYyYN7rPWdM
+u+6rTB4LZhHuhIwSQODSI8GGM/aCL8BiCWZcT62U5hDbQEP6VMuhB9mkxIVKwyDN
+niZvQA+AgcysDoykvv4M36UhYSu6BswL/A468gM=
+-----END NEBULA CERTIFICATE-----

nebula-v2/lighthouse2.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+HViWuomFSVwVfl6Xua+vPsw3hIFAkQ2RmKgm79ZimeQ=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/nebula.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Run the Nebula Overlay Network Service
+Wants=basic.target
+After=basic.target network.target
+Before=sshd.service
+
+[Service]
+SyslogIdentifier=nebula
+WorkingDirectory=/etc/nebula/
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStartPre=/usr/local/bin/nebula -config /etc/nebula/config.yml -test
+ExecStart=/usr/local/bin/nebula -config /etc/nebula/config.yml
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

nebula-v2/remote-api.conf

@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/dockerd -H fd:// -H tcp://0.0.0.0:4243 --containerd=/run/containerd/containerd.sock

nebula-v2/rena.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmIKBHJlbmESCuis2OAKgP7//w8o5LjljAYw9ruVowc6ICwJ6O9eaIC+eFUQ3i13
+w6AO2r6lGPZ03spxkhBPybYMSiA1LgXGkvoNK7zt/RJcNjJg3us9Z0y77qtMHgtm
+Ee6EjBJA1vdySTNyJ3bqk7AugaNGQ3+3nYCPbJ3Qq7+1rA5xSzceyL7yume7/Rn7
+Xhk7yYQqpDaKHtykYkpYmcHsWmrTAA==
+-----END NEBULA CERTIFICATE-----

nebula-v2/rena.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+5ZaYOPZzLCxEB6T29iJzgsLxm/cPPAb9M8ayo19Qzi0=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/reya.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmIKBHJleWESCums2OAKgP7//w8o8bjljAYw9ruVowc6IIu/Pt73el7lCt2lQmlp
+qHpUeFAA4f2yk3YRgG4vnH9HSiA1LgXGkvoNK7zt/RJcNjJg3us9Z0y77qtMHgtm
+Ee6EjBJAQQto6kuyIRzIp/8DQaz0+f/91OjYrsTqKo065jBGjzJpdtmhYP2Ttt8B
+bHne2Gq0bZYHKV5Dwjep2kmGF6owCQ==
+-----END NEBULA CERTIFICATE-----

nebula-v2/reya.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+EBNrzvBRtmVa1TXY1xWEmkk1T32eF+C6f+zGE8CwN4s=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/rhea.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmIKBHJoZWESCues2OAKgP7//w8okrjljAYw9ruVowc6INm3H1yW8WvGKjiQ8jNg
+kU7uyVO625xcEgNUS0/A/u1qSiA1LgXGkvoNK7zt/RJcNjJg3us9Z0y77qtMHgtm
+Ee6EjBJAu2G9EVm5vWLOGZlyKu8w3WCEjQPoqVlUuWa8TjNH2Zz6eQqi7whtsBD7
+0QXu191j+O1MHUqZt1KkGBP37X2yAQ==
+-----END NEBULA CERTIFICATE-----

nebula-v2/rhea.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+G/XO/TGPH0oS1UnHHuq4NX1YHhdVRldbbeX0tow7eWo=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/rita.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmIKBHJpdGESCvis2OAKgP7//w8ogrnljAYw9ruVowc6IBmdDTTE7Msge8ZV6RUd
+PXFfSSdX8/+Do4wldJC3DyEbSiA1LgXGkvoNK7zt/RJcNjJg3us9Z0y77qtMHgtm
+Ee6EjBJAHZgQmkkZsmsEQwhjrwnuhVIwzvAf1UrpVp7pBqheK4gqWhR6yftEQamd
+046GUTTudlVq+PZC7rDOD/ZdY+VXCQ==
+-----END NEBULA CERTIFICATE-----

nebula-v2/rita.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+z/YRU+lvxKn3SIAEbfKNCdfD2MIehxwngQ8u6UxlxDQ=
+-----END NEBULA X25519 PRIVATE KEY-----

nebula-v2/rosa.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CmIKBHJvc2ESCuWs2OAKgP7//w8o+bfljAYw9ruVowc6IJSKZCZ1TE6TYsPfyPlw
+z5d8tbXUULTdXMNSD0KHi0YKSiA1LgXGkvoNK7zt/RJcNjJg3us9Z0y77qtMHgtm
+Ee6EjBJA8cllA8C098SM4WTGr9zleGyVA0j2WSPDCbsYm8enG22s7BgYFIxCSpNP
+Di5X6tnA+AuLozraugM2dVsXbSLhCw==
+-----END NEBULA CERTIFICATE-----

nebula-v2/rosa.key

@@ -0,0 +1,3 @@
+-----BEGIN NEBULA X25519 PRIVATE KEY-----
+J2nvAyOcDyrDXuo54icpYsxWOr3DptJ1pC2SSWNzGi4=
+-----END NEBULA X25519 PRIVATE KEY-----