Public Release

examples/quickstart-vagrant/ansible/ansible.cfg

@@ -0,0 +1,4 @@
+[defaults]
+host_key_checking = False
+private_key_file = ~/.vagrant.d/insecure_private_key
+become = yes

examples/quickstart-vagrant/ansible/filter_plugins/to_nebula_ip.py

@@ -0,0 +1,21 @@
+#!/usr/bin/python
+
+
+class FilterModule(object):
+    def filters(self):
+        return {
+            'to_nebula_ip': self.to_nebula_ip,
+            'map_to_nebula_ips': self.map_to_nebula_ips,
+        }
+
+    def to_nebula_ip(self, ip_str):
+        ip_list = map(int, ip_str.split("."))
+        ip_list[0] = 10
+        ip_list[1] = 168
+        ip = '.'.join(map(str, ip_list))
+        return ip
+
+    def map_to_nebula_ips(self, ip_strs):
+	ip_list = [ self.to_nebula_ip(ip_str) for ip_str in ip_strs ]
+	ips = ', '.join(ip_list)
+        return ips

examples/quickstart-vagrant/ansible/inventory

@@ -0,0 +1,11 @@
+[all]
+generic1.vagrant
+generic2.vagrant
+lighthouse1.vagrant
+
+[generic]
+generic1.vagrant
+generic2.vagrant
+
+[lighthouse]
+lighthouse1.vagrant 

examples/quickstart-vagrant/ansible/playbook.yml

@@ -0,0 +1,20 @@
+---
+- name: test connection to vagrant boxes
+  hosts: all
+  tasks:
+    - debug: msg=ok
+
+- name: build nebula binaries locally 
+  connection: local
+  hosts: localhost
+  tasks:
+    - command: chdir=../../../ make bin-vagrant
+  tags:
+    - build-nebula
+   
+- name: install nebula on all vagrant hosts
+  hosts: all
+  become: yes
+  gather_facts: yes
+  roles:
+    - nebula

examples/quickstart-vagrant/ansible/roles/nebula/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+# defaults file for nebula
+nebula_config_directory: "/etc/nebula/"

examples/quickstart-vagrant/ansible/roles/nebula/files/systemd.nebula.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=nebula
+Wants=basic.target
+After=basic.target network.target
+
+[Service]
+SyslogIdentifier=nebula
+StandardOutput=syslog
+StandardError=syslog
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStart=/usr/local/bin/nebula -config /etc/nebula/config.yml
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

examples/quickstart-vagrant/ansible/roles/nebula/files/vagrant-test-ca.crt

@@ -0,0 +1,5 @@
+-----BEGIN NEBULA CERTIFICATE-----
+CkAKDm5lYnVsYSB0ZXN0IENBKNXC1NYFMNXIhO0GOiCmVYeZ9tkB4WEnawmkrca+
+hsAg9otUFhpAowZeJ33KVEABEkAORybHQUUyVFbKYzw0JHfVzAQOHA4kwB1yP9IV
+KpiTw9+ADz+wA+R5tn9B+L8+7+Apc+9dem4BQULjA5mRaoYN
+-----END NEBULA CERTIFICATE-----

examples/quickstart-vagrant/ansible/roles/nebula/files/vagrant-test-ca.key

@@ -0,0 +1,4 @@
+-----BEGIN NEBULA ED25519 PRIVATE KEY-----
+FEXZKMSmg8CgIODR0ymUeNT3nbnVpMi7nD79UgkCRHWmVYeZ9tkB4WEnawmkrca+
+hsAg9otUFhpAowZeJ33KVA==
+-----END NEBULA ED25519 PRIVATE KEY-----

examples/quickstart-vagrant/ansible/roles/nebula/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+# handlers file for nebula
+
+- name: restart nebula
+  service: name=nebula state=restarted

examples/quickstart-vagrant/ansible/roles/nebula/tasks/main.yml

@@ -0,0 +1,56 @@
+---
+# tasks file for nebula
+
+- name: get the vagrant network interface and set fact
+  set_fact:
+    vagrant_ifce: "ansible_{{ ansible_interfaces | difference(['lo',ansible_default_ipv4.alias]) | sort | first }}"
+  tags:
+    - nebula-conf
+  
+- name: install built nebula binary
+  copy: src=../../../../../{{ item }} dest=/usr/local/bin mode=0755
+  with_items:
+    - nebula
+    - nebula-cert
+
+- name: create nebula config directory
+  file: path="{{ nebula_config_directory }}" state=directory mode=0755
+ 
+- name:  temporarily copy over root.crt and root.key to sign
+  copy: src={{ item }} dest=/opt/{{ item }}
+  with_items:
+    - vagrant-test-ca.key
+    - vagrant-test-ca.crt
+
+- name: sign using the root key
+  command: nebula-cert sign -ca-crt /opt/vagrant-test-ca.crt -ca-key /opt/vagrant-test-ca.key -duration 4320h -groups vagrant -ip {{ hostvars[inventory_hostname][vagrant_ifce]['ipv4']['address'] | to_nebula_ip }}/9 -name {{ ansible_hostname }}.nebula -out-crt /etc/nebula/host.crt -out-key /etc/nebula/host.key
+
+- name: remove root.key used to sign
+  file: dest=/opt/{{ item }} state=absent
+  with_items:
+    - vagrant-test-ca.key
+
+- name: write the content of the trusted ca certificate
+  copy: src="vagrant-test-ca.crt" dest="/etc/nebula/vagrant-test-ca.crt"
+  notify: restart nebula
+
+- name: Create config directory
+  file: path="{{ nebula_config_directory }}" owner=root group=root mode=0755 state=directory
+
+- name: nebula config
+  template: src=config.yml.j2 dest="/etc/nebula/config.yml" mode=0644 owner=root group=root
+  notify: restart nebula
+  tags:
+    - nebula-conf
+
+- name: nebula systemd
+  copy: src=systemd.nebula.service dest="/etc/systemd/system/nebula.service" mode=0644 owner=root group=root
+  register: addconf
+  notify: restart nebula
+
+- name: maybe reload systemd
+  shell: systemctl daemon-reload
+  when: addconf.changed
+
+- name: nebula running
+  service: name="nebula" state=started enabled=yes

examples/quickstart-vagrant/ansible/roles/nebula/templates/config.yml.j2

@@ -0,0 +1,84 @@
+pki:
+  ca: /etc/nebula/vagrant-test-ca.crt
+  cert: /etc/nebula/host.crt
+  key: /etc/nebula/host.key
+
+# Port Nebula will be listening on
+listen:
+  host: 0.0.0.0
+  port: 4242
+
+# sshd can expose informational and administrative functions via ssh
+sshd:
+  # Toggles the feature
+  enabled: true
+  # Host and port to listen on
+  listen: 127.0.0.1:2222
+  # A file containing the ssh host private key to use
+  host_key: /etc/ssh/ssh_host_ed25519_key
+  # A file containing a list of authorized public keys
+  authorized_users:
+{% for user in nebula_users %}
+    - user: {{ user.name }}
+      keys:
+{% for key in user.ssh_auth_keys %}
+        - "{{ key }}"
+{% endfor %}
+{% endfor %}
+
+local_range: 10.168.0.0/16
+
+static_host_map:
+# lighthouse
+  {{ hostvars[groups['lighthouse'][0]][vagrant_ifce]['ipv4']['address'] | to_nebula_ip }}: ["{{ hostvars[groups['lighthouse'][0]][vagrant_ifce]['ipv4']['address']}}:4242"]
+
+default_route: "0.0.0.0"
+
+lighthouse:
+{% if 'lighthouse' in group_names %}
+  am_lighthouse: true
+  serve_dns: true
+{% else %}
+  am_lighthouse: false
+{% endif %}
+  interval: 60
+  hosts:
+    - {{ hostvars[groups['lighthouse'][0]][vagrant_ifce]['ipv4']['address'] | to_nebula_ip }}
+  
+# Configure the private interface
+tun:
+  dev: nebula1
+  # Sets MTU of the tun dev.
+  # MTU of the tun must be smaller than the MTU of the eth0 interface
+  mtu: 1300
+
+# TODO
+# Configure logging level
+logging:
+  level: info
+  format: json
+
+firewall:
+  conntrack:
+    tcp_timeout: 12m
+    udp_timeout: 3m
+    default_timeout: 10m
+    max_connections: 100,000
+
+  inbound:
+    - proto: icmp
+      port: any
+      host: any
+    - proto: any
+      port: 22
+      host: any
+{% if "lighthouse" in groups %}
+    - proto: any
+      port: 53
+      host: any
+{% endif %}
+
+  outbound:
+    - proto: any
+      port: any
+      host: any

examples/quickstart-vagrant/ansible/roles/nebula/vars/main.yml

@@ -0,0 +1,7 @@
+---
+# vars file for nebula
+
+nebula_users:
+  - name: user1
+    ssh_auth_keys: 
+      - "ed25519 place-your-ssh-public-key-here"