Files

T

Ansible Lint / lint (push) Successful in 7s

Details

Add jellyfin media stack with full service automation

- New jellyfin Ansible role: Docker stack (Jellyfin, qBittorrent, Radarr,
  Sonarr, Prowlarr, FlareSolverr, Jellyseerr) with NVIDIA GPU passthrough
- configure_services.yml automates download clients, root folders, Prowlarr
  indexers/apps, qBittorrent credential pre-seeding, and Jellyseerr setup
- Fix TPB Cardigann season search: apibay.org returns 0 for season-level
  queries (e.g. the.boys.s05); patch strips season/ep from tv-search params
  and locks the definition file read-only to survive Prowlarr refreshes
- Fix Pi-hole update_hosts.py regex: use re.DOTALL + count=1 to handle
  multi-line arrays without overwriting the DHCP section
- Add phone WireGuard peer, devbox Traefik/DNS entries, TLS cert plumbing,
  firewall rule for Traefik IP to Proxmox web UI

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-18 18:31:30 +02:00

2.7 KiB

Raw Permalink Blame History

Adding a new WireGuard client

Current peer assignments

Name	IP
server	10.10.10.1
fedora	10.10.10.2
phone	10.10.10.3

Pick the next free IP (10.10.10.3, 10.10.10.4, …) for each new machine.

Step 1 — Generate a keypair on the new machine

Linux / macOS:

wg genkey | tee ~/wg-client.key | wg pubkey

Windows (WireGuard app installed): Open the WireGuard app → Add Tunnel → Add empty tunnel. It generates a keypair and shows the public key at the top.

Copy the public key — you need it in Step 2.
Keep the private key local. Never commit it to git.

Step 2 — Register the peer in Ansible

Edit ansible/inventory/group_vars/proxmox_hosts/vars.yml and add an entry to wireguard_peers:

wireguard_peers:
  - name: fedora
    public_key: "ivtchk9pxEwYwusMzmn7Uq89LFV3uB1I8iYto0EJuy4="
    allowed_ips: 10.10.10.2/32
  - name: my-new-machine          # ← add this
    public_key: "<public key from Step 1>"
    allowed_ips: 10.10.10.X/32   # ← next free IP

Step 3 — Push the peer to the server

cd ansible && ansible-playbook playbooks/host.yml

The server will accept connections from the new client immediately after this.

Step 4 — Create the client config

Use the template below. Store it in a location that is not committed to git.

[Interface]
Address = 10.10.10.X/32
PrivateKey = <private key from Step 1>
DNS = 10.10.1.2

[Peer]
PublicKey = UJaAvoT65+qC7NdD4lKFK+/J1OxKBYp1ZY3ynHjqcHE=
Endpoint = adyrem.duckdns.org:51820
AllowedIPs = 10.10.10.0/24, 10.10.1.0/24, 10.10.2.0/24
PersistentKeepalive = 25

AllowedIPs is a split tunnel — only homelab traffic goes through the VPN.
Replace adyrem.duckdns.org with 192.168.1.10 when connecting from inside the LAN.

Step 5 — Connect

Linux (one-off):

sudo wg-quick up /path/to/wg0.conf
# disconnect: sudo wg-quick down /path/to/wg0.conf

Linux (persistent, starts on boot):

sudo cp wg0.conf /etc/wireguard/wg0.conf
sudo systemctl enable --now wg-quick@wg0

Windows / macOS / Android / iOS: Import the config file into the WireGuard app, then toggle the tunnel on.

Step 6 — Verify

ping 10.10.10.1        # Proxmox host
ping 10.10.1.137       # monitoring VM
# Proxmox web UI: https://10.10.10.1:8006
# Grafana:        http://10.10.1.137:3000

Removing a client

Delete the peer entry from wireguard_peers in group_vars/proxmox_hosts/vars.yml
Run ansible-playbook playbooks/host.yml
The client's public key is removed from the server — existing sessions drop immediately

2.7 KiB Raw Permalink Blame History