Adyrem
bc838dfcb6
Ansible Lint / lint (push) Successful in 7s
- New jellyfin Ansible role: Docker stack (Jellyfin, qBittorrent, Radarr, Sonarr, Prowlarr, FlareSolverr, Jellyseerr) with NVIDIA GPU passthrough - configure_services.yml automates download clients, root folders, Prowlarr indexers/apps, qBittorrent credential pre-seeding, and Jellyseerr setup - Fix TPB Cardigann season search: apibay.org returns 0 for season-level queries (e.g. the.boys.s05); patch strips season/ep from tv-search params and locks the definition file read-only to survive Prowlarr refreshes - Fix Pi-hole update_hosts.py regex: use re.DOTALL + count=1 to handle multi-line arrays without overwriting the DHCP section - Add phone WireGuard peer, devbox Traefik/DNS entries, TLS cert plumbing, firewall rule for Traefik IP to Proxmox web UI Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
113 lines
2.7 KiB
Markdown
113 lines
2.7 KiB
Markdown
# Adding a new WireGuard client
|
|
|
|
## Current peer assignments
|
|
|
|
| Name | IP |
|
|
|--------|--------------|
|
|
| server | 10.10.10.1 |
|
|
| fedora | 10.10.10.2 |
|
|
| phone | 10.10.10.3 |
|
|
|
|
Pick the next free IP (10.10.10.3, 10.10.10.4, …) for each new machine.
|
|
|
|
---
|
|
|
|
## Step 1 — Generate a keypair on the new machine
|
|
|
|
**Linux / macOS:**
|
|
```bash
|
|
wg genkey | tee ~/wg-client.key | wg pubkey
|
|
```
|
|
|
|
**Windows** (WireGuard app installed):
|
|
Open the WireGuard app → Add Tunnel → Add empty tunnel. It generates a keypair and shows the public key at the top.
|
|
|
|
Copy the **public key** — you need it in Step 2.
|
|
Keep the **private key** local. Never commit it to git.
|
|
|
|
---
|
|
|
|
## Step 2 — Register the peer in Ansible
|
|
|
|
Edit `ansible/inventory/group_vars/proxmox_hosts/vars.yml` and add an entry to `wireguard_peers`:
|
|
|
|
```yaml
|
|
wireguard_peers:
|
|
- name: fedora
|
|
public_key: "ivtchk9pxEwYwusMzmn7Uq89LFV3uB1I8iYto0EJuy4="
|
|
allowed_ips: 10.10.10.2/32
|
|
- name: my-new-machine # ← add this
|
|
public_key: "<public key from Step 1>"
|
|
allowed_ips: 10.10.10.X/32 # ← next free IP
|
|
```
|
|
|
|
---
|
|
|
|
## Step 3 — Push the peer to the server
|
|
|
|
```bash
|
|
cd ansible && ansible-playbook playbooks/host.yml
|
|
```
|
|
|
|
The server will accept connections from the new client immediately after this.
|
|
|
|
---
|
|
|
|
## Step 4 — Create the client config
|
|
|
|
Use the template below. Store it in a location that is **not** committed to git.
|
|
|
|
```ini
|
|
[Interface]
|
|
Address = 10.10.10.X/32
|
|
PrivateKey = <private key from Step 1>
|
|
DNS = 10.10.1.2
|
|
|
|
[Peer]
|
|
PublicKey = UJaAvoT65+qC7NdD4lKFK+/J1OxKBYp1ZY3ynHjqcHE=
|
|
Endpoint = adyrem.duckdns.org:51820
|
|
AllowedIPs = 10.10.10.0/24, 10.10.1.0/24, 10.10.2.0/24
|
|
PersistentKeepalive = 25
|
|
```
|
|
|
|
`AllowedIPs` is a split tunnel — only homelab traffic goes through the VPN.
|
|
Replace `adyrem.duckdns.org` with `192.168.1.10` when connecting from inside the LAN.
|
|
|
|
---
|
|
|
|
## Step 5 — Connect
|
|
|
|
**Linux (one-off):**
|
|
```bash
|
|
sudo wg-quick up /path/to/wg0.conf
|
|
# disconnect: sudo wg-quick down /path/to/wg0.conf
|
|
```
|
|
|
|
**Linux (persistent, starts on boot):**
|
|
```bash
|
|
sudo cp wg0.conf /etc/wireguard/wg0.conf
|
|
sudo systemctl enable --now wg-quick@wg0
|
|
```
|
|
|
|
**Windows / macOS / Android / iOS:**
|
|
Import the config file into the WireGuard app, then toggle the tunnel on.
|
|
|
|
---
|
|
|
|
## Step 6 — Verify
|
|
|
|
```bash
|
|
ping 10.10.10.1 # Proxmox host
|
|
ping 10.10.1.137 # monitoring VM
|
|
# Proxmox web UI: https://10.10.10.1:8006
|
|
# Grafana: http://10.10.1.137:3000
|
|
```
|
|
|
|
---
|
|
|
|
## Removing a client
|
|
|
|
1. Delete the peer entry from `wireguard_peers` in `group_vars/proxmox_hosts/vars.yml`
|
|
2. Run `ansible-playbook playbooks/host.yml`
|
|
3. The client's public key is removed from the server — existing sessions drop immediately
|