mirror of
https://github.com/itdoginfo/ansible-openwrt-hirkn.git
synced 2025-12-22 07:03:35 +05:00
Added install script, openwrt 23.05, sing-box, tun2socks
This commit is contained in:
itdoginfo
@@ -9,70 +9,100 @@
|
||||
|
||||
vars:
|
||||
ansible_template_dir: /etc/ansible/templates/
|
||||
wg_server_address: wg_server_ip/url
|
||||
list_domains: true
|
||||
list_subnet: false
|
||||
list_ip: false
|
||||
list_community: false
|
||||
tunnel: wg
|
||||
dns_encrypt: false
|
||||
country: russia-inside
|
||||
|
||||
wg_server_address: wg-server-host
|
||||
wg_private_key: privatekey-client
|
||||
wg_public_key: publickey-server
|
||||
#wg_preshared_key: preshared-key
|
||||
wg_public_key: publickey-client
|
||||
#wg_preshared_key: presharedkey-client
|
||||
wg_listen_port: 51820
|
||||
wg_client_port: 51820
|
||||
wg_client_address: 192.168.100.3/24
|
||||
download_utility: curl
|
||||
list_subnet: true
|
||||
list_ip: true
|
||||
list_community: true
|
||||
list_domains: false
|
||||
|
||||
# Packages installation
|
||||
wg_client_address: ip-client
|
||||
|
||||
tasks:
|
||||
- name: install packages
|
||||
opkg:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- kmod-wireguard
|
||||
- wireguard-tools
|
||||
- dnscrypt-proxy2
|
||||
|
||||
- name: install curl
|
||||
opkg:
|
||||
name: curl
|
||||
state: present
|
||||
when: download_utility == "curl"
|
||||
|
||||
- name: install ipset
|
||||
opkg:
|
||||
name: ipset
|
||||
state: present
|
||||
when: ansible_distribution_major_version < "22"
|
||||
|
||||
# Dnsmasq version check
|
||||
|
||||
- name: Get dnsmasq version
|
||||
shell: opkg list-installed | grep dnsmasq-full | awk '{print $3}'
|
||||
register: dnsmasqfull_version
|
||||
|
||||
# Hirkn script configure
|
||||
- name: debug
|
||||
debug:
|
||||
var: ansible_distribution_major_version
|
||||
|
||||
# Packages installation
|
||||
|
||||
- name: install wg
|
||||
opkg:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- kmod-wireguard
|
||||
- wireguard-tools
|
||||
when: tunnel == "wg"
|
||||
|
||||
- name: install openvpn
|
||||
opkg:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- openvpn-openssl
|
||||
when: tunnel == "openvpn"
|
||||
|
||||
- name: install singbox
|
||||
opkg:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- sing-box
|
||||
when: tunnel == "singbox" and ansible_distribution_major_version >= "23"
|
||||
|
||||
- name: install curl and nano
|
||||
opkg:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- curl
|
||||
- nano
|
||||
|
||||
- name: install ipset
|
||||
opkg:
|
||||
name: ipset
|
||||
state: present
|
||||
when: ansible_distribution_major_version < "22"
|
||||
|
||||
- name: install dnsmasq-full (23)
|
||||
shell: opkg update && cd /tmp/ && opkg download dnsmasq-full && opkg remove dnsmasq && opkg install dnsmasq-full --cache /tmp/ && [ -f /etc/config/dhcp-opkg ] && cp etc/config/dhcp /etc/config/dhcp-old && mv /etc/config/dhcp-opkg /etc/config/dhcp
|
||||
when: ansible_distribution_major_version >= "23" and list_domains and not dnsmasqfull_version.stdout
|
||||
ignore_errors: true
|
||||
|
||||
# Getdomains script configure
|
||||
|
||||
- name: hirkn script copy
|
||||
- name: getdomains script copy
|
||||
template:
|
||||
src: "{{ ansible_template_dir }}openwrt-hirkn.j2"
|
||||
dest: "/etc/init.d/hirkn"
|
||||
src: "{{ ansible_template_dir }}openwrt-getdomains.j2"
|
||||
dest: "/etc/init.d/getdomains"
|
||||
mode: a+x
|
||||
trim_blocks: false
|
||||
notify:
|
||||
- Run hirkn script
|
||||
- Run getdomains script
|
||||
|
||||
- name: create simplink in rc.d
|
||||
file:
|
||||
src: "/etc/init.d/hirkn"
|
||||
dest: "/etc/rc.d/S99hirkn"
|
||||
src: "/etc/init.d/getdomains"
|
||||
dest: "/etc/rc.d/S99getdomains"
|
||||
state: link
|
||||
notify:
|
||||
- Run hirkn script
|
||||
- Run getdomains script
|
||||
|
||||
- name: check string in crontab
|
||||
shell: grep "hirkn" /etc/crontabs/root
|
||||
shell: grep "getdomains" /etc/crontabs/root
|
||||
register: check_cron
|
||||
ignore_errors: true
|
||||
|
||||
@@ -80,7 +110,7 @@
|
||||
lineinfile:
|
||||
path: /etc/crontabs/root
|
||||
create: yes
|
||||
line: "0 4 * * * /etc/init.d/hirkn reload"
|
||||
line: "0 4 * * * /etc/init.d/getdomains start"
|
||||
when: check_cron.stdout == ""
|
||||
|
||||
- name: enable and start crontab
|
||||
@@ -91,14 +121,62 @@
|
||||
|
||||
# Configure route table
|
||||
|
||||
- name: route copy in hotplug
|
||||
# - name: Create vpn0 interface
|
||||
# uci:
|
||||
# command: section
|
||||
# config: network
|
||||
# type: interface
|
||||
# find_by:
|
||||
# name: vpn0
|
||||
# name: vpn0
|
||||
# value:
|
||||
# name: vpn0
|
||||
# proto: none
|
||||
# auto: 1
|
||||
# device: tun0
|
||||
# when: tunnel == "openvpn" or tunnel == "singbox" or tunnel == "tun2socks"
|
||||
# notify:
|
||||
# - Restart network
|
||||
|
||||
# - name: tunnel routing. tun0
|
||||
# uci:
|
||||
# command: section
|
||||
# config: network
|
||||
# type: route
|
||||
# find_by:
|
||||
# name: vpn_route
|
||||
# name: vpn_route
|
||||
# value:
|
||||
# name: vpn_route
|
||||
# interface: vpn0
|
||||
# table: vpn
|
||||
# target: 0.0.0.0/0
|
||||
# when: tunnel == "openvpn" or tunnel == "singbox" or tunnel == "tun2socks"
|
||||
# notify:
|
||||
# - Restart network
|
||||
|
||||
# - name: tunnel routing. wg0
|
||||
# uci:
|
||||
# command: section
|
||||
# config: network
|
||||
# type: route
|
||||
# find_by:
|
||||
# name: vpn
|
||||
# name: vpn_route
|
||||
# value:
|
||||
# interface: wg0
|
||||
# table: vpn
|
||||
# target: 0.0.0.0/0
|
||||
# when: tunnel == "wg"
|
||||
# notify:
|
||||
# - Restart network
|
||||
|
||||
- name: Route for vpn table
|
||||
template:
|
||||
src: "{{ ansible_template_dir }}openwrt-30-rknroute.j2"
|
||||
dest: "/etc/hotplug.d/iface/30-rknroute"
|
||||
mode: 0644
|
||||
notify:
|
||||
- Restart network
|
||||
|
||||
|
||||
- name: Check string in rt_tables
|
||||
shell: grep "99 vpn" /etc/iproute2/rt_tables
|
||||
register: check_rt_tables
|
||||
@@ -112,14 +190,15 @@
|
||||
notify:
|
||||
- Restart network
|
||||
|
||||
# Configure network
|
||||
|
||||
# Configure WG
|
||||
|
||||
- name: add wg interface
|
||||
uci:
|
||||
command: add
|
||||
config: network
|
||||
type: interface
|
||||
name: wg0
|
||||
when: tunnel == "wg"
|
||||
|
||||
- name: configure wg interface
|
||||
uci:
|
||||
@@ -131,6 +210,9 @@
|
||||
listen_port: "{{ wg_listen_port }}"
|
||||
addresses:
|
||||
- "{{ wg_client_address }}"
|
||||
when: tunnel == "wg"
|
||||
notify:
|
||||
- Restart network
|
||||
|
||||
- name: set wg client without wg_preshared_key
|
||||
uci:
|
||||
@@ -146,8 +228,10 @@
|
||||
endpoint_host: "{{ wg_server_address }}"
|
||||
allowed_ips: 0.0.0.0/0
|
||||
endpoint_port: "{{ wg_client_port }}"
|
||||
when: wg_preshared_key is undefined
|
||||
|
||||
when: wg_preshared_key is undefined and tunnel == "wg"
|
||||
notify:
|
||||
- Restart network
|
||||
|
||||
- name: set wg client with wg_preshared_key
|
||||
uci:
|
||||
command: section
|
||||
@@ -163,8 +247,117 @@
|
||||
endpoint_host: "{{ wg_server_address }}"
|
||||
allowed_ips: 0.0.0.0/0
|
||||
endpoint_port: "{{ wg_client_port }}"
|
||||
when: wg_preshared_key is defined
|
||||
when: wg_preshared_key is defined and tunnel == "wg"
|
||||
|
||||
- name: set WG firewall zone
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
type: zone
|
||||
find_by:
|
||||
name: wg
|
||||
value:
|
||||
forward: REJECT
|
||||
output: ACCEPT
|
||||
name: wg
|
||||
input: REJECT
|
||||
masq: 1
|
||||
mtu_fix: 1
|
||||
network: wg0
|
||||
family: ipv4
|
||||
when: tunnel == "wg"
|
||||
|
||||
- name: add WG forwarding
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
type: forwarding
|
||||
find_by:
|
||||
name: wg-lan
|
||||
value:
|
||||
dest: wg
|
||||
src: lan
|
||||
family: ipv4
|
||||
when: tunnel == "wg"
|
||||
|
||||
# Configure Sing-box
|
||||
|
||||
- name: set sing-box firewall zone. Only >=22
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
type: zone
|
||||
find_by:
|
||||
name: tun
|
||||
value:
|
||||
forward: ACCEPT
|
||||
output: ACCEPT
|
||||
name: tun
|
||||
input: ACCEPT
|
||||
masq: 1
|
||||
mtu_fix: 1
|
||||
device: tun0
|
||||
family: ipv4
|
||||
when: tunnel == "singbox"
|
||||
failed_when: ansible_distribution_major_version < "22"
|
||||
notify:
|
||||
- Restart firewall
|
||||
|
||||
- name: template for sing-box.json
|
||||
template:
|
||||
src: "{{ ansible_template_dir }}sing-box-json.j2"
|
||||
dest: "/etc/sing-box/config.json"
|
||||
mode: 0644
|
||||
when: tunnel == "singbox"
|
||||
failed_when: ansible_distribution_major_version < "22"
|
||||
|
||||
- name: template for config/sing-box
|
||||
template:
|
||||
src: "{{ ansible_template_dir }}config-sing-box.j2"
|
||||
dest: "/etc/config/sing-box"
|
||||
mode: 0600
|
||||
when: tunnel == "singbox"
|
||||
failed_when: ansible_distribution_major_version < "22"
|
||||
|
||||
# Configure OpenVPN, tun2socks
|
||||
|
||||
- name: set {{ tunnel }} firewall zone
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
type: zone
|
||||
find_by:
|
||||
name: tun
|
||||
value:
|
||||
forward: REJECT
|
||||
output: ACCEPT
|
||||
name: tun
|
||||
input: REJECT
|
||||
masq: 1
|
||||
mtu_fix: 1
|
||||
device: tun0
|
||||
family: ipv4
|
||||
when: tunnel == "openvpn" or tunnel == "tun2socks"
|
||||
notify:
|
||||
- Restart firewall
|
||||
|
||||
- name: add {{ tunnel }} forwarding
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
type: forwarding
|
||||
find_by:
|
||||
name: lan-tun
|
||||
value:
|
||||
dest: tun
|
||||
src: lan
|
||||
family: ipv4
|
||||
when: tunnel == "openvpn" or tunnel == "tun2socks" or tunnel == "singbox"
|
||||
notify:
|
||||
- Restart firewall
|
||||
|
||||
# Configure network
|
||||
|
||||
- name: set rule mark0x1
|
||||
uci:
|
||||
command: section
|
||||
@@ -183,8 +376,16 @@
|
||||
key: network.wan
|
||||
value:
|
||||
peerdns: 0
|
||||
when: ansible_distribution_major_version < "22"
|
||||
|
||||
- name: uci commit
|
||||
- name: uci commit firewall
|
||||
uci:
|
||||
command: commit
|
||||
config: firewall
|
||||
notify:
|
||||
- Restart firewall
|
||||
|
||||
- name: uci commit network
|
||||
uci:
|
||||
command: commit
|
||||
config: network
|
||||
@@ -192,36 +393,7 @@
|
||||
- Restart network
|
||||
|
||||
# Configure firewall
|
||||
|
||||
- name: set WG firewall zone
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
type: zone
|
||||
find_by:
|
||||
name: wg
|
||||
value:
|
||||
forward: REJECT
|
||||
output: ACCEPT
|
||||
name: wg
|
||||
input: REJECT
|
||||
masq: 1
|
||||
mtu_fix: 1
|
||||
network: wg0
|
||||
family: ipv4
|
||||
|
||||
- name: add WG forwarding
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
type: forwarding
|
||||
find_by:
|
||||
name: wg-lan
|
||||
value:
|
||||
dest: wg
|
||||
src: lan
|
||||
family: ipv4
|
||||
|
||||
|
||||
- name: add ipset for subnet (<22)
|
||||
uci:
|
||||
command: section
|
||||
@@ -265,7 +437,7 @@
|
||||
maxelem: 9900000
|
||||
when: ansible_distribution_major_version < "22" and list_community
|
||||
|
||||
- name: add ipset for subnet (22)
|
||||
- name: add nfset for subnet (22)
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
@@ -275,9 +447,9 @@
|
||||
value:
|
||||
match: dst_net
|
||||
loadfile: /tmp/lst/subnet.lst
|
||||
when: ansible_distribution_major_version == "22" and list_subnet
|
||||
when: ansible_distribution_major_version >= "22" and list_subnet
|
||||
|
||||
- name: add ipset for ip (22)
|
||||
- name: add nfset for ip (22)
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
@@ -287,9 +459,9 @@
|
||||
value:
|
||||
match: dst_net
|
||||
loadfile: /tmp/lst/ip.lst
|
||||
when: ansible_distribution_major_version == "22" and list_ip
|
||||
when: ansible_distribution_major_version >= "22" and list_ip
|
||||
|
||||
- name: add ipset for community (22)
|
||||
- name: add nfset for community (22)
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
@@ -299,7 +471,7 @@
|
||||
value:
|
||||
match: dst_net
|
||||
loadfile: /tmp/lst/community.lst
|
||||
when: ansible_distribution_major_version == "22" and list_community
|
||||
when: ansible_distribution_major_version >= "22" and list_community
|
||||
|
||||
- name: add ipset for domains (<22). If failed, check dnsmasq-full
|
||||
uci:
|
||||
@@ -312,9 +484,9 @@
|
||||
match: dst_net
|
||||
storage: hash
|
||||
failed_when: ansible_distribution_major_version < "22" and list_domains and not dnsmasqfull_version.stdout
|
||||
when: ansible_distribution_major_version < "22" and list_domains and dnsmasqfull_version.stdout
|
||||
when: ansible_distribution_major_version < "22" and list_domains
|
||||
|
||||
- name: add ipset for domains (22). If failed, check dnsmasq-full
|
||||
- name: add nfset for domains (>=22). If failed, check dnsmasq-full
|
||||
uci:
|
||||
command: section
|
||||
config: firewall
|
||||
@@ -323,8 +495,8 @@
|
||||
name: vpn_domains
|
||||
value:
|
||||
match: dst_net
|
||||
failed_when: ansible_distribution_major_version == "22" and list_domains and dnsmasqfull_version.stdout < "2.87"
|
||||
when: ansible_distribution_major_version == "22" and list_domains and dnsmasqfull_version.stdout >= "2.87"
|
||||
failed_when: ansible_distribution_major_version >= "22" and list_domains and (not dnsmasqfull_version.stdout or dnsmasqfull_version.stdout < "2.87")
|
||||
when: ansible_distribution_major_version >= "22" and list_domains
|
||||
|
||||
- name: add mark rule vpn_subnet
|
||||
uci:
|
||||
@@ -392,7 +564,7 @@
|
||||
set_mark: "0x1"
|
||||
target: MARK
|
||||
family: ipv4
|
||||
when: (ansible_distribution_major_version < "22" and list_domains and dnsmasqfull_version.stdout) or (ansible_distribution_major_version == "22" and list_domains and dnsmasqfull_version.stdout >= "2.87")
|
||||
when: (ansible_distribution_major_version < "22" and list_domains and dnsmasqfull_version.stdout) or (ansible_distribution_major_version >= "22" and list_domains and dnsmasqfull_version.stdout >= "2.87")
|
||||
|
||||
# Remove unused rules and ipset
|
||||
- name: Remove ipset for ip
|
||||
@@ -467,26 +639,26 @@
|
||||
name: mark_domains
|
||||
when: not list_domains
|
||||
|
||||
- name: uci commit firewall
|
||||
uci:
|
||||
command: commit
|
||||
config: firewall
|
||||
notify:
|
||||
- Restart firewall
|
||||
# Configure DNS resolver
|
||||
|
||||
# Configure dnscrypt2
|
||||
- name: install dnscrypt-proxy2
|
||||
opkg:
|
||||
name: dnscrypt-proxy2
|
||||
state: present
|
||||
when: dns_encrypt == "dnscrypt"
|
||||
|
||||
- name: check string in dnscrypt-proxy.toml
|
||||
shell: grep "# server_names" /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
|
||||
register: check_server_names
|
||||
ignore_errors: true
|
||||
|
||||
when: dns_encrypt == "dnscrypt"
|
||||
|
||||
- name: dnscrypt2 enable exact servers
|
||||
lineinfile:
|
||||
path: /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
|
||||
regexp: "# server_names ="
|
||||
line: "server_names = ['google', 'cloudflare', 'scaleway-fr', 'yandex']"
|
||||
when: check_server_names.stdout
|
||||
when: dns_encrypt == "dnscrypt" and check_server_names.stdout
|
||||
notify:
|
||||
- Restart dnscrypt-proxy
|
||||
|
||||
@@ -498,10 +670,45 @@
|
||||
line: "{{ item }}"
|
||||
with_items:
|
||||
- " list server '127.0.0.53#53'"
|
||||
- " list server '/pool.ntp.org/208.67.222.222'"
|
||||
- " option noresolv '1'"
|
||||
notify:
|
||||
- Restart dnsmasq
|
||||
when: dns_encrypt == "dnscrypt"
|
||||
|
||||
- name: install stubby
|
||||
opkg:
|
||||
name: stubby
|
||||
state: present
|
||||
when: dns_encrypt == "stubby"
|
||||
|
||||
- name: edit dhcp config. add localhost server
|
||||
lineinfile:
|
||||
path: /etc/config/dhcp
|
||||
firstmatch: "true"
|
||||
insertafter: "option leasefile '/tmp/dhcp.leases'"
|
||||
line: "{{ item }}"
|
||||
with_items:
|
||||
- " list server '127.0.0.1#5453'"
|
||||
- " option noresolv '1'"
|
||||
notify:
|
||||
- Restart dnsmasq
|
||||
when: dns_encrypt == "stubby"
|
||||
|
||||
# Commit and handlers
|
||||
|
||||
- name: uci commit firewall
|
||||
uci:
|
||||
command: commit
|
||||
config: firewall
|
||||
notify:
|
||||
- Restart firewall
|
||||
|
||||
- name: uci commit network
|
||||
uci:
|
||||
command: commit
|
||||
config: network
|
||||
notify:
|
||||
- Restart network
|
||||
|
||||
handlers:
|
||||
- name: Restart network
|
||||
@@ -514,9 +721,9 @@
|
||||
name: firewall
|
||||
state: restarted
|
||||
|
||||
- name: Run hirkn script
|
||||
- name: Run getdomains script
|
||||
service:
|
||||
name: hirkn
|
||||
name: getdomains
|
||||
state: restarted
|
||||
|
||||
- name: Restart dnscrypt-proxy
|
||||
|
||||
Reference in New Issue
Block a user