72 lines
2.3 KiB
Text
72 lines
2.3 KiB
Text
|
let _presets = (import "schemas/lib/concerns_presets.ncl").presets in
|
||
|
|
|
||
|
|
{
|
||
|
|
wireguard | default = {
|
||
|
|
name | default = "wireguard",
|
||
|
|
version | default = "15",
|
||
|
|
image | default = "ghcr.io/wg-easy/wg-easy:15",
|
||
|
|
namespace | default = "vpn",
|
||
|
|
mode | default = 'cluster,
|
||
|
|
node | default = "",
|
||
|
|
fip_name | default = "",
|
||
|
|
lb_ipam_ip | default = "",
|
||
|
|
vpn_subnet | default = "10.200.0.0/24",
|
||
|
|
server_ip | default = "10.200.0.1",
|
||
|
|
wg_default_address | default = "10.200.0.x",
|
||
|
|
listen_port | default = 51820,
|
||
|
|
ui_port | default = 51821,
|
||
|
|
dns | default = ["1.1.1.1", "8.8.8.8"],
|
||
|
|
mtu | default = 1420,
|
||
|
|
keepalive | default = 25,
|
||
|
|
host_network | default = false,
|
||
|
|
|
||
|
|
client_allowed_ips | default = [
|
||
|
|
"10.200.0.0/24",
|
||
|
|
],
|
||
|
|
|
||
|
|
wg_post_up_extra | default = [],
|
||
|
|
wg_post_down_extra | default = [],
|
||
|
|
|
||
|
|
requires | default = {
|
||
|
|
storage = { size = "1Gi", persistent = true },
|
||
|
|
storage_class = "hcloud-volumes",
|
||
|
|
ports = [
|
||
|
|
{ port = 51820, protocol = "UDP", exposure = 'public },
|
||
|
|
{ port = 51821, protocol = "TCP", exposure = 'internal },
|
||
|
|
],
|
||
|
|
credentials = ["WGUI_PASSWORD", "PASSWORD_HASH", "WG_PRIVATE_KEY", "WG_PUBLIC_KEY"],
|
||
|
|
},
|
||
|
|
|
||
|
|
credential_generators | default = {
|
||
|
|
WGUI_PASSWORD = { kind = "random_password", length = 32 },
|
||
|
|
PASSWORD_HASH = { kind = "bcrypt_password", source = "WGUI_PASSWORD" },
|
||
|
|
WG_PRIVATE_KEY = { kind = "wg_privkey" },
|
||
|
|
WG_PUBLIC_KEY = { kind = "wg_pubkey", source = "WG_PRIVATE_KEY" },
|
||
|
|
},
|
||
|
|
|
||
|
|
provides | default = {
|
||
|
|
service = "wireguard",
|
||
|
|
ports = [51820],
|
||
|
|
},
|
||
|
|
|
||
|
|
operations | default = {
|
||
|
|
install = true,
|
||
|
|
update = true,
|
||
|
|
delete = true,
|
||
|
|
restart = true,
|
||
|
|
health = true,
|
||
|
|
},
|
||
|
|
|
||
|
|
live_check | default = {
|
||
|
|
strategy = 'k8s_pods,
|
||
|
|
scope = 'cp_only,
|
||
|
|
},
|
||
|
|
|
||
|
|
# ServiceConcerns default — WireGuard VPN gateway; stateless preset with custom tls/backup.
|
||
|
|
concerns | default = _presets.stateless & {
|
||
|
|
tls | force = { kind = 'disabled, reason = "WireGuard uses its own Noise-protocol mTLS; no x509 termination" },
|
||
|
|
backup | force = { kind = 'disabled, reason = "stateless: peer keys + config in git/SOPS; runtime state is connection metadata only" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
}
|