Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- {% set network = "master" %}
- {% set id = grains['id'] %}
- {% set interface = "Master" %}
- {% set interfaceConfig = pillar['vAddress'] + " 255.255.0.0" %}
- {% set tincBase = "C:\\Program Files (x86)\\tinc\\" %}
- {% set configBase = tincBase + network + "\\" %}
- {% set hostsPath = configBase + "hosts\\" %}
- {% set port = "655" %}
- Install Tinc:
- pkg.installed:
- - name: tinc
- Tinc Path:
- win_path.exists:
- - name: {{ tincBase }}
- - require:
- - pkg: Install Tinc
- {% for host in salt['mine.get']('*', 'tinc_export').items() %}
- {% set name = host[0] %}
- {% if name != id %}
- Populate Host {{ name }}:
- file.managed:
- - name: {{ hostsPath }}{{ name }}
- - source: salt://{{ tpldir }}/config/host.template
- - template: jinja
- - makedirs: true
- - defaults:
- interfaceConfig: {{ interfaceConfig }}
- interface: {{ interface }}
- id: {{ id }}
- port: {{ port }}
- hostName: {{ name }}
- mineName: tinc_export
- - require:
- - pkg: Install Tinc
- {% endif %}
- {% endfor %}
- {% for host in salt['mine.get']('*', 'tinc_export_slave').items() %}
- {% set name = host[0] + "slave" %}
- {% if name != id %}
- Populate Host {{ name }}:
- file.managed:
- - name: {{ hostsPath }}{{ name }}
- - source: salt://{{ tpldir }}/config/host.template
- - template: jinja
- - makedirs: true
- - defaults:
- interfaceConfig: {{ interfaceConfig }}
- interface: {{ interface }}
- id: {{ id }}
- port: {{ port }}
- hostName: {{ host[0] }}
- mineName: tinc_export_slave
- - require:
- - pkg: Install Tinc
- {% endif %}
- {% endfor %}
- Init Tinc:
- cmd.run:
- - name: tinc -n {{ network }} init {{ grains['id'] }}
- - creates:
- - {{ configBase }}ed25519_key.priv
- - {{ configBase }}rsa_key.priv
- - {{ hostsPath }}{{ grains['id'] }}
- - require:
- - win_path: Tinc Path
- Configure Tinc:
- file.managed:
- - name: {{ configBase }}tinc.conf
- - source: salt://{{ tpldir }}/config/tinc.conf
- - template: jinja
- - defaults:
- interfaceConfig: {{ interfaceConfig }}
- interface: {{ interface }}
- network: {{ network }}
- id: {{ id }}
- port: {{ port }}
- - require:
- - cmd: Init Tinc
- Configure Up Script:
- file.managed:
- - name: {{ configBase }}tinc-up.bat
- - source: salt://{{ tpldir }}/config/windows/tinc-up.bat
- - template: jinja
- - defaults:
- interfaceConfig: {{ interfaceConfig }}
- interface: {{ interface }}
- network: {{ network }}
- id: {{ id }}
- port: {{ port }}
- - require:
- - pkg: Install Tinc
- Add Address:
- cmd.run:
- - name: tinc -n {{ network }} add address {{ grains['id'] }}.silvenga.net
- - unless: tinc -n {{ network }} get address
- - require:
- - cmd: Init Tinc
- Log Directory:
- file.directory:
- - name: {{ tincBase }}log
- Install Tap Cert:
- win_pki.import_cert:
- - name: salt://{{ tpldir }}/config/windows/openvpn-tap.cer
- - cert_format: cer
- - context: LocalMachine
- - store: TrustedPublisher
- Create Tap Device:
- cmd.run:
- - name: cmd.exe /c 'tapinstall.exe install OemWin2k.inf tap0901'
- - cwd: C:\Program Files (x86)\tinc\tap-win64\
- - onlyif: get-wmiobject win32_networkadapter | ? { $_.netconnectionid -eq "{{ interface }}" } | % { exit 1 }
- - shell: powershell
- - require:
- - win_pki: Install Tap Cert
- Rename Tap Device:
- cmd.run:
- - name: get-wmiobject win32_networkadapter | ? { $_.ServiceName -eq "tap0901" } | select -first 1 | % { $_.NetConnectionID = "{{ interface }}"; $_.Put() }
- - onlyif: get-wmiobject win32_networkadapter | ? { $_.netconnectionid -eq "{{ interface }}" } | % { exit 1 }
- - shell: powershell
- - require:
- - cmd: Create Tap Device
- Remove Bad State Service:
- cmd.run:
- - name: tinc -n {{ network }} stop
- - unless: Get-Service | ?{ ($_.Status -ne "Running") -and ($_.Name -eq "tinc.{{ network }}") } | %{ exit 1 }
- - shell: powershell
- - require:
- - cmd: Create Tap Device
- Ensure Service Installed:
- cmd.run:
- - name: tinc -n {{ network }} start --logfile
- - onlyif: Get-Service | ? { $_.Name -eq "tinc.{{ network }}" } | %{ exit 1 }
- - shell: powershell
- - require:
- - cmd: Remove Bad State Service
- Restart Tinc Service:
- service.running:
- - name: tinc.{{ network }}
- - enable: True
- - watch:
- - file: Configure Tinc
- - cmd: Rename Tap Device
- - require:
- - cmd: Ensure Service Installed
- Enable Firewall Tinc TCP:
- win_firewall.add_rule:
- - name: Tinc (TCP)
- - localport: 655
- - protocol: tcp
- Enable Firewall Tinc UDP:
- win_firewall.add_rule:
- - name: Tinc (UDP)
- - localport: 655
- - protocol: udp
- Set Network Type To Private:
- cmd.run:
- - name: Get-NetConnectionProfile | ?{$_.InterfaceAlias -eq 'Master' -and $_.NetworkCategory -ne 'Private'} | Set-NetConnectionProfile -NetworkCategory Private
- - unless: Get-NetConnectionProfile | ?{$_.InterfaceAlias -eq 'Master' -and $_.NetworkCategory -ne 'Private'} | %{ exit 1 }
- - shell: powershell
- - require:
- - service: Restart Tinc Service
Add Comment
Please, Sign In to add comment