nebula

Overview Versions Insights

Ansible Role: nebula

Ansible role to install Nebula Mesh.

Requirements

The requirements are:

Ansible version >=2.10
Linux
Systemd as init system

This role is tested on:

Ubuntu 20.04 Focal Fossa
Python 3.10
Ansible 2.10

Role Variables

The following variables are available:

Variable	Default Value	Description
`nebula_am_lighthouse`	`false`	If member is a lighthouse
`nebula_arch`	`amd64`	Architecture to use to build the download URL
`nebula_bin_dir`	`/usr/local/bin`	The directory to install the binaries
`nebula_ca_duration`	`175200h` (20 years)	The duration of CA
`nebula_ca_host`	`<UNDEFINED>`	The inventory_hostname of the host which should be used as CA. If not defined, exactly 1 play host must have `nebula_is_ca` variable set to true. Required to be set if `nebula_am_lighthouse`
`nebula_ca_name`	`Nebula CA Org`	The name of the CA
`nebula_ca_wait_timeout_secs`	`120`	Timeout in seconds for members to wait until the CA is ready to issue certificates
`nebula_config_dir`	`/etc/nebula`	Directory to keep config and certificates
`nebula_download_checksum`	`<UNDEFINED>`	If provided, the checksum will be tested before downloading Nebula from the URL
`nebula_download_dir`	`/opt`	The directory to download the tarball
`nebula_download_url`	see defaults/main.yml	The Nebula download URL
`nebula_groups`	`[]`	Nebula groups of the member
`nebula_ip`	`<UNDEFINED>`	The IP required by Nebula. Needs to contain subnet prefix at the end (e.g. `172.20.0.42/24`). Required.
`nebula_is_ca`	`false`	If the host is the certificate authority or not. If `nebula_ca_host` is not defined, exactly 1 play host must have this variable set to true. Required to be set if `nebula_am_lighthouse`
`nebula_is_member`	`true`	If the host should be added to the mesh
`nebula_name`	`"{{ ansible_facts.hostname }}"`	Name of the Nebula member
`nebula_routable_ip`	`<UNDEFINED>`	The routable IP required by Nebula. If undefined, the public IP of the host will be determined and used
`nebula_service_name`	`nebula`	Name of the systemd service
`nebula_version`	see defaults/main.yml	Nebula version to use. See git tags here
`nebula_additional_member_certs_download_dir`	`/tmp`	Local directory to download any additional member certificates
`nebula_cert_private_key`	`<UNDEFINED>`	Nebula member private key to use. If defined, no private key will be generated on CA but this one will be used. Must be defined together with `nebula_cert_public_key`
`nebula_cert_public_key`	`<UNDEFINED>`	Nebula member public key to use. If defined, no public key will be generated on CA but this one will be siged and used. Must be defined together with `nebula_cert_private_key`
`nebula_additional_member_certs`	see defaults/main.yml	Dict object of additional member certs with each key being the member name and value being the member configuration. Only used to generate additional certificates on CA. Can be useful to issue certificates to devices that are not managed by Ansible (e.g. Windows or mobile devices)
`nebula_pki_disconnect_invalid`	`<UNDEFINED>`	See Nebula configuration reference and example config
`nebula_lighthouse_interval`	`60`	See Nebula configuration reference and example config
`nebula_listen_host`	`0.0.0.0`	See Nebula configuration reference and example config
`nebula_listen_port`	`4242`	See Nebula configuration reference and example config
`nebula_listen_batch`	`<UNDEFINED>`	See Nebula configuration reference and example config
`nebula_listen_read_buffer`	`<UNDEFINED>`	See Nebula configuration reference and example config
`nebula_listen_write_buffer`	`<UNDEFINED>`	See Nebula configuration reference and example config
`nebula_punchy_punch`	`true`	See Nebula configuration reference and example config
`nebula_punchy_respond`	`<UNDEFINED>`	See Nebula configuration reference and example config
`nebula_punchy_delay`	`<UNDEFINED>`	See Nebula configuration reference and example config
`nebula_cipher`	`<UNDEFINED>`	See Nebula configuration reference and example config
`nebula_tun_disabled`	`false`	See Nebula configuration reference and example config
`nebula_tun_dev`	`nebula1`	See Nebula configuration reference and example config
`nebula_tun_drop_local_broadcast`	`false`	See Nebula configuration reference and example config
`nebula_tun_drop_multicast`	`false`	See Nebula configuration reference and example config
`nebula_tun_tx_queue`	`500`	See Nebula configuration reference and example config
`nebula_tun_mtu`	`1300`	See Nebula configuration reference and example config
`nebula_logging_level`	`info`	See Nebula configuration reference and example config
`nebula_logging_format`	`text`	See Nebula configuration reference and example config
`nebula_logging_disable_timestamp`	`false`	See Nebula configuration reference and example config
`nebula_firewall_conntrack_tcp_timeout`	`12m`	See Nebula configuration reference and example config
`nebula_firewall_conntrack_udp_timeout`	`3m`	See Nebula configuration reference and example config
`nebula_firewall_conntrack_default_timeout`	`10m`	See Nebula configuration reference and example config
`nebula_firewall_conntrack_max_connections`	`100000`	See Nebula configuration reference and example config
`nebula_firewall_outbound`	see defaults/main.yml	See Nebula configuration reference and example config
`nebula_firewall_inbound`	see defaults/main.yml	See Nebula configuration reference and example config

Example Playbook

Here's a minimalistic example:

- name: Setup Nebula
  hosts: servers
  become: true
  strategy: free
  roles:
    - role: utkuozdemir.nebula

See tests/ directory for a concrete example.

About

Ansible role to install Nebula Mesh overlay

role mesh slackhq vpn

Install

ansible-galaxy install utkuozdemir/ansible-role-nebula

GitHub repository

15 stars

4 forks

3 open issues

License

apache-2.0

Downloads

154

Owner

Utku Özdemir

Backend & Cloud Infrastructure Engineer