kelson8/kcn-dn42-ansible
1
0
Fork 0
mirror of https://github.com/kelson8/kcn-dn42-ansible.git synced 2026-08-01 17:47:21 -04:00
Code Issues Projects Releases Packages Wiki Activity
This will contain my DN42 testing setup using BGP and Wireguard, the ansible setup is not complete yet.
43 commits 1 branch 0 tags 150 KiB
  • Jinja 79.7%
  • Makefile 12.6%
  • Python 7.7%
Find a file
Exact
kelson8 2ad030f16e
 Fix formatting in readme
2026-07-24 12:15:11 -04:00
.idea Change interpreter 2022-05-08 01:21:21 +03:00
ansible Add AS-KCN-DN42 info 2026-07-24 12:02:30 -04:00
.gitignore Refactor looking-glass role 2022-05-08 01:09:20 +03:00
.tool-versions Add .tool-versions 2022-05-06 01:54:20 +03:00
dn42.iml Recursive DNS 2022-05-08 19:14:40 +03:00
LICENSE Initial commit 2022-02-20 19:32:49 +02:00
README.md Fix formatting in readme 2026-07-24 12:15:11 -04:00

README.md

DN42 Setup

I have started to modify this to include kcn.dn42, I will try to fix it up later. This will need to be tested on a VM to transfer over to.

This repo contains tooling to set up my DN42 AS, AS4242422365 (aka AS-KCN-DN42).

DN42 is for experimenting with BGP and routing, there is also other things that can be done with this.

You can apply for an ASN for DN42 by using this Git repo

The stack is -

  • Bird2
  • Bind9 for DNS
  • Multiple peers over Wireguard
  • ROA checks, periodically updated
  • Full support for DN42 DNS with Bind9
  • IPv6, working on support for it.

Unsupported things for now:

  • Non-Wireguard peers
  • Babel/OSPF
  • Nftables firewall - This is a work in progress.
  • Full support for DN42 HTTPS
  • Looking Glass (bird-lg-go by xddxdd) + Caddy reverse proxy with Let's Encrypt TLS - This isn't setup for my uses, and I will set it up later.

This setup is tested with Ubuntu Server 22.04 LTS. I need to test this new setup with Debian 13.

Inside the ansible dir you'll find all the roles and playbooks, in standard Ansible layout. There's a handy Makefile to simplify the commands.

Info for new ASN

  • ASN: 4242422365
  • IPv4 CIDR: 172.23.117.32/27
  • IPv6 CIDR: fdb1:ef8b:1766::/48
  • Maintainer: WHYPEEPS-MNT
Item Description
domain kcn.dn42
admin-c WHYPEEPS-DN42
tech-c WHYPEEPS-DN42
mnt-by WHYPEEPS-MNT
nserver: ns1.kcn.dn42 172.23.117.32 - Not active
nserver ns1.kcn.dn42 fdb1:ef8b:1766:25::1 - Not active
nserver ns2.kcn.dn42 172.23.117.33
nserver ns2.kcn.dn42 fdb1:ef8b:1766:25::2
source DN42
ASN Name AS-KCN-DN42

ASN on map:

Maintainer on burble:

Servers in use for peering/BGP:

Kioubit

This is currently running on a Raspberry Pi 4 in my homelab, and I may move it over to a VPS later in the future.

Kioubit dashboard:

GPG Key

This is the GPG key for my ASN and for any commits I sign within the DN42 repos.

Name: Why Peeps Email: whypeeps88@proton.me

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEalvCpxYJKwYBBAHaRw8BAQdAQtUuJyRu7QTfnmnvDP6ql3AgYRldjvTyXQNU
Fk5SlCe0IFdoeSBQZWVwcyA8d2h5cGVlcHM4OEBwcm90b24ubWU+iJMEExYKADsW
IQSMSgHx/BuyUTGvwbtSGvT7ORXKtQUCalvCpwIbAwULCQgHAgIiAgYVCgkICwIE
FgIDAQIeBwIXgAAKCRBSGvT7ORXKtVbuAP0S5Q96927d7Bd8y4M6xaU5EPGToNjw
ZHUL58A0sB9O6QD/Z6lpyiNKG27Sc9HxXF4B5pKVLZ4aUUn7v1IuPuyGQwu4OARq
W8KnEgorBgEEAZdVAQUBAQdAloNYOQ5PXxjmsDnzuvowqpcPIXZ2M+qMxAtQFr98
nWIDAQgHiHgEGBYKACAWIQSMSgHx/BuyUTGvwbtSGvT7ORXKtQUCalvCpwIbDAAK
CRBSGvT7ORXKtW8jAQCoAXeUuFi8AQeDVhHyb6z2UJji+dvFfh4c0c8LFcwFDAD/
felBVom1dIAKpGVh2d+gvbL/2iKuL50KPgiEmWBMOgI=
=qUqP
-----END PGP PUBLIC KEY BLOCK-----

Using this for your own AS

I still need to setup Ansible to work with my new setup, I'm not sure if this will work just yet.

If you want to run this repo for your own AS, you'll have to change these files:

  • inventory - change to your own hosts. spanner is just a nickname of my server, you can change it as well.
  • as.yml - holds your ASN and your CIDR blocks.
  • peers.yml & spanner.yml - internal_ip is the DN42 IP of your node. The rest is details about the peered ASes.
  • wireguard.yml - use your private Wireguard key (all the peers are configured with the corresponding public key).
  • dn42_deploy - this is an SSH key that's used to clone the DN42 registry. The clone is used to generate ROA files for Bird. So, sign up for the registry and use your own SSH key. Currently, we use Burble's ROA endpoint so this key is not needed for now.

Use ansible-vault to encrypt the private keys.

Makefile Targets

  • play-<PLAYBOOK NAME> - see each playbook for reference

Utils:

  • print-pubkeys - extracts the Wireguard public keys from the wg_private_key hostvar (i.e. wireguard.yml).
  • encrypt-string / encrypt-file - uses ansible-vault to encrypt content.

Environment Variables

The makefile needs these environment variables:

  • VAULT_PASS_COMMAND - Used to echo the ansible-vault password. For example echo my-secret-password or lpass show ... (if using Lastpass).
  • ANSIBLE_PLAYBOOK_ARGS (optional) - extra args for ansible-playbook, like --private-key /path/to/key

Credits

Credit to matan129 on GitHub for this project