{"id":13434767,"url":"https://github.com/evrardjp/ansible-tinc","last_synced_at":"2025-04-10T21:15:14.186Z","repository":{"id":52858032,"uuid":"76180181","full_name":"evrardjp/ansible-tinc","owner":"evrardjp","description":"Role to install tinc in a star/ring topology (w/ leaf/spine) (based on your variables)","archived":false,"fork":false,"pushed_at":"2021-04-16T11:21:14.000Z","size":78,"stargazers_count":15,"open_issues_count":3,"forks_count":10,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-10T21:15:06.598Z","etag":null,"topics":["ansible","centos","debian","molecule","openwrt","tinc","ubuntu","vpn"],"latest_commit_sha":null,"homepage":"","language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/evrardjp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-12-11T14:42:51.000Z","updated_at":"2025-01-29T18:51:58.000Z","dependencies_parsed_at":"2022-08-23T00:31:14.963Z","dependency_job_id":null,"html_url":"https://github.com/evrardjp/ansible-tinc","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evrardjp%2Fansible-tinc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evrardjp%2Fansible-tinc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evrardjp%2Fansible-tinc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evrardjp%2Fansible-tinc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/evrardjp","download_url":"https://codeload.github.com/evrardjp/ansible-tinc/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248298312,"owners_count":21080320,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","centos","debian","molecule","openwrt","tinc","ubuntu","vpn"],"created_at":"2024-07-31T03:00:22.463Z","updated_at":"2025-04-10T21:15:14.166Z","avatar_url":"https://github.com/evrardjp.png","language":"Jinja","funding_links":[],"categories":["HarmonyOS"],"sub_categories":["Windows Manager"],"readme":"# Tinc\n\n![Daily branch test status](https://github.com/evrardjp/ansible-tinc/actions/workflows/daily.yml/badge.svg)\n\nThis role installs tinc in a star or a ring topology.\n\nThe nodes listed in the group [tinc_nodes] is a full list of nodes to apply/install the role.\n\nThe nodes part of [tinc_spine_nodes] are the \"core\" nodes, where all the nodes connect.\n\nThe nodes in [tinc_leaf_nodes] connect only to the spine nodes.  Devices behind a NAT would be an example of such.\n\nIf all the [tinc_nodes] are part of the [tinc_spine_nodes], you have a more \"ringy\" topology. If you have one node in [tinc_spine_nodes], you have a more \"starry\" topology.\n\n## Requirements\n\n* Ubuntu 18.04 / CentOS 7 (or above) / OpenWRT\n* On CentOS and above, EPEL repo needs to be configured in advance.\n\nTo do so, you can run the following:\n```bash\nyum install epel-release || dnf install epel-release\nyum update || dnf update\n```\n\n## Role Variables\n\n* tinc_key_size: The size of the generated keys (Default: `4096`)\n* tinc_address_family can be ipv4/ipv6/any (or undefined)\n* tinc_mode can be router, switch, or hub. (See https://www.tinc-vpn.org/documentation/tinc.conf.5). (Default: `router`)\n* tinc_netname: The tinc network name\n* tinc_vpn_ip: The ip to assign to a single VPN endpoint. Use host vars to set it.\n* tinc_vpn_cidr: The cidr used in tinc network (Default: `/24`, or force /32 in router mode).\n* tinc_vpn_interface: The device for tinc to use, in case there are multiple tun devices (Default: `tun0`)\n* tinc_control_plane_bind_ip: The ip for tincd service to bind to (Default: `ansible_default_ipv4.address` }} )\n\nInventory must set tinc_control_plane_bind_ip (for core) and/or tinc_vpn_ip (for core and edge nodes).\nPlease have a look in the task files.\n\n## Examples\n\n### Router mode, ring topology\n\n(Short) Inventory:\n```\n[tinc_nodes:children]\ntinc_spine_nodes\ntinc_leaf_nodes\n\n[tinc_spine_nodes]\nnode1 tinc_vpn_ip=10.10.0.11\nnode2 tinc_vpn_ip=10.10.0.12\nnode3 tinc_vpn_ip=10.10.0.13\n\n[tinc_leaf_nodes]\nnode1\nnode2\nnode3\n```\n### Router mode, star topology\n\n(Detailed) Inventory:\n\n```\n[tinc_nodes]\nnode1\nnode2\nnode3\n\n[tinc_spine_nodes]\nnode1\n\n[tinc_leaf_nodes]\nnode1\nnode2\nnode3\n```\n\nGroup vars for `tinc_nodes`:\n\n```\ntinc_netname: mynetname\ntinc_vpn_interface: tun0\n```\n\nHost vars for spine node, `node1`:\n\n```\ntinc_control_plane_bind_ip: \"{{ ansible_eth0.ipv4.address | default(ansible_default_ipv4.address) }}\"\ntinc_vpn_ip: 10.10.0.10\n```\n\nHost vars for edge node, `node2`:\n\n```\ntinc_vpn_ip: 10.10.0.11\n```\n\nHost vars for edge node, `node3`:\n```\ntinc_vpn_ip: 10.10.0.12\n```\n\n## Dependencies\n\nNone\n\n## Example Playbook\n\nSee https://raw.githubusercontent.com/evrardjp/ansible-tinc/master/molecule/default/converge.yml\n\nDon't forget to set the necessary variables in your inventory (see above).\n\n## Testing\n\nTests are based on Ansible Molecule framework which:\n- checks role syntax\n- starts several containers with different OS \u003ci\u003e(only for tests. We don't mix Tinc versions in production)\u003c/i\u003e\n- applies this role to each container\n- runs idempotency tests (make sure that second run will not make unexpected changes)\n- verifies that each prepared node able to ping other nodes over VPN\n\nTests run in a github actions on PR and daily. Additionally you may execute them on local machine.\n\nDependencies you need to have installed for running the tests:\n- Ansible\n- [Docker](https://docs.docker.com/engine/install/)\n- [Molecule](https://molecule.readthedocs.io/en/latest/installation.html) with `molecule-docker` driver, or tox.\n\n### Run tests manually, using molecule directly\n\nYou can existing tests for star and ring topologies:\n```bash\ncd ansible-tinc\nmolecule test # this run default tests for Ring scenario\nmolecule test -s star\n```\n\nThe 'molecule test' command execute full scenario: 'create', 'converge', 'check idempotency', 'verify' and 'destroy' steps. Often you don't want to have container immediately destroyed and need access it for debug. For this might be useful replace 'molecule test' with:\n\n```bash\nmolecule converge # this create containers and apply the role\nmolecule verify # run tests described in molecule/default/verify.yml\n\n# after both steps you have live Docker containers\n# you can access them with usual commands 'docker ps', 'docker exec' etc\n\nmolecule destroy\n```\n\n### Run tests manually, using tox\n\ntox is a test runner for python. It will install all the necessary python dependencies (ansible, molecule[docker]) in a virtual environment.\n\nTo run a test:\n\n```bash\ntox -e ansible-\u003cversion\u003e-\u003ctinc scenario\u003e\n```\n\nSee supported values for `version` in `tox.ini`.\nCurrent testable scenarios for tinc are `ring`, or `star`.\nPositional arguments will be passed to the `molecule test` command.\n\nFor example, to run a test for ansible-2.9, with the ring topology and prevent molecule to destroy the environment:\n\n```bash\ntox -e ansible-2.9-ring -- --destroy=never\n```\n\n## How to test role with new OS\n\nadd new image to [molecule/default/molecule.yml](molecule/default/molecule.yml) and [molecule/star/molecule.yml](molecule/star/molecule.yml) following existing examples. Files are similar except the variables `scenario.name` and `groups`. Next hightlights could be hepful:\n\n- code `privileged: true` with `command: /sbin/init` enable systemd if container  support it. Please don't forget that privileged containers in your system could be a risk.\n- Docker images lack some standard software, so [molecule/default/converge.yml](molecule/default/converge.yml) take care about installing necessary dependencies\n- according with https://github.com/ansible-community/molecule/issues/959 Docker doesn't allow modify /etc/hosts in a container. To workaround this we skipping one step with `molecule-notest` tag in [tasks/tinc_configure.yml](tasks/tinc_configure.yml) and modifying /etc/hosts during container creation - following the corresponding directives in [molecule/default/molecule.yml](molecule/default/molecule.yml)\n\n\n## License\n\nApache2\n\n## Author Information\n\nJean-Philippe Evrard\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fevrardjp%2Fansible-tinc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fevrardjp%2Fansible-tinc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fevrardjp%2Fansible-tinc/lists"}