fix: alice/ionosのVIP・BGP prefix・WireGuard AllowedIPs・/etc/wireguard権限の不一致を修正

hardware/alice/main.tf

@@ -58,23 +58,23 @@ locals {
 
 data "external" "ssh_key" {
   program = ["bash", "-c", <<-EOT
-    value=$(bws secret get "${var.ssh_key_bitwarden_id}" | jq -r '.value')
+    value=$(bws secret get "${var.ssh_key_bitwarden_id}" --color no | jq -r '.value')
     jq -n --arg value "$value" '{"value": $value}'
   EOT
   ]
 }
 
 data "external" "sudo_password" {
   program = ["bash", "-c", <<-EOT
-    value=$(bws secret get "${var.sudo_password_bitwarden_id}" | jq -r '.value')
+    value=$(bws secret get "${var.sudo_password_bitwarden_id}" --color no | jq -r '.value')
     jq -n --arg value "$value" '{"value": $value}'
   EOT
   ]
 }
 
 data "external" "inuyama_wireguard_public_key" {
   program = ["bash", "-c", <<-EOT
-    value=$(bws secret get "${var.inuyama_wireguard_public_key_bitwarden_id}" | jq -r '.value')
+    value=$(bws secret get "${var.inuyama_wireguard_public_key_bitwarden_id}" --color no | jq -r '.value')
     jq -n --arg value "$value" '{"value": $value}'
   EOT
   ]
@@ -139,7 +139,7 @@ resource "null_resource" "alice_gateway" {
       apt-get update -y
       apt-get install -y ca-certificates frr haproxy iproute2 iptables prometheus-node-exporter ufw wireguard
 
-      install -d -m 700 /etc/wireguard
+      install -d -m 711 /etc/wireguard
 
       rm -f /etc/sysctl.d/99-wireguard-forward.conf
       rm -f /etc/wireguard/server_private.key /etc/wireguard/server_public.key

hardware/alice/variables.tf

@@ -59,6 +59,7 @@ variable "wireguard_peer_allowed_ips" {
   default = [
     "172.31.255.1/32",
     "192.168.1.0/24",
+    "10.0.0.0/24",
   ]
 }
 
@@ -96,7 +97,7 @@ variable "bgp_router_id" {
 variable "inuyama_accepted_prefixes" {
   type = list(string)
   default = [
-    "192.168.1.0/24",
+    "10.0.0.0/24",
   ]
 }
 
@@ -108,19 +109,19 @@ variable "alice_advertised_prefixes" {
 variable "inuyama_ingress_vip" {
   description = "Inuyama ingress VIP for alice HTTP/HTTPS forwarding. Empty disables those HAProxy frontends."
   type        = string
-  default     = "192.168.1.240"
+  default     = "10.0.0.240"
 }
 
 variable "minecraft_backend_vip" {
   description = "Inuyama Minecraft backend VIP for alice TCP/25565 forwarding. Empty disables that HAProxy frontend."
   type        = string
-  default     = "192.168.1.241"
+  default     = "10.0.0.241"
 }
 
 variable "k8s1_wireguard_public_key" {
   description = "k8s1 の WireGuard 公開鍵 (空の場合はピア設定なし)"
   type        = string
-  default     = ""
+  default     = "HZ5NneXNytqEanGjJSLDE5ncHk440O2fXxUmXDyOKDw="
 }
 
 variable "k8s1_wireguard_address" {
@@ -132,7 +133,7 @@ variable "k8s1_wireguard_address" {
 variable "k8s2_wireguard_public_key" {
   description = "k8s2 の WireGuard 公開鍵 (空の場合はピア設定なし)"
   type        = string
-  default     = ""
+  default     = "+PuboGsR5IW7ODJ+h7tKXfaeQeTZyC9dsGJPBKos+iY="
 }
 
 variable "k8s2_wireguard_address" {

hardware/ionos/main.tf

@@ -183,7 +183,7 @@ resource "null_resource" "ionos_gateway" {
       apt-get update -y
       apt-get install -y ca-certificates frr haproxy iproute2 iptables prometheus-node-exporter ufw wireguard
 
-      install -d -m 700 /etc/wireguard
+      install -d -m 711 /etc/wireguard
 
       if [ ! -f /etc/wireguard/ionos_private.key ]; then
         wg genkey > /etc/wireguard/ionos_private.key

hardware/ionos/variables.tf

@@ -65,7 +65,7 @@ variable "wireguard_peer_allowed_ips" {
   type = list(string)
   default = [
     "172.31.254.1/32",
-    "192.168.1.0/24",
+    "10.0.0.0/24",
   ]
 }
 
@@ -103,7 +103,7 @@ variable "bgp_router_id" {
 variable "inuyama_accepted_prefixes" {
   type = list(string)
   default = [
-    "192.168.1.0/24",
+    "10.0.0.0/24",
   ]
 }
 

hardware/k8s4/main.tf

@@ -126,7 +126,7 @@ resource "null_resource" "inuyama_wireguard" {
       apt-get -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold install -f -y
       apt-get -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold install -y ca-certificates wireguard
 
-      install -d -m 700 /etc/wireguard
+      install -d -m 711 /etc/wireguard
 
       derived_public_key=$(wg pubkey < /tmp/inuyama-wireguard-private.key)
       configured_public_key="${data.external.inuyama_wireguard_public_key.result.value}"
@@ -259,15 +259,15 @@ module "bgp" {
       neighbor_ip     = var.alice_wireguard_address
       neighbor_as     = var.alice_bgp_as
       import_prefixes = []
-      export_prefixes = ["10.0.0.0/16"]
+      export_prefixes = ["10.0.0.0/24"]
     },
     {
       local_ip        = trimsuffix(var.ionos_wireguard_address, "/30")
       local_as        = var.inuyama_asn
       neighbor_ip     = "172.31.254.2"
       neighbor_as     = var.ionos_bgp_as
       import_prefixes = []
-      export_prefixes = ["10.0.0.0/16"]
+      export_prefixes = ["10.0.0.0/24"]
     }
   ]
 }

hardware/modules/wireguard/main.tf

@@ -27,7 +27,7 @@ resource "null_resource" "wireguard" {
       apt-get update -y
       apt-get install -y wireguard
 
-      install -d -m 700 /etc/wireguard
+      install -d -m 711 /etc/wireguard
 
       if [ ! -f /etc/wireguard/privatekey ]; then
         wg genkey > /etc/wireguard/privatekey