Skip to content

Commit da88eda

Browse files
serinkoserinko
committed
finish deploy and bond
1 parent 6daa7dc commit da88eda

File tree

13 files changed

+212
-149
lines changed

13 files changed

+212
-149
lines changed

‎ansible/nym-node/playbooks/group_vars/all.yml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,25 @@ ansible_ssh_private_key_file: ~/.ssh/<SSH_KEY>
1010

1111
cli_url: "https://github.com/nymtech/nym/releases/download/nym-binaries-{{ nym_version }}/nym-cli"
1212
tunnel_manager_url: "https://github.com/nymtech/nym/raw/refs/heads/develop/scripts/nym-node-setup/network-tunnel-manager.sh"
13-
quic_bridge_deployment_url: "https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh"
14-
15-
operator_name: "<OPERATOR_NAME>"
16-
17-
main_domain: "<DOMAIN>"
13+
quic_bridge_deployment_url: "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh"
1814

1915
# NOTE: These values will be used globally unless overwritten per node in inventory/all
20-
2116
ansible_user: root
2217
email: "<EMAIL>"
23-
website: "<WEBSITE>""
24-
description: "<NODE_PUBLIC_DESCRIPTION>"
25-
moniker: "<MONIKER>"
26-
description: "<DESCRIPTION>"
18+
website: "<WEBSITE>" # it will be used in the description.toml
19+
description: "<NODE_PUBLIC_DESCRIPTION>" # or define per node in inventory/all
20+
21+
# NOTE:
22+
# Set these vars if you want them globally for all nodes
23+
# Per node in inventory/all will overwrite these global ones:
24+
hostname: "" # this is a fallback, keep it and setup hostname per node in inventory/all
25+
# moniker: "<MONIKER>"
2726
# mode: <MODE> # entry-gateway/exit-gateway/mixnode
2827
# wireguard_enabled: <WIREGUARD_ENABLED> # true/false
2928

29+
# NOTE: Possible vars to incule on landing page, etc.
30+
# operator_name: "<OPERATOR_NAME>"
31+
3032
packages:
3133
- tmux
3234
- speedtest-cli
@@ -39,6 +41,5 @@ packages:
3941
- neovim
4042
- ca-certificates
4143
- jq
42-
- curl
4344
- wget
4445
- ufw

‎ansible/nym-node/playbooks/inventory/all‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
#
77
# node1 ansible_host=<YOUR_SERVER_IP> ansible_user=<USER> hostname=<HOSTNAME> location=<LOCATION> email=<EMAIL> mode=<MODE> wireguard_enabled=<true/false> moniker=<MONIKER> description=<DESCRIPTION>>
88
#
9-
# anything setup globaly can be removed from here
9+
# anything setup globaly can be overwritten
1010
# if provided here, it overwrites the global setting per node
1111
#
1212
# example exit + wireguard gateway:
@@ -18,6 +18,4 @@
1818
# NOTE:
1919
#
2020
# all examples above don't have defined user, email nor description as we use the definition from group_vars/main.yml without an attempt of overwriting it
21-
# all examples above don't have moniker defined as there is a function in /templates/description.toml.j2 deriving it from the hostname
22-
23-
21+
# all examples above don't have moniker defined as there is a function in /templates/description.toml.j2 deriving it from the hostname

‎ansible/nym-node/roles/base/tasks/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
- name: Set hostname
22
hostname:
33
name: "{{ hostname }}"
4+
when: hostname is defined and hostname | length > 0
45

56
- name: Install aptitude
67
apt:

‎ansible/nym-node/roles/nginx/tasks/templates/nginx-site.conf.j2‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
server {
22
listen 80;
33
listen [::]:80;
4+
45
server_name {{ hostname }};
56

67
location / {

‎ansible/nym-node/roles/nginx/tasks/templates/wss-config.conf.j2‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
server {
2-
listen 9001 ssl;
3-
listen [::]:9001 ssl;
2+
listen 9001 ssl http2;
3+
listen [::]:9001 ssl http2;
44

55
server_name {{ hostname }};
66

@@ -10,7 +10,7 @@ server {
1010
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
1111

1212
access_log /var/log/nginx/access.log;
13-
error_log /var/log/nginx/error.log;
13+
error_log /var/log/nginx/error.log;
1414

1515
location /favicon.ico {
1616
return 204;
@@ -19,10 +19,10 @@ server {
1919
}
2020

2121
location / {
22-
add_header 'Access-Control-Allow-Origin' '*';
23-
add_header 'Access-Control-Allow-Credentials' 'true';
24-
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, HEAD';
25-
add_header 'Access-Control-Allow-Headers' '*';
22+
add_header 'Access-Control-Allow-Origin' '*' always;
23+
add_header 'Access-Control-Allow-Credentials' 'true' always;
24+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, HEAD' always;
25+
add_header 'Access-Control-Allow-Headers' '*' always;
2626

2727
proxy_http_version 1.1;
2828
proxy_set_header Upgrade $http_upgrade;

‎ansible/nym-node/roles/nym/defaults/main.yml‎

Lines changed: 41 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
1-
- name: Configure UFW rules
2-
ufw:
3-
rule: allow
4-
port: "{{ item.port }}"
5-
proto: "{{ item.proto }}"
6-
loop:
7-
- { port: 22, proto: tcp }
8-
- { port: 80, proto: tcp }
9-
- { port: 443, proto: tcp }
10-
- { port: 1789, proto: tcp }
11-
- { port: 1790, proto: tcp }
12-
- { port: 8080, proto: tcp }
13-
- { port: 9000, proto: tcp }
14-
- { port: 9001, proto: tcp }
15-
- { port: 51822, proto: udp }
16-
17-
- name: Enable UFW
18-
ufw:
19-
state: enabled
1+
---
2+
# Where binaries live
3+
nym_install_dir: /root/nym-binaries
4+
5+
# nym-node run arguments (defaults, can be overridden per host/group)
6+
mode: "gateway" # maps to --mode
7+
http_bind_address: "0.0.0.0:8080" # maps to --http-bind-address
8+
mixnet_bind_address: "0.0.0.0:1789" # maps to --mixnet-bind-address
9+
location: "unknown" # maps to --location
10+
11+
# WireGuard boolean
12+
wireguard_enabled: "{{ wireguard_enabled | default(false) | bool }}"
13+
14+
# Landing page base dir, hostname is appended in the task
15+
landing_page_assets_base_dir: "/var/www"
16+
17+
# Flag toggles
18+
accept_operator_terms: true # controls --accept-operator-terms-and-conditions
19+
nym_write_flag: true # controls -w
20+
nym_init_only_flag: true # controls --init-only
21+
wss_port: 9001 # controlls --announce-wss-port
22+
23+
# Optional: extra flags if you want to append more later
24+
nym_extra_flags: ""
25+
26+
# CLI URL (nym_version can be set elsewhere / via GitHub API)
27+
nym_cli_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-cli"
28+
29+
# UFW
30+
nym_ufw_enable: true
31+
32+
nym_ufw_rules:
33+
- { port: 22, proto: tcp }
34+
- { port: 80, proto: tcp }
35+
- { port: 443, proto: tcp }
36+
- { port: 1789, proto: tcp }
37+
- { port: 1790, proto: tcp }
38+
- { port: 8080, proto: tcp }
39+
- { port: 9000, proto: tcp }
40+
- { port: 9001, proto: tcp }
41+
- { port: 51822, proto: udp }

‎ansible/nym-node/roles/nym/tasks/config.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
# Useful when the host is behind a NAT
3+
- name: Fetch the public IP address
4+
command: "curl -4 canhazip.com"
5+
register: ipv4
6+
changed_when: false
7+
failed_when: false
8+
9+
- name: Set public IP address
10+
set_fact:
11+
public_ip: "{{ ipv4.stdout | default(ansible_default_ipv4.address) }}"
12+
13+
- name: Initialize nym node
14+
# Delete the part from --hostname onward if you run mode=mixnode only
15+
command:
16+
cmd: >
17+
{{ nym_install_dir }}/nym-node run
18+
--mode {{ mode }}
19+
--public-ips {{ public_ip }}
20+
--http-bind-address {{ http_bind_address }}
21+
--mixnet-bind-address {{ mixnet_bind_address }}
22+
--location {{ location }}
23+
{% if accept_operator_terms %}--accept-operator-terms-and-conditions{% endif %}
24+
25+
{{ nym_extra_flags }}
26+
27+
--hostname {{ hostname }}
28+
--wireguard-enabled {{ wireguard_enabled }}
29+
--landing-page-assets-path {{ landing_page_assets_base_dir }}/{{ hostname }}/
30+
{% if nym_write_flag %}-w{% endif %}
31+
{% if nym_init_only_flag %}--init-only{% endif %}
32+
--announce-wss-port {{ wss_port }}
33+
34+
35+
- name: Update nym description
36+
template:
37+
src: description.toml.j2
38+
dest: /root/.nym/nym-nodes/default-nym-node/data/description.toml

‎ansible/nym-node/roles/nym/tasks/firewall.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
- name: Configure UFW rules
2+
ufw:
3+
rule: allow
4+
port: "{{ item.port }}"
5+
proto: "{{ item.proto }}"
6+
comment: "{{ item.comment | default(omit) }}"
7+
loop: "{{ nym_ufw_rules }}"
8+
loop_control:
9+
label: "{{ item.port }}/{{ item.proto }}"
10+
when:
11+
- nym_ufw_enable
12+
- item.when | default(true)
13+
14+
- name: Allow bandwidth/topup rule inside WG tunnel
15+
command: >
16+
ufw allow in on nymwg to any port 51830 proto tcp comment 'bandwidth queries/topup'
17+
when:
18+
- nym_ufw_enable
19+
- (wireguard_enabled | bool)
20+
21+
- name: Enable UFW
22+
ufw:
23+
state: enabled
24+
when:
25+
nym_ufw_enable

‎ansible/nym-node/roles/nym/tasks/install.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
- name: Create nym directory
3+
file:
4+
path: "{{ nym_install_dir }}"
5+
state: directory
6+
mode: "0755"
7+
8+
- name: Get latest Nym release metadata
9+
uri:
10+
url: https://api.github.com/repos/nymtech/nym/releases/latest
11+
return_content: yes
12+
register: latest_release
13+
when: nym_version is not defined or nym_version == 'latest'
14+
15+
- name: Set nym_version from GitHub API
16+
set_fact:
17+
nym_version: "{{ latest_release.json.tag_name }}"
18+
when: nym_version is not defined or nym_version == 'latest'
19+
20+
- name: Set binary URL
21+
set_fact:
22+
binary_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-node"
23+
24+
- name: Download nym-node binary
25+
get_url:
26+
url: "{{ binary_url }}"
27+
dest: "{{ nym_install_dir }}/nym-node"
28+
mode: "0755"
29+
30+
- name: Download nym-cli binary
31+
get_url:
32+
url: "{{ nym_cli_url }}"
33+
dest: "{{ nym_install_dir }}/nym-cli"
34+
mode: "0755"

‎ansible/nym-node/roles/nym/tasks/main.yml‎

Lines changed: 9 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,70 +1,12 @@
1-
- name: Create nym directory
2-
file:
3-
path: "/root/nym-binaries"
4-
state: directory
5-
mode: "0755"
1+
---
2+
- name: Install Nym binaries
3+
import_tasks: install.yml
64

7-
- name: Get latest Nym release metadata
8-
uri:
9-
url: https://api.github.com/repos/nymtech/nym/releases/latest
10-
return_content: yes
11-
register: latest_release
12-
when: nym_version is not defined
5+
- name: Configure Nym node
6+
import_tasks: config.yml
137

14-
- name: Set nym_version from GitHub API
15-
set_fact:
16-
nym_version: "{{ latest_release.json.tag_name }}"
17-
when: nym_version is not defined
8+
- name: Configure firewall for Nym
9+
import_tasks: firewall.yml
1810

19-
- name: Generate binary_url from version
20-
set_fact:
21-
binary_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-node"
22-
23-
- name: Download nym-node binary
24-
get_url:
25-
url: "{{ binary_url }}"
26-
dest: "/root/nym-binaries/nym-node"
27-
mode: "0755"
28-
29-
- name: Download nym-cli binary
30-
get_url:
31-
url: "{{ cli_url }}"
32-
dest: "/root/nym-binaries/nym-cli"
33-
mode: "0755"
34-
35-
- name: Template systemd service
36-
tags: systemctl
37-
template:
38-
src: nym-node.service.j2
39-
dest: /etc/systemd/system/nym-node.service
40-
41-
# Useful when the host is behind a NAT
42-
- name: Fetch the public IP address
43-
command: "curl -4 canhazip.com"
44-
register: ipv4
45-
changed_when: false
46-
47-
- name: Show IP address
48-
debug:
49-
msg: "{{ ipv4.stdout }}"
50-
51-
- name: Set public IP address based on curl result
52-
set_fact:
53-
public_ip: "{{ ipv4.stdout if ipv4.rc == 0 else ansible_default_ipv4.address }}"
54-
55-
- name: Initialize nym node
56-
command:
57-
cmd: "/root/nym-binaries/nym-node run --mode {{ mode }} --public-ips {{ public_ip }} --hostname {{ hostname }} --http-bind-address 0.0.0.0:8080 --mixnet-bind-address 0.0.0.0:1789 --location {{ location }} --accept-operator-terms-and-conditions --wireguard-enabled {{ wireguard_enabled }} --landing-page-assets-path /var/www/{{ hostname }}/ -w --init-only"
58-
59-
- name: Update nym description
60-
template:
61-
src: description.toml.j2
62-
dest: /root/.nym/nym-nodes/default-nym-node/data/description.toml
63-
64-
- name: Enable and start nym service
65-
tags: systemctl
66-
systemd:
67-
name: nym-node
68-
enabled: yes
69-
state: started
70-
daemon_reload: yes
11+
- name: Configure and start Nym service
12+
import_tasks: service.yml

0 commit comments

Comments
 (0)