Skip to content
ansible-Scripts to build new VPN-Gateways
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
behave tasksite-Rolle (Phabricator) hinzufügen (#64) May 23, 2016
filter_plugins backbone-gre: Bring up interfaces immediately Apr 3, 2016
group_vars Increased fastd peer limit Jan 6, 2019
host_vars vpn0[25]: Replace uplink peer addresses Mar 7, 2019
library fastd_key prepare python3 May 19, 2018
playbooks Switched to new backup script Jan 2, 2019
site @ 3c89298
vagrant Add vagrant configuration Jul 28, 2015
.gitignore Store secret variables in GPG encrypted host_vars, loaded by inventory ( Jan 4, 2019
.gitmodules Add site configuration as submodule Aug 22, 2015 remove unnecessary alfred-announce-cleanup role May 18, 2018
ansible.cfg Make ansible_managed static Feb 26, 2017
hosts Synced to reality Jan 11, 2019

Ansible Freifunk Bremen

In this repository are playbooks for deploying services on Freifunk Bremen machines.


apt-get install python-dnspython ca-certificates


  • services: Generic service host for Freifunk Bremen community.
  • vpnserver: vpnserver sets up a Freifunk Bremen gateway.


Community related variables are defined in site/site.conf and group_vars/all.yml. This variables are used by the ansible-tasks.

pgp_keyserver:        ''
site_git_root:        ''
site_city:            'bremen'
site_domain:          ''
site_vpn_prefix:      'vpn'
icvpn_as:             65196
fastd_peers_limit:    150

Other communities need to modify this variables.


The hosts-file defines all machines where our services are deployed on as well as community related variables. For other communities the variables are to be changed. Variables:

ipv6_local_network  = "fd75:3707:b8c2::/64",
icvpn_ipv4_network  = "",
icvpn_ipv6_network  = "fec0::a:cf:0:c4/96",



with exit_ipv4=openvpn/gre and ansible_ssh_port=* (both optional).

Gateway Playbook

Playbook vpnserver sets up a Freifunk Bremen gateway. When executed additional variabels need to be defined. For example to set up a Freifunk gateway on vpn05 the following command is used:

ansible-playbook playbooks/vpnserver.yml -e "exit_ipv6_remote=* exit_ipv4_openvpn_username=* exit_ipv4_openvpn_password=*"

Username, host and password can be found by your exit-vpn provider.

For detailed information about the roles see inside of the role.


After setting up a vpnserver you have to do something by hand.

Create DNS-Entries

In Bremen you need a VPN-Entry and NTP-Entry.

Add fastd-public-key to site.confg

You got your key from running

fastd --show-key -c /etc/fastd/{{site_code}}/fastd.conf

Then add it to your site.conf - From Bremen you found it here

Do not forget to add NTP-Server either.

Add vpn to icvpn

Publish your tinc Public-key to IC-VPN. Your found your one /etc/tinc/icvpn/hosts/{{site_city}}{{id}}. So other IC-VPN-Servers could create a vpn-Connection to your VPN.

Add vpn to icvpn-meta

Add your new VPN to the IC-VPN-Meta to get the bgp routing active on other Host from other communitys.

Add bgp internal routing

Ask to other VPN-Owner to run ansible again. On this way the other vpns got the new internal routing in bird and bird6. See here

You can’t perform that action at this time.