Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
This branch is 14 commits ahead of ccollicutt:master.

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


This playbook generates tinc config for whole tinc vpn network (including clients), and deploys generated configs to ssh reachable hosts. It factually reduces tinc network setup to writing single hosts file.


  • support for tinc 1.0 and 1.1
  • config generation works without tinc installed
  • generates whole configuration localy
  • generates also hosts and zone files
  • pre-generates all needed handler scripts
  • supports node visibility configuration (some nodes might be firewalled)


Create a tinc hosts file with host group coresponding to desired tinc network name (netname).

$ cat /etc/tinc/hosts
gw1	ansible_ssh_host=vpn-host1	tinc_ip=
gw2	ansible_connection=local	tinc_ip= tinc_subnet='["",""]'
gw3	ansible_ssh_host=vpn-host3	tinc_ip=	tinc_subnet='' tinc_port=1655
client1	ansible_connection=local	tinc_ip=
client2 ansible_connection=local	tinc_ip= os_family=Android tinc_connect='["gw1","gw2"]'
# gw4 is visible only from gw3 !
gw4	ansible_ssh_host=vpn-host4	tinc_ip=	tinc_visible_from='["gw3"]'

Next up, run ansible:

$ ansible-playbook site.yml -e netname=vpn1

If that completes OK, all the hosts in host group specified via netname variable and accessible via ssh (ansible_connection != local) will have tinc configured and running. All other hosts will have tinc configuration generated in config directory (/etc/tinc/netname/config), so it can be distributed manualy as necessary.

If you want to auto setup tinc on local node, you can not configure it as ansible_connection=local, because this will not deploy generated scripts. But this will not slow down local script generation - configuration for every node is first localy generated and only after that synchronized to remote node.

If you want to only generate configuration, and distribute it yourself just run:

$ ansible-playbook site.yml -e netname=vpn1 -t config

IP addressing

It is required to specify tinc_ip for each host in ansible hosts file. This ip will be then configured on host, and used for vpn routing. It is also possible to override additional subnets that are reachable via given hosts via tinc_subnect.

Config variables

There are additional variables provided, that will override default settings. They can be defined per-host in hosts file or globaly by ansible invocation via -e parameter.

  • tinc_ip - host internal vpn ip (required)
  • tinc_hostname - host internal hostname, used to generated internal hosts file and zone file (default = inventory_hostname)
  • tinc_remote - host remote address, if it is differs form ansible_ssh_host or is not reachable via ssh at all (default = ansible_ssh_host)
  • tinc_port - specify different port to listen to (default = 655)
  • tinc_subnet - subnets that should be assigned to given tinc host (default = tinc_ip/32)
  • tinc_compression - specify tinc compression level (default = 10)
  • tinc_indirect - set IndirectData (default = 'no')
  • tinc_connect - by default all hosts will connect only to public hosts (where ansible_connection != local), with this you can override this
  • tinc_visible_from - specify which hosts are only able to connect to this node (ie. all other are firewalled)
  • os_family - override ansible_os_family, this is specially there for Android clients

Custom Up/Down scripts

Generated tinc up/down scripts residing in tinc network directory (like /etc/tinc/netname/tinc-up, subnet-up, ...etc) should not be modified. Because they can be anytime regenerated, there exists a possibility to setup on-site scripts, that will be automaticaly executed from generated tinc up/down script. This scripts should reside in tinc parent directory (obviously /etc/tinc) - see generated scripts for details. Note: along with default tinc script variables there are also few others provided via /etc/tinc/netname/


Ansible playbook that generates and deploys configs for all nodes from simple hosts file







No packages published


  • Python 100.0%