gitirabassi/vault-plugin-secrets-wireguard

Vault's plugin for managing server and dynamic client configurations

Vault-secret-plugin-wireguard

NOTA BENE: this is still WIP, basic functionalities are still not fully implemented

Paths

• GET/POST/DELETE /config
  • cidr --> 10.20.0.0/24
• GET/POST/DELETE /servers/:server_name
  • port --> defaults to 51820
  • public_endpoint -->
  • post_up_script
  • post_down_script
  • private_webhook_address --> defaults to public_endpoint in case it's not specified
  • allowed_ips --> list of subnets to route traffic trhu this server can be ["0.0.0.0/0"] or ["10.0.0.0/24","192.68.0.0/24"]
• GET/POST/DELETE /roles/:role_name
  • servers --> list of servers to connect to ["default", "aws-europe", "gcp-testing"] --> must exist :server_name
  • dns
  • client_persistent_keepalive --> defaults to 25 seconds
  • client_subnet_mask --> defaults to 32
• GET /creds/:role_name
  • conf --> complete wireguard configuration to be used with wg-quick for a client
• GET /server-creds/:server_name
  • conf --> complete wireguard configuration to be used with wg-quick for a client
  • webhook_secret --> webhook secret that vault will use to POST updates to wireguard servers

Apply policy

vault policy write wireguard_client_develper contrib/client.hcl

Client User Experience

export VAULT_ADDR=https://vault.example.com
vault status
vault login -method=oidc
vault read -field=conf wireguard/crets/default |clipcopy

Terraform deployment

IMPORTANT: this cannot be applied all at once as it will breack. there is a order:

• First create Vault server without TLS
• Configure DNS such that will resolve your domain to the host
• enable TLS
• Create Wireguard server disabling agent
• Configure vault with right servers and configurations

2 main changes need to happen to this example:

• ssh key: if you use github to distribute your public ssh key, please add your account name instead of someone in the github link
• change the vault_address and module.dns.domain to match your domain

The modules are opinionated:

• both Vault and Wireguard server create and live in their own VPC
• these VPCs are dedidcated to running them, and them only.
• You shuould enable Aws Ec2 Transit Gateways or VPC to connect the Wireguard Server with your VPC.
• THis way you'll get much more control of what goes where and you may have different VPCs connect to the Wireguard VPC

A video recording on how to do all this will come very soon

provider "aws" {
  region = "eu-central-1"
}

data "http" "ssh_key" {
  url = "https://github.com/someone.keys"
}

resource "aws_key_pair" "main" {
  key_name   = "wireguard_infra_key"
  public_key = data.http.ssh_key.body
}

variable vault_address {
  default = "vault.example.com"
}

module "dns" {
  source = "github.com/gitirabassi/vault-plugin-secrets-wireguard//terraform/route53"
  domain = "example.com"
  a_records = {
    "vault"   = module.vault-server.public_ip
    "first-wireguard-server" = module.wireguard-server.public_ip
  }
}

module "vault-server" {
  source        = "github.com/gitirabassi/vault-plugin-secrets-wireguard//terraform/vault-server"
  name          = "vault-server"
  vpc_cidr      = "10.210.0.0/16"
  vault_address = var.vault_address
  instance_type = "t3.small"
  region        = "eu-central-1"
  ssh_key_name  = aws_key_pair.main.key_name
  enable_ssh    = false
  auto_tls      = true
}

module "wireguard-server" {
  source              = "github.com/gitirabassi/vault-plugin-secrets-wireguard//terraform/wg-server"
  name                = "wireguard-server"
  vpc_cidr            = "10.220.0.0/16"
  vault_address       = "https://${var.vault_address}"
  vault_role_name     = "wireguard-server"
  webhook_source_cidr = "${module.vault-server.public_ip}/32"
  instance_type       = "t3.small"
  ssh_key_name        = aws_key_pair.main.key_name
  enable_ssh          = true
  disable_agent       = true
}

provider "vault" {
  address = "https://${var.vault_address}"
}

module "vault-configuration" {
  source             = "github.com/gitirabassi/vault-plugin-secrets-wireguard//terraform/vault-config"
  backend_mount_path = "wireguard"
  wireguard_cidr     = "172.16.0.0/16"
  servers = {
    "wireguard-server" = {
      address  = module.wireguard-server.public_ip
      port     = module.wireguard-server.public_port
      role_arn = module.wireguard-server.role_arn
      vpc_id   = module.wireguard-server.vpc_id
      region   = "eu-central-1"
    },
  }
}

Webhook

The webook is a trick to not make the wireguard poll every X secods but to reload it's configuration only when a user gets added or deleted

To simulate the hook that Vault will send to the wg-server-agent curl can be used

curl -XPOST -H 'Content-Type: application/json' -d '{"token":"example-super-secret-token"}' http://dev.aws.example.com:51821/webhook

Future features

• rotate server keys (find a ways to use multiple keys to make migration smoother)

vault-plugin-secrets-wireguard's Issues

Add WIP disclaimer in README

Hey guys, really nice idea for a project - just want to check if this was more of a one-off hackathon thing or if it's something you aim to continue working on?

(AFAICT it's only half-way to working; only static placeholder values are returned from supposedly dynamic endpoints)

In either case, it would be great to add a disclaimer about the status at the top of the README so people who discover the repo know what to expect.

Cheers

Updates?

This is exactly what I need, but it hasn't been updated in almost 2 months.

Any forthcoming updates on this plugin? Is the project still active?

Github Release?

Is it possible to compile and add releases to github? I'm using this in a docker and I would like to pull the latest release without compiling myself :)

no updates?

i can say this, i for one would really like to see this finished, ive got everything already deployed, vault and wireguard, be nice if i could literally tie them together to automate users keys via device on boot. what would it take to get it done?

Hello From HashiCorp Vault team

Hi,
This is not really an issue. I am from the HashiCorp Vault team looking to do some interviews with plugin developers. I saw some of your livecast when you were developing the wireguard vault plugin and wanted to just chat about your experience in writing a plugin.

this is regarding some new features we are planning on introducing in future releases.
Would you be willing to meet some time this week or next week?

Thanks in advance!!