Move WireGuard gateway to Aegis

ansible/inventory/host_vars/aegis.yml

@@ -15,6 +15,26 @@ aegis_host_dns_servers:
   - 192.168.178.1
 aegis_host_dns_search_domains:
   - fritz.box
+
+# Aegis is the internal WireGuard endpoint and NAT gateway for the LAN.
+wireguard_overlay_enabled: true
+wireguard_address: 10.0.0.2/24
+wireguard_enable_ipv4_forwarding: true
+wireguard_reload_rootful_podman_networks: true
+wireguard_forwarding_policies:
+  - name: aegis-wireguard-to-lan
+    ingress_zone: wireguard
+    egress_zone: public
+    source: 10.0.0.0/24
+    destination: "{{ aegis_lan_subnet }}"
+    masquerade: true
+wireguard_peers:
+  - name: prometheus
+    host: prometheus
+    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
+    allowed_ips:
+      - 10.0.0.0/24
+    persistent_keepalive: 25
 aegis_ssh_authorized_keys:
   - name: ikaros
     key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"

ansible/inventory/host_vars/atlas.yml

@@ -52,19 +52,9 @@ atlas_manage_storage: true
 atlas_manage_sharing: true
 atlas_manage_media_stack: false
 
-wireguard_overlay_enabled: true
-wireguard_address: 10.0.0.2/24
-wireguard_peers:
-  - name: prometheus
-    host: prometheus
-    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
-    allowed_ips:
-      - 10.0.0.0/24
-    persistent_keepalive: 25
-
-backend_phase1_enabled: true
-backend_phase1_start_services: false
-backend_phase1_wireguard_address: 10.0.0.2
+# Atlas is a NAS-only host. WireGuard is retired manually on the host and is
+# intentionally no longer managed here.
+backend_phase1_enabled: false
 
 rocky_manage_openzfs_repo: true
 rocky_manage_syncthing_binary: false

ansible/inventory/host_vars/prometheus.yml

@@ -21,10 +21,12 @@ wireguard_listen_port: 51820
 wireguard_enable_ipv4_forwarding: true
 wireguard_reload_rootful_podman_networks: true
 wireguard_peers:
-  - name: atlas
-    host: atlas
+  - name: aegis
+    host: aegis
+    # TODO: Aggiungere VIP di Uranus in futuro
     allowed_ips:
       - 10.0.0.2/32
+      - 192.168.178.0/24
 
 host_packages:
   - cockpit

ansible/inventory/hosts.yml

@@ -99,7 +99,7 @@ all:
     wireguard_overlay:
       hosts:
         prometheus:
-        atlas:
+        aegis:
 
     role_backend_phase1:
       hosts: