Vpn¶

VPN¶

This service will change during TPA-RFC-73: Tails infra merge roadmap and this page should be updated when that happens.

We're using a VPN between our different machines to interconnect them. This is especially important for machines that host VMs without public IPs, as this may be the most practical way of communicating with other systems.

this documentation does not take into account the changes done in puppet-tails commit da321073 and friends.

Installation¶

Once you installed the system on a new machine, you'll need to setup the VPN by hand on it, right before you can go on with the puppet client setup and first run.

On the new system
```
 apt-get install tinc
```

Generate the SSL key pair for this host:

 export VPN_NAME=tailsvpn
 export VPN_HOSTNAME=$(hostname)
 mkdir -p /etc/tinc/$VPN_NAME/hosts
 tincd -n $VPN_NAME -K4096

Mark the VPN as autostarting:

 echo "$VPN_NAME" >> /etc/tinc/nets.boot
 systemctl enable tinc@tailsvpn.service

Create a new host configuration file in Puppet (site/profile/files/tails/vpn/tailsvpn/hosts/$VPN_HOSTNAME). Use another one as example. You just need to change the Address field, the Subnet one, and put the right RSA public key.
Make sure that the node includes the profile::tails::vpn::instance class. Note that this profile is alreadyn included by the role::tails::physical class.
Run the Puppet agent.
Restart the tinc@tailsvpn service:

systemctl restart tinc@tailsvpn