ansible-openwisp2

The openwisp.openwisp2 role provides a limited abstraction for django-cors-headers via the openwisp2_django_cors variable. To configure settings not covered by the standard abstraction (such as CORS_ALLOW_CREDENTIALS or CORS_ALLOW_ALL_ORIGINS), use the openwisp2_extra_django_settings_instructions variable.

This variable accepts a list of strings, where each string contains valid Python code that will be used to set Django settings.

- hosts: openwisp2
  become: "{{ become | default('yes') }}"
  roles:
    - openwisp.openwisp2
  vars:
    openwisp2_django_cors:
      enabled: true
      allowed_origins_list:
        - https://frontend.openwisp.org
        - https://logs.openwisp.org
    # Configuring additional settings for django-cors-headers
    openwisp2_extra_django_settings_instructions:
      - |
        CORS_ALLOW_CREDENTIALS = True
        CORS_ALLOW_ALL_ORIGINS = True

To enable WPA Enterprise (EAP-TTLS-PAP) authentication using OpenWISP RADIUS, you must configure the openwisp.openwisp2 Ansible role to create individual FreeRADIUS sites for each organization. This supports multi-tenancy by isolating authentication per organization.

Key Requirements:

• Set openwisp2_radius: true.
• Set openwisp2_freeradius_install: true.
• Define a list of organizations in the freeradius_eap_orgs variable.

Port Isolation: Because the Ansible role creates a common FreeRADIUS site for all organizations (used for captive portals) listening on default ports (1812, 1813, 18120), you must provide unique ports for each organization in freeradius_eap_orgs to ensure proper isolation.

- hosts: openwisp2
  become: "{{ become | default('yes') }}"
  roles:
    - openwisp.openwisp2
  vars:
    openwisp2_radius: true
    openwisp2_freeradius_install: true
    freeradius_eap_orgs:
      - name: openwisp
        uuid: 00000000-0000-0000-0000-000000000000
        radius_token: secret-radius-token
        auth_port: 1822
        acct_port: 1823
        inner_tunnel_auth_port: 18230
        cert: /etc/freeradius/certs/cert.pem
        private_key: /etc/freeradius/certs/key.pem
        ca: /etc/freeradius/certs/ca.crt
        dh: /etc/freeradius/certs/dh
        tls_config_extra: |
          private_key_password = whatever
          ecdh_curve = "prime256v1"

To use the latest unreleased features, you can deploy the master branch of the Ansible role. This requires a custom directory structure to manage local roles and collections.

1. Setup Directory Structure

Create a directory (e.g., ~/openwisp-dev) with roles and collections subdirectories.

mkdir -p ~/openwisp-dev/roles
mkdir -p ~/openwisp-dev/collections
cd ~/openwisp-dev/
touch ansible.cfg requirements.yml hosts playbook.yml

2. Configure ansible.cfg

Set the paths for roles and collections in your ansible.cfg:

[defaults]
roles_path=~/openwisp-dev/roles
collections_paths=~/openwisp-dev/collections

3. Define Requirements

In requirements.yml, point to the OpenWISP Git repository and specify the master version:

---
roles:
  - src: https://github.com/openwisp/ansible-openwisp2.git
    version: master
    name: openwisp.openwisp2-dev
collections:
  - name: community.general
    version: ">=3.6.0"

4. Install and Run

Install the requirements and run your playbook:

ansible-galaxy install -r requirements.yml
ansible-playbook -i hosts playbook.yml

Example Development Playbook:

- hosts: openwisp2
  become: "{{ become | default('yes') }}"
  roles:
    - openwisp.openwisp2-dev
  vars:
    openwisp2_network_topology: true
    openwisp2_firmware_upgrader: true
    openwisp2_radius: true
    openwisp2_monitoring: true

To resolve Cross-Origin Resource Sharing (CORS) issues when integrating OpenWISP with external services, use the openwisp2_django_cors variable within the openwisp.openwisp2 role. This role leverages the django-cors-headers package.

Basic Configuration

Create a playbook that defines the openwisp2_django_cors variable. At a minimum, you can enable CORS and specify a list of allowed origins using allowed_origins_list.

Steps to Apply

1. Install Ansible and the openwisp.openwisp2 role.
2. Create an inventory file.
3. Create a playbook (see example below).
4. Run the playbook.
5. Verify by logging into the OpenWISP admin panel (e.g., https://openwisp2.mydomain.com/admin).

- hosts: openwisp2
  become: "{{ become | default('yes') }}"
  roles:
    - openwisp.openwisp2
  vars:
    # Cross-Origin Resource Sharing (CORS) settings
    openwisp2_django_cors:
      enabled: true
      allowed_origins_list:
        - https://frontend.openwisp.org
        - https://logs.openwisp.org