Add p14 configuration

templates/mpv/config.j2

@@ -1,9 +1,5 @@
 # {{ ansible_managed }}
 #
-gpu-api=opengl
-vo=gpu
-hwdec=vaapi
-
 audio-samplerate=128000
 audio-format=s64
 volume=100

templates/p14/cmdline.j2

@@ -0,0 +1 @@
+rd.luks.name=e02bb19c-8b7b-4537-a001-7dd9698674b2=cryptlvm root=/dev/VolumeGroup/root rw resume=/dev/VolumeGroup/swap

templates/p14/iwd.j2

@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+
+[General]
+AddressRandomization=network

templates/p14/mkinitcpio/1-modules.conf.j2

@@ -0,0 +1,3 @@
+# {{ ansible_managed }}
+
+MODULES=(amdgpu)

templates/p14/mkinitcpio/2-hooks.conf.j2

@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+#
+
+HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt lvm2 filesystems fsck)

templates/p14/mkinitcpio/linux-lts.preset.j2

@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+#
+# mkinitcpio preset file for the 'linux' package
+
+PRESETS=('default')
+
+default_uki="/boot/EFI/Linux/linux-lts.efi"
+default_kver="/boot/vmlinuz-linux-lts"

templates/p14/mkinitcpio/linux.preset.j2

@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+#
+# mkinitcpio preset file for the 'linux' package
+
+PRESETS=('default')
+
+default_uki="/boot/EFI/Linux/linux.efi"
+default_kver="/boot/vmlinuz-linux"

templates/p14/network/lan.network.j2

@@ -0,0 +1,11 @@
+[Match]
+Name={{ lan_interface }}
+
+[Network]
+DHCP=yes
+DNS={{ default_network_dns }}
+MulticastDNS=yes
+DNSOverTLS=yes
+
+[Link]
+RequiredForOnline=routable

templates/p14/network/wg0.netdev.j2

@@ -0,0 +1,25 @@
+# {{ ansible_managed }}
+
+[NetDev]
+Name={{ wireguard.interface }}
+Kind=wireguard
+Description=WireGuard tunnel {{ wireguard.interface }}
+
+[WireGuard]
+PrivateKeyFile={{ wireguard.private_key_path }}
+RouteTable=main
+
+{% for peer in wireguard.peers %}
+[WireGuardPeer]
+PublicKey={{ peer.public_key }}
+PresharedKeyFile={{ peer.preshared_key_path }}
+{% for ip in peer.allowed_ips %}
+AllowedIPs={{ ip }}
+{% endfor %}
+{% if peer.endpoint %}
+Endpoint={{ peer.endpoint }}
+{% endif %}
+{% if not loop.last %}
+
+{% endif %}
+{% endfor %}

templates/p14/network/wg0.network.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+
+[Match]
+Name={{ wireguard.interface }}
+
+[Network]
+Address={{ wireguard.ip }}/{{ wireguard.prefix }}
+DNS={{ wireguard.dns }}
+Domains={{ wireguard.domains | join(' ') }}
+BindCarrier={{ lan_interface }} {{ wireless_interface }}

templates/p14/network/wg1.netdev.j2

@@ -0,0 +1,25 @@
+# {{ ansible_managed }}
+
+[NetDev]
+Name={{ wireguard.interface }}
+Kind=wireguard
+Description=WireGuard tunnel {{ wireguard.interface }}
+
+[WireGuard]
+PrivateKeyFile={{ wireguard.private_key_path }}
+RouteTable=main
+
+{% for peer in wireguard.peers %}
+[WireGuardPeer]
+PublicKey={{ peer.public_key }}
+PresharedKeyFile={{ peer.preshared_key_path }}
+{% for ip in peer.allowed_ips %}
+AllowedIPs={{ ip }}
+{% endfor %}
+{% if peer.endpoint %}
+Endpoint={{ peer.endpoint }}
+{% endif %}
+{% if not loop.last %}
+
+{% endif %}
+{% endfor %}

templates/p14/network/wg1.network.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+
+[Match]
+Name={{ wireguard.interface }}
+
+[Network]
+Address={{ wireguard.ip }}/{{ wireguard.prefix }}
+DNS={{ wireguard.dns }}
+Domains={{ wireguard.domains | join(' ') }}
+BindCarrier={{ lan_interface }} {{ wireless_interface }}

templates/p14/network/wlan0.network.j2

@@ -0,0 +1,12 @@
+[Match]
+Name={{ wireless_interface }}
+
+[Network]
+DNS={{ default_network_dns }}
+DNSOverTLS=yes
+DNSSEC=yes
+DHCP=yes
+IgnoreCarrierLoss=3s
+
+[Link]
+RequiredForOnline=routable

templates/p14/nftables.j2

@@ -0,0 +1,43 @@
+#!/usr/bin/nft -f
+# vim:set ts=2 sw=2 et:
+
+flush ruleset
+
+table inet filter {
+  chain input {
+    type filter hook input priority 0; policy drop;
+
+    # allow established/related connections
+    ct state { established, related } accept
+
+    # early drop of invalid connections
+    ct state invalid drop
+
+    # allow from loopback
+    iifname lo accept
+
+    # allow icmp
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+
+    # allow mDNS
+    udp dport 5353 accept
+
+    # allow ssh
+    tcp dport ssh accept
+  }
+
+  chain forward {
+    type filter hook forward priority security; policy drop;
+
+    ct state { established, related } accept;
+
+		mark 1 accept
+  }
+}
+
+table ip filter {
+	chain DOCKER-USER {
+		mark set 1
+	}
+}