sonny/arch-setup
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use DNS over TLS & enable DNSSEC

Browse source
This commit is contained in:
Sonny Bakker 2025-04-26 17:11:03 +02:00
parent 6f393b4c39
commit 82a02be85a
7 changed files with 22 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
host_vars/desktop/network.yml
View file

@ -2,7 +2,7 @@ lan_interface: enp1s0
lan_interface_mac: 00:d8:61:9f:52:65 lan_interface_mac: 00:d8:61:9f:52:65
local_network_address: 192.168.2.15/24 local_network_address: 192.168.2.15/24
local_network_dns: 192.168.2.254 local_network_dns: 9.9.9.9 149.112.112.112
local_network_gateway: 192.168.2.254 local_network_gateway: 192.168.2.254
hostname: desktop hostname: desktop

6
host_vars/xps/network.yml
View file

@ -3,12 +3,14 @@ wireless_interface_mac: 98:2c:bc:e3:ff:bc
local_network_ssid: KPNAE51C6 local_network_ssid: KPNAE51C6
local_network_address: 192.168.2.9/24 local_network_address: 192.168.2.9/24
local_network_dns: 192.168.2.254 local_network_dns: 9.9.9.9 149.112.112.112
local_network_gateway: 192.168.2.254 local_network_gateway: 192.168.2.254
frans_network_ssid: KPNDD1056 frans_network_ssid: KPNDD1056
frans_network_address: 192.168.2.9/24 frans_network_address: 192.168.2.9/24
frans_network_dns: 192.168.2.254 frans_network_dns: 9.9.9.9 149.112.112.112
frans_network_gateway: 192.168.2.254 frans_network_gateway: 192.168.2.254
default_network_dns: 9.9.9.9 149.112.112.112
hostname: xps hostname: xps

3
playbook.yml
View file

@ -29,7 +29,8 @@
- name: Personal provisiong - name: Personal provisiong
when: "'personal' in group_names" when: "'personal' in group_names"
block: block:
# TODO: require (w)lan interfaces before configuring these # Note: set `network.dns.native_https_query` in about:config to prevent
# DoH requests by default. See https://github.com/arkenfox/user.js/issues/1881
- name: Wireguard provisioning - name: Wireguard provisioning
ansible.builtin.import_tasks: 'tasks/personal/all/wireguard.yml' ansible.builtin.import_tasks: 'tasks/personal/all/wireguard.yml'
tags: wireguard tags: wireguard

6
templates/personal/desktop/network/enp1s0.network.j2
View file

@ -5,10 +5,12 @@ Name={{ lan_interface }}
[Network] [Network]
Address={{ local_network_address }} Address={{ local_network_address }}
DNS={{ local_network_dns }}
Gateway={{ local_network_gateway }} Gateway={{ local_network_gateway }}
DHCP=no DNS={{ local_network_dns }}
MulticastDNS=yes MulticastDNS=yes
DNSOverTLS=yes
DNSSEC=yes
DHCP=no
LinkLocalAddressing=no LinkLocalAddressing=no
IPv6AcceptRA=no IPv6AcceptRA=no
IPv6SendRA=no IPv6SendRA=no

6
templates/personal/xps/network/wlan0-frans.network.j2
View file

@ -6,10 +6,12 @@ SSID={{ frans_network_ssid }}
[Network] [Network]
Address={{ frans_network_address }} Address={{ frans_network_address }}
DNS={{ frans_network_dns }}
Gateway={{ frans_network_gateway }} Gateway={{ frans_network_gateway }}
DHCP=no DNS={{ frans_network_dns }}
MulticastDNS=yes MulticastDNS=yes
DNSOverTLS=yes
DNSSEC=yes
DHCP=no
LinkLocalAddressing=no LinkLocalAddressing=no
IPv6AcceptRA=no IPv6AcceptRA=no
IPv6SendRA=no IPv6SendRA=no

6
templates/personal/xps/network/wlan0-local.network.j2
View file

@ -6,10 +6,12 @@ SSID={{ local_network_ssid }}
[Network] [Network]
Address={{ local_network_address }} Address={{ local_network_address }}
DNS={{ local_network_dns }}
Gateway={{ local_network_gateway }} Gateway={{ local_network_gateway }}
DHCP=no DNS={{ local_network_dns }}
MulticastDNS=yes MulticastDNS=yes
DNSOverTLS=yes
DNSSEC=yes
DHCP=no
LinkLocalAddressing=no LinkLocalAddressing=no
IPv6AcceptRA=no IPv6AcceptRA=no
IPv6SendRA=no IPv6SendRA=no

3
templates/personal/xps/network/wlan0.network.j2
View file

@ -2,6 +2,9 @@
MACAddress={{ wireless_interface_mac }} MACAddress={{ wireless_interface_mac }}
[Network] [Network]
DNS={{ default_network_dns }}
DNSOverTLS=yes
DNSSEC=yes
DHCP=yes DHCP=yes
RequiredForOnline=routable RequiredForOnline=routable
IgnoreCarrierLoss=3s IgnoreCarrierLoss=3s