Add laptop network configuration

roles/arch/tasks/main.yml

@@ -35,16 +35,9 @@
     group: root
     mode: "0600"
 
-- name: add reflector to weekly timer
-  become: yes
-  file:
-    src: "/usr/lib/systemd/system/reflector.service"
-    path: "/etc/systemd/system/weekly.target.wants/reflector.service"
-    state: link
-
 # TODO
-# - network setup (laptop)
 # - pacman setup depending on platform (see include section for common options)
+# - laptop power saving configuration
 
 - include_tasks: network.yml
 - include_tasks: mpv.yml # TODO

roles/arch/tasks/network.yml

@@ -9,4 +9,28 @@
   notify: restart systemd-networkd
   when: platform == "desktop"
 
-# TODO add laptop setup
+- name: setup laptop systemd networkd
+  become: yes
+  template:
+    src: "laptop/network.j2"
+    dest:  "/etc/systemd/network/20-wireless.network"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart systemd-networkd
+  when: platform == "laptop"
+
+- name: start systemd-resolved service
+  become: yes
+  systemd:
+    name: systemd-resolved
+    state: started
+    enabled: yes
+
+- name: start iwd service
+  become: yes
+  systemd:
+    name: iwd
+    state: started
+    enabled: yes
+  when: platform == "laptop"

roles/arch/tasks/timer.yml

@@ -45,3 +45,11 @@
   loop:
     - "/etc/systemd/system/daily.target.wants"
     - "/etc/systemd/system/weekly.target.wants"
+
+- name: add reflector to weekly timer
+  become: yes
+  file:
+    src: "/usr/lib/systemd/system/reflector.service"
+    path: "/etc/systemd/system/weekly.target.wants/reflector.service"
+    state: link
+

roles/arch/templates/laptop/network.j2

@@ -0,0 +1,7 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[Match]
+Name=wlan0
+
+[Network]
+DHCP=ipv4

roles/arch/templates/laptop/nftables.j2

@@ -0,0 +1,66 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+#
+#!/usr/bin/nft -f
+# vim:set ts=2 sw=2 et:
+
+flush ruleset
+
+table inet filter {
+  chain input {
+    type filter hook input priority 0; policy drop;
+
+    # allow established/related connections
+    ct state { established, related } accept
+
+    # early drop of invalid connections
+    ct state invalid drop
+
+    # allow from loopback
+    iifname lo accept
+
+    # allow icmp
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+
+    # allow ssh
+    tcp dport ssh accept
+
+    # syncthing
+    ip saddr 10.8.1.1 tcp dport 22000 accept
+
+    # allow dhcp requests for bridged connections
+    iifname "vmbr0" udp dport { 53, 67 } accept
+  }
+
+  chain forward {
+    type filter hook forward priority security; policy drop;
+
+    ct state { established, related } accept;
+
+		mark 1 accept
+
+    iifname "vmbr0" oifname "wlan0" accept
+    iifname "wlan0" oifname "vmbr0" accept
+  }
+}
+
+table ip filter {
+	chain DOCKER-USER {
+		mark set 1
+	}
+}
+
+table ip nat {
+  chain prerouting {
+    type nat hook prerouting priority 0; policy accept;
+
+    # iifname "wlan0" tcp dport { http } dnat to 10.4.0.243
+  }
+
+  chain postrouting {
+    type nat hook postrouting priority 0; policy accept;
+
+    oifname "wlan0" masquerade
+  }
+}
+

roles/arch/vars/laptop.yml

@@ -1 +1,2 @@
-platform_packages: []
+platform_packages:
+  - iwd