73 lines
2.1 KiB
YAML
73 lines
2.1 KiB
YAML
# Note that Wireguard does DNS resolution only once during connection.
|
|
# When a client's IP changes, the server should be notified in some way,
|
|
# using `wg set wg0 peer izHzmRwh2yzICps6pFI2Bg3TnmTD66/8uH4loJpkuD4= endpoint <NEW-IP>:<PORT>`
|
|
# for example.
|
|
|
|
- name: Copy firewall template
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: "{{ lookup('ansible.builtin.first_found', paths) }}"
|
|
dest: '/etc/nftables.conf'
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
vars:
|
|
paths:
|
|
- 'templates/{{ ansible_hostname }}/nftables.j2'
|
|
- 'templates/{{ group_names[0] }}/{{ ansible_hostname }}/nftables.j2'
|
|
notify: restart nftables
|
|
|
|
- name: Desktop configuration
|
|
notify:
|
|
- restart systemd-networkd
|
|
- restart systemd-resolved
|
|
when: ansible_hostname == 'desktop'
|
|
block:
|
|
- name: Setup network configuration
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: '{{ item.src }}'
|
|
dest: '{{ item.dest }}'
|
|
owner: root
|
|
group: systemd-network
|
|
mode: '0640'
|
|
loop:
|
|
- src: 'templates/personal/desktop/network/enp.network.j2'
|
|
dest: '/etc/systemd/network/20-wired.network'
|
|
|
|
- name: Remove leftover configuration files
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: '{{ item }}'
|
|
state: absent
|
|
loop:
|
|
- '/etc/systemd/network/30-vmbr0.network'
|
|
- '/etc/systemd/network/30-vmbr0.netdev'
|
|
|
|
- name: XPS configuration
|
|
notify:
|
|
- restart systemd-networkd
|
|
- restart systemd-resolved
|
|
- restart iwd
|
|
when: ansible_hostname == 'xps'
|
|
block:
|
|
- name: Setup network configuration
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: '{{ item.src }}'
|
|
dest: '{{ item.dest }}'
|
|
owner: root
|
|
group: systemd-network
|
|
mode: '0640'
|
|
loop:
|
|
- src: 'templates/personal/xps/network/wireless.network.j2'
|
|
dest: '/etc/systemd/network/20-wireless.network'
|
|
|
|
- name: Remove leftover configuration files
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: '{{ item }}'
|
|
state: absent
|
|
loop:
|
|
- '/etc/systemd/network/30-vmbr0.network'
|
|
- '/etc/systemd/network/30-vmbr0.netdev'
|