ansible.cfg

@@ -1,6 +1,5 @@
 [defaults]
 ask_vault_pass = True
-inventory = inventory.yml
 
 [privilege_escalation]
 become_ask_pass = True

inventory.yml

@@ -1,4 +0,0 @@
-bookworm:
-  hosts:
-    fudiggity:
-      ansible_connection: local

playbook.yml

@@ -1,5 +1,5 @@
 - name: Provision debian server
-  hosts: bookworm
+  hosts: localhost
   pre_tasks:
     - name: Install shared packages
       become: true

templates/network/resolved.j2

@@ -28,10 +28,10 @@
 #DNSOverTLS=no
 #MulticastDNS=yes
 #LLMNR=yes
-Cache=yes
+#Cache=yes
-CacheFromLocalhost=yes
+#CacheFromLocalhost=no
-DNSStubListener=yes
+#DNSStubListener=yes
 DNSStubListenerExtra={{ vpn_listen_address }}
 DNSStubListenerExtra={{ vpn_media_listen_address }}
-ReadEtcHosts=yes
+#ReadEtcHosts=yes
 #ResolveUnicastSingleLabel=no

templates/nftables.j2

@@ -52,9 +52,11 @@ table ip filter {
   chain vpn_chain {
     meta l4proto { tcp, udp } th dport 53 ip saddr . ip daddr @vpn_set accept comment "DNS"
 
+    tcp dport { {{ http_port }}, {{ https_port }} } ip saddr . ip daddr @vpn_set accept comment "HTTP/HTTPS" # TODO: remove?
+
     tcp dport 80 ip saddr {{ vpn_subnet }} ip daddr {{ transmission_nginx_ip }} accept comment "Transmission Web"
 
-    tcp dport 80 ip saddr {{ vpn_subnet }} ip daddr {{ syncthing_nginx_ip }} accept comment "Syncthing Web"
+    tcp dport { 80, 443 } ip saddr {{ vpn_subnet }} ip daddr {{ syncthing_nginx_ip }} accept comment "Syncthing Web"
     tcp dport {{ syncthing_protocol_port }} ip saddr {{ vpn_subnet }} ip daddr {{ syncthing_app_ip }} accept comment "Syncthing protocol"
 
     tcp dport 80 ip saddr {{ vpn_subnet }} ip daddr {{ radicale_nginx_ip }} accept comment "Radicale"
@@ -73,7 +75,7 @@ table ip filter {
   chain media_vpn_chain {
     meta l4proto { tcp, udp } th dport 53 ip saddr . ip daddr @vpn_media_set accept comment "DNS"
 
-    tcp dport 80 ip saddr {{ vpn_media_subnet }} ip daddr {{ jellyfin_nginx_ip }} accept comment "Jellyfin"
+    tcp dport { 80, 443 } ip saddr {{ vpn_media_subnet }} ip daddr {{ jellyfin_nginx_ip }} accept comment "Jellyfin"
   }
 
   # docker's user configurable forward hook chain