From e32d3734e4341faa38cb2aa90f224cef4e896d52 Mon Sep 17 00:00:00 2001 From: Renovate Date: Tue, 4 Aug 2026 21:31:00 +0000 Subject: [PATCH 01/51] Update docker.io/pretix/standalone Docker tag to v2026.7 --- resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 index 5de121b8..9eac87ca 100644 --- a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 @@ -25,7 +25,7 @@ services: backend: pretix: - image: docker.io/pretix/standalone:2026.3 + image: docker.io/pretix/standalone:2026.7 command: ["all"] ports: - "8345:80" From 54b0d834510c8e0c92a5cbb470b70b3a5e7fc196 Mon Sep 17 00:00:00 2001 From: Renovate Date: Tue, 4 Aug 2026 21:31:22 +0000 Subject: [PATCH 02/51] Update docker.io/pretalx/standalone Docker tag to v2026 --- resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index dea2dfb1..3c6e5daa 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -33,7 +33,7 @@ services: - pretalx_net pretalx: - image: docker.io/pretalx/standalone:v2025.1.0 + image: docker.io/pretalx/standalone:v2026.2.1 entrypoint: gunicorn command: - "pretalx.wsgi" @@ -78,7 +78,7 @@ services: - pretalx_net celery: - image: docker.io/pretalx/standalone:v2025.1.0 + image: docker.io/pretalx/standalone:v2026.2.1 command: - taskworker restart: unless-stopped From aeaa80d2c4ca9f4c5fdddd7c0cb360a8a5c341b9 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 23 May 2026 23:46:00 +0200 Subject: [PATCH 03/51] rt1(z9 host): create host and configure networkd and nftables --- inventories/z9/host_vars/rt1.sops.yaml | 198 ++++++++++++++++++ inventories/z9/host_vars/rt1.yaml | 6 + inventories/z9/hosts.yaml | 11 + resources/z9/rt1/nftables/nftables.conf | 111 ++++++++++ .../z9/rt1/systemd_networkd/00-netlan.link | 6 + .../z9/rt1/systemd_networkd/00-netwan.link | 6 + .../rt1/systemd_networkd/10-netlan.51.netdev | 7 + .../rt1/systemd_networkd/10-netlan.52.netdev | 7 + .../rt1/systemd_networkd/10-netlan.53.netdev | 7 + .../rt1/systemd_networkd/10-netlan.54.netdev | 7 + .../rt1/systemd_networkd/10-netwan.400.netdev | 7 + .../z9/rt1/systemd_networkd/10-wg55.netdev | 90 ++++++++ .../z9/rt1/systemd_networkd/20-netlan.network | 12 ++ .../z9/rt1/systemd_networkd/20-netwan.network | 9 + .../z9/rt1/systemd_networkd/20-wg55.network | 6 + .../21-netlan.51-clients.network | 27 +++ .../systemd_networkd/21-netlan.52-iot.network | 27 +++ .../21-netlan.53-public.network | 27 +++ .../21-netlan.54-management.network | 27 +++ .../21-netwan.400-fux_uplink.network | 26 +++ .../rt1/systemd_networkd_global_config.conf | 3 + 21 files changed, 627 insertions(+) create mode 100644 inventories/z9/host_vars/rt1.sops.yaml create mode 100644 inventories/z9/host_vars/rt1.yaml create mode 100644 resources/z9/rt1/nftables/nftables.conf create mode 100644 resources/z9/rt1/systemd_networkd/00-netlan.link create mode 100644 resources/z9/rt1/systemd_networkd/00-netwan.link create mode 100644 resources/z9/rt1/systemd_networkd/10-netlan.51.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-netlan.52.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-netlan.53.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-netlan.54.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-netwan.400.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-wg55.netdev create mode 100644 resources/z9/rt1/systemd_networkd/20-netlan.network create mode 100644 resources/z9/rt1/systemd_networkd/20-netwan.network create mode 100644 resources/z9/rt1/systemd_networkd/20-wg55.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netlan.53-public.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netlan.54-management.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network create mode 100644 resources/z9/rt1/systemd_networkd_global_config.conf diff --git a/inventories/z9/host_vars/rt1.sops.yaml b/inventories/z9/host_vars/rt1.sops.yaml new file mode 100644 index 00000000..f4141fd9 --- /dev/null +++ b/inventories/z9/host_vars/rt1.sops.yaml @@ -0,0 +1,198 @@ +secrets__secrets: + - name: ENC[AES256_GCM,data:MmqDXUKy+U67JZFmKJTGLYAJcYPClQ8M2w==,iv:/eDx++bJCzdKXYB8YipB/GB6aM421JR3sy8i5trBKxk=,tag:/zTklys9bN839iT1qOH0UQ==,type:str] + content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str] + - name: ENC[AES256_GCM,data:9i4hZU7Hv/IMlI/1oYthx8g57nrst9LHZQk=,iv:IQanD/CA64A+hVyTQBiTvWdXyY8qNF9BpehWZxI5a9c=,tag:RiY0OJe2xbFPG6wfe5XjiA==,type:str] + content: ENC[AES256_GCM,data:lrwHaNvHkh5E94ziiQsd8ua9YvuwmhZ6iIGZS0oFnZdYKuyNh7egWOoii2o=,iv:LLRKhbiJl1GwK/SfqNdNrrJuDF17YXw3hHmuhlyI87w=,tag:DbR/a7jfy1+4yswSdYfOFA==,type:str] + - name: ENC[AES256_GCM,data:2lJUcDJ7ECJ1bF4Fg1VwOR2tBIQ77ZvDAbFF8w==,iv:HrPWIetjN/lOyQ7Mvk0sM1w+bWldlNfWhvw7/sfqKN8=,tag:AJL0s+f0O/yR4G3RVd1IHQ==,type:str] + content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str] + - name: ENC[AES256_GCM,data:ESxpEp9k9BdD1GJv+af+U3ny0+RPuaJjWDhQ,iv:DxsZLiDF8F+ixepbUdlitMJ7DLHjGNFNuxRwLl7efo8=,tag:STnv/oLzbchdiwXfKP3fow==,type:str] + content: ENC[AES256_GCM,data:W2h5AcoT85OkekPeRkrf1m0bDdBjG/YNSbWlrcZtP7FjaPh/F+cx+J6oRRI=,iv:CLVXTqfstpIU3BX/Zdcnp9w0gWxeGDI/G1MNl6xr4ZU=,tag:yCqN4r1MV/VTWQvZ6COfIw==,type:str] + - name: ENC[AES256_GCM,data:IRwwy+WQxgQ8cDpB8HaCLpKwJj7oC87p0XOxWRo=,iv:BLXNMcigvaOeY6y4NlLPMMWQt9XFi6nodRwIYFgAAnU=,tag:OdQalmujOgrzW8oi64xMRg==,type:str] + content: ENC[AES256_GCM,data:C5oIcuEYtODsvjQZnbqbWVfP63mQzcRuh8f5rlBCyjwSq2mZiYGQe9t0T78=,iv:sITUDo9SKZTSwPfsMv4m4U0ruuVCcaxu7SUT52U4FSE=,tag:4CsSMJWQQPAIeK8DwUDBqg==,type:str] + - name: ENC[AES256_GCM,data:r0sbpjaGjezoNlyl1khy+Dly+8xbbfQZNB8om/E4/tj9lmM=,iv:MLrglBJA6BrHGmFRprlQcf5/Hqh952e5OyQQ9nPxumY=,tag:Se05kMBkSQ7TRxzij7Fo8A==,type:str] + content: ENC[AES256_GCM,data:/c1nRf1eZhbUmoQWvcj8yDaVPtyAN7Uu+S054q3C1/kXlQ7CgOe4CrMXnmk=,iv:ppar0aCKuIU3DOjwAoliZ5TOL199Z+Ffo4pCktjs0W8=,tag:nfaGutK+5KnlWBKU1MTxkQ==,type:str] + - name: ENC[AES256_GCM,data:7mwuykEqbGISOa2n+pWb6INLsHYdjyf2HxTtWpAr5xP1,iv:NMcg+L2DFtBO1nhyPid31yzLr+ZX7DUGl/WxV1MnrqU=,tag:65/BiUEI8v5oMlQqpKNDRg==,type:str] + content: ENC[AES256_GCM,data:SObbA3D/sGN5/i5ps4Zz3alygIXKbSgptFjfPHlwC8G588O+gKAkvKQwU/s=,iv:PY2vLfI3gInFeQbse49KC2/zZ9O4jeXAQ0fpP84GHHE=,tag:214Mb8hIYDkQ4+UkRWtc9w==,type:str] + - name: ENC[AES256_GCM,data:bES9O6JI4wTnuZsup9gflfaozeUDkfjVGNIFn8RnZQ==,iv:98kigM3KZIN5qXNdgfLg5WLmxzAsYCjNqVzyUPco/BI=,tag:1fwEtwQ6i9QQC3OCewN0eA==,type:str] + content: ENC[AES256_GCM,data:flO3Nb4u2WfWNVhn8k5Bgo3LmsHo2cVnLCsrz8ST9Ip7gO9FY9d27FQgphM=,iv:aiDoq+41cSjwcCZRaIPLtbltkOpc7FeuNN7swPqkHXQ=,tag:OhzcY2xKKJF2jZVRseXCFg==,type:str] + - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str] + content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str] +sops: + lastmodified: "2026-05-23T21:19:38Z" + mac: ENC[AES256_GCM,data:Ded0VfGn8H2qGMk5LDyqF1gW8hajKc9FgvCynHPQkWkhMSdaHYbFwf//gWi2TjIO22HD5sPw1w9KAjPy53b57RwBCjXfMMq0JCPvuePLK40NC8uCAi+wr5Er0fAWz1JiaA+dowposoi6RxBtyHCaNHMDVGMLh1j+IL+pTOyi6fk=,iv:gssOMmR0DDQC4WjMVXTD/zqbQa8qlBr9ZZWF15W0WnE=,tag:DORTxQfCmpVjDjyGSNH7dw==,type:str] + pgp: + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxK/JaB2/SdtAQ//bbr0oza/X6GG43ay9coZbb+0aptj3pGzQqT1ND6nsI34 + iY3IZaMZIti+j/BS5kEfmRn56WZSx6EcbSrlbiyL5NZw9R4/bGRd848rOLwMvuYO + 8Usei9jHdpHiPvKBZnZXaXGU8E27L0Y/LCxSIFOXbyHzHogjz3JmtJQsYpSC+ue6 + mIRrSAJPALrqEL+DZ2bl5UYlBIRXdtIe/jL1CFCJhULt+EjJw72T62DZK/jaNZTj + eint63+IFZSxx5e5vrAeQB+p2EDsp6c5NbDrlgQWb8/J1q/G5bG4KxBs/0hum7OW + /sSsIDb4Qb8U/axt5LduV6AkMXXsclNLQU/LbFAbBRcV8Lvh11f0U3V/UnqUdmvp + efesb5VQh1x0uWjzobxaioLEV/YYbWx8binvuJ3MBHKp6E2xj7IrBTVl0MWgjEou + ZbQDF8DvxA49xEnJyOviL2/zjnV1kXy+Q+BKZga3pr8AnBHA8Ftbsvmk6CyDEM0R + i4FAUOVa9VWiszoOaqyn1Fl02YlweFmgzuFjd3wi74Tbi6RE37rN/vBKySbnRQYl + rFUU3SQlztxd4UBAXBo6gQKTz5B4rehvKVye2mmqEE9bas/lCWAKVJ7+3+0NQdA2 + lp/X7h7DRSD2Qkd35SzxkJz7P86rd0LM1aOu87psxYavEWw6vFs2ErDkSeqDn1DU + aAEJAhDb1s+jpDUa3GvVZjoiiCyutI018jfJU1vi12PGktg4KJcXBx66R/nLItO2 + ba6o66scIiAJZ+jYymW6RbJTI7XRHJp4Cs8COhpMRQeOGwEHFGGL2rpGd3KrOLQe + 0/C6EmrJvGpl + =atNE + -----END PGP MESSAGE----- + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQEMA1QflAioE8i3AQf+NkUGCBrTCkkyl+iBb6P1IWLDGqAY8s20mBZ7G3plKE/J + UrIe947letj/8EA+yoN0uzjwEkh3rDLtZrOLTSgflq1GMpdVhdaTbS71fD3kghJQ + P9tz0zDQEgXHBi+2q7iRrEETx/cu7UDNkSCNvQbWvDmo8MfbSBy+VFCknfupdQxj + 9hlq4kBA0pckPCY8V7E05nDhQntS8wpXIEO1SWiSuiGg+p4yFlvNzWNfhLyEFHxL + BZHVVIU/mzyClMajjLJWjKI1LSgHXXIa28tgdrtiBZOsF+CWveYqJlRJh9NUepJI + ZSeFNhyWmnS9ZkQu5BUyb7+oRxfq2NY51T76Xbo8gNJeAZWwyr1sj1wjubuVeNMF + aU6FiynYWr3I35JRVghTMJ93CnPl+NTpWnQuHpq1bzEGe2u8BMFhgrTu2yMD23VQ + eGien6SqfEbA/wAiz9ZaUgTQH8UyHpliteZ8/SQgkw== + =UJvq + -----END PGP MESSAGE----- + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAz5uSgHG2iMJAQ/+O5JOJfDp/BuBCuXDQVUgJagspQO6LZ/MLrl9qH282AMf + MdgN5M/WjbOv6WZDCMg4nfXps1XgzUEiaA/1m4PxHlMmxjEoQHAE51GMcxsXg+B1 + lM+8uJ1+js1sdDX4xsZtJpbVxJKIbPuhF7oM950oDlL2+UKhUbPlCoxeOihlkVGa + RqHJ/M74xkyKH281oRI5bllJaAroBnXVSFIvbCxA7ts/O7YJPKBowTIj62Kye9Ra + aHC11bPy2RlJCcFZJjPSdnXvzUMpfzEd6O72VUtMBBQZn/in7efutC8FwpRYuUW7 + vSofxUN5n6Mtb8A1XSMFD/nfXVc/pM6Cu7kdtHSwSKgbKKf6mrCeVgaM9xcG0t2W + 9yEtWvkdvOOSqz/vd1vkftbBWcCejX7bktfmD408CJAs1bjzz5CyrDoWcnYmbxFY + 6N4rhMDRMTe19VH2UQ4EvSjQjmmYCspnUW3/78zi5kU1ijyQy13UpbgwulU7tSGc + KKtBjPoy6mLIVl0YhnEJZWD/XPIRWyW+0s+7m70YXCWSVipvCelEE8oPWjf8PLaE + J85crlZGkSRcRO7yOP/YtB9ZnajgaF33zJU3ZWr0C/IXj2TeepZp/JUteD2H/LRf + 9YJzOFYDOFIWcdmaTzJLBEaefWcDjT6wkIf6TBqQRMLsu8JUwy9VwFcsi/d5aMXS + XgEQqSxYb1B39OR0sS1Xpw0/CFe4imBPuG3w0tOAyM3DbPWYY1kZYIRZenV1ZIOS + aRZJh086kuWgHYB76VoNzDK3QperWvHL/8CT2g3HuPiVGSrrXwxCYXk5+UXB9bQ= + =Xx91 + -----END PGP MESSAGE----- + fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DsZXvxFXTXoQSAQdA0rZTVdySF9nUiz7ZyFJgq1tojyLojGTgE4UIEJzFSTUw + 9y4kbGn1cWMpAqr+sE3WHV9p7v6kgm/XdUjXGN4DadpUbiYx6sQW2Jov6Km2EYhq + 0l4BawupjX25wi7c2yR5iGdxYS8oCYVmGgcAB3T96v8VsXpkAOYQAOOh7B9GQIxm + hB3cFQLCy2un3VvBsiKGFMA2FhZYBOuaEwP/KmWnPv0IPIRH4by6LDB0xgq8MUNz + =xoVE + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAgcGcZ3BT6lsJ8FxkMghxg5/PZLtIzNeJaEUbxN0EFhsw + uM+Lec3k9BJSUJK8GeVmesYxQh8vP6Yi/+m2LnGjHXzkQg8Bx1HJzuC/Ap36rC6N + 0l4Bxj1URTsRD4yILEA3TY4Dn9St9uOtodJcf5YdAKvmeb3Uwy//huNnA1eK7b+v + WRHcU2K+GgkSzLiRLZTc/nMrrCQ/P5HzwYHmP2rypFX7kxXlPd3K6yMZWTiSgYZd + =gZLQ + -----END PGP MESSAGE----- + fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxjNhCKPP69fAQ//YGOLOFtORNbOu+KFCtGcJBXQMy6Ej3/tePVuDi2vmqLD + 3Dz6stB9D+BmBbcgbFlDA+g7Vi6DD+zcze9wM10iuc9t9ucAuQ7B/ymSvJc4MrYn + MJFvQv5IYgWJmzXLYEFYYpmZPGG3hSHSgWIPs+574wEA/L867ktguW6ZD3ZuMn3E + yjCTeT/ZkGjuIpGqMu2/o9Wvc+RYgWlCB69D8kTHtnbFzbqEzvKU5/zte5ThchA+ + QZwFd/gk3o1G/7WOYJJ6CbBSOQaSrfm0mnb6sppNPdOAQtqHVSFVX5vX96gXsht/ + AkrvD6/2R5eNzbqRaU83cg7c5far49xoBbL6czreWY3D56yK4BJbrrg9mK7oCEfO + GaRDFFD7R4LJPfVx2xDoIQ3Hyp4E3dz4nyJx0Kg7NSEt7soOb5MnZ+04LLAiHbaT + qZr618V530uw3qaCsYcgHy+WsZXXlqXQey3A7jphi3u9Kvn9UjeegjNvpOrMk6g1 + RhGzv72G0wjZnzjTjPlzeROHaQ6RPgfpkZjEcVZNZkfAgAbB3XPgCFGKz4qvx9MP + 4eHIlBSJizLzSi519o+0i5PwrZdEf9L4RUVxgQgdJXMh1JaydVh5DOU+xomdStD5 + Maymkt8fSgYgDaS953YA2e04PrkXCH0EHZ62T9EMxreEoU3nYTmw/TGx7RfU+wzS + XgEuQkLWSToJ40/Ir3obDA246yv7J2FpmPwG4oFypkM5xe1WjlMlk90b9RBhUgXk + ylRXXLBzau6mtbPOa7LGdVyVs2DClWQo9BoK+dxEsnW+TR144O4UmZEfifJXvgQ= + =ympd + -----END PGP MESSAGE----- + fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA46L6MuPqfJqARAAshm2x7wX/9g3XJtSN0AnSeCwSHO1I4+ebLKOsB7zcXh8 + hrVO3694jQcU9L01H7jGYw4lNNzBd61/uVE5AvMq4Sqn9iH3MFNESbAEOWVV+TRf + 53JMg9C/aZfde8gHgHPaiVXlCBVEVY9CqHpUXUKDmEE7iRb5P4DuMxOmybDYZGzY + 4c5Ke1MFMkGRmAtsT1qLrT2vh+F0CX4JwpMkxCmOzSWAXbwrVOigJ35l5zM6vme4 + 5EQu9jI8FApTxVchZbr0v3UOKxp5OebqC0jGeznZNf4qb0qnsvuowY6IIw5Tl3/q + H4TLq5EUOVqTC1voIWY/gMjieiW1gtr6vASy4MvbswsZLc26YVE9IbHzAOUWDN2o + f2iQ3aZYuINvniD23XtM0TKepDXWq5eF+AJpmyP/LL8sYvSnWFD+muK3O657djEu + yGZs2EFTrkiUvhBq3apOOYiU0eOi4Aq6UeEbOsLENnQrBRXuHEm4KUSwzOitVwJ1 + ByxQTu7wzY727SOR2hzjMC0LI602WGpEQU7ech5L4uWqtMFwaBP9HnUamcofKqqt + 1vI2BevsJfQ0rtTE6GWseHt702lllTGe3RnHWc6YsMWLwUfRdBPggMW37hAPPcfO + ytbU3RJIxx4vImRtXhkI5yvbpFQrooz1zSeXWaitPE5jmmiKe9IRStLnfiq9E2TS + XgFVuQM8K0LgUYEoAipvafhnC3ohfGsM2AYd36EoaMNLeQ2ZZEiV06/Y3EWoI0iM + aqRLwyBvTuDOc5BK32nCbAgUbbPJjPhqWaoNp5ymCBV76oW613gApkzoUF+OIUU= + =KKaI + -----END PGP MESSAGE----- + fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DQrf1tCqiJxoSAQdA8YKD21h5POTLPf04KvGN93omFgkYO+Y8Kc0jM0vdqm8w + 3zYRaLsDjdh8Zd89/HhHJUfLrTp/IJ0n81sK0ZjznbXKxgkseGthMzof+L7BnPAp + 0l4BnAs9iZS4q2LZVS7ySBP89xLmF97qhK2jagMNSAwq8Afxbcw8oQAVQmeyYfxx + X59irIHjI1ugO4o1WnTN67nTQjU5msbVBs0eALrw3jobzFHRL67fS0a4Soa59LTY + =ZHIU + -----END PGP MESSAGE----- + fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdAN7rRlv3dMoFOfj9eHgf+0H8521b32nWqySUdriEy6Tcw + gjuReMBpKQOgUfuhIiWkHIKNtNgMrYWiC20ESOXX5b9uYZNpqHCgHQPlX0lEeGim + 0lgBOieL7mSEq4wkWLCSv4sBAmkQA+dnugBeF+TrlqKQTZsbe/Z+jNG4ZrHRvdqi + 4I5It+uaRV9Vrul1c6H7fNreRPUd4hNyJwU7gZQ+vU2WyAmgqerxE1Wb + =gplT + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+ARAAjWK8mU99VcnM/Ckzm+YsZFTwnz4PDAenDDdZ1OOz5IXe + tS4SQPcQlSSOuXEkFLJMmm8QVxtUC3Gh4nF7o+7OygT+0ZXOrB7jFgg10+v/KVA9 + hSlqBdsMxcC0OzBtkGyAOXOxqnTVubuHEGyGpIryHt1/lthUUZHBbjgw7P0Tw2/U + sYK5j5YbqhyBl20gyZorkTTq7pHfVXDVtpe75+ZkqbOg4S6HgW3/dl+v6N0TLfRs + GVl0fUlWIK/akGCB71zdwJs2I1qTeMTlL6v+XSUdXj0YV+5fjh3wf8qzN9geIjQK + ybxGFWDKCAgTMnqoFF5BCL23hFtnCbTtLN1wQT7/m7zpjaBKHOBXZOGXYZCMGZui + sBsUvPANgNdfOse9H2aABQvUQh8WqFw8S73GasvrZHAwEmvnXzocMJd+kUovzmQu + 9FBk5UkcgXfmxeamoP8C700vh4zI+sKz6uEW0+AuVtLlLVqlb2w21kTc+ArZW52n + HLolH5q3Wj6pKuuFCWKr6UgLFcq2w4QngB2p+UABHU3RbwXIra7prDXCUcNC5iCn + ElRFY7OZ3nbHOf9oaW/MitcfszVLyl0ueoay6qxdlIGdXKRGpqxHqqr+92INV/iz + 6CRoAsTqVq1a7ZuAaUdJPvfKVAHHEHjPwlrOc9cXvykG0iQKsRzgqiOtPiGQShnU + aAEJAhDSqCwywHDnQ7X9ZWIzPjwvqyHpEVez8zYh3vpgKpsLb9uL+JizZjV02HMe + nhiL+4o/aNjJgGJWph1uPFhU4wO4AavnNBsHbJSiL/1yTS96hdf8d+gB41yVLU3e + kBkDFLKkIBkU + =aRLd + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdABId/P8ozRgJ4ItF1zvxp98aH+g3LZ6UGnxjYjtDxjEIw + VmyerznjOLnpz0EobXRRoot1Lo82Va64HQmXt26LG3gFY1HVp0WOnIZXa/CUoUb8 + 1GgBCQIQloFxKcgFTiRidaJfN7hSeQLleiEe3aifZUyJj8niTmBaY29t+CSoA46N + xZzX1AlxVjfmputhYdTyOYSJtGrj7otmnUN2P+55pjz4L2qCYAEKi1+ibqgpmJh/ + bETQsT6WKJ8FXA== + =Ci7L + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/inventories/z9/host_vars/rt1.yaml b/inventories/z9/host_vars/rt1.yaml new file mode 100644 index 00000000..218f4c40 --- /dev/null +++ b/inventories/z9/host_vars/rt1.yaml @@ -0,0 +1,6 @@ +systemd_networkd__config_dir: 'resources/z9/rt1/systemd_networkd/' +systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/systemd_networkd_global_config.conf') }}" +nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/nftables/nftables.conf') }}" +ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin" +ansible_pull__timer_randomized_delay_sec: 0min +unbound_access_control: [ "10.89.208.0/20" ] diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index b07a2864..42e9a234 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -15,6 +15,9 @@ all: yate: ansible_host: yate.z9.ccchh.net ansible_user: chaos + rt1: + ansible_host: rt1.ccchh.net + ansible_user: chaos certbot_hosts: hosts: light: @@ -34,6 +37,7 @@ infrastructure_authorized_keys_hosts: light: waybackproxy: yate: + rt1: nginx_hosts: hosts: light: @@ -47,6 +51,12 @@ transmission: proxmox_vm_template_hosts: hosts: thinkcccore0: +systemd_networkd_hosts: + hosts: + rt1: +nftables_hosts: + hosts: + rt1: alloy_hosts: hosts: light: @@ -60,5 +70,6 @@ ansible_pull_hosts: yate: secrets_hosts: hosts: + rt1: forgejo_runner_hosts: hosts: diff --git a/resources/z9/rt1/nftables/nftables.conf b/resources/z9/rt1/nftables/nftables.conf new file mode 100644 index 00000000..21bfbd16 --- /dev/null +++ b/resources/z9/rt1/nftables/nftables.conf @@ -0,0 +1,111 @@ +#!/usr/sbin/nft -f + +## Variables + +# Hosts + + +# Interfaces +define if_netwan = "netwan" +define if_netlan = "netlan" +define if_wg55_management = "wg55" +define if_netwan_400_fux_uplink = "netwan.400" +define if_netlan_51_clients = "netlan.51" +define if_netlan_52_iot = "netlan.52" +define if_netlan_53_public = "netlan.53" +define if_netlan_54_management = "netlan.54" + +# Interface Groups +define wan_ifs = { $if_netwan_400_fux_uplink } +define lan_ifs = { $if_netlan_51_clients, + $if_netlan_52_iot, + $if_netlan_53_public, + $if_netlan_54_management } +define v4_exposed_ifs = { $if_netlan_53_public } +define v6_exposed_ifs = { $if_netlan_53_public } +define v4_nat_ifs = { $if_netlan_51_clients, + $if_netlan_52_iot, + $if_netlan_54_management } + + +## Rules + +table inet reverse-path-forwarding { + chain rpf-filter { + type filter hook prerouting priority mangle + 10; policy drop; + + # Only allow packets if their source address is routed via their incoming interface. + # https://github.com/NixOS/nixpkgs/blob/d9d87c51960050e89c79e4025082ed965e770d68/nixos/modules/services/networking/firewall-nftables.nix#L100 + fib saddr . mark . iif oif exists accept + } +} + +table inet host { + chain input { + type filter hook input priority filter; policy drop; + + iifname "lo" accept comment "allow loopback" + + ct state invalid drop + ct state established,related accept + + ip protocol icmp accept + # ICMPv6 + # https://datatracker.ietf.org/doc/html/rfc4890#autoid-24 + # Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped" + # Error messages that are essential to the establishment and maintenance of communications: + icmpv6 type { destination-unreachable, packet-too-big } accept + icmpv6 type { time-exceeded } accept + icmpv6 type { parameter-problem } accept + # Connectivity checking messages: + icmpv6 type { echo-request, echo-reply } accept + # Address Configuration and Router Selection messages: + icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } accept + # Link-Local Multicast Receiver Notification messages: + icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report } accept + # SEND Certificate Path Notification messages: + icmpv6 type { 148, 149 } accept + # Multicast Router Discovery messages: + icmpv6 type { 151, 152, 153 } accept + + # Allow SSH access. + tcp dport 22 accept comment "allow ssh access" + + # Allow WireGuard access. + udp dport 51820 accept comment "allow WireGuard access" + + # Allow DHCP server access. + iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access" + } +} + +table ip v4nat { + chain prerouting { + type nat hook prerouting priority dstnat; policy accept; + } + + chain postrouting { + type nat hook postrouting priority srcnat; policy accept; + + iifname { $v4_nat_ifs, $if_wg55_management } oifname $wan_ifs masquerade + } +} + +table inet forward { + chain forward { + type filter hook forward priority filter; policy drop; + + ct state invalid drop + ct state established,related accept + + # Allow internet access. + iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access" + + # Allow access to exposed networks from internet. + meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access" + meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access" + + # Allow clients and managment to most + iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "allow clients and managment to lan_ifs" + } +} diff --git a/resources/z9/rt1/systemd_networkd/00-netlan.link b/resources/z9/rt1/systemd_networkd/00-netlan.link new file mode 100644 index 00000000..c2e24707 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/00-netlan.link @@ -0,0 +1,6 @@ +[Match] +MACAddress=BC:24:11:72:A3:27 +Type=ether + +[Link] +Name=netlan diff --git a/resources/z9/rt1/systemd_networkd/00-netwan.link b/resources/z9/rt1/systemd_networkd/00-netwan.link new file mode 100644 index 00000000..523e18a9 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/00-netwan.link @@ -0,0 +1,6 @@ +[Match] +MACAddress=BC:24:11:CF:65:57 +Type=ether + +[Link] +Name=netwan diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.51.netdev b/resources/z9/rt1/systemd_networkd/10-netlan.51.netdev new file mode 100644 index 00000000..b951ecc3 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netlan.51.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netlan.51 +Kind=vlan + +[VLAN] +Id=51 + diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.52.netdev b/resources/z9/rt1/systemd_networkd/10-netlan.52.netdev new file mode 100644 index 00000000..1f345c72 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netlan.52.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netlan.52 +Kind=vlan + +[VLAN] +Id=52 + diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.53.netdev b/resources/z9/rt1/systemd_networkd/10-netlan.53.netdev new file mode 100644 index 00000000..c6dab812 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netlan.53.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netlan.53 +Kind=vlan + +[VLAN] +Id=53 + diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.54.netdev b/resources/z9/rt1/systemd_networkd/10-netlan.54.netdev new file mode 100644 index 00000000..6271e6c4 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netlan.54.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netlan.54 +Kind=vlan + +[VLAN] +Id=54 + diff --git a/resources/z9/rt1/systemd_networkd/10-netwan.400.netdev b/resources/z9/rt1/systemd_networkd/10-netwan.400.netdev new file mode 100644 index 00000000..e0b6afcf --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netwan.400.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netwan.400 +Kind=vlan + +[VLAN] +Id=400 + diff --git a/resources/z9/rt1/systemd_networkd/10-wg55.netdev b/resources/z9/rt1/systemd_networkd/10-wg55.netdev new file mode 100644 index 00000000..b3e41a62 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-wg55.netdev @@ -0,0 +1,90 @@ +[NetDev] +Description=Admin-Wireguard +Kind=wireguard +Name=wg55 + +[WireGuard] +ListenPort=51820 +PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_privat_key + +# WireGuard Peers + +[WireGuardPeer] +# friendly_name = stb +AllowedIPs = 10.89.214.2/32,2a07:c481:1:37::2/128 +PublicKey = vILSL4dbaC5IaTsRhJviamV18ssxWSj+qLVyowLQ214= +PersistentKeepalive = 30 + +[WireGuardPeer] +# friendly_name = fi +AllowedIPs = 10.89.214.3/32,2a07:c481:1:37::3/128 +PublicKey = UHi/if5uW2V3+8Q3R+uk6/XpRi4fPXbw7chsKI4xlkI= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_fi_psk + +[WireGuardPeer] +# friendly_name = jtbx +AllowedIPs = 10.89.214.4/32,2a07:c481:1:37::4/128 +PublicKey = NyyEqdWgScgsnTF8Zz/Om4Lc84fdFMwVtvaCmLEkUlQ= + +[WireGuardPeer] +# friendly_name = June +AllowedIPs = 10.89.214.6/32,2a07:c481:1:37::6/128 +PublicKey = 6jAEB+f9przBGxPhuvv9U9gvZDEBQNqpQSD0BoGqXQQ= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_June_psk + +[WireGuardPeer] +# friendly_name = Max +AllowedIPs = 10.89.214.7/32,2a07:c481:1:37::7/128 +PublicKey = oC1hJjtlAgLX/CmbwTC+LPmd1uwluQTwsN8RaMNmHn0= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_Max_psk + +[WireGuardPeer] +# friendly_name = dario +AllowedIPs = 10.89.214.9/32,2a07:c481:1:37::9/128 +PublicKey = bYF2EGRGpEGjiKcasi/oaWoWeLsgqsF6FGaq3Z4ERww= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_dario_psk + +[WireGuardPeer] +# friendly_name = June-mobile +AllowedIPs = 10.89.214.11/32,2a07:c481:1:37::11/128 +PublicKey = 6edjXykegUgGjbkIG1aJyBlX1SgTKcqXXaSBVPHdKDc= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_June-mobile_psk + +[WireGuardPeer] +# friendly_name = djerun_at_ferrum.local +AllowedIPs = 10.89.214.12/32,2a07:c481:1:37::12/128 +PublicKey = aHbdkTHhPkd+o7wWfTua9nd72aF4OVp66zGtpaoD8Fg= + +[WireGuardPeer] +# friendly_name = c6ristian +AllowedIPs = 10.89.214.13/32,2a07:c481:1:37::13/128 +PublicKey = 6ndwj3Ur6AqfUPWuyPYXIaGZs2ujJKawSQ9LEvlYzEc= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_c6ristian_psk + +[WireGuardPeer] +# friendly_name = langoor +AllowedIPs = 10.89.214.14/32,2a07:c481:1:37::14/128 +PublicKey = qTnVQlQa1m4SucFFNli/xM6QWfsdWx2baRAit7Cg8RM= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_psk + +[WireGuardPeer] +# friendly_name = langoor_home +AllowedIPs = 10.89.214.15/32,2a07:c481:1:37::15/128 +PublicKey = NeMDs2+5rHuKO5ZYXVUR76GorgdesFUnDOFECQ3RzG4= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_home_psk + +[WireGuardPeer] +# friendly_name = lilly-lillysLaptop +AllowedIPs = 10.89.214.16/32 #,2a07:c481:1:37::/128 +PublicKey = IBsI+N8qUNpQnDc5HnqQ2Zo/1graFM0RMIecHmAF+Vk= + +[WireGuardPeer] +# friendly_name = bitwhisker +AllowedIPs = 10.89.214.17/32,2a07:c481:1:37::a/128 +PublicKey = DvEGvQPGi+IxeRTIA72Gx3WNINcrV9HRNB1v7mHnhjA= + +[WireGuardPeer] +# friendly_name = forestcat +AllowedIPs = 10.89.214.18/32,2a07:c481:1:37::b/128 +PublicKey = PdJ7KlIeASizj0WTY87d7oSi14/MebrhRa+L8YiPoQE= + diff --git a/resources/z9/rt1/systemd_networkd/20-netlan.network b/resources/z9/rt1/systemd_networkd/20-netlan.network new file mode 100644 index 00000000..3aed7151 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/20-netlan.network @@ -0,0 +1,12 @@ +[Match] +Name=netlan + +[Link] +RequiredForOnline=no + +[Network] +VLAN=netwan.51 +VLAN=netwan.52 +VLAN=netwan.53 +VLAN=netwan.54 + diff --git a/resources/z9/rt1/systemd_networkd/20-netwan.network b/resources/z9/rt1/systemd_networkd/20-netwan.network new file mode 100644 index 00000000..89a8494a --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/20-netwan.network @@ -0,0 +1,9 @@ +[Match] +Name=netwan + +[Link] +RequiredForOnline=no + +[Network] +VLAN=netwan.400 + diff --git a/resources/z9/rt1/systemd_networkd/20-wg55.network b/resources/z9/rt1/systemd_networkd/20-wg55.network new file mode 100644 index 00000000..750e8445 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/20-wg55.network @@ -0,0 +1,6 @@ +[Match] +Name=wg55 + +[Network] +Address=10.89.214.1/24 +Address=2a07:c481:1:37::1/64 diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network b/resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network new file mode 100644 index 00000000..5e9635f6 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network @@ -0,0 +1,27 @@ +[Match] +Name=netlan.51 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=clients + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=10.89.208.1/22 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:33::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network b/resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network new file mode 100644 index 00000000..5b586103 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network @@ -0,0 +1,27 @@ +[Match] +Name=netlan.52 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=IoT + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=10.89.212.1/24 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:34::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.53-public.network b/resources/z9/rt1/systemd_networkd/21-netlan.53-public.network new file mode 100644 index 00000000..f544a5bc --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netlan.53-public.network @@ -0,0 +1,27 @@ +[Match] +Name=netlan.53 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=public + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=185.161.130.65/28 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:35::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.54-management.network b/resources/z9/rt1/systemd_networkd/21-netlan.54-management.network new file mode 100644 index 00000000..2396da02 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netlan.54-management.network @@ -0,0 +1,27 @@ +[Match] +Name=netlan.54 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=Management + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=10.89.213.0/24 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:36::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network b/resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network new file mode 100644 index 00000000..1657c40a --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network @@ -0,0 +1,26 @@ +[Match] +Name=netwan.400 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=fux-uplink + +DNS=185.161.128.66 +DNS=2a07:c481:0:4::2 +DNS=185.161.128.67 +DNS=2a07:c481:0:4::3 + +IPv6AcceptRA=no +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=no + +[Address] +Address=185.161.129.134/25 +Address=2a07:c481::1:2/64 + +[Route] +Gateway=185.161.129.129 +Gateway=2a07:c481::1 diff --git a/resources/z9/rt1/systemd_networkd_global_config.conf b/resources/z9/rt1/systemd_networkd_global_config.conf new file mode 100644 index 00000000..2d3d8a34 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd_global_config.conf @@ -0,0 +1,3 @@ +[Network] +IPv4Forwarding=true +IPv6Forwarding=true From 010b8d12249546175abd0aa5977c8281fd0e65d8 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 24 May 2026 04:01:11 +0200 Subject: [PATCH 04/51] rt1(z9 host) unbound(role) kea_dhcp(role): create unbound and kea_dhcp role for rt1 - create unbound role - create kea_dhcp role - configure unbound and keadhcp on rt1(z9 host) --- inventories/z9/host_vars/rt1.yaml | 1 + inventories/z9/hosts.yaml | 7 + playbooks/deploy.yaml | 14 + resources/z9/rt1/kea_dhcp.yaml | 293 ++++++++++++++++++ resources/z9/rt1/nftables/nftables.conf | 3 + roles/kea_dhcp/defaults/main.yaml | 69 +++++ roles/kea_dhcp/handlers/main.yml | 30 ++ roles/kea_dhcp/meta/argument_specs.yaml | 125 ++++++++ roles/kea_dhcp/tasks/install_archlinux.yml | 8 + roles/kea_dhcp/tasks/install_debian.yml | 22 ++ roles/kea_dhcp/tasks/kea.yaml | 51 +++ roles/kea_dhcp/tasks/main.yml | 19 ++ roles/kea_dhcp/tasks/stork-agent.yaml | 76 +++++ .../kea_dhcp/templates/kea-ctrl-agent.conf.j2 | 20 ++ roles/kea_dhcp/templates/kea-dhcp4.conf.jinja | 27 ++ roles/kea_dhcp/templates/kea-dhcp6.conf.jinja | 27 ++ .../kea_dhcp/templates/stork-agent.env.jinja | 44 +++ roles/unbound/README.md | 19 ++ roles/unbound/defaults/main.yml | 7 + roles/unbound/files/no-resolved.resolv.conf | 1 + roles/unbound/handlers/main.yml | 27 ++ roles/unbound/tasks/main.yml | 63 ++++ roles/unbound/tasks/prometheus-exporter.yml | 17 + roles/unbound/templates/unbound.conf.j2 | 73 +++++ 24 files changed, 1043 insertions(+) create mode 100644 resources/z9/rt1/kea_dhcp.yaml create mode 100644 roles/kea_dhcp/defaults/main.yaml create mode 100644 roles/kea_dhcp/handlers/main.yml create mode 100644 roles/kea_dhcp/meta/argument_specs.yaml create mode 100644 roles/kea_dhcp/tasks/install_archlinux.yml create mode 100644 roles/kea_dhcp/tasks/install_debian.yml create mode 100644 roles/kea_dhcp/tasks/kea.yaml create mode 100644 roles/kea_dhcp/tasks/main.yml create mode 100644 roles/kea_dhcp/tasks/stork-agent.yaml create mode 100644 roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2 create mode 100644 roles/kea_dhcp/templates/kea-dhcp4.conf.jinja create mode 100644 roles/kea_dhcp/templates/kea-dhcp6.conf.jinja create mode 100644 roles/kea_dhcp/templates/stork-agent.env.jinja create mode 100644 roles/unbound/README.md create mode 100644 roles/unbound/defaults/main.yml create mode 100644 roles/unbound/files/no-resolved.resolv.conf create mode 100644 roles/unbound/handlers/main.yml create mode 100644 roles/unbound/tasks/main.yml create mode 100644 roles/unbound/tasks/prometheus-exporter.yml create mode 100644 roles/unbound/templates/unbound.conf.j2 diff --git a/inventories/z9/host_vars/rt1.yaml b/inventories/z9/host_vars/rt1.yaml index 218f4c40..876776a3 100644 --- a/inventories/z9/host_vars/rt1.yaml +++ b/inventories/z9/host_vars/rt1.yaml @@ -4,3 +4,4 @@ nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/nftables/ ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin" ansible_pull__timer_randomized_delay_sec: 0min unbound_access_control: [ "10.89.208.0/20" ] +kea_dhcp__include_vars: resources/z9/rt1/kea_dhcp.yaml diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 42e9a234..b1770ee7 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -57,11 +57,18 @@ systemd_networkd_hosts: nftables_hosts: hosts: rt1: +unbound_hosts: + hosts: + rt1: +kea_dhcp_hosts: + hosts: + rt1: alloy_hosts: hosts: light: yate: dooris: + rt1: ansible_pull_hosts: hosts: dooris: diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index 59fe15a4..2a1498ac 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -27,6 +27,20 @@ tags: - nftables +- name: Ensure unbound deployment on unbound_hosts + hosts: unbound_hosts + roles: + - unbound + tags: + - unbound + +- name: Ensure kea_dhcp deployment on kea_dhcp_hosts + hosts: kea_dhcp_hosts + roles: + - kea_dhcp + tags: + - kea_dhcp + - name: Ensure deployment of infrastructure authorized keys hosts: infrastructure_authorized_keys_hosts roles: diff --git a/resources/z9/rt1/kea_dhcp.yaml b/resources/z9/rt1/kea_dhcp.yaml new file mode 100644 index 00000000..d1918813 --- /dev/null +++ b/resources/z9/rt1/kea_dhcp.yaml @@ -0,0 +1,293 @@ +kea_dhcp__dns_servers: + v4: + - 185.161.129.134 + v6: + - 2a07:c481::1:2 + +kea_dhcp__dhcp4: + enable: true + interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] + control-sockets: + - socket-name: /var/run/kea-dhcp4-ctrl-agent.sock + socket-type: unix + lease-database: + type: memfile + persist: true + option-data: + - name: "domain-name-servers" + code: 6 + csv-format: true + data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}" + subnets: + - id: 1 + subnet: 10.89.208.0/22 + pools: + - pool: "10.89.208.32 - 10.89.211.250" + reservations: + - ip-address: 10.89.208.11 + hostname: beamer + hw-address: "ac:87:a3:18:9e:01" + - ip-address: 10.89.208.12 + hostname: Brother-CCCHH + hw-address: "00:80:77:04:3a:55" + - ip-address: 10.89.208.13 + hostname: muzak + hw-address: "00:11:24:5f:4f:80" + - ip-address: 10.89.208.14 + hostname: Big-Room-Beamer + hw-address: "64:d2:c4:db:08:5c" + - ip-address: 10.89.208.16 + hostname: dooris + hw-address: "bc:24:11:b3:93:9c" + - ip-address: 10.89.208.17 + hostname: hmdooris-ccu + hw-address: "bc:24:11:5f:2d:b1" + - ip-address: 10.89.208.27 + hostname: cisco-slm248p + hw-address: "00:23:eb:b0:fc:3f" + - ip-address: 10.89.208.47 + hw-address: "6c:df:fb:0b:34:21" + - ip-address: 10.89.208.48 + hw-address: "6c:df:fb:0d:91:63" + - ip-address: 10.89.209.28 + hostname: hp-color + hw-address: "3c:52:82:29:21:79" + - ip-address: 10.89.209.29 + hostname: dooris-ng + hw-address: "6c:4b:90:19:21:a1" + - ip-address: 10.89.209.166 + hostname: encoder-ccchh + hw-address: "00:4e:01:a2:40:d7" + - ip-address: 10.89.209.254 + hostname: ki10 + hw-address: "dc:a6:32:a9:ff:82" + option-data: + - name: routers, + csv-format: true + data: 10.89.208.1 + - id: 2 + subnet: 10.89.212.0/24 + pools: + - pool: "10.89.212.32 - 10.89.212.250" + reservations: + - ip-address: 10.89.212.3 + hostname: prusamk3 + hw-address: "10:9c:70:2e:59:3e" + - ip-address: 10.89.212.4 + hostname: prusamk4 + hw-address: "10:9c:70:2e:6e:f0" + - ip-address: 10.89.212.11 + hostname: Ziggy + hw-address: "44:17:93:53:65:57" + - ip-address: 10.89.212.12 + hostname: legacy + hw-address: "00:15:65:a1:ed:98" + - ip-address: 10.89.212.23 + hostname: foobarpay + hw-address: "f4:f2:6d:09:a6:73" + - ip-address: 10.89.212.24 + hostname: foobackup + hw-address: "bc:24:11:20:1a:a8" + - ip-address: 10.89.212.27 + hostname: ender3v2-sonic-pad + hw-address: "fc:ee:91:00:0e:14" + - ip-address: 10.89.212.31 + hostname: octopi + hw-address: "b8:27:eb:0f:d8:09" + - ip-address: 10.89.212.32 + hostname: 433mhz-bridge + hw-address: "0c:b8:15:fe:e3:34" + - ip-address: 10.89.212.33 + hostname: wled-kueche + hw-address: "30:ae:a4:7a:8d:a0" + - ip-address: 10.89.212.34 + hostname: wled-serverschrank + hw-address: "18:fe:34:a6:64:76" + - ip-address: 10.89.212.35 + hostname: wled-couch + hw-address: "64:b7:08:40:ab:c0" + - ip-address: 10.89.212.36 + hostname: laser + hw-address: "b8:27:eb:be:38:fa" + - ip-address: 10.89.212.37 + hostname: laser-eth + hw-address: "b8:27:eb:eb:6d:af" + - ip-address: 10.89.212.42 + hostname: t-mix + hw-address: "40:a5:ef:d9:eb:93" + - ip-address: 10.89.212.86 + hostname: fritz-fon + hw-address: "00:1f:3f:c9:e5:b2" + - ip-address: 10.89.212.211 + hostname: hauptraum-esphome + hw-address: "e8:db:84:e8:18:d2" + - ip-address: 10.89.212.212 + hostname: werkstatt-esphome + hw-address: "3c:71:bf:26:42:32" + - ip-address: 10.89.212.213 + hostname: ir-bridge-beamer + hw-address: "8c:ce:4e:51:93:dd" + - ip-address: 10.89.212.215 + hostname: pi-dmx-werkstatt + hw-address: "b8:27:eb:65:e5:31" + - ip-address: 10.89.212.227 + hostname: SIP-T46S + hw-address: "80:5e:c0:09:bf:55" + - ip-address: 10.89.212.230 + hostname: SIP-T46S + hw-address: "80:5e:c0:22:33:08" + - ip-address: 10.89.212.232 + hostname: staubi + hw-address: "b8:4d:43:98:51:2b" + - ip-address: 10.89.212.233 + hostname: staubiv2 + hw-address: "70:c9:32:82:25:b2" + - ip-address: 10.89.212.234 + hostname: AtemMini + hw-address: "7c:2e:0d:13:72:a8" + - ip-address: 10.89.212.235 + hostname: okilaser + hw-address: "2c:ff:65:22:b4:63" + - ip-address: 10.89.212.236 + hw-address: "b8:27:eb:29:bd:77" + option-data: + - name: routers, + csv-format: true + data: 10.89.212.1 + - id: 3 + subnet: 10.89.213.0/24 + pools: + - pool: "10.89.213.32 - 10.89.213.250" + reservations: + - ip-address: 10.89.213.2 + hostname: sw-rack-1 + hw-address: "F0:9F:C2:10:C3:AA" + - ip-address: 10.89.213.3 + hostname: sw-rack-2-peo + hw-address: "44:d9:e7:06:69:5d" + - ip-address: 10.89.213.4 + hostname: sw-main-1 + hw-address: "a8:9c:6c:16:df:cc" + - ip-address: 10.89.213.5 + hostname: sw-main-2 + hw-address: "a8:9c:6c:16:e8:86" + - ip-address: 10.89.213.6 + hostname: sw-shop-1 + hw-address: "C0:4A:00:FB:DA:C5" + - ip-address: 10.89.213.7 + hostname: sw-shop-2-peo + hw-address: "f4:e2:c6:bf:20:ee" + - ip-address: 10.89.213.8 + hostname: sw-shop-3-peo + hw-address: "d8:b3:70:85:72:76" + - ip-address: 10.89.213.11 + hostname: pve01 + hw-address: "38:05:25:30:80:35" + - ip-address: 10.89.213.12 + hostname: pve02 + hw-address: "b8:85:84:b1:57:b6" + - ip-address: 10.89.213.13 + hostname: pve03 + hw-address: "98:fa:9b:a2:ed:e8" + - ip-address: 10.89.213.15 + hostname: pbs + hw-address: "BC:24:11:D6:2C:81" + - ip-address: 10.89.213.21 + hostname: unifi + hw-address: "BC:24:11:25:77:60" + - ip-address: 10.89.213.22 + hostname: club-assistant + hw-address: "7a:55:61:c3:a2:89" + - ip-address: 10.89.213.23 + hostname: automation + hw-address: "f2:20:75:5a:2f:8c" + - ip-address: 10.89.213.24 + hostname: yate + hw-address: "bc:24:11:73:3e:f7" + - ip-address: 10.89.213.25 + hostname: ptouch-print-server + hw-address: "bc:24:11:f2:cf:8f" + - ip-address: 10.89.213.26 + hostname: mqtt + hw-address: "bc:24:11:48:85:73" + - ip-address: 10.89.213.27 + hostname: factorio + hw-address: "bc:24:11:a3:43:7f" + - ip-address: 10.89.213.28 + hostname: light + hw-address: "72:61:ea:e6:49:e3" + - ip-address: 10.89.213.29 + hostname: homematic + hw-address: "fe:3a:42:77:3a:be" + - ip-address: 10.89.213.30 + hostname: proxmox-backup-server + hw-address: "8a:48:dd:a3:22:40" + option-data: + - name: routers, + csv-format: true + data: 10.89.213.1 + +kea_dhcp__dhcp6: + enable: true + interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] + control-sockets: + - socket-name: /var/run/kea-dhcp6-ctrl-agent.sock + socket-type: unix + lease-database: + type: memfile + persist: true + option-data: + - name: "dns-servers" + code: 23 + csv-format: true + data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}" + subnets: + - id: 1 + subnet: "2a07:c481:1:33::/64" + pools: + - pool: "2a07:c481:1:33::1:1 - 2a07:c481:1:33::FFFF:FFFF" + - id: 2 + subnet: "2a07:c481:1:34::/64" + pools: + - pool: "2a07:c481:1:34::1:1 - 2a07:c481:1:34::FFFF:FFFF" + - id: 3 + subnet: "2a07:c481:1:36::/64" + pools: + - pool: "2a07:c481:1:36::1:1 - 2a07:c481:1:36::FFFF:FFFF" + reservations: + - ip-address: "2a07:c481:1:36::2" + hostname: sw-rack-1 + hw-address: "F0:9F:C2:10:C3:AA" + - ip-address: "2a07:c481:1:36::3" + hostname: sw-rack-2-peo + hw-address: "44:d9:e7:06:69:5d" + - ip-address: "2a07:c481:1:36::4" + hostname: sw-main-1 + hw-address: "a8:9c:6c:16:df:cc" + - ip-address: "2a07:c481:1:36::5" + hostname: sw-main-2 + hw-address: "a8:9c:6c:16:e8:86" + - ip-address: "2a07:c481:1:36::6" + hostname: sw-shop-1 + hw-address: "C0:4A:00:FB:DA:C5" + - ip-address: "2a07:c481:1:36::7" + hostname: sw-shop-2-peo + hw-address: "f4:e2:c6:bf:20:ee" + - ip-address: "2a07:c481:1:36::8" + hostname: sw-shop-3-peo + hw-address: "d8:b3:70:85:72:76" + - ip-address: "2a07:c481:1:36::b" + hostname: pve01 + hw-address: "38:05:25:30:80:35" + - ip-address: "2a07:c481:1:36::c" + hostname: pve02 + hw-address: "b8:85:84:b1:57:b6" + - ip-address: "2a07:c481:1:36::d" + hostname: pve03 + hw-address: "98:fa:9b:a2:ed:e8" + - ip-address: "2a07:c481:1:36::f" + hostname: pbs + hw-address: "BC:24:11:D6:2C:81" + - ip-address: "2a07:c481:1:36::14" + hostname: unifi + hw-address: "BC:24:11:25:77:60" diff --git a/resources/z9/rt1/nftables/nftables.conf b/resources/z9/rt1/nftables/nftables.conf index 21bfbd16..842ca041 100644 --- a/resources/z9/rt1/nftables/nftables.conf +++ b/resources/z9/rt1/nftables/nftables.conf @@ -76,6 +76,9 @@ table inet host { # Allow DHCP server access. iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access" + + # Allow DNS server access from lan_ifs + iifname { $lan_ifs, $if_wg55_management } udp dport 53 accept comment "allow dns server access from lan_ifs" } } diff --git a/roles/kea_dhcp/defaults/main.yaml b/roles/kea_dhcp/defaults/main.yaml new file mode 100644 index 00000000..409f0a11 --- /dev/null +++ b/roles/kea_dhcp/defaults/main.yaml @@ -0,0 +1,69 @@ +kea_dhcp__stork_agent: + enable: false + prometheus_only: true +kea_dhcp__version_repo: "kea-3-0" +kea_dhcp__dns_servers: + v6: + - "2a07:c481:0:4::2" + - "2a07:c481:0:4::3" + v4: + - "185.161.128.66" + - "185.161.128.67" +kea_dhcp__include_vars: + +kea_dhcp__dhcp4: + enable: false + interfaces: [ ] + control-sockets: + - socket-name: /var/run/kea-dhcp4-ctrl-agent.sock + socket-type: unix + lease-database: + type: memfile + persist: true + option-data: + - name: "domain-name-servers" + code: 6 + csv-format: true + data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}" + subnets: + - id: 0 + subnet: nil + pools: + - pool: nil + reservations: + - ip-address: nil + hostname: beispiel.test + hw-address: "00:11:22:33:44:55" + option-data: + - name: nil, + code: nil, + csv-format: true + data: nil +kea_dhcp__dhcp6: + enable: false + interfaces: [ ] + lease-database: + type: memfile + persist: true + control-sockets: + - socket-name: /var/run/kea-dhcp6-ctrl-agent.sock + socket-type: unix + option-data: + - name: "dns-servers" + code: 23 + csv-format: true + data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}" + subnets: + - id: 0 + subnet: nil + pools: + - pool: nil + reservations: + - ip-address: nil + hostname: beispiel.test + hw-address: "00:11:22:33:44:55" + option-data: + - name: nil, + code: nil, + csv-format: true + data: nil diff --git a/roles/kea_dhcp/handlers/main.yml b/roles/kea_dhcp/handlers/main.yml new file mode 100644 index 00000000..5b44d6e1 --- /dev/null +++ b/roles/kea_dhcp/handlers/main.yml @@ -0,0 +1,30 @@ +--- +- name: Systemd.daemon_reload + become: true + ansible.builtin.systemd_service: + daemon_reload: true + +- name: Kea_dhcp4.reloaded + ansible.builtin.service: + name: kea-dhcp4 + state: restarted + enabled: true + +- name: Kea_dhcp6.reloaded + ansible.builtin.service: + name: kea-dhcp6 + state: restarted + enabled: true + +- name: Kea_ctrl.reloaded + ansible.builtin.systemd: + name: kea-ctrl-agent + state: restarted + enabled: true + +- name: Stork_agent.restarted + become: true + ansible.builtin.systemd: + name: isc-stork-agent + state: restarted + enabled: true diff --git a/roles/kea_dhcp/meta/argument_specs.yaml b/roles/kea_dhcp/meta/argument_specs.yaml new file mode 100644 index 00000000..995b8382 --- /dev/null +++ b/roles/kea_dhcp/meta/argument_specs.yaml @@ -0,0 +1,125 @@ +--- +argument_specs: + main: + short_description: "Role for managing Kea DHCP server" + options: + kea_dhcp__stork_agent: + type: "dict" + description: "Configuration for Stork Agent" + options: + enable: + type: "bool" + default: false + prometheus_only: + type: "bool" + default: true + kea_dhcp__version_repo: + type: "str" + description: "Version of Kea DHCP repository to use" + default: "kea-3-0" + kea_dhcp__dns_servers: + type: "dict" + description: "Default DNS servers for DHCP clients" + options: + v6: + type: "list" + elements: "str" + v4: + type: "list" + elements: "str" + kea_dhcp__dhcp4: + type: "dict" + description: "Configuration for DHCPv4 service" + options: + enable: + type: "bool" + default: false + interfaces: + type: "list" + elements: "str" + default: [] + control-sockets: + type: "list" + elements: "dict" + lease-database: + type: "dict" + option-data: + type: "list" + elements: "dict" + subnets: + type: "list" + elements: "dict" + options: + id: + type: "int" + subnet: + type: "str" + pools: + type: "list" + elements: "dict" + options: + pool: + type: "str" + reservations: + type: "list" + elements: "dict" + options: + ip-address: + type: "str" + hostname: + type: "str" + hw-address: + type: "str" + duid: + type: "str" + option-data: + type: "list" + elements: "dict" + kea_dhcp__dhcp6: + type: "dict" + description: "Configuration for DHCPv6 service" + options: + enable: + type: "bool" + default: false + interfaces: + type: "list" + elements: "str" + default: [] + control-sockets: + type: "list" + elements: "dict" + lease-database: + type: "dict" + option-data: + type: "list" + elements: "dict" + subnets: + type: "list" + elements: "dict" + options: + id: + type: "int" + subnet: + type: "str" + pools: + type: "list" + elements: "dict" + options: + pool: + type: "str" + reservations: + type: "list" + elements: "dict" + options: + ip-address: + type: "str" + hostname: + type: "str" + hw-address: + type: "str" + duid: + type: "str" + option-data: + type: "list" + elements: "dict" diff --git a/roles/kea_dhcp/tasks/install_archlinux.yml b/roles/kea_dhcp/tasks/install_archlinux.yml new file mode 100644 index 00000000..7bdb140b --- /dev/null +++ b/roles/kea_dhcp/tasks/install_archlinux.yml @@ -0,0 +1,8 @@ +--- +- name: Install Kea on Archlinux + when: ansible_facts['distribution'] == "Archlinux" + become: true + community.general.pacman: + name: kea + state: present + update_cache: false diff --git a/roles/kea_dhcp/tasks/install_debian.yml b/roles/kea_dhcp/tasks/install_debian.yml new file mode 100644 index 00000000..2ac23468 --- /dev/null +++ b/roles/kea_dhcp/tasks/install_debian.yml @@ -0,0 +1,22 @@ +--- +- name: Register isc-kea apt repository + become: true + register: kea_dhcp_repo + when: ansible_facts['distribution'] == "Debian" + ansible.builtin.deb822_repository: + name: "isc-{{ kea_dhcp__version_repo }}" + uris: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/deb/debian" + suites: any-version + components: main + signed_by: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/gpg.key" + +- name: Install Kea packages + become: true + when: ansible_facts['distribution'] == "Debian" + ansible.builtin.apt: + name: + - isc-kea-dhcp4 + - isc-kea-dhcp6 + - isc-kea-ctrl-agent + - isc-kea-admin + update_cache: "{{ kea_dhcp_install_repo.changed }}" diff --git a/roles/kea_dhcp/tasks/kea.yaml b/roles/kea_dhcp/tasks/kea.yaml new file mode 100644 index 00000000..a4fd3b57 --- /dev/null +++ b/roles/kea_dhcp/tasks/kea.yaml @@ -0,0 +1,51 @@ +--- +- name: Include config vars + tags: [ kea, include_vars ] + when: kea_dhcp__include_vars is not None + ansible.builtin.include_vars: + file: "{{ kea_dhcp__include_vars }}" + +- name: Deploy kea-dhcp4 configuration file + tags: [ kea, dhcp4 ] + become: true + when: kea_dhcp__dhcp4.enable + ansible.builtin.template: + src: kea-dhcp4.conf.jinja + dest: /etc/kea/kea-dhcp4.conf + backup: true + owner: root + group: kea + mode: "u=rw,g=r,o=" + validate: kea-dhcp4 -T %s + notify: + - Kea_dhcp4.reloaded + +- name: Deploy kea-dhcp6 configuration file + tags: [ kea, dhcp6 ] + become: true + when: kea_dhcp__dhcp6.enable + ansible.builtin.template: + src: kea-dhcp6.conf.jinja + dest: /etc/kea/kea-dhcp6.conf + backup: true + owner: root + group: kea + mode: "u=rw,g=r,o=" + validate: kea-dhcp6 -T %s + notify: + - Kea_dhcp6.reloaded + +- name: Copy kea-ctrl-agent configuration file + tags: [ kea, ctrl-agent ] + become: true + when: kea_dhcp__stork_agent.enable + ansible.builtin.template: + src: kea-ctrl-agent.conf.j2 + dest: /etc/kea/kea-ctrl-agent.conf + owner: root + group: kea + mode: "u=rw,g=r,o=" + validate: kea-ctrl-agent -t %s + notify: + - Kea_ctrl.reloaded + - Stork_agent.restarted diff --git a/roles/kea_dhcp/tasks/main.yml b/roles/kea_dhcp/tasks/main.yml new file mode 100644 index 00000000..a3478fa4 --- /dev/null +++ b/roles/kea_dhcp/tasks/main.yml @@ -0,0 +1,19 @@ +--- +- name: Setup Kea DHCP + tags: [kea, dhcp] + block: + - name: Install Kea on Archlinux + when: ansible_facts['distribution'] == "Archlinux" + ansible.builtin.import_tasks: install_archlinux.yml + + - name: Install Kea on Debian + when: ansible_facts['distribution'] == "Debian" + ansible.builtin.import_tasks: install_debian.yml + + - name: Configure Kea + ansible.builtin.include_tasks: kea.yaml + +- name: Run stork-agent tasks + tags: [stork-agent, monitoring] + when: kea_dhcp__stork_agent.enable + ansible.builtin.include_tasks: stork-agent.yaml diff --git a/roles/kea_dhcp/tasks/stork-agent.yaml b/roles/kea_dhcp/tasks/stork-agent.yaml new file mode 100644 index 00000000..916760c4 --- /dev/null +++ b/roles/kea_dhcp/tasks/stork-agent.yaml @@ -0,0 +1,76 @@ +--- +- name: Install stork-agent + tags: [stork-agent] + block: + - name: Install stork-agent on Archlinux + when: ansible_facts['distribution'] == "Archlinux" + tags: [stork-agent, archlinux] + block: + - name: Create stork-agent user + ansible.builtin.user: + name: stork-agent + create_home: false + home: "/var/lib/stork-agent" + shell: "/usr/bin/nologin" + system: true + groups: ["kea"] + append: true + + - name: Install stork-agent with aur_pkg_install + ansible.builtin.include_role: + name: aur_pkg_install + vars: + aur_pkg_install__pkg_name: "stork-agent" + aur_pkg_install__git_clone_url: "https://ansible:{{ secret__ansible_git_token }}@git.fux-eg.net/aur-mirror/stork-agent.git" + aur_pkg_install__git_ref: "bf96e34" + + - name: Install stork-agent on Debian + when: ansible_facts['distribution'] == "Debian" + tags: [stork-agent, debian] + block: + - name: Register isc-stork apt repository + become: true + register: "kea_dhcp_install_repo" + ansible.builtin.deb822_repository: + name: isc-stork + uris: https://dl.cloudsmith.io/public/isc/stork/deb/debian + suites: any-version + components: main + signed_by: https://dl.cloudsmith.io/public/isc/stork/gpg.key + + - name: Install isc-stork-agent + become: true + ansible.builtin.apt: + name: isc-stork-agent + update_cache: "{{ kea_dhcp_install_repo.changed }}" + + - name: Add stork-agent user to _kea group on Debian + when: ansible_facts['distribution'] == "Debian" + become: true + ansible.builtin.user: + name: stork-agent + groups: ["_kea"] + append: true + + - name: Config for stork-agent + ansible.builtin.template: + src: stork-agent.env.jinja + dest: /etc/stork/agent.env + owner: root + group: root + mode: "0660" + notify: + - Systemd_daemon_reload + - Stork_agent.restarted + + - name: Flush handlers + ansible.builtin.meta: flush_handlers + + - name: Ensure that stork kea exporter is working + ansible.builtin.uri: + url: "http://localhost:9547/metrics" + method: GET + register: kea_dhcp_stork_status_code + retries: 6 + delay: 5 + until: kea_dhcp_stork_status_code.status == 200 diff --git a/roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2 b/roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2 new file mode 100644 index 00000000..5ac1473e --- /dev/null +++ b/roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2 @@ -0,0 +1,20 @@ +{ +"Control-agent": { + "http-host": "127.0.0.1", + "http-port": 8000, + "control-sockets": { + {% if kea_dhcp__dhcp4.enable | default(false) %} + "dhcp4": { + "socket-type": "{{ kea_dhcp__dhcp4['control-sockets'][0]['socket-type'] }}", + "socket-name": "{{ kea_dhcp__dhcp4['control-sockets'][0]['socket-name'] }}" + }{% if kea_dhcp__dhcp6.enable %},{% endif %} + {% endif %} + {% if kea_dhcp__dhcp6.enable | default(false) %} + "dhcp6": { + "socket-type": "{{ kea_dhcp__dhcp6['control-sockets'][0]['socket-type'] }}", + "socket-name": "{{ kea_dhcp__dhcp6['control-sockets'][0]['socket-name'] }}" + }, + {% endif %} + } +} +} diff --git a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja new file mode 100644 index 00000000..78f06aef --- /dev/null +++ b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja @@ -0,0 +1,27 @@ +{ + "Dhcp4": { + "interfaces-config": { + "interfaces": {{ kea_dhcp__dhcp4.interfaces | to_nice_json }} + }, + "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json }}, + "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json }}, + {% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %} + "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json }}, + {% endif %} + "subnet4": [ + {% for subnet in kea_dhcp__dhcp4.subnets %} + { + "id": {{ subnet.id }}, + "subnet": "{{ subnet.subnet }}", + "pools": {{ subnet.pools | to_nice_json }}, + {% if subnet.reservations is defined and subnet.reservations %} + "reservations": {{ subnet.reservations | to_nice_json }}, + {% endif %} + {% if subnet['option-data'] is defined and subnet['option-data'] %} + "option-data": {{ subnet['option-data'] | to_nice_json }} + {% endif %} + }{% if not loop.last %},{% endif %} + {% endfor %} + ] + } +} diff --git a/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja b/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja new file mode 100644 index 00000000..da1929a5 --- /dev/null +++ b/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja @@ -0,0 +1,27 @@ +{ + "Dhcp6": { + "interfaces-config": { + "interfaces": {{ kea_dhcp__dhcp6.interfaces | to_nice_json }} + }, + "control-sockets": {{ kea_dhcp__dhcp6['control-sockets'] | to_nice_json }}, + "lease-database": {{ kea_dhcp__dhcp6['lease-database'] | to_nice_json }}, + {% if kea_dhcp__dhcp6['option-data'] is defined and kea_dhcp__dhcp6['option-data'] %} + "option-data": {{ kea_dhcp__dhcp6['option-data'] | to_nice_json }}, + {% endif %} + "subnet6": [ + {% for subnet in kea_dhcp__dhcp6.subnets %} + { + "id": {{ subnet.id }}, + "subnet": "{{ subnet.subnet }}", + "pools": {{ subnet.pools | to_nice_json }}, + {% if subnet.reservations is defined and subnet.reservations %} + "reservations": {{ subnet.reservations | to_nice_json }}, + {% endif %} + {% if subnet['option-data'] is defined and subnet['option-data'] %} + "option-data": {{ subnet['option-data'] | to_nice_json }} + {% endif %} + }{% if not loop.last %},{% endif %} + {% endfor %} + ] + } +} diff --git a/roles/kea_dhcp/templates/stork-agent.env.jinja b/roles/kea_dhcp/templates/stork-agent.env.jinja new file mode 100644 index 00000000..bdfa4d2d --- /dev/null +++ b/roles/kea_dhcp/templates/stork-agent.env.jinja @@ -0,0 +1,44 @@ +### the IP or hostname to listen on for incoming Stork server connections +# STORK_AGENT_HOST= + +### the TCP port to listen on for incoming Stork server connections +# STORK_AGENT_PORT=8081 + +### listen for commands from the Stork server only, but not for Prometheus requests +# STORK_AGENT_LISTEN_STORK_ONLY=true + +{% if kea_dhcp__stork_agent.prometheus_only %} +### listen for Prometheus requests only, but not for commands from the Stork server +STORK_AGENT_LISTEN_PROMETHEUS_ONLY=true +{% endif %} + +### settings for exporting stats to Prometheus +### the IP or hostname on which the agent exports Kea statistics to Prometheus +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS= +### the port on which the agent exports Kea statistics to Prometheus +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT= +## enable or disable collecting per-subnet stats from Kea +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PER_SUBNET_STATS=true +### the IP or hostname on which the agent exports BIND 9 statistics to Prometheus +# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_ADDRESS= +### the port on which the agent exports BIND 9 statistics to Prometheus +# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_PORT= + +### Stork Server URL used by the agent to send REST commands to the server during agent registration +# STORK_AGENT_SERVER_URL= + +### skip TLS certificate verification when the Stork Agent connects +### to Kea over TLS and Kea uses self-signed certificates +# STORK_AGENT_SKIP_TLS_CERT_VERIFICATION=true + + +### Logging parameters + +### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR +STORK_LOG_LEVEL=DEBUG +### disable output colorization +# CLICOLOR=false + +### path to the hook directory +# STORK_AGENT_HOOK_DIRECTORY= + diff --git a/roles/unbound/README.md b/roles/unbound/README.md new file mode 100644 index 00000000..806b9d8d --- /dev/null +++ b/roles/unbound/README.md @@ -0,0 +1,19 @@ +# Unbound DNS resolver + +Role fora a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/). +It is designed to be fast and lean and incorporates modern features based on open standards. + +- [Documentation](https://unbound.docs.nlnetlabs.nl/en/latest/) + +## Role Customization + +The following variables can be used to customize this role: + +| Variable | Type | Default | Description | +|------------------------------------------|-----------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| unbound_install_prometheus_exporter | Boolean | `true` | Whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format. | +| unbound_bind_interfaces | List of Strings | `[0.0.0.0, ::]` | List of interface names or IP addresses on which unbound will listen for dns queries | +| unbound_enable_unbound_control | Boolean | `true` | Whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured. | +| unbound_enable_dnssec | Boolean | `true` | Whether dnssec validation should be enabled | +| unbound_access_control | List of Strings | `[]` | **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E) | +| unbound_disable_systemd_networkd | Boolean | `true` | If true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. | diff --git a/roles/unbound/defaults/main.yml b/roles/unbound/defaults/main.yml new file mode 100644 index 00000000..fa6cb240 --- /dev/null +++ b/roles/unbound/defaults/main.yml @@ -0,0 +1,7 @@ +unbound_install_prometheus_exporter: true +unbound_bind_interfaces: [ "0.0.0.0", "::" ] +unbound_disable_systemd_networkd: true +unbound_enable_unbound_control: true +unbound_enable_dnssec: true +unbound_access_control: [ ] +unbound_private_domain: [ ] diff --git a/roles/unbound/files/no-resolved.resolv.conf b/roles/unbound/files/no-resolved.resolv.conf new file mode 100644 index 00000000..bbc8559c --- /dev/null +++ b/roles/unbound/files/no-resolved.resolv.conf @@ -0,0 +1 @@ +nameserver 127.0.0.1 diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml new file mode 100644 index 00000000..e1345bfd --- /dev/null +++ b/roles/unbound/handlers/main.yml @@ -0,0 +1,27 @@ +- name: unbound.restarted + tags: [ unbound, dns, dns_resolver ] + become: true + ansible.builtin.systemd: + name: unbound.service + state: restarted + +- name: unbound.reloaded + tags: [ unbound, dns, dns_resolver ] + become: true + ansible.builtin.systemd: + name: unbound.service + state: reloaded + +- name: prometheus-unbound-exporter.restarted + become: true + ansible.builtin.systemd: + name: prometheus-unbound-exporter.service + state: restarted + enabled: true + +- name: prometheus-unbound-exporter.enabled + become: true + ansible.builtin.systemd: + name: prometheus-unbound-exporter.service + enabled: true + daemon_reload: true diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml new file mode 100644 index 00000000..7ed42cb9 --- /dev/null +++ b/roles/unbound/tasks/main.yml @@ -0,0 +1,63 @@ +- name: unbound role main + tags: [ unbound, dns, dns_resolver ] + block: + + - name: install unbound dns resolver + become: true + ansible.builtin.package: + name: unbound + + - name: install extra dns tooling + become: true + ansible.builtin.package: + name: [ bind ] # the bind package includes tools like dig in archlinux + + - name: ensure correct directory permissions + become: true + ansible.builtin.file: + path: /etc/unbound + state: directory + mode: u=rwX,g=rX,o=rX + recurse: true + owner: unbound + group: unbound + + - name: configure unbound dns resolver + become: true + notify: unbound.restarted + ansible.builtin.template: + src: unbound.conf.j2 + dest: /etc/unbound/unbound.conf + owner: unbound + group: unbound + mode: u=rw,g=r,o=r + + - name: ensure unbound is running and enabled + become: true + ansible.builtin.systemd: + name: unbound.service + state: started + enabled: true + + - name: disable systemd-resolved + become: true + when: unbound_disable_systemd_networkd + ansible.builtin.systemd: + name: systemd-resolved.service + state: stopped + enabled: false + + - name: configure system resolver to point to local unbound + become: true + when: unbound_disable_systemd_networkd + ansible.builtin.copy: + src: no-resolved.resolv.conf + dest: /etc/resolv.conf + owner: unbound + group: unbound + mode: u=rw,g=r,o=r + + + - name: install and configure prometheus-exporter for unbound + ansible.builtin.import_tasks: prometheus-exporter.yml + when: unbound_install_prometheus_exporter diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml new file mode 100644 index 00000000..d05b838c --- /dev/null +++ b/roles/unbound/tasks/prometheus-exporter.yml @@ -0,0 +1,17 @@ +--- +- name: install unbound prometheus exporter + become: true + ansible.builtin.package: + name: prometheus-unbound-exporter + notify: prometheus-unbound-exporter.enabled + +- name: configure unbound exporter + become: true + ansible.builtin.copy: + dest: /etc/conf.d/prometheus-unbound-exporter + content: | + UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound-control.sock" + owner: root + group: root + mode: '0660' + notify: prometheus-unbound-exporter.restarted diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2 new file mode 100644 index 00000000..a1e310e0 --- /dev/null +++ b/roles/unbound/templates/unbound.conf.j2 @@ -0,0 +1,73 @@ +# ref: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html +# unbound.conf(5) man page +server: + {% if unbound_enable_dnssec -%} + # disable chroot because unbound is the only thing running on the VM + # and because it has issues with how archlinux configures the systemd units write protection regarding the anchor file + chroot: "" + + # location of the trust anchor file that enables DNSSEC + # this file is generated by the `unbound-anchor` command + auto-trust-anchor-file: "/etc/unbound/trusted-key.key" + {% endif -%} + + # use all CPUs + num-threads: 2 + + # more cache memory + rrset-cache-size: 60m + msg-cache-size: 30m + + # prefetch to keep the cache up to date + prefetch: yes + + # fetch the DNSKEYs earlier in the validation process, when a DS record is encountered + prefetch-key: yes + + # Faster UDP with multithreading (only on Linux). + so-reuseport: yes + + # disable special large send buffer handling and just use kernel defaults + so-sndbuf: 0 + + # send minimal amount of information to upstream servers to enhance privacy + qname-minimisation: yes + + # specify the interface to answer queries from by ip-address. + {% for i in unbound_bind_interfaces -%} + interface: "{{ i }}" + {% endfor %} + + # addresses from the IP range that are allowed to connect to the resolver + {% for i in unbound_access_control -%} + access-control: {{ i }} + {% endfor -%} + + {% for i in unbound_private_domain -%} + private-domain: {{ i }} + {% endfor -%} + + # The number of seconds between printing statistics to the log for every thread. + statistics-interval: 0 + + # Extended statistics are printed, Keeping track of more statistics takes time. + extended-statistics: yes + +remote-control: + control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} + control-interface: /run/unbound-control.sock + + +# configure some zones for which this resolver will act authoritatively +# https://www.dns.icann.org/services/axfr/ +{% for i in [ ".", "in-addr.arpa.", "arpa.", "root-servers.net.", "ip6.arpa.", "ip6-servers.arpa.", "mcast.net." ] %} +auth-zone: + name: "{{ i }}" + primary: "lax.xfr.dns.icann.org" + primary: "iad.xfr.dns.icann.org" + fallback-enabled: yes + for-downstream: no + for-upstream: yes + + +{% endfor %} From 1dff022146eb8647ed5f1b9fe5bd1a77a3ddc06b Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 18:31:05 +0200 Subject: [PATCH 05/51] z9-router(host): rename rt1 to z9-router --- .../{rt1.sops.yaml => z9-router.sops.yaml} | 8 ++++---- .../z9/host_vars/{rt1.yaml => z9-router.yaml} | 8 ++++---- inventories/z9/hosts.yaml | 18 +++++++++--------- resources/z9/{rt1 => z9-router}/kea_dhcp.yaml | 0 .../{rt1 => z9-router}/nftables/nftables.conf | 0 .../systemd_networkd/00-netlan.link | 0 .../systemd_networkd/00-netwan.link | 0 .../systemd_networkd/10-netlan.51.netdev | 0 .../systemd_networkd/10-netlan.52.netdev | 0 .../systemd_networkd/10-netlan.53.netdev | 0 .../systemd_networkd/10-netlan.54.netdev | 0 .../systemd_networkd/10-netwan.400.netdev | 0 .../systemd_networkd/10-wg55.netdev | 0 .../systemd_networkd/20-netlan.network | 0 .../systemd_networkd/20-netwan.network | 0 .../systemd_networkd/20-wg55.network | 0 .../21-netlan.51-clients.network | 0 .../systemd_networkd/21-netlan.52-iot.network | 0 .../21-netlan.53-public.network | 0 .../21-netlan.54-management.network | 0 .../21-netwan.400-fux_uplink.network | 0 .../systemd_networkd_global_config.conf | 0 22 files changed, 17 insertions(+), 17 deletions(-) rename inventories/z9/host_vars/{rt1.sops.yaml => z9-router.sops.yaml} (94%) rename inventories/z9/host_vars/{rt1.yaml => z9-router.yaml} (53%) rename resources/z9/{rt1 => z9-router}/kea_dhcp.yaml (100%) rename resources/z9/{rt1 => z9-router}/nftables/nftables.conf (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/00-netlan.link (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/00-netwan.link (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netlan.51.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netlan.52.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netlan.53.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netlan.54.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netwan.400.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-wg55.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/20-netlan.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/20-netwan.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/20-wg55.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netlan.51-clients.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netlan.52-iot.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netlan.53-public.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netlan.54-management.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netwan.400-fux_uplink.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd_global_config.conf (100%) diff --git a/inventories/z9/host_vars/rt1.sops.yaml b/inventories/z9/host_vars/z9-router.sops.yaml similarity index 94% rename from inventories/z9/host_vars/rt1.sops.yaml rename to inventories/z9/host_vars/z9-router.sops.yaml index f4141fd9..89f18e18 100644 --- a/inventories/z9/host_vars/rt1.sops.yaml +++ b/inventories/z9/host_vars/z9-router.sops.yaml @@ -1,8 +1,8 @@ secrets__secrets: - - name: ENC[AES256_GCM,data:MmqDXUKy+U67JZFmKJTGLYAJcYPClQ8M2w==,iv:/eDx++bJCzdKXYB8YipB/GB6aM421JR3sy8i5trBKxk=,tag:/zTklys9bN839iT1qOH0UQ==,type:str] + - name: ENC[AES256_GCM,data:gt9BarzsfE/GJ5gQeelgePquW6KAgE3Exv4=,iv:IPpUQI+zkf8O+ej+ZxLFyWUOrxGGlZvmDRG0ut2cNsA=,tag:GP66MvcKyCqyKV814+uMYg==,type:str] content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str] - name: ENC[AES256_GCM,data:9i4hZU7Hv/IMlI/1oYthx8g57nrst9LHZQk=,iv:IQanD/CA64A+hVyTQBiTvWdXyY8qNF9BpehWZxI5a9c=,tag:RiY0OJe2xbFPG6wfe5XjiA==,type:str] - content: ENC[AES256_GCM,data:lrwHaNvHkh5E94ziiQsd8ua9YvuwmhZ6iIGZS0oFnZdYKuyNh7egWOoii2o=,iv:LLRKhbiJl1GwK/SfqNdNrrJuDF17YXw3hHmuhlyI87w=,tag:DbR/a7jfy1+4yswSdYfOFA==,type:str] + content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str] - name: ENC[AES256_GCM,data:2lJUcDJ7ECJ1bF4Fg1VwOR2tBIQ77ZvDAbFF8w==,iv:HrPWIetjN/lOyQ7Mvk0sM1w+bWldlNfWhvw7/sfqKN8=,tag:AJL0s+f0O/yR4G3RVd1IHQ==,type:str] content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str] - name: ENC[AES256_GCM,data:ESxpEp9k9BdD1GJv+af+U3ny0+RPuaJjWDhQ,iv:DxsZLiDF8F+ixepbUdlitMJ7DLHjGNFNuxRwLl7efo8=,tag:STnv/oLzbchdiwXfKP3fow==,type:str] @@ -18,8 +18,8 @@ secrets__secrets: - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str] content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str] sops: - lastmodified: "2026-05-23T21:19:38Z" - mac: ENC[AES256_GCM,data:Ded0VfGn8H2qGMk5LDyqF1gW8hajKc9FgvCynHPQkWkhMSdaHYbFwf//gWi2TjIO22HD5sPw1w9KAjPy53b57RwBCjXfMMq0JCPvuePLK40NC8uCAi+wr5Er0fAWz1JiaA+dowposoi6RxBtyHCaNHMDVGMLh1j+IL+pTOyi6fk=,iv:gssOMmR0DDQC4WjMVXTD/zqbQa8qlBr9ZZWF15W0WnE=,tag:DORTxQfCmpVjDjyGSNH7dw==,type:str] + lastmodified: "2026-05-25T16:29:22Z" + mac: ENC[AES256_GCM,data:zxtV1xgjQuKNMvh6S8oAOxX5J6+iBRO6k3vGw3vWNlhah4Gu3S/lt+5v8lQHogz1Vyc+Zff0yMj1cn6RstDDj5AuOCljRQN0FYs0fjCo4Yrxx5sMMwcwBYquC77skEiZhRnqdXKkjiOM7EGE8qj8O3DJ29borIjm5NAsflH/qkA=,iv:7EUElg+gu8mk2Gq32JQMTf+A1+ZhZufoqt5bk4+Ca1E=,tag:XG+F/zlXizsc2B8THoXj4g==,type:str] pgp: - created_at: "2026-05-23T20:58:22Z" enc: |- diff --git a/inventories/z9/host_vars/rt1.yaml b/inventories/z9/host_vars/z9-router.yaml similarity index 53% rename from inventories/z9/host_vars/rt1.yaml rename to inventories/z9/host_vars/z9-router.yaml index 876776a3..c9d2b6fd 100644 --- a/inventories/z9/host_vars/rt1.yaml +++ b/inventories/z9/host_vars/z9-router.yaml @@ -1,7 +1,7 @@ -systemd_networkd__config_dir: 'resources/z9/rt1/systemd_networkd/' -systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/systemd_networkd_global_config.conf') }}" -nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/nftables/nftables.conf') }}" +systemd_networkd__config_dir: 'resources/z9/z9-router/systemd_networkd/' +systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/systemd_networkd_global_config.conf') }}" +nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/nftables/nftables.conf') }}" ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin" ansible_pull__timer_randomized_delay_sec: 0min unbound_access_control: [ "10.89.208.0/20" ] -kea_dhcp__include_vars: resources/z9/rt1/kea_dhcp.yaml +kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index b1770ee7..41ca0396 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -15,8 +15,8 @@ all: yate: ansible_host: yate.z9.ccchh.net ansible_user: chaos - rt1: - ansible_host: rt1.ccchh.net + z9-router: + ansible_host: z9-router.ccchh.net ansible_user: chaos certbot_hosts: hosts: @@ -37,7 +37,7 @@ infrastructure_authorized_keys_hosts: light: waybackproxy: yate: - rt1: + z9-router: nginx_hosts: hosts: light: @@ -53,22 +53,22 @@ proxmox_vm_template_hosts: thinkcccore0: systemd_networkd_hosts: hosts: - rt1: + z9-router: nftables_hosts: hosts: - rt1: + z9-router: unbound_hosts: hosts: - rt1: + z9-router: kea_dhcp_hosts: hosts: - rt1: + z9-router: alloy_hosts: hosts: light: yate: dooris: - rt1: + z9-router: ansible_pull_hosts: hosts: dooris: @@ -77,6 +77,6 @@ ansible_pull_hosts: yate: secrets_hosts: hosts: - rt1: + z9-router: forgejo_runner_hosts: hosts: diff --git a/resources/z9/rt1/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml similarity index 100% rename from resources/z9/rt1/kea_dhcp.yaml rename to resources/z9/z9-router/kea_dhcp.yaml diff --git a/resources/z9/rt1/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf similarity index 100% rename from resources/z9/rt1/nftables/nftables.conf rename to resources/z9/z9-router/nftables/nftables.conf diff --git a/resources/z9/rt1/systemd_networkd/00-netlan.link b/resources/z9/z9-router/systemd_networkd/00-netlan.link similarity index 100% rename from resources/z9/rt1/systemd_networkd/00-netlan.link rename to resources/z9/z9-router/systemd_networkd/00-netlan.link diff --git a/resources/z9/rt1/systemd_networkd/00-netwan.link b/resources/z9/z9-router/systemd_networkd/00-netwan.link similarity index 100% rename from resources/z9/rt1/systemd_networkd/00-netwan.link rename to resources/z9/z9-router/systemd_networkd/00-netwan.link diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.51.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netlan.51.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.52.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netlan.52.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.53.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netlan.53.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.54.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netlan.54.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-netwan.400.netdev b/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netwan.400.netdev rename to resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-wg55.netdev b/resources/z9/z9-router/systemd_networkd/10-wg55.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-wg55.netdev rename to resources/z9/z9-router/systemd_networkd/10-wg55.netdev diff --git a/resources/z9/rt1/systemd_networkd/20-netlan.network b/resources/z9/z9-router/systemd_networkd/20-netlan.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/20-netlan.network rename to resources/z9/z9-router/systemd_networkd/20-netlan.network diff --git a/resources/z9/rt1/systemd_networkd/20-netwan.network b/resources/z9/z9-router/systemd_networkd/20-netwan.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/20-netwan.network rename to resources/z9/z9-router/systemd_networkd/20-netwan.network diff --git a/resources/z9/rt1/systemd_networkd/20-wg55.network b/resources/z9/z9-router/systemd_networkd/20-wg55.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/20-wg55.network rename to resources/z9/z9-router/systemd_networkd/20-wg55.network diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network b/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network b/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.53-public.network b/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netlan.53-public.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.54-management.network b/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netlan.54-management.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network diff --git a/resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network b/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network rename to resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network diff --git a/resources/z9/rt1/systemd_networkd_global_config.conf b/resources/z9/z9-router/systemd_networkd_global_config.conf similarity index 100% rename from resources/z9/rt1/systemd_networkd_global_config.conf rename to resources/z9/z9-router/systemd_networkd_global_config.conf From 8351c28cd05edaf70f902bdc6d0778ad365e1843 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 19:26:52 +0200 Subject: [PATCH 06/51] z9-router(host): add ansible pull --- .sops.yaml | 7 + inventories/z9/group_vars/all.sops.yaml | 298 ++++++++++--------- inventories/z9/host_vars/z9-router.sops.yaml | 251 ++++++++-------- inventories/z9/hosts.yaml | 1 + 4 files changed, 294 insertions(+), 263 deletions(-) diff --git a/.sops.yaml b/.sops.yaml index c3ceb875..7df285b4 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -51,6 +51,7 @@ keys: - &host_light_ansible_pull_age_key age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q - &host_waybackproxy_ansible_pull_age_key age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j - &host_yate_ansible_pull_age_key age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22 + - &host_z9_router_ansible_pull_age_key age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp creation_rules: ## group vars @@ -262,6 +263,12 @@ creation_rules: *admin_gpg_keys age: - *host_yate_ansible_pull_age_key + - path_regex: "inventories/z9/host_vars/z9-router\\.sops\\..+" + key_groups: + - pgp: + *admin_gpg_keys + age: + - *host_z9_router_ansible_pull_age_key # general - path_regex: ".+\\.sops\\..+" key_groups: diff --git a/inventories/z9/group_vars/all.sops.yaml b/inventories/z9/group_vars/all.sops.yaml index bc4c3f13..f5aed044 100644 --- a/inventories/z9/group_vars/all.sops.yaml +++ b/inventories/z9/group_vars/all.sops.yaml @@ -2,213 +2,225 @@ metrics__chaos_password: ENC[AES256_GCM,data:seOU504dZ9K21+NK1MBf9isee2L2rueP6Bl msmtp__smtp_password: ENC[AES256_GCM,data:FAih8FghRYDx3QGFCjKoJ8Zq0TkeCIx4n1jTx4/sASgECqvucg==,iv:8NDn3wj/bXsbHbuce3ycJTBVWde6XAVxv4NuMUkMbIM=,tag:jeE2b0i/8JPtguLYQvdV1w==,type:str] sops: age: - - recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VWJQWnBhcDc3VXh3TnMy - RFljQU0vNS9iY3AvTWFraUxneHIremlDeUZvCmdzd0twWHZEdTZSbHpLbEpRRDNX - aGI4ZlczN0tFbC94TzJ4bm9aUjkwcVEKLS0tIHRGSGdkQkN6ZEVTUjl1cGhMZzVI - S2FtSktoWmF2TjZCZnNlYWpWYzQ4MzQKeK7f+UPSanQsOIXNjzZa9B5FafNFsN3W - sjssDdbNQ1OEn2CLWRVQl1umKrADuvd85fMu3gUZrycZRDCCfsBzVg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxTzAzaVFSRDQwN2llbmdl + alBBVDZwTWhWUkV2L3ZLZmNDUDRyTitDaFVzCkNRTEN4ODV5ekxRVlBZT3ZIM2pj + Z0JxYUlobHZCeGxxNE9PcENkR2h2VDAKLS0tIFZiVXJHSU5naXhSSEFobVZBN1Rl + NnVDUVRyVWxlUnMydVhiQ2s0bGMzTGcKh97/UOPxrKieK5dKdGyRqCRi8Sm5UNcT + I9jLCPqX8Utt0e2EEp+ivJwFxgo7QuNCYWu6jtPCO/Zmc5Q/2tJQ9Q== -----END AGE ENCRYPTED FILE----- - - recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q - enc: | + recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkSmVEVyt3OCtvUUNqV2FR - QW5WaDBFcnZVMTV3QWdSLzhxRENCdGNaVFU0CmxqM0xIWUVCSUwvY1pBVjQ0RCtq - T0psSG84VWdpY1dYa2doeFZXd2RKNVEKLS0tIGNFeDFRYzBDN3NWcnpUSVhEWitY - RXhLRkp3ajdlNGY4R3hRcWVSUU04T0UKdprDhBpp0aMc733Wx/K7hS/nLVohvlft - N9aSQdcRoqT3/iMGu/6xdqbeq0/7a/U+6JvhYyWLkLsrzw2mlVRoIw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVUtpb0FmeUduNW9EdHJw + WEY0WllWdE8vRlVhODU1dUcxUnF3WE5mUG5vCnBQRlNkblNHbUFESXhvQ05YdGVW + UkhjdjdvclRmTk55UXRGRStXREFiVVkKLS0tIDlkMHhxVkxEK1BjV2orQUtndGc2 + Mk8rZm14SzFWTjJTanVXaE53UmViS28KQmnPfzLhgLasSuu1Aflp/JDWo1hqvYjb + BijruPUZ3NuoZ4Wuo56FLlTLrch051fI3ottzy85FfX3lRnWZ2IK8g== -----END AGE ENCRYPTED FILE----- - - recipient: age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j - enc: | + recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWWM1WFdidkY4a2hLNm03 - TGdNNE9ZK2lvelhYQndTYy9sUzM4TkN5elRZClJwQU1qeCtwUlFzeVE2d0FSSCsz - WTdzQWZLYXpqUHcxc3VEWHZvNmZibU0KLS0tIElCTWdraXRLcHNHMjR2eDVxVCta - bHhVdFpOdDB0eUR5d2hhdWJlcmJDMjgKBbVkm7LNwnoUVrUF3NPI7d25b6tAIr1t - HelMjQU5YFM7DvRYFOlNpgO7WmddNSq3C6WYa8AZDGpsjc6GypcLVw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQSm9FZ1VmVWhadldRY0JU + c2R5d0tNMDV5U2tzbVorai91RTFyZFdUMWo0CmxLVUJYdVFUN296U3Q3MTJQM0JW + LzNTYlVVVitRYmk3azQ4VXBLWTZiZjQKLS0tIDhXdFZaK1BWVFp4M09jbk0zdGpF + dGxmUUZkQS9sMXZoeTJETGpvQW5VQ0EK9Y/trD7VhjQnqY+KryPfEv1J/D4NCWsx + CHv0R1ps6A0qoRJzS1UNxU5bLXDX1RGQiU/arhJ7LXFxHrNOdObsZQ== -----END AGE ENCRYPTED FILE----- - - recipient: age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22 - enc: | + recipient: age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTmRaRXorMzBQZWwyNFp5 - VHdUUElyd1V2dUcvQ3k2STQ0d1QyMytsRG1BCm5CVCtRWU5FVmErQWl2N3Y4QTc1 - Mnh3K01QUnk2MGpSZk1NRVJWUlhFYWMKLS0tIEFOM0pMa3RVNUppS2xOakFVM1lR - cnlBL29XQVlsL1ZCenBIYTQ3S3JxQjQKq09vbn1XOC1jIXDpv+ThFMk9k7SyYknr - MBJRBp/0PrKBo/Xk+RCSWSLjgali5Cc8KTjDTJyBG8rFzzvLIazBRg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBreTY4bzJ3T1FHOVdhS05v + dG40VWdVeWRpamdqd2ttajFJUjdYVHB0ZXdVCmk0UUJuRHdsUnE3ZThNakpwY3po + b3dtWXNNSUlvbzVHcXVIclNlaVNub00KLS0tIEMwL2FYcEZ1dkZ5MFl0S3pWSWFJ + NGdXVXA4UGJIOTN4UnhoMjRYaTRNWXMKGJNomXuB5TqXZKWk3Ub/rEc69CrfYABw + bBBidbCQBrv7cnsvjsVpHHGaTwyP9Nk1ceF/gbv9fD9gZ7dwt3SA1A== -----END AGE ENCRYPTED FILE----- + recipient: age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrQWhjNHlDU0RKRmdKTzh0 + M3dhOGcrc1N5SnozMHhSQWNUdERPSjRrZ3lZClBpd1lrbXY5OEVnMVgwTGl4YmUw + bWpJR0Z6RDZubG9lS1BIVnEvMWhEdlkKLS0tIFhSbVFhVnZIN2xETXlWNlh3TVVG + N1VTSWN3SEU5U2Uxc2lRUmwwaWc0L1UKfPWAEs93dF10GZdlQt3yeDltk/9Djmuh + 3ZeGLgkOjcJPXO2hFQMZoJY7a2ZRIxN5Oa8PGwuy7DEtmQ9PdP/mbg== + -----END AGE ENCRYPTED FILE----- + recipient: age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp lastmodified: "2026-05-23T22:10:20Z" mac: ENC[AES256_GCM,data:JbnKG1qyAkvFDXr2iHu+gk7nRjedmm+dEK8vBFW5YzndWE4QKoYWeaqRHBk7wdWO9kpZgU2rFiu4Be+ikotoMS8jKAcd5wWSrWtSreaZxxiD2TWMWX8HwPtETnYe0rjrEZ3kPcUj4QPyNTphfbH3ARLjthedRXNF70NDc+DIpAY=,iv:4LN3oslWUWqoY3rQNVDSmlJn1o0c8JQELzsWd5btn7Y=,tag:c8X1q9XMMUkXed93j9C6ww==,type:str] pgp: - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxK/JaB2/SdtAQ//VIMBtLL8lhncJeItw53fQW4Lia0hs84yuKLuSBucNXhy - x3LT5r21C5CZ+JnucrGPxur4clsLnDnng2CgyWhksJNknk6smQIq3ZhyBd/OJzS4 - zNGUJIbitJsDaKjTrYDCdsQ3KVcRBDMu3ow7vzeP4wnL4qU5fUuQ7S2rK6a1hfMB - eTQmn4wD/Rl+Q0AWEo2V/X8UgchwGPeuOXfju2t9+1UVE0kUJdXw/JIrGyR8XrYM - 6ZGXB3mPnlZTZjqhXVSFSSOUTRYu/0g+s/JuDLpgl8gVP+oDvSCPrB2pDNK+o2Oo - VbQbJMg6lMbIuewd0ZTTeCv/TFU9O51RtkFyxHIEW7dVelDrNkuciAG1mDUHFUUw - MHeWDjngeCzr1hj1Z78P1bvR7I2pqBQiWT+d/e50S5quNRVjtLVEjuU7r1eKiPDu - pL1lYJZZu5+uY1nWE4qeJiI1KambjP9/C+RUCF38yT1wNvxrbwsM9haXGbI3t2cU - X/RRpK5VKKKwbBqyQmkZX7xaDR13hLF2vLtdVw6L9nYVVactfnFr9HKDV95HUnhO - uevmzu+ShtAt9FMXz86dLYmBx90A2BSWxb6sKvZkG8UDY+vVT1K0gNK4kwxR9rKt - LFzCq1a3ftx3UvrNMCwaboGQZLpRtiKr0lNQvGLpH/SRDZ2HksinV16FNVuN74HS - XgG5HnRO9/lkL2Bn+ms7Q6+ki9QmC21FlLGJOBQIi+VHNVwy6J8XQlrs5NZPy6Ib - LmWIV6BdIRejCAITlVeBRBpXymdUBicPLa/VQMK2s9L3SS7MUcv+4j+vje9YR5M= - =IEFm + hQIMAxK/JaB2/SdtAQ//cayg/ELKtybgayA4z+xOUK10zQJDE/U43BcPRMrBN0+x + VLu/C96Eom/dJN62SM2QamThHu454HMZj1PjDynMUzgfVqXEg/eG45bBBweWrI65 + s0tuzLmsqpdt9TJ5t0znliL2DYS3MPfmYRNbAsYsCbQd4I0YpxdzQwTvURdzjpUG + nVBUfzfcYH1Yqq8BVtR40MKfa/DbOsJGENHtpkQ9UDAa3gwVQs0NyZRQzg5w364C + UvItYlU77ZCKPkyOQuciLn4sM5poihu3UNWp855QsDK6fZVuxPTS4Cn54cfwdOTe + rL/ZQjLcHJ7PRmZUiWR6GVNDrY55u7zhORD4b8BgrpWW4hhxpp/ENjnRmNt8jKR2 + dJ/5/uC4HBX0fM3mbfpUn19BxCk9+gFPmNUOUZ93UxpQ28l1lZxeiLBOHAw1srEs + 7ZfFrJ0osedPGHu8rVOe93DCAtb/oNxr1xvGuDK/licRkEh8t8cvuoVsVhYFjNBc + UKXIPrhvuSj69c3OiHa+u9fNZJX2XAi0oOcZqGp+sQCCgUCA15I5QiqTpalCSTKt + /Stoj9BsmlSiy8YD2XBjmzHHVxJHfl8XHcuONKc3e4UmVjKlzkzc0bI73Y6XiEvt + zRIUmWxfvAvqP/zPcMSwaZke5h7N7ywKcjM+RHB4NqRUVYlBNwIWXvi7f5BdLhrU + aAEJAhBcA//3NJxuDzlf1zoXGKOhGIwNv5/Qb1n13OKIT2s0nfbqEHgAUm+tX3gk + VKKMqFuVmq2mkAaxXWFq20VC6djTJJS1QOaNsc6x3bJ6iDtYV19Ddn/20jbmbqmn + XbCDvb50nubC + =ZByJ -----END PGP MESSAGE----- fp: EF643F59E008414882232C78FFA8331EEB7D6B70 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQEMA1QflAioE8i3AQf7BB0RdJbe8Ro2Fv4Phw+VaR0rUIuQKWOb7zf3/9YCbV2w - rICGVIx7V1vJF5R5RgSfk0RDrLN3Pfoq/7Jfkq6bMoHIVCHSFdryHfjG5Dgm49Xv - gDZ2CPAHPn15mG0Rr/67YUWsC2Jy4y6/JY478wzYu4Og9IkxkeBd6ufBFB6bTn4H - qB7B2hfkyQzA66zoxc0r2O1mchbJ3A4pVJw0v2I/sWCiZoJQKmt8ksoEK8BAQCWC - E8sozb2opRzFaUCZSNEdhz/rnbV8u5wW378kd8kHSOlWxaFZNkWUP42YQiNTkd9/ - YpxxGvwCTIpHGAYFtU7CV7QfQHzTuAOz7ZElPZsYkdJeAZCwUFO24nzwpxYS43AV - 29IHXvlKAQkjJunix0bPGcE3D6T8CUs0wXL2sUSDcvgOOQZSezRn4UNEqFCftjJ4 - Gmldo/baMO2Y054/iA0jvNmHRk6sJCY8aRYv9m5Fqg== - =n7Qb + hQEMA1QflAioE8i3AQgAm+iazJdcOXiq08MvSGMQ9/NAvrgcDav4561Hew23n4Ms + tKC5VLXf3l1f6yjhBZy6mnslYOWWdJ+X4XK0OqWkRr/t7zxEK4M6PC6g1W5hkaFU + +9DrkBLKss8atz3EhexK6GeljTuRpVWM629BtvMPBo/41eyue78TLf81vCkbUJkC + UpeB4alsETvD9Oz0ZRT8fipuXzdpGSjobOIgQa9bKwFMXXGY2fwBuKW8gVtSgbXP + mKwqvGaSdHz30BxQExmLne5ERKHOvzac2woG5tOmKPaihg8pbvuq/VjS2K0mzS5q + cbwyq/u4d5fGEFQYqMARW1aiyo3NjYk4xWDcGo5Ql9JeAdwhj3Wgm1wccULt2Hj7 + z/V1utNINoB0bPFb8ZQMmPpwAeH6nnoqjWmmoRSW0tL/EaPh5xQXdEuU+DloT5f+ + k8c2KQC+v4bh6BMUcycAeIG/h4vKsgz/Jc6BWKKD2g== + =G51B -----END PGP MESSAGE----- fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJARAA4zyDJtNqK5w6QPYMyEtjuoAmva91yLA4oAU/diRpFXHx - D4UzksW8moYqmaiWblFy1HeQJFwZWrxnXeqg9B7PFOkhriIG7al4DpV2wXoCjami - DIkewGoeZjTbPNxsDVl0SbDafCARQFnQ8LNTmM2hi2X/ACg+c8mSM7eK6C3mh8yG - Bo2EsuCnIqzwzV6XbGCKnfOUh0QekWM7Jc/e3oYGSgCP2N5wb2PLVsW1220qdPvo - 8D1l5cDVj2Pgq7fnfbxZGJYSfdgJb1YweH8mjHk3gHU68AGeeSkV+VwcBGV2HObg - hKSbVWcyGAHrP1ppCNyXr5ZkBgyvdB/EjxjLqTLq7sdTnqjLLbMLgi9CCI0NuDMI - jfgMjOdaImjUvvr8lCl7dOMyp9wc6ks0bwRbfG3AMLGKWeR+un3uaDYujD0bQLqZ - m0g5mx1wHxNCJIb2ZQ6UVjDlnatTYGBnxEupqxr9PFyny0MRhaiYkuDIh4tHW3nH - xyCHN9QIO2/EktLkM4wcfhOeVgdpfvKgT+cMG9kS/yfInZ5ZAGvXznzvfNZZtKDL - fLvvF5AqYbN05c0h56WJa65tIT75P2wI6ZBncCSLqSAzyXWlZFV6UBP+5QLEkQaE - WtY8y2907OAx1v8g6vc5v5oHMqfwfWC4nuFbkoJo/ZbfvtDWq4eFZfkUKY3Au5LS - XgE/l6NTtWknF4nPYIRaibum4527ke053JdD/50eqfuRv8MFIHbRPfWE4lE6lgev - +/j0Ef9sYRu726Sv3wAgT7K6PmCFsLN1319OmjkZpBAJiNsxx9qwXyqgTpTvb34= - =Hr9J + hQIMAz5uSgHG2iMJAQ/+NjXRTghMiYErsXenuJRaWdwHZ+6DkkG8nC5b+Aigljgu + OJg5UQgYtX5W5T79uUuEh5BWKO5bMHBwDNHQC7Hn1FseYgrOxcoSYOsewlb8t2QH + fqGLLhv82nRnU0nTs8W/yvrBH/ub0kAtuko1jkPSAWnoonmeEW970iLVIF9lCVYJ + idF+DDSiic9RDpHd4Csuxdv+1Q8OcaOW1HVAUrfrKOvC17sawd1Cat2DWC8EcOVD + clNn6A91FBCTxVnxwM4j2J/NXP1JRIGnlxaa4lATQMiX8lfheu0LyEpsFZai55RC + dq20HWqPgYHiamp6eGQ+Uqe5edx6F5YX/25S2Jfrx4D5vRh0PFx6blY0kgZJp16a + ywNiMtLPh7HjOMbB1v7bcWtIDWrIhWDtyJ7axny8sMamCLCPOwPpPvdL/B5YOntm + +0wMXHXCLCaljzsa5GFIyVYj3pTY/6O0Fgkv+6ow08ndPjsViHNikufCSW0ueIFF + ehv0V2+AHhedoHChFZI/DEbGzIKVcr7JAA+GHAIWcklg7O5hss+/rr7nYxVB0A+t + Sfp5kVMInLpCPLRm2retun3zPF8+R0kN/ZrkLy02K7z4rrD8wVE5QUvSCWbpKdfS + deWIy4lp9wRXSunag1/CxqvrH3ZszlxSZPEQkC4hez+xOS//L/5QsiP52SavB9PS + XgHvkL3slXXsdnIgm3cYnHqEBf2rXLQR/ZTzusXMLEBaGCd9JB33T/Lz+TUftCUI + xxLwzFvm+dEvQ6bOB6/OvSMBIsvVzMZxaIblwZRdIYfQovEdKLCRc+F4lTqV8fE= + =1lXS -----END PGP MESSAGE----- fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DsZXvxFXTXoQSAQdAp7TsXm2MaBAh0qB3eOjtFuegcEsmtdQHsMP0rs0N/m0w - bbbzXLwq1TGL82l5Qon4NnX9Jg5gXnKydWOiKWhxCsQ0iHJ7eupJLxyfDD/kzga+ - 0l4BRUpbBFslWWa8Fb7zfNA7kslhkaQIJAmN92Yh/2NdkpmNEpMMaIrx2p2jK4Iz - mwGUQlUz4ZkK10xy+9LMaAtmLhBJgBhDTKKzw7OAsRAnASq2gXA/4wqEVgBU9BxB - =tBBK + hF4DsZXvxFXTXoQSAQdAJAr+RX2f5gW5PpXJ/WA+1qMPFjuWuDccIk1ecWzc4kEw + sNH69jVC0JL7l5RMrJTAaY0GRTMrJffoz28JxpVbUVFEpeHsd+myGCcD1jZyS1MX + 0l4BllCKEsOVnEKKxOscOIctaIw8/MDNnLSoP04JI2xVKKThor+UwUhRzg+fVwxH + uEiHsx0xA/q0HVXhTNIvIWn0CKx/4uV8JwVa9JqjSSyQVm8PBwU+UTfXMQ5VcuHv + =uxSy -----END PGP MESSAGE----- fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAlBZhTjLL3YPqorSXq0jet/0CXmeZeLL8inGvm/HgmgIw - aplmjWHB80err0ffZeRfcvqx9DGujpwlgoFGDxjqn4LIqoNg6YK/VfFb9pXUvIOv - 0l4B9xQ4DlaYOX1egCQUBw3KcdcnNlcEZwTOwTKn0Hg3gXp0u3TYlJFZAchw2G+l - XJjlWiwJN2gKfEG7hrtZ7MJkYJFsqMFa1aC1oWHduxU4jmdRdQqdIaQDsqkcqJc3 - =KNVY + hF4DerEtaFuTeewSAQdA2k3VLlMvCocHQ1ULFwTJKqscSb2FScq8A2I1TIdlfXAw + jWLzGphdsfHuNBEsocoixm4nKAdhjgBsud2rfYkuwxpqX2MlBr6ikpN73dXlHtt2 + 0l4BkUvmqlioN961OV7nssbeQLzb49C9Gzm5S1dQqBQVCt/7qGodTHHiQON7bYJp + +OgUaI6bKZjd9Lhm/u98dTH2cdPm1B5bUQPDzptWX5vG8euzBQxXc7OrGsTFyYME + =e/rg -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fARAAhSBdgW04fKM8tAU8sC6h8/4e0Io3W/D2l6P7nZiD9WVR - 2pUqS12mlNCoRt1I2empyJ5vm1wjor34BCuSCiyfLQ1WIlBJlDro96ygpsHZGmam - tNcrgwc7y6rg4ycqUWr+H+WVZ0kw1IYYKbfAjMAJF5lQqzz+VMvET9BbmvA595MO - l/dnMColnjxxBiYBIzO7mnli+uqRHB79rM2VVlrqoT+C2s9zuPfpJfY0PJaCbbdg - BlffAMqs9m2JZdDr2r0lrN/jyLUB2d3l9NCcF6UYP6tjgZsKmHv/JxSgXLf6IklE - wolO04qgDRK7jeO2UGEniweVQNi7hqA4vkp2TskGbfVsS10PyLYKw4N19GedLS3c - ZxRGde42Fze/PrccWq8bGdOfWhPBo2/MEyqVW4lgTeCCwrFRO3UNyYcWo7cmaN1q - lz7uaV6ffqbUDJSkjkphvxnJtuX62x9Uv/wcwrJuZUarSNclQ0nQV/e5wc7SzPgM - B+GLeR4tnconDZGFq8q+KKuHe7MSx2uwiZsJIVXohcZwhkd9wk5YQBPc8i4aP0NQ - wsb+QptuM8VpCEVAwKOUjp7IRRfUyqAIlmIRDkTijmHknSmI9HZXPyCvTLoy1Szf - KDrN1MAma6b4gsru1fFnVizXQyZozl5RVZFP2Uv+ndugdvRE5sv5aevlzgaWFg3S - XgFqaFwId78UDNTrxcs4EzjHmlwg4E05G9pUqbA9zBDdCqwlD4+6CfAgQ46A6ptY - 5p2QQJ3KXgJXrtlJySq8piReyq3mpagtWZJfAazovJA/ZF4o/xs9ZIu/q3qxHSE= - =nR8y + hQIMAxjNhCKPP69fAQ//VLyOILC6lpvlq0W7NeYfUzL7KtKYXVDF7aSQ/b6Vn7Of + ggc9n40n6FkMJqknhbvSnhhlFdzVOCZkLy/hinNk+jF2POBlLbzBjCuzQSP+ZDyC + Dll2UJ/khITd+tQ4zwrFLpixr518Fgcj8NOgtljUovxR1bGIzYogpmiVFJEd0cT4 + k7ldv5WbZtB2UprhPPpNe+98BaUvuSvA9RWCogaBbuQpY2p3g9t9Zo58spOawbP4 + ccz7Pu03Esy3cenlnCt3G7gl19viIh+wHKrIXPa8dGO6TEsrRMPT0tNEs8iUJyDO + TNEgo6+yxQ2p+08EzAh0BCRwljqnPLjS/h2s2s208Z5rBOCpLY9RuoXz7JRvZ06p + gBgPFSIH12VBGjfqCB1uZIatbtLQLjOo6+UU0evM65WhKw3//tUnLrox1reoiRzO + ro4JuytP+f4PylQRsr3jOYKRKCBzoZOOPZbVEpwQeBOe9zzxDgVQqHgVDDZQzCcw + VTHCrs4XVHxPH0aRMlS4A80xbH7VncYbcbf8a6VrTpnPflv0OryWMWDqLBzmIPgM + W1Bz/hq/o6br+g4uAKjt4GTdTwWYxptA5L84aMoihpXRu0MaPhG+7MRsXpEa/+Ll + +ybl2DLpm6zm0iixkJuxwtOdQOGjqJqC/GLw/EZJTt2aO+ZUb8dLrChNmR7HJAjS + XgGBpFYao1AQqLZU3c+5B2/9/3rtOoVX1DQXhUsji5NkaHyYO8usauj9evPUf4qx + FAQRWua5/zp/cTlNWU3GknqtJ1G0g1mrkiVeBZCRxIK2Iyvyav7RALJ1jlkyW5c= + =meb0 -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA46L6MuPqfJqARAAjpM3MO83b2EUtzyZs66HWH6Kd60rl3QODTqs4PQm1cH5 - HdzfVJ2IDo1y+FMTMmfJov6xBqnlalNaOvg8XFAkKTUkZgUHRW/q1WXP4FywTWmP - aJV47x4dOQXQgj/i/ykMspUgsxA5049/nG1y06Wsm2agLO3KjL6KIJAx0LI28XPU - qA/NFtfNuEAv7DGS2LGz1+X1hnRYcBX/oUgpihzActWmMORD6VS7xZGcMdF2/+Ex - OCDAnwT0cBSAihBSLTmEMJ4xfmMG228nbLqm9r/gELgVIsIL5hXWz0CtxaewwLQQ - XFMm/ZV/G6bZKRJzKPOR9EcPMF7Z+nnBts9wKNlE+WA32p7zu7hjvEFZhLiDKYlN - +nFcx/rvyWB6sbFK0xn2x5MonxWNVUy58PnqGWmPi2VtXT1al1zSAoKAgg8Xdw21 - PQENtxqeUSLXXb0SZXFptMmYStwqoaFusLOCLW42DogFU246o14veDDtsS619T5G - RrszsNg543i3ra7MIm99YRXyniUaDp5VlKufPkWRexIT5YZYalOLtdLcaTTzfr7J - x4PNVOK2ddtmlKbbakvvmPWS3iBEUGMqw69dPhEdpY8yy7HJ2jpXX7TiezNqGJ9w - XqtI9RJmWrr0/zSoim0EpHDwXZhSf7YVcwTs0XCtwrXcQT6DLaZJr8cny/G1ErLS - XgEdnUqFpB1D0bacmRpfHA3PLZJd/x0QfwZ/b7gzz3f1xRfMXgnsM4iYu1S8+VAW - Dy21iVFZledWfrmuXh/PkLFftLipYK6tc0n922kFFxCn/xSP0yx9qKlNwzyduNI= - =4+Bv + hQIMA46L6MuPqfJqAQ/+NK0D10olgDK4KcArzoMtrJR7qwbrceSeKwaQGsUB1+RZ + xv6pZJ0zyw7McTuUV2I4bLYHy/TffSyJk5vLSSTGFXgHVdfKmjvm7VDEp5d2uKku + GW3Qh73quldfhd5GjO+F9V/S3rCysrNMpTmPnR5ha877FKGtc8168XRhIpe/1+mP + mvlE6h0Xizbx9myGR+ie17nHpoH+tjTtQFH640s38+xDgH6AozwWGUe/g5TdLaLJ + 8SKHyQnS8hOHQDkttvhWRbyhKa8WuGyOKSjuQ81HIv+/UPxh1fs7vovPHM8rtIyy + xGcWPzUeoKQiV2nyXUP3BqglhOhD1vokh3ejDcxwWWKuyASCSXhhvW7KMsV3Stdd + E3O1nyOi4+2I2E4TQo0NLt5mTJonPbvSn4IvV0LuatrG902UeNNZRRwQv3ZrVp6f + G2ZJ9HNSs+Tp9H8cJzBGjDBYjC6/d3GGWi7N/5G/n6C7T6W81BgO8UiQOleEDF1c + Bi6NPNeoGL8fivVGlGTHpLcpPpbYz+1ynsFs1ho4+v5bHS5w+UfvVvQC7dlDKmR0 + fUAkllcxLSnzKkpKis1HF+Gp+lSNc75/BzOeTA2gS3c8H9jMuncRolndPX1rVJA3 + mrLiQE/Mja9NaYHzUROKIHDEUOQ1ZzvpcRduggvfj6Gb2wzNdUdR5QrXnLeI2jbS + XgHO7Jr0HrHzr/+p+w89U+uH4b7onseYDiAjfLjAZpcYwkzuy7b2ZUmpLq1BjZRo + zs+rSqv4BP0Xa7LNIFrHj4OeL9ivwP7Kw/Tb36hU8DJ8xDfilx81n69Fer/cJ8Y= + =BNfm -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdActtZQL4KWrCP8UUZa/fLeDltuNV9JjxTYiI9upoH12Qw - 6n8EBLgKKNw1Hsb40u9M5Ro7Xzbys7zwZsL5CxEgFGDBxthtcdaI/ykjU0W3poLE - 0l4BcMpLoCyxxwIn49GpFxHiv84Q9xhouSMmCTe2p3bn5zCRBnKsetVHtEti4iRF - sY9FipGcyiNHfkp8KsWeUxD/j1QUIkGODXt2RqYkO8ltA5QS3kUCPErmWYymEAEu - =RFaD + hF4DQrf1tCqiJxoSAQdA7az9ylWMB3fWHwSVRmU8Gu4Qnd6HIyMuiG46weuS/Cww + QMCknkfCG06HtMrOcroNigaj7G6FEvDm64sUkpW/ggWkHUUEMuwi5jcKIdx7XdbJ + 0l4BDGUF81uOghQUq/JqDtiYPD8IzRHMXbJmXiO+4y6DE5b1t99wBUt3C5K5H91D + U3blcYO6GROPSkVp8ZIzfnWLvyVoWInd1ZiRs19n9MN6Yf8uWfx9/3xvN2kKQyvj + =4X+A -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DzAGzViGx4qcSAQdAoNdta1fDVjzrPWeSfKrmslkoFi86I2nWplPOli/gFXsw - 2Cx+wmejLlc61RE5sqAaQJc+0ctRezwXzBJbkuqznZ2jWPCK2A1EQ7r3Q7USCCca - 0lgB6XOo0ByOj/W4TrrGn7VmwLvEqIiWCt5zk4BEUSVc62Ffv48dcwL3hsB3HlRw - 6FXyR+2zwyEU5fuddFO4nMi8AXB6cfU6F4ugFgwn92lCgTom7IULY1D7 - =Czq/ + hF4DzAGzViGx4qcSAQdA/+jZ9/0jHioWKE2TK24OFDKjJ8futm2TP8z6Xat3uxww + DGwSznxagIkVgdTNKqAWmzGvOum8xDBqzP232CM8B/oxmwIjuIV8+FXtJuFHA/4b + 0lgBN9loSuX5uL5O4uWzPulEhqjFElrWRZXLHZn7uIWipW/7mP8CGu02wwV/lme5 + jvtJ6EjgopmHrxyaJqRk+e65gxBYKvxTQ1H1iETCUq8lOnxSBZVY5m5K + =7H6g -----END PGP MESSAGE----- fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA2pVdGTIrZI+AQ/7B7h5br3PMgum71smOTJMBfl4OaxkQAirJeG/z2fjqbAG - l9q62H1cutGKS/IYOFLE0OQaRwmHtkdTkrdmf9yIuAktcdAGAeqwnYW3LwM3t7U1 - nfZRJH5Hi4xcSVVaWHn5mX0QpxzrCye1EIjHvPRx6/bWHD5sW9qnkZAlAvEJS3/K - jdyBLLlK8AITpsX4eeVnmVLZBjbVEXPlXfFCh9PFyqrl+iyBBY9bO2aMzWldbQIr - j1551Xe1wKAOn5SJTg2Mrm5ehBKfH53HY6ubCy9acbv5ZTe6JuStseWordtRNNXY - 9eVmR3MRVoFWgK4Ccb9Qq8l+uEHRuQfG9K7dSnxQIJpHCOAQO9oi3/ykDt9Vgvo6 - WKPpvyuJpWc5Tn+WF1qhz5wDTRX6XY+cUoHkUqZXG0qMTIfMLIAFZ6MuslHU9f6J - PlY0FTnwp5/v9rK/rjXZkfIxKjQtSWZwkZCszZ0WtNVuaY3KO6KYrd9rolFFYjqn - I2xFGnTNZwh3tjG/3INoMwilOkIUNXr18k6FsPqVCAhj1Oo0iNxb3j+3pGJsH9iN - ciTLeM8MsFW9MYXG23i65a5WVXi8hMTcyqCy9GyxLeFprt2DaH2HaBahF3RIWPop - KTNsvW1aawy+lDUyr4mBy9F0TA8Z1/db3l950Gtuz5s9/7D6bbmRn72O++W1RD3S - XgE3QuksqaIh7ZGt8tVPREEHpBWmPCskh35vLoqeO1QxGxzJcjrcuNeHtOH44EEj - mHzYUydn0e1jwKZkATG23DiBCyMpcNAWmsMH45wmk0fgNLdQhuslhKLqOUDLpN0= - =Ygd+ + hQIMA2pVdGTIrZI+AQ//aZjaPgcAM6RSG6QCnYJgn8EDEhG7HDvXmb58G7VfxArr + m+K4Hc3hW0Hh/c7/bzu2QWniN1ie4apqFSvQmAIJ3zQZSyOsqhzvbmyTFRAyzpzO + lOAo/s0xMu8s5V055vC2KWnKuqb9+WtWgJPotkpOf7wQM3aqtvXKFnPa74ihjXdt + uuopRsOsZPiG8MLcqkCrTy+pd1PywrqwjKeva+mfgbM8zpypw4kwLwrljsxCThkZ + To4dH+K8oesvSeyVOKWtAwnjQsPa3Zn5CFWXNwPnn2kpjyMoNRo07xuRkfHYI4L/ + 7D8zz07XdN47kJbEj2BYjChURtbxkFbAxq+IUDgbNDW+M7VQCKZW+vOFjwmFJAlT + CCco2I3lmrVX1j9BTMRr/3aQNbY/OzOxk0qjYZGnPqV1bH4IazaDFUB8pOdmit2t + KBzDt1L26V0Ek1CpOp1dcJxneITXX1j5IqjMbl0TzyoJ9CxsSaOWfZ6XsBBSXZNZ + VnDENbBAOGcJgatjmC2qH5FCNio7vMRRncX5j82sytDRWbj/7XHENFpfXyGPIuYg + AaHyxSVegFCeRUHpzXo+qeFpNFR4407v+otVaEdxbfj6MQfMZ7tDUOde+97NNRow + tAMUOAN9yhGuEPMPr4stQUz4lHseGMX3VdpJH8UQH+BxVdJhzKg0H/+6bAmnRi/U + aAEJAhAi7DZdrKpPPkDijPKnXCPJB+IzdAJdOCsnIhZFzaiDUo+RLvP9bEpoqv4m + ZFMtiF7P7bXyeNIObCCsgKhdX0thXI9lZvv7k9M4lAbFhPS9vlmDwf25t2Nm9Um8 + 2tbINg+K23jp + =syE6 -----END PGP MESSAGE----- fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DKKbvh61jX5USAQdA8qtjYHoUe+GUdy3obbF+pNmvfuKQUqkMHa6V5ZXOpXAw - M/kx52Vu5xOdynB3NMBXsfTVH7KXh0f06HcehTREOkhlwVMYPcvDQQdzgJ3Xodpc - 0l4BdYtmbmk9ETTqr+wXvf+6BMYIuvyhsLLSqyWyCxJv7blQYsxsc3EAHZ4LB0ZS - /lw6gQ5lmQyvVt9PQZayt6Iku0+WMJcgrf9xykOAm3N2QrtUnr4jHV3FydvTiUwR - =snV0 + hF4DKKbvh61jX5USAQdAHw+hxKofus/fR32ThZOHfkL+8TIPvWeYnTYe5UUCC1ww + AtCE+MfZvMgRx7gUpVPcdWtch6nlFzun+r84QfPopFk4S824JFEkK8jG0scYCpy3 + 1GgBCQIQm+g/LWX0T3Do0NXrRGIuw0fiKrQiOpEhbO6a6ez/pES0zKKBdlH+scQl + +nLZoz6Mw5mkwhY6zIKsrikuQ/+sciO2fIq9tI4MR6cvD5gmVrGEjIyOZ4xgl3X9 + nX6OVR9w8cR7rA== + =voeW -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted diff --git a/inventories/z9/host_vars/z9-router.sops.yaml b/inventories/z9/host_vars/z9-router.sops.yaml index 89f18e18..33bd3c83 100644 --- a/inventories/z9/host_vars/z9-router.sops.yaml +++ b/inventories/z9/host_vars/z9-router.sops.yaml @@ -1,3 +1,4 @@ +ansible_pull__age_private_key: ENC[AES256_GCM,data:TlMDo9sUTYznxKOGityGLexk54mM7LU9+U4ln0YYhO5fhXXmwvySxyMLHlaKzSlpU2/mRRy/0v7AIOuRVZx5XqV8X2JJsv3/NeY=,iv:r66g2UQ663KvWyAISitbHBRaLBlJ0gB2g/TW9JiL0Ls=,tag:VEq3Fqj+t40uBo9g4Icfew==,type:str] secrets__secrets: - name: ENC[AES256_GCM,data:gt9BarzsfE/GJ5gQeelgePquW6KAgE3Exv4=,iv:IPpUQI+zkf8O+ej+ZxLFyWUOrxGGlZvmDRG0ut2cNsA=,tag:GP66MvcKyCqyKV814+uMYg==,type:str] content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str] @@ -18,180 +19,190 @@ secrets__secrets: - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str] content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str] sops: - lastmodified: "2026-05-25T16:29:22Z" - mac: ENC[AES256_GCM,data:zxtV1xgjQuKNMvh6S8oAOxX5J6+iBRO6k3vGw3vWNlhah4Gu3S/lt+5v8lQHogz1Vyc+Zff0yMj1cn6RstDDj5AuOCljRQN0FYs0fjCo4Yrxx5sMMwcwBYquC77skEiZhRnqdXKkjiOM7EGE8qj8O3DJ29borIjm5NAsflH/qkA=,iv:7EUElg+gu8mk2Gq32JQMTf+A1+ZhZufoqt5bk4+Ca1E=,tag:XG+F/zlXizsc2B8THoXj4g==,type:str] + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxallVTFdueHBucXBVNzIx + cENqanlOOUticExzVnlERS90b2hWQ2VldUE4Cm9SVmhZejVzanRDTkJhQzhwM3BM + MGcwTEZ4YVQvdjc3clBHei93VEN5SkkKLS0tIGI3KzRPbjlNTFFBL2huYlZSVTZh + OVdXYVRkVVJwbVltSHBXRktIY3BYL2sKe+eqKzYeCUWx0KmT0+aM+TwWRj+P0Ecp + tnFHmQgnEPypIhVvZtzL7i64kL6sHizTmNhbw+hlnCztvsdEV5T0cw== + -----END AGE ENCRYPTED FILE----- + recipient: age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp + lastmodified: "2026-05-25T17:15:30Z" + mac: ENC[AES256_GCM,data:IW9eN5H2J5cnXUHlK2aD+yd2ORx+weSFKBGWd7pIolFb5txg0WlGVp8UpD4h+Tv0SJ9NkQOT6KpcXDez/L7r7xNYtmgf7AdrdGpy3IOkEYzHJ+oHUMd/aL+h5w6/RahrpxlPSrNKAC+AfpY+l0iodwQ09iuLp4YXFxRaRDGpGZw=,iv:6M7RkDN9D9Zlyq1MCRoiT4f1bd6OBZNg+C65oEuSWn4=,tag:wRsq4lt4mHVyY6ruGkYNKQ==,type:str] pgp: - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxK/JaB2/SdtAQ//bbr0oza/X6GG43ay9coZbb+0aptj3pGzQqT1ND6nsI34 - iY3IZaMZIti+j/BS5kEfmRn56WZSx6EcbSrlbiyL5NZw9R4/bGRd848rOLwMvuYO - 8Usei9jHdpHiPvKBZnZXaXGU8E27L0Y/LCxSIFOXbyHzHogjz3JmtJQsYpSC+ue6 - mIRrSAJPALrqEL+DZ2bl5UYlBIRXdtIe/jL1CFCJhULt+EjJw72T62DZK/jaNZTj - eint63+IFZSxx5e5vrAeQB+p2EDsp6c5NbDrlgQWb8/J1q/G5bG4KxBs/0hum7OW - /sSsIDb4Qb8U/axt5LduV6AkMXXsclNLQU/LbFAbBRcV8Lvh11f0U3V/UnqUdmvp - efesb5VQh1x0uWjzobxaioLEV/YYbWx8binvuJ3MBHKp6E2xj7IrBTVl0MWgjEou - ZbQDF8DvxA49xEnJyOviL2/zjnV1kXy+Q+BKZga3pr8AnBHA8Ftbsvmk6CyDEM0R - i4FAUOVa9VWiszoOaqyn1Fl02YlweFmgzuFjd3wi74Tbi6RE37rN/vBKySbnRQYl - rFUU3SQlztxd4UBAXBo6gQKTz5B4rehvKVye2mmqEE9bas/lCWAKVJ7+3+0NQdA2 - lp/X7h7DRSD2Qkd35SzxkJz7P86rd0LM1aOu87psxYavEWw6vFs2ErDkSeqDn1DU - aAEJAhDb1s+jpDUa3GvVZjoiiCyutI018jfJU1vi12PGktg4KJcXBx66R/nLItO2 - ba6o66scIiAJZ+jYymW6RbJTI7XRHJp4Cs8COhpMRQeOGwEHFGGL2rpGd3KrOLQe - 0/C6EmrJvGpl - =atNE + hQIMAxK/JaB2/SdtARAAlyJLMDlT4FLpMKaC3ygn1cfA2390Dz24lzKlHmwl5GgE + yS9bdTGMpcM8zPOQoqaoy/my3kgx2/U3q7WiCTMdUyYePAWuJFh8ZRZjw/hPpv6n + GwYgK3M2C1I9++zmZD5LlR4TaTTpr99+hctYrrp79QJddgozUzAQ44g7WvDm5VhI + bb2UVSo0MpWvLEMXHqH9YZcjkQyVg/DL+IaU1rM9pmpZxoN7+0jQY4ci1ZeHVo9e + DbYcjMazBLakjZxxdtHrqx3DjZgbYCancMy/dUKVuvDF/lN35WWSxslv14BNHljL + +/9YBDRgIr11x9j1hq241UwBW+6mSFxWF3qQ5esdR5xlLEqbm27PYGtqC4LIdzRX + ZUvdujuQ2PHCYJY/jKWSf0cdfXKEGorc1ZGOV9FNq9L+aKvfmRLWfzX4D0Hp47H2 + d3itVuA9KYOdzmk6O+8FZv/VK1042L90tOPJhrtE287KhcJ2CvfT/Az4Qot8xg3c + tXmO3cWQpigXxJPfKRPjmmLJ9nq0BnBXj5ngkVz7d8R3FR1J/+TWG0F1VU7YeW2+ + Z04RAbbKf36xUTqnaV34EDum4QLLdTMra6fPYPy0KiQYIKDcRSdHeM/hEs7JXP1c + zbUX4xuBOXl7kWYR0e3MUTzxYiQBr9BvSDY+7sGQCb+fPw+AKvFxig1grjsnZvPU + ZgEJAhAUE/ebqBa2nGimcAPn3PfeihehcmjLg7HmyWBPkHHMt/TIOztjkbGiQSC/ + jBP+rhjmFxm0WKUGM4dkh14JkMgz7DZ9fozzLfo8zN8beuSDDzX1BndTIMBQJj8P + Q/rk1NL6pg== + =UXJ9 -----END PGP MESSAGE----- fp: EF643F59E008414882232C78FFA8331EEB7D6B70 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQEMA1QflAioE8i3AQf+NkUGCBrTCkkyl+iBb6P1IWLDGqAY8s20mBZ7G3plKE/J - UrIe947letj/8EA+yoN0uzjwEkh3rDLtZrOLTSgflq1GMpdVhdaTbS71fD3kghJQ - P9tz0zDQEgXHBi+2q7iRrEETx/cu7UDNkSCNvQbWvDmo8MfbSBy+VFCknfupdQxj - 9hlq4kBA0pckPCY8V7E05nDhQntS8wpXIEO1SWiSuiGg+p4yFlvNzWNfhLyEFHxL - BZHVVIU/mzyClMajjLJWjKI1LSgHXXIa28tgdrtiBZOsF+CWveYqJlRJh9NUepJI - ZSeFNhyWmnS9ZkQu5BUyb7+oRxfq2NY51T76Xbo8gNJeAZWwyr1sj1wjubuVeNMF - aU6FiynYWr3I35JRVghTMJ93CnPl+NTpWnQuHpq1bzEGe2u8BMFhgrTu2yMD23VQ - eGien6SqfEbA/wAiz9ZaUgTQH8UyHpliteZ8/SQgkw== - =UJvq + hQEMA1QflAioE8i3AQgAg+PBxAqWTfRhxP7GxDfQBPK3d52zshP9xhutqANzszhs + nbo3nHWj/vjvHlEuD+Rr/lr9qxsE3qS4ON7FG929RoB1YFHJnQl29Xym2Q34T0Hy + Ih3dibykm0t/NE+fuxsU4iU0imtjqhqA6P0+8FNF3UeCg60brcqlrBTXM9jFqlZ2 + 9nuvk75HkM1FoHiKx837qAd+RjNNO7xKUpn+EX0l0l9tScuPqUkWNQxLrbHrcO5M + bcEC1syZHQKCiucsesS1pJ7TFWOJsnamZyaqhzANGwWdhYwGQv37bWKr6dYTCy3q + rsT2NxQK4/N9CxmP6xWeAZbX00BDhNMfEQVtTlYLgdJcAS433Hiw+DSEwGu2zvTa + pHtQlGlaoOZemNnthw0NO6JQWGhz6Bx5QqYmbrshtVKNPh87vNVV0HhL/fQ7qwLp + uCgnMi3P59r8EKDZqTSp0YGfE2bx2hpBDnyJ42A= + =rOz4 -----END PGP MESSAGE----- fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJAQ/+O5JOJfDp/BuBCuXDQVUgJagspQO6LZ/MLrl9qH282AMf - MdgN5M/WjbOv6WZDCMg4nfXps1XgzUEiaA/1m4PxHlMmxjEoQHAE51GMcxsXg+B1 - lM+8uJ1+js1sdDX4xsZtJpbVxJKIbPuhF7oM950oDlL2+UKhUbPlCoxeOihlkVGa - RqHJ/M74xkyKH281oRI5bllJaAroBnXVSFIvbCxA7ts/O7YJPKBowTIj62Kye9Ra - aHC11bPy2RlJCcFZJjPSdnXvzUMpfzEd6O72VUtMBBQZn/in7efutC8FwpRYuUW7 - vSofxUN5n6Mtb8A1XSMFD/nfXVc/pM6Cu7kdtHSwSKgbKKf6mrCeVgaM9xcG0t2W - 9yEtWvkdvOOSqz/vd1vkftbBWcCejX7bktfmD408CJAs1bjzz5CyrDoWcnYmbxFY - 6N4rhMDRMTe19VH2UQ4EvSjQjmmYCspnUW3/78zi5kU1ijyQy13UpbgwulU7tSGc - KKtBjPoy6mLIVl0YhnEJZWD/XPIRWyW+0s+7m70YXCWSVipvCelEE8oPWjf8PLaE - J85crlZGkSRcRO7yOP/YtB9ZnajgaF33zJU3ZWr0C/IXj2TeepZp/JUteD2H/LRf - 9YJzOFYDOFIWcdmaTzJLBEaefWcDjT6wkIf6TBqQRMLsu8JUwy9VwFcsi/d5aMXS - XgEQqSxYb1B39OR0sS1Xpw0/CFe4imBPuG3w0tOAyM3DbPWYY1kZYIRZenV1ZIOS - aRZJh086kuWgHYB76VoNzDK3QperWvHL/8CT2g3HuPiVGSrrXwxCYXk5+UXB9bQ= - =Xx91 + hQIMAz5uSgHG2iMJAQ/7BOewbq1xQgTOruTFebugbSrodtfUlIDpCez+FZMw3Gos + uwfp6jslBKXHidsA39CRktJ40EYqygmBgcxGTvHGC94VwSl7OfCjHsyfD/93L358 + XsjpTHXBO/mOjQmJ2smhZx+q+iMLpJnq2QA8mGUI5uzPTjXD19sD9QdYdHF2p8D6 + mdpVWED2gRf/sDoN+y3c/iZvMTN2HeDCx5d/wIgl3mmoHLvWRO8pNBV3EUg3ZBiv + fc0Y7m/0KOqW1itE4yg9IoPBWJg2jYSZTkRnQMPEkKEEHNtbx6dq5tLOYUIIwOwC + 5JlL76BRoaul6ousBSHV8OWCAvS2N8OC+l0ATzk99p/h4zY7PCG7NhkKAOgYfWFa + /z5u6J6TMrmeLZjknFXepuVAzNmDU0CmuhMwZankGKq6lmsQQnHvdq8+ExGGWhfK + m6I8nPvG654md9H7Y3HusHa6y1rkf9gZp1UFzhvXQgZdvc7K5pJrhxjGUnEg6sS0 + m4daDRuNLW32PXiwoWTtTJfOQFv0t1f1eEKI9DO/O8/4fNtIvmI/8HDcdF1XzDnt + lGnyD9cZ5jKsKjGrT9DcvJhyTGWDFeBDTY+rlt52E8NbrzWUjX4J7Gyz8QRY9j7m + wRi4uaVt5KBmB8Ibo2bMTUXU3Db/0p8nCAg/89D1fP6FF4izg3GU4oD3vJyl81XS + XAH8tGT9wbjXuhomyhqemDYb0QdTRfpAznm4AS36qbeU/Tvj4M+Nm64qLpj7FFtK + aeDas4lzgeQf6/cdd5ItLlRHhlBOJEmjHVzRR4npabCWZojP8PTac1IlBgvS + =OH/y -----END PGP MESSAGE----- fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DsZXvxFXTXoQSAQdA0rZTVdySF9nUiz7ZyFJgq1tojyLojGTgE4UIEJzFSTUw - 9y4kbGn1cWMpAqr+sE3WHV9p7v6kgm/XdUjXGN4DadpUbiYx6sQW2Jov6Km2EYhq - 0l4BawupjX25wi7c2yR5iGdxYS8oCYVmGgcAB3T96v8VsXpkAOYQAOOh7B9GQIxm - hB3cFQLCy2un3VvBsiKGFMA2FhZYBOuaEwP/KmWnPv0IPIRH4by6LDB0xgq8MUNz - =xoVE + hF4DsZXvxFXTXoQSAQdAIjnFVslIKlmP0X12z6AdWNqxkpVBDFvf03ToWQEQv3Uw + 8ka0OYl32rH6UiiSE1Vve1wZ/iVvK9/il6UhTpeAt8bIiCq6gEGR9Ba5NJnm6rSG + 0lwBwzEtaARPJbbcWu7Jl+dAQ0quP6uVS55OYBuSannlaPrQ5qBuS14AtuQ3UEVz + EbcLJ0b4lGL7hgyAf2E6nuDTkPGPChAJ5H5DfrB74ZB30GcYBTzwj13+jWx/VQ== + =Hxuh -----END PGP MESSAGE----- fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAgcGcZ3BT6lsJ8FxkMghxg5/PZLtIzNeJaEUbxN0EFhsw - uM+Lec3k9BJSUJK8GeVmesYxQh8vP6Yi/+m2LnGjHXzkQg8Bx1HJzuC/Ap36rC6N - 0l4Bxj1URTsRD4yILEA3TY4Dn9St9uOtodJcf5YdAKvmeb3Uwy//huNnA1eK7b+v - WRHcU2K+GgkSzLiRLZTc/nMrrCQ/P5HzwYHmP2rypFX7kxXlPd3K6yMZWTiSgYZd - =gZLQ + hF4DerEtaFuTeewSAQdANsYlCeGhhqmBgnqcSuNdQBUwYKpucDrb6aR9Siyukjww + 72Gin/635k9bYXwknA1rPyTMvG00giQgjUr/QK6PSD/eGi0QOtMZLj1JRi8f5EU+ + 0lwB+MIM9+EEzHJ96ouzL3bu0e++NvRY1Qjyx1Xi43bM96eBeLZ5DAc1eTSdWizQ + EWTorcmXffkdfOQx1zrlGZo/qvfj5F706VcwX4aZwok/ASRmSeCfEXLgGLCwqQ== + =ccBm -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fAQ//YGOLOFtORNbOu+KFCtGcJBXQMy6Ej3/tePVuDi2vmqLD - 3Dz6stB9D+BmBbcgbFlDA+g7Vi6DD+zcze9wM10iuc9t9ucAuQ7B/ymSvJc4MrYn - MJFvQv5IYgWJmzXLYEFYYpmZPGG3hSHSgWIPs+574wEA/L867ktguW6ZD3ZuMn3E - yjCTeT/ZkGjuIpGqMu2/o9Wvc+RYgWlCB69D8kTHtnbFzbqEzvKU5/zte5ThchA+ - QZwFd/gk3o1G/7WOYJJ6CbBSOQaSrfm0mnb6sppNPdOAQtqHVSFVX5vX96gXsht/ - AkrvD6/2R5eNzbqRaU83cg7c5far49xoBbL6czreWY3D56yK4BJbrrg9mK7oCEfO - GaRDFFD7R4LJPfVx2xDoIQ3Hyp4E3dz4nyJx0Kg7NSEt7soOb5MnZ+04LLAiHbaT - qZr618V530uw3qaCsYcgHy+WsZXXlqXQey3A7jphi3u9Kvn9UjeegjNvpOrMk6g1 - RhGzv72G0wjZnzjTjPlzeROHaQ6RPgfpkZjEcVZNZkfAgAbB3XPgCFGKz4qvx9MP - 4eHIlBSJizLzSi519o+0i5PwrZdEf9L4RUVxgQgdJXMh1JaydVh5DOU+xomdStD5 - Maymkt8fSgYgDaS953YA2e04PrkXCH0EHZ62T9EMxreEoU3nYTmw/TGx7RfU+wzS - XgEuQkLWSToJ40/Ir3obDA246yv7J2FpmPwG4oFypkM5xe1WjlMlk90b9RBhUgXk - ylRXXLBzau6mtbPOa7LGdVyVs2DClWQo9BoK+dxEsnW+TR144O4UmZEfifJXvgQ= - =ympd + hQIMAxjNhCKPP69fAQ/+IRYUQhf7zzIZy3AKAtQgyMKRINOUUqOEv6IKmNQaaQP7 + K5JXnVi2gjgBuG+2gH9iCEimIggnWxFhHerfOps+NkAI6y7kFz5hnMtOY2Qf3vxT + Hoyq4l6Yn+gG1HSLozVr9dTQPjyGOKJkm36ZKpM7gqSuLNP2ijKARzay4Chg3i+p + E1TVTVoEczrPdLg3O2fd5mi2UT1k3E4QREti0k6K4juMWqMz+5iJ5X98qCdmE1eX + L5dmW0QSUChzBVw+7NEcxeNx5WsbhWgPA5m2+bng3V8tHqAwrRUCoxn2+yabnsZB + Z0Z7TgcLk0Xnezw+BkT3bOsKgv+atE5lm2rBiRUHRDR3S04j0Ju6fJHf24CNy5ES + xMF7BE23SgmqUq0BrvdJB0ToNKYGMM0C5Xg4vGRiE61+18TiFIeC3mF9suvFFKc+ + houq6Cy7q3O5PEqEbu6t5vXAZHwL9Th+ZatIIe9jSToiZiLEOIEmiYptR009/OWq + v6ADzaAE6+i6HZ62xBYQuZFkiUrRKxYzTHFn0A10QUJrJgbWr8QjS76oKi8feEDC + BJAOwE/0aK+l46hI6mlh6rgeSy8XdOPLEnL4+1HjlshhTTiW1rE2cr0ZiTTA6UFX + UhABIUi6jiLnM13L+auulU1UZQ8wxp73okrcuu6g2bPT/l7zO9YNOCocWVPQa5vS + XAH7qrW533ttg2XAczCdALMulV2N5GHl7TbgRQBkdoBAKL+6oKfxbOZeQM2nrfZT + arytZbnjgCcy5ygnjeziRvWwLk7sysEpAQqQNRm50m2Cq+2ccedRP6zFzUhc + =4hCA -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA46L6MuPqfJqARAAshm2x7wX/9g3XJtSN0AnSeCwSHO1I4+ebLKOsB7zcXh8 - hrVO3694jQcU9L01H7jGYw4lNNzBd61/uVE5AvMq4Sqn9iH3MFNESbAEOWVV+TRf - 53JMg9C/aZfde8gHgHPaiVXlCBVEVY9CqHpUXUKDmEE7iRb5P4DuMxOmybDYZGzY - 4c5Ke1MFMkGRmAtsT1qLrT2vh+F0CX4JwpMkxCmOzSWAXbwrVOigJ35l5zM6vme4 - 5EQu9jI8FApTxVchZbr0v3UOKxp5OebqC0jGeznZNf4qb0qnsvuowY6IIw5Tl3/q - H4TLq5EUOVqTC1voIWY/gMjieiW1gtr6vASy4MvbswsZLc26YVE9IbHzAOUWDN2o - f2iQ3aZYuINvniD23XtM0TKepDXWq5eF+AJpmyP/LL8sYvSnWFD+muK3O657djEu - yGZs2EFTrkiUvhBq3apOOYiU0eOi4Aq6UeEbOsLENnQrBRXuHEm4KUSwzOitVwJ1 - ByxQTu7wzY727SOR2hzjMC0LI602WGpEQU7ech5L4uWqtMFwaBP9HnUamcofKqqt - 1vI2BevsJfQ0rtTE6GWseHt702lllTGe3RnHWc6YsMWLwUfRdBPggMW37hAPPcfO - ytbU3RJIxx4vImRtXhkI5yvbpFQrooz1zSeXWaitPE5jmmiKe9IRStLnfiq9E2TS - XgFVuQM8K0LgUYEoAipvafhnC3ohfGsM2AYd36EoaMNLeQ2ZZEiV06/Y3EWoI0iM - aqRLwyBvTuDOc5BK32nCbAgUbbPJjPhqWaoNp5ymCBV76oW613gApkzoUF+OIUU= - =KKaI + hQIMA46L6MuPqfJqAQ/9G5pRNmw775xCYA+foCx9rM7eLXJFl2DjaI3a/O0yVc6t + 32xtPuaHwTnP00Pbbo5Vc9QG7k0Fr3Rgy+ep1lGzeCMoHwF9xk98LspDtYZoKopE + 6/L6KLldSauRv0rPVhCQHpZFsnx1VxaJiXn9vAW17+imC9SgqLYGWyrxAtLCOOqH + N68RnTsEDquXixEs82ao0EmQXPquimJgSx+xVSF4yitYYLLLHyUL+drMNuVb9q9Y + oAIdEL1svDIieTbTKGQUqZ8Alf8f/0cqPWpEkDwYIyB/i9KDkH5Oj7uBBRtVLGxQ + VxE32wO1xpXvKgUY2PhWD2rOBVDG8dW/hyqvc1WgIeo1A6FTq34b5dGC2lmTRngB + 9mBjUd59zeOvdXLmoGwXgbjVhpgnm/5wlUeiIC3xR9MjW3znRBT6ujCaglpAdXBC + 0AIugssGcuXbP9Tj5zMVlbdi2dj6Ylc8S1Tj/OjwxHCCj6AWRqpxN5vY28RiLFGy + +eAsryzPk6UTCPIydiWwsrP+w8EhbllFxzZM+Sn+fshAHdRug+EeyT3h5V5JF+Ko + BZCrZkwYqAcVkJjEYlukjvxVFvo+T6tRMz4F4yNgjqFjneUaeLCc6RllaT696H0Y + 8+lw5rK+XpcXBZqso6vsLChRdZQJjoj9lkjRDbmhOkaRglikC6Cx+mpY1/XnGvDS + XAFWOuNKjN/xIRtaDc6tmeWsKkuqghjHiMeRqw10/kTBjniMLLJIN9ssj4HjYqC3 + CsqyHqZmrbITUMr718gX1kkAvzF/fVAXT8YshOcK7rQbiMQJCZqeBp3fY7FC + =5yPR -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdA8YKD21h5POTLPf04KvGN93omFgkYO+Y8Kc0jM0vdqm8w - 3zYRaLsDjdh8Zd89/HhHJUfLrTp/IJ0n81sK0ZjznbXKxgkseGthMzof+L7BnPAp - 0l4BnAs9iZS4q2LZVS7ySBP89xLmF97qhK2jagMNSAwq8Afxbcw8oQAVQmeyYfxx - X59irIHjI1ugO4o1WnTN67nTQjU5msbVBs0eALrw3jobzFHRL67fS0a4Soa59LTY - =ZHIU + hF4DQrf1tCqiJxoSAQdAfLqKILCrCv2s2V7bLntk5lHI6Dc1FQlCg3LAefc8oTIw + a3UZU3OajQ1CCIhhu02JSlTKZm2z+pZKVHy+s5EgCqwAWTfPNAnyPT0ZGrhIdcah + 0lwBdg2Tq3+Nhix1ZuA/mUgcrbRBcFKlHY+IGEgOHKLJld9UPF2xEjTX6nmLyuTR + 6x+HW/7vVuc/jcFeQEmokhQw/SICVdyD7NQua4k1agLkty3hGcm1XCsfyKfj+w== + =Bxf9 -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DzAGzViGx4qcSAQdAN7rRlv3dMoFOfj9eHgf+0H8521b32nWqySUdriEy6Tcw - gjuReMBpKQOgUfuhIiWkHIKNtNgMrYWiC20ESOXX5b9uYZNpqHCgHQPlX0lEeGim - 0lgBOieL7mSEq4wkWLCSv4sBAmkQA+dnugBeF+TrlqKQTZsbe/Z+jNG4ZrHRvdqi - 4I5It+uaRV9Vrul1c6H7fNreRPUd4hNyJwU7gZQ+vU2WyAmgqerxE1Wb - =gplT + hF4DzAGzViGx4qcSAQdAr2tfPiCpUkxFj4rgSiLf7y4iyKbsgEY87iYH3GAZTVcw + vK2YpjSVgFRoJNx9s3bFr+9UG0LFmKvDZEP83ThQizYs2I/N7MSU8ERRImshaQMH + 0lYB4At0RHC1mp8eKqhRgXenOtpfCiBACtlIdS9m1aqcU6i9Drgt86Bk/LC/HSvJ + MUOit2PP7QZVRWV6F8wAHlUFd6bdTKv9eOCZLSB6mY6DQmkp93FIMg== + =lQcB -----END PGP MESSAGE----- fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA2pVdGTIrZI+ARAAjWK8mU99VcnM/Ckzm+YsZFTwnz4PDAenDDdZ1OOz5IXe - tS4SQPcQlSSOuXEkFLJMmm8QVxtUC3Gh4nF7o+7OygT+0ZXOrB7jFgg10+v/KVA9 - hSlqBdsMxcC0OzBtkGyAOXOxqnTVubuHEGyGpIryHt1/lthUUZHBbjgw7P0Tw2/U - sYK5j5YbqhyBl20gyZorkTTq7pHfVXDVtpe75+ZkqbOg4S6HgW3/dl+v6N0TLfRs - GVl0fUlWIK/akGCB71zdwJs2I1qTeMTlL6v+XSUdXj0YV+5fjh3wf8qzN9geIjQK - ybxGFWDKCAgTMnqoFF5BCL23hFtnCbTtLN1wQT7/m7zpjaBKHOBXZOGXYZCMGZui - sBsUvPANgNdfOse9H2aABQvUQh8WqFw8S73GasvrZHAwEmvnXzocMJd+kUovzmQu - 9FBk5UkcgXfmxeamoP8C700vh4zI+sKz6uEW0+AuVtLlLVqlb2w21kTc+ArZW52n - HLolH5q3Wj6pKuuFCWKr6UgLFcq2w4QngB2p+UABHU3RbwXIra7prDXCUcNC5iCn - ElRFY7OZ3nbHOf9oaW/MitcfszVLyl0ueoay6qxdlIGdXKRGpqxHqqr+92INV/iz - 6CRoAsTqVq1a7ZuAaUdJPvfKVAHHEHjPwlrOc9cXvykG0iQKsRzgqiOtPiGQShnU - aAEJAhDSqCwywHDnQ7X9ZWIzPjwvqyHpEVez8zYh3vpgKpsLb9uL+JizZjV02HMe - nhiL+4o/aNjJgGJWph1uPFhU4wO4AavnNBsHbJSiL/1yTS96hdf8d+gB41yVLU3e - kBkDFLKkIBkU - =aRLd + hQIMA2pVdGTIrZI+ARAAjNHCArTtU9D8zw5yJzvf0KSwQoOaQWHui7AqQkvQ8mJv + 8+Vo9sb+JoSuFHQqqDbOU+VFpmc9CZ6HCJaWqO2gZVgjxrsrPgyfq795LBd6GhX5 + 6zwUH2huxv+n7XkfjN4HHJAlSj0pRyL3fyojdOdtXCTuBGbofLIBJUbuD1wro1K+ + nSHLvdBEitn8afKt5/SaatB8Prwyet6E6J4HluXFQjl+KdrRHHvXImmhNSR4yfIr + yQt2s8qapSvLhrUw9/GFXqM/jg4ZlDhPUhCAKI2Pr5PbsRMBqwdkSrDeB7MHdsU6 + tI4uyb7j8m3VMbFKNVpuluwgk47V+W/h+jtZetSR6ewYsXJjgHNmX6JX73XzR7R+ + q4EBfSAxR7ByZ/HHuumUH6BKBj8IcNJQwtEkLIZmLZ3OdFtJP3YY0esV+gEhG6K7 + m2Zl9C7axuYmvoLrqygaChmxMhMiebTPNkD/dH5Ircwl2cXfHC+bvF2WO73DTk9G + emHzrkniEtuUs+svMhT3NKM3/mpOJTiNezdH39HZADzkBwZ5Mmkfe4mbXByfRN7F + AEJWmnOcpXwXE9//sRbkRr+CGmB86raZE22wHPuk6U9IyVFJm8hJbOzFc7rwu1Eo + 0YWBCsc9dA+jH8hIKrIfXwqnfhYjTrX+oZJeK/8McOwfF7I2G9YrPAgwbokQmtLU + ZgEJAhC8ryOvXwp2kP9sv6nbXIEcwrX8lRjkEWduf6ZAWAfQ5FGBSPzR8WnZWGzN + PCxjg7utA9AHBChF1duwOV2Qr5XW8HTUGAx4fc0T0rjC862vSwf8yAY89WWJyUfk + n8qhhdw1uw== + =KgOe -----END PGP MESSAGE----- fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DKKbvh61jX5USAQdABId/P8ozRgJ4ItF1zvxp98aH+g3LZ6UGnxjYjtDxjEIw - VmyerznjOLnpz0EobXRRoot1Lo82Va64HQmXt26LG3gFY1HVp0WOnIZXa/CUoUb8 - 1GgBCQIQloFxKcgFTiRidaJfN7hSeQLleiEe3aifZUyJj8niTmBaY29t+CSoA46N - xZzX1AlxVjfmputhYdTyOYSJtGrj7otmnUN2P+55pjz4L2qCYAEKi1+ibqgpmJh/ - bETQsT6WKJ8FXA== - =Ci7L + hF4DKKbvh61jX5USAQdAYrtySnoCK7k4ZZIyllSAr23fozsiZb9Nf6Q+r56i3lAw + 7IxBdJc2ipMxafy1Ntq0wfAYYk7nY6Vz1XtB+ekVeYLOjDmHRnJWq/Jw0K8wLvWT + 1GYBCQIQ/0zDLdFOrMNjVPMutGVJOkpm7mbD30GpgRugzEf2NZePGtptqnP6i1t1 + izBqFRByftV1MUw1uWgTFgB8zEVDh6gG0QAYeRuu3NS9QhwR71Wlu2J4eu+VhZi7 + AKabk3T3Z00= + =A2ad -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 41ca0396..add77aa9 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -75,6 +75,7 @@ ansible_pull_hosts: light: waybackproxy: yate: + z9-router: secrets_hosts: hosts: z9-router: From ebc6c8a9b87146908a08fd2d0974e0caccc9e455 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 19:50:01 +0200 Subject: [PATCH 07/51] z9-router(host): fix some spelling and a wireguard peer address --- resources/z9/z9-router/nftables/nftables.conf | 4 ++-- resources/z9/z9-router/systemd_networkd/10-wg55.netdev | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf index 842ca041..f6396894 100644 --- a/resources/z9/z9-router/nftables/nftables.conf +++ b/resources/z9/z9-router/nftables/nftables.conf @@ -108,7 +108,7 @@ table inet forward { meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access" meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access" - # Allow clients and managment to most - iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "allow clients and managment to lan_ifs" + # Allow clients and management to most + iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces" } } diff --git a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev b/resources/z9/z9-router/systemd_networkd/10-wg55.netdev index b3e41a62..f2de509a 100644 --- a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-wg55.netdev @@ -5,7 +5,7 @@ Name=wg55 [WireGuard] ListenPort=51820 -PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_privat_key +PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_private_key # WireGuard Peers @@ -75,7 +75,7 @@ PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_home_psk [WireGuardPeer] # friendly_name = lilly-lillysLaptop -AllowedIPs = 10.89.214.16/32 #,2a07:c481:1:37::/128 +AllowedIPs = 10.89.214.16/32,2a07:c481:1:37::16/128 PublicKey = IBsI+N8qUNpQnDc5HnqQ2Zo/1graFM0RMIecHmAF+Vk= [WireGuardPeer] From 7440e8fd15c101f8872f649696b697f966930553 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 20:13:29 +0200 Subject: [PATCH 08/51] kea_dhcp(role): some fixes and removing arch part - remove tags from tasks - remove archlinux part - use debian default package for kea --- roles/kea_dhcp/defaults/main.yaml | 1 - roles/kea_dhcp/handlers/main.yml | 6 +-- roles/kea_dhcp/meta/argument_specs.yaml | 4 +- roles/kea_dhcp/tasks/install_archlinux.yml | 8 ---- roles/kea_dhcp/tasks/install_debian.yml | 39 +++++++++--------- roles/kea_dhcp/tasks/kea.yaml | 10 ++--- roles/kea_dhcp/tasks/main.yml | 6 --- roles/kea_dhcp/tasks/stork-agent.yaml | 47 +++------------------- 8 files changed, 34 insertions(+), 87 deletions(-) delete mode 100644 roles/kea_dhcp/tasks/install_archlinux.yml diff --git a/roles/kea_dhcp/defaults/main.yaml b/roles/kea_dhcp/defaults/main.yaml index 409f0a11..dc6453ad 100644 --- a/roles/kea_dhcp/defaults/main.yaml +++ b/roles/kea_dhcp/defaults/main.yaml @@ -1,7 +1,6 @@ kea_dhcp__stork_agent: enable: false prometheus_only: true -kea_dhcp__version_repo: "kea-3-0" kea_dhcp__dns_servers: v6: - "2a07:c481:0:4::2" diff --git a/roles/kea_dhcp/handlers/main.yml b/roles/kea_dhcp/handlers/main.yml index 5b44d6e1..d06aa1cc 100644 --- a/roles/kea_dhcp/handlers/main.yml +++ b/roles/kea_dhcp/handlers/main.yml @@ -4,19 +4,19 @@ ansible.builtin.systemd_service: daemon_reload: true -- name: Kea_dhcp4.reloaded +- name: Kea_dhcp4.restarted ansible.builtin.service: name: kea-dhcp4 state: restarted enabled: true -- name: Kea_dhcp6.reloaded +- name: Kea_dhcp6.restarted ansible.builtin.service: name: kea-dhcp6 state: restarted enabled: true -- name: Kea_ctrl.reloaded +- name: Kea_ctrl.restarted ansible.builtin.systemd: name: kea-ctrl-agent state: restarted diff --git a/roles/kea_dhcp/meta/argument_specs.yaml b/roles/kea_dhcp/meta/argument_specs.yaml index 995b8382..4d0d594f 100644 --- a/roles/kea_dhcp/meta/argument_specs.yaml +++ b/roles/kea_dhcp/meta/argument_specs.yaml @@ -37,7 +37,7 @@ argument_specs: interfaces: type: "list" elements: "str" - default: [] + default: [ ] control-sockets: type: "list" elements: "dict" @@ -85,7 +85,7 @@ argument_specs: interfaces: type: "list" elements: "str" - default: [] + default: [ ] control-sockets: type: "list" elements: "dict" diff --git a/roles/kea_dhcp/tasks/install_archlinux.yml b/roles/kea_dhcp/tasks/install_archlinux.yml deleted file mode 100644 index 7bdb140b..00000000 --- a/roles/kea_dhcp/tasks/install_archlinux.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -- name: Install Kea on Archlinux - when: ansible_facts['distribution'] == "Archlinux" - become: true - community.general.pacman: - name: kea - state: present - update_cache: false diff --git a/roles/kea_dhcp/tasks/install_debian.yml b/roles/kea_dhcp/tasks/install_debian.yml index 2ac23468..f897ddbd 100644 --- a/roles/kea_dhcp/tasks/install_debian.yml +++ b/roles/kea_dhcp/tasks/install_debian.yml @@ -1,22 +1,25 @@ --- -- name: Register isc-kea apt repository - become: true - register: kea_dhcp_repo - when: ansible_facts['distribution'] == "Debian" - ansible.builtin.deb822_repository: - name: "isc-{{ kea_dhcp__version_repo }}" - uris: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/deb/debian" - suites: any-version - components: main - signed_by: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/gpg.key" - - name: Install Kea packages become: true when: ansible_facts['distribution'] == "Debian" - ansible.builtin.apt: - name: - - isc-kea-dhcp4 - - isc-kea-dhcp6 - - isc-kea-ctrl-agent - - isc-kea-admin - update_cache: "{{ kea_dhcp_install_repo.changed }}" + block: + - name: Install Kea dhcp4 + when: kea_dhcp__dhcp4.enable + ansible.builtin.apt: + name: + - isc-kea-dhcp4 + - name: Install Kea dhcp6 + when: kea_dhcp__dhcp6.enable + ansible.builtin.apt: + name: + - isc-kea-dhcp6 + - name: Install Kea ctrl agent + when: kea_dhcp__stork_agent.enable + ansible.builtin.apt: + name: + - isc-kea-ctrl-agent + - name: Install Kea admin + when: kea_dhcp__stork_agent.enable + ansible.builtin.apt: + name: + - isc-kea-admin diff --git a/roles/kea_dhcp/tasks/kea.yaml b/roles/kea_dhcp/tasks/kea.yaml index a4fd3b57..116c7dd7 100644 --- a/roles/kea_dhcp/tasks/kea.yaml +++ b/roles/kea_dhcp/tasks/kea.yaml @@ -1,12 +1,10 @@ --- - name: Include config vars - tags: [ kea, include_vars ] when: kea_dhcp__include_vars is not None ansible.builtin.include_vars: file: "{{ kea_dhcp__include_vars }}" - name: Deploy kea-dhcp4 configuration file - tags: [ kea, dhcp4 ] become: true when: kea_dhcp__dhcp4.enable ansible.builtin.template: @@ -18,10 +16,9 @@ mode: "u=rw,g=r,o=" validate: kea-dhcp4 -T %s notify: - - Kea_dhcp4.reloaded + - Kea_dhcp4.restarted - name: Deploy kea-dhcp6 configuration file - tags: [ kea, dhcp6 ] become: true when: kea_dhcp__dhcp6.enable ansible.builtin.template: @@ -33,10 +30,9 @@ mode: "u=rw,g=r,o=" validate: kea-dhcp6 -T %s notify: - - Kea_dhcp6.reloaded + - Kea_dhcp6.restarted - name: Copy kea-ctrl-agent configuration file - tags: [ kea, ctrl-agent ] become: true when: kea_dhcp__stork_agent.enable ansible.builtin.template: @@ -47,5 +43,5 @@ mode: "u=rw,g=r,o=" validate: kea-ctrl-agent -t %s notify: - - Kea_ctrl.reloaded + - Kea_ctrl.restarted - Stork_agent.restarted diff --git a/roles/kea_dhcp/tasks/main.yml b/roles/kea_dhcp/tasks/main.yml index a3478fa4..6fced088 100644 --- a/roles/kea_dhcp/tasks/main.yml +++ b/roles/kea_dhcp/tasks/main.yml @@ -1,11 +1,6 @@ --- - name: Setup Kea DHCP - tags: [kea, dhcp] block: - - name: Install Kea on Archlinux - when: ansible_facts['distribution'] == "Archlinux" - ansible.builtin.import_tasks: install_archlinux.yml - - name: Install Kea on Debian when: ansible_facts['distribution'] == "Debian" ansible.builtin.import_tasks: install_debian.yml @@ -14,6 +9,5 @@ ansible.builtin.include_tasks: kea.yaml - name: Run stork-agent tasks - tags: [stork-agent, monitoring] when: kea_dhcp__stork_agent.enable ansible.builtin.include_tasks: stork-agent.yaml diff --git a/roles/kea_dhcp/tasks/stork-agent.yaml b/roles/kea_dhcp/tasks/stork-agent.yaml index 916760c4..0e777d42 100644 --- a/roles/kea_dhcp/tasks/stork-agent.yaml +++ b/roles/kea_dhcp/tasks/stork-agent.yaml @@ -1,55 +1,18 @@ --- - name: Install stork-agent - tags: [stork-agent] block: - - name: Install stork-agent on Archlinux - when: ansible_facts['distribution'] == "Archlinux" - tags: [stork-agent, archlinux] - block: - - name: Create stork-agent user - ansible.builtin.user: - name: stork-agent - create_home: false - home: "/var/lib/stork-agent" - shell: "/usr/bin/nologin" - system: true - groups: ["kea"] - append: true - - - name: Install stork-agent with aur_pkg_install - ansible.builtin.include_role: - name: aur_pkg_install - vars: - aur_pkg_install__pkg_name: "stork-agent" - aur_pkg_install__git_clone_url: "https://ansible:{{ secret__ansible_git_token }}@git.fux-eg.net/aur-mirror/stork-agent.git" - aur_pkg_install__git_ref: "bf96e34" - - - name: Install stork-agent on Debian + - name: Install isc-stork-agent when: ansible_facts['distribution'] == "Debian" - tags: [stork-agent, debian] - block: - - name: Register isc-stork apt repository - become: true - register: "kea_dhcp_install_repo" - ansible.builtin.deb822_repository: - name: isc-stork - uris: https://dl.cloudsmith.io/public/isc/stork/deb/debian - suites: any-version - components: main - signed_by: https://dl.cloudsmith.io/public/isc/stork/gpg.key - - - name: Install isc-stork-agent - become: true - ansible.builtin.apt: - name: isc-stork-agent - update_cache: "{{ kea_dhcp_install_repo.changed }}" + become: true + ansible.builtin.apt: + name: isc-stork-agent - name: Add stork-agent user to _kea group on Debian when: ansible_facts['distribution'] == "Debian" become: true ansible.builtin.user: name: stork-agent - groups: ["_kea"] + groups: [ "_kea" ] append: true - name: Config for stork-agent From c803b1fc672171029b6732d6fe67ce3e1ab79e53 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 21:18:56 +0200 Subject: [PATCH 09/51] kea_dhcp(role): add README.md --- roles/kea_dhcp/README.md | 102 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 102 insertions(+) create mode 100644 roles/kea_dhcp/README.md diff --git a/roles/kea_dhcp/README.md b/roles/kea_dhcp/README.md new file mode 100644 index 00000000..40719438 --- /dev/null +++ b/roles/kea_dhcp/README.md @@ -0,0 +1,102 @@ +# Role `kea_dhcp` + +Install and manage kea dhcp. + +## Supported Distributions + +Should work on Debian-based distributions. + +## Required Arguments + +None. + +## Optional Arguments + +- `kea_dhcp__stork_agent.enable`: Enable Kea DHCP stork agent. + Defaults to `false`. +- `kea_dhcp__stork_agent.prometheus_only`: Only enable the prometheus endpoint in stork agent. + Defaults to `true`. +- `kea_dhcp__dns_servers.v4`: List of IPv4 DNS Servers in DHCP response. + Defaults to FUX DNS Servers. +- `kea_dhcp__dns_servers.v6`: List of IPv6 DNS Servers in DHCP response. + Defaults to FUX DNS Servers. +- `kea_dhcp__include_vars`: Path to YAML File to separately load VARs for Kea config templating. +- `kea_dhcp__dhcp4.enable`: Enable Kea DHCP4 Service. + Defaults to `false`. +- `kea_dhcp__dhcp4.interfaces`: List of interfaces the DHCP4 Server should listen to and serve. + Defaults to the empty list (`[ ]`). +- `kea_dhcp__dhcp4.control-sockets`: List of Kea DHCP4 control sockets. + Defaults to the list with one entry (see below). +- `kea_dhcp__dhcp4.control-sockets.*.socket-name`: Control socket name. + Defaults to `kea_dhcp__dhcp4.control-sockets.0.socket-name: /var/run/kea-dhcp4-ctrl-agent.sock`. +- `kea_dhcp__dhcp4.control-sockets.*.socket-type`: Control socket type. + Defaults to `kea_dhcp__dhcp4.control-sockets.0.socket-type: unix`. +- `kea_dhcp__dhcp4.lease-database.type`: Type of lease database. + Defaults to `memfile`. +- `kea_dhcp__dhcp4.lease-database.persist`: Persist the lease database. + Defaults to `true`. +- `kea_dhcp__dhcp4.option-data`: List of DHCP4 Options. + Defaults to a list with one entry (see below). +- `kea_dhcp__dhcp4.option-data.*.name`: Name of DHCP4 Option. + Defaults to `kea_dhcp__dhcp4.option-data.0.name: "domain-name-servers"`. +- `kea_dhcp__dhcp4.option-data.*.code`: DHCP4 Option code. + Defaults to `kea_dhcp__dhcp4.option-data.0.code: 6`. +- `kea_dhcp__dhcp4.option-data.*.csv-format`: DHCP4 Option as csv format. + Defaults to `kea_dhcp__dhcp4.option-data.0.csv-format: true`. +- `kea_dhcp__dhcp4.option-data.*.data`: DHCP4 Option data. + Defaults to `kea_dhcp__dhcp4.option-data.0.data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}"`. +- `kea_dhcp__dhcp4.subnets`: List of subnets the DHCP4 server should manage. + Defaults to the empty list (`[ ]`). +- `kea_dhcp__dhcp4.subnets.*.id`: ID of interface (starts with 1). +- `kea_dhcp__dhcp4.subnets.*.subnet`: Subnet on interface. +- `kea_dhcp__dhcp4.subnets.*.pools`: List of DHCP pools in subnet. +- `kea_dhcp__dhcp4.subnets.*.pools.*.pool`: DHCP pool in range format. +- `kea_dhcp__dhcp4.subnets.*.reservations`: List of DHCP lease reservations. +- `kea_dhcp__dhcp4.subnets.*.reservations.*.ip-address`: IP address of reservation. +- `kea_dhcp__dhcp4.subnets.*.reservations.*.hostname`: Hostname of reservation. +- `kea_dhcp__dhcp4.subnets.*.reservations.*.hw-address`: Hardware address of reservation. +- `kea_dhcp__dhcp4.subnets.*.option-data`: List of DHCP lease reservations. +- `kea_dhcp__dhcp4.subnets.*.option-data.*.name`: Name of DHCP4 Option. +- `kea_dhcp__dhcp4.subnets.*.option-data.*.code`: DHCP4 Option code. +- `kea_dhcp__dhcp4.subnets.*.option-data.*.csv-format`: DHCP4 Option as csv format. +- `kea_dhcp__dhcp4.subnets.*.option-data.*.data`: DHCP4 Option data. +- `kea_dhcp__dhcp6.enable`: Enable Kea DHCP6 Service. + Defaults to `false`. +- `kea_dhcp__dhcp6.interfaces`: List of interfaces the DHCP6 Server should listen to and serve. + Defaults to the empty list (`[ ]`). +- `kea_dhcp__dhcp6.control-sockets`: List of Kea DHCP6 control sockets. + Defaults to the list with one entry (see below). +- `kea_dhcp__dhcp6.control-sockets.*.socket-name`: Control socket name. + Defaults to `kea_dhcp__dhcp6.control-sockets.0.socket-name: /var/run/kea-dhcp6-ctrl-agent.sock`. +- `kea_dhcp__dhcp6.control-sockets.*.socket-type`: Control socket type. + Defaults to `kea_dhcp__dhcp6.control-sockets.0.socket-type: unix`. +- `kea_dhcp__dhcp6.lease-database.type`: Type of lease database. + Defaults to `memfile`. +- `kea_dhcp__dhcp6.lease-database.persist`: Persist the lease database. + Defaults to `true`. +- `kea_dhcp__dhcp6.option-data`: List of DHCP6 Options. + Defaults to a list with one entry (see below). +- `kea_dhcp__dhcp6.option-data.*.name`: Name of DHCP6 Option. + Defaults to `kea_dhcp__dhcp6.option-data.0.name: "domain-name-servers"`. +- `kea_dhcp__dhcp6.option-data.*.code`: DHCP6 Option code. + Defaults to `kea_dhcp__dhcp6.option-data.0.code: 6`. +- `kea_dhcp__dhcp6.option-data.*.csv-format`: DHCP6 Option as csv format. + Defaults to `kea_dhcp__dhcp6.option-data.0.csv-format: true`. +- `kea_dhcp__dhcp6.option-data.*.data`: DHCP6 Option data. + Defaults to `kea_dhcp__dhcp6.option-data.0.data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}"`. +- `kea_dhcp__dhcp6.subnets`: List of subnets the DHCP6 server should manage. + Defaults to the empty list (`[ ]`). +- `kea_dhcp__dhcp6.subnets.*.id`: ID of interface (starts with 1). +- `kea_dhcp__dhcp6.subnets.*.subnet`: Subnet on interface. +- `kea_dhcp__dhcp6.subnets.*.pools`: List of DHCP pools in subnet. +- `kea_dhcp__dhcp6.subnets.*.pools.*.pool`: DHCP pool in range format. +- `kea_dhcp__dhcp6.subnets.*.reservations`: List of DHCP lease reservations. +- `kea_dhcp__dhcp6.subnets.*.reservations.*.ip-address`: IP address of reservation. +- `kea_dhcp__dhcp6.subnets.*.reservations.*.hostname`: Hostname of reservation. +- `kea_dhcp__dhcp6.subnets.*.reservations.*.hw-address`: Hardware address of reservation. +- `kea_dhcp__dhcp6.subnets.*.option-data`: List of DHCP lease reservations. +- `kea_dhcp__dhcp6.subnets.*.option-data.*.name`: Name of DHCP6 Option. +- `kea_dhcp__dhcp6.subnets.*.option-data.*.code`: DHCP6 Option code. +- `kea_dhcp__dhcp6.subnets.*.option-data.*.csv-format`: DHCP6 Option as csv format. +- `kea_dhcp__dhcp6.subnets.*.option-data.*.data`: DHCP6 Option data. + From 6734843e8aa859b21df2c73e6b44b4d9a6e56e5b Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 21:27:25 +0200 Subject: [PATCH 10/51] kea_dhcp(role): fix indentation in template --- roles/kea_dhcp/templates/kea-dhcp4.conf.jinja | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja index 78f06aef..fa7cfd56 100644 --- a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja +++ b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja @@ -3,12 +3,12 @@ "interfaces-config": { "interfaces": {{ kea_dhcp__dhcp4.interfaces | to_nice_json }} }, - "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json }}, - "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json }}, - {% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %} - "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json }}, - {% endif %} - "subnet4": [ + "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json }}, + "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json }}, + {% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %} + "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json }}, + {% endif %} + "subnet4": [ {% for subnet in kea_dhcp__dhcp4.subnets %} { "id": {{ subnet.id }}, From 613e0528d7c4e5dfc34a753d34dcc370e2153142 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 08:37:40 +0200 Subject: [PATCH 11/51] kea_dhcp(role): make stork-agent.env smaller and add link to documentation --- roles/kea_dhcp/README.md | 2 +- .../kea_dhcp/templates/stork-agent.env.jinja | 30 ++----------------- 2 files changed, 4 insertions(+), 28 deletions(-) diff --git a/roles/kea_dhcp/README.md b/roles/kea_dhcp/README.md index 40719438..9938cf98 100644 --- a/roles/kea_dhcp/README.md +++ b/roles/kea_dhcp/README.md @@ -1,6 +1,6 @@ # Role `kea_dhcp` -Install and manage kea dhcp. +Install and manage Kea DHCP and [Stork Agent](https://stork.readthedocs.io/en/latest/man/stork-agent.8.html). ## Supported Distributions diff --git a/roles/kea_dhcp/templates/stork-agent.env.jinja b/roles/kea_dhcp/templates/stork-agent.env.jinja index bdfa4d2d..75250b06 100644 --- a/roles/kea_dhcp/templates/stork-agent.env.jinja +++ b/roles/kea_dhcp/templates/stork-agent.env.jinja @@ -1,11 +1,6 @@ -### the IP or hostname to listen on for incoming Stork server connections -# STORK_AGENT_HOST= +### Stork Agent env file +### (created and managed by ansible kea_dhcp role) -### the TCP port to listen on for incoming Stork server connections -# STORK_AGENT_PORT=8081 - -### listen for commands from the Stork server only, but not for Prometheus requests -# STORK_AGENT_LISTEN_STORK_ONLY=true {% if kea_dhcp__stork_agent.prometheus_only %} ### listen for Prometheus requests only, but not for commands from the Stork server @@ -14,31 +9,12 @@ STORK_AGENT_LISTEN_PROMETHEUS_ONLY=true ### settings for exporting stats to Prometheus ### the IP or hostname on which the agent exports Kea statistics to Prometheus -# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS= +STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS=localhost ### the port on which the agent exports Kea statistics to Prometheus # STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT= -## enable or disable collecting per-subnet stats from Kea -# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PER_SUBNET_STATS=true -### the IP or hostname on which the agent exports BIND 9 statistics to Prometheus -# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_ADDRESS= -### the port on which the agent exports BIND 9 statistics to Prometheus -# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_PORT= - -### Stork Server URL used by the agent to send REST commands to the server during agent registration -# STORK_AGENT_SERVER_URL= - -### skip TLS certificate verification when the Stork Agent connects -### to Kea over TLS and Kea uses self-signed certificates -# STORK_AGENT_SKIP_TLS_CERT_VERIFICATION=true - ### Logging parameters ### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR STORK_LOG_LEVEL=DEBUG -### disable output colorization -# CLICOLOR=false - -### path to the hook directory -# STORK_AGENT_HOOK_DIRECTORY= From 1a0ac38861531171156084e70726adc7116e5d26 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:06:52 +0200 Subject: [PATCH 12/51] unbound(role): use existing deploy_systemd_resolved_config role and some reordering --- inventories/z9/hosts.yaml | 3 +++ roles/unbound/handlers/main.yml | 7 ------ roles/unbound/tasks/main.yml | 24 +++---------------- roles/unbound/tasks/prometheus-exporter.yml | 8 ++++++- .../vars/deploy_systemd_resolved_config.yaml | 9 +++++++ 5 files changed, 22 insertions(+), 29 deletions(-) create mode 100644 roles/unbound/vars/deploy_systemd_resolved_config.yaml diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index add77aa9..7c1264da 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -18,6 +18,9 @@ all: z9-router: ansible_host: z9-router.ccchh.net ansible_user: chaos +base_config_hosts: + hosts: + z9-router: certbot_hosts: hosts: light: diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml index e1345bfd..222e8c50 100644 --- a/roles/unbound/handlers/main.yml +++ b/roles/unbound/handlers/main.yml @@ -18,10 +18,3 @@ name: prometheus-unbound-exporter.service state: restarted enabled: true - -- name: prometheus-unbound-exporter.enabled - become: true - ansible.builtin.systemd: - name: prometheus-unbound-exporter.service - enabled: true - daemon_reload: true diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index 7ed42cb9..eb88f931 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -7,11 +7,6 @@ ansible.builtin.package: name: unbound - - name: install extra dns tooling - become: true - ansible.builtin.package: - name: [ bind ] # the bind package includes tools like dig in archlinux - - name: ensure correct directory permissions become: true ansible.builtin.file: @@ -40,23 +35,10 @@ enabled: true - name: disable systemd-resolved - become: true when: unbound_disable_systemd_networkd - ansible.builtin.systemd: - name: systemd-resolved.service - state: stopped - enabled: false - - - name: configure system resolver to point to local unbound - become: true - when: unbound_disable_systemd_networkd - ansible.builtin.copy: - src: no-resolved.resolv.conf - dest: /etc/resolv.conf - owner: unbound - group: unbound - mode: u=rw,g=r,o=r - + ansible.builtin.include_role: + name: deploy_systemd_resolved_config + vars_from: deploy_systemd_resolved_config - name: install and configure prometheus-exporter for unbound ansible.builtin.import_tasks: prometheus-exporter.yml diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml index d05b838c..b794e07b 100644 --- a/roles/unbound/tasks/prometheus-exporter.yml +++ b/roles/unbound/tasks/prometheus-exporter.yml @@ -3,7 +3,13 @@ become: true ansible.builtin.package: name: prometheus-unbound-exporter - notify: prometheus-unbound-exporter.enabled + +- name: enable unbound prometheus exporter + become: true + ansible.builtin.systemd: + name: prometheus-unbound-exporter.service + enabled: true + daemon_reload: true - name: configure unbound exporter become: true diff --git a/roles/unbound/vars/deploy_systemd_resolved_config.yaml b/roles/unbound/vars/deploy_systemd_resolved_config.yaml new file mode 100644 index 00000000..0da57c11 --- /dev/null +++ b/roles/unbound/vars/deploy_systemd_resolved_config.yaml @@ -0,0 +1,9 @@ +--- +deploy_systemd_resolved_config__enable: false +deploy_systemd_resolved_config__dns: + - 127.0.0.1 +deploy_systemd_resolved_config__fallback_dns: # Fux DNS Server + - 185.161.128.66 + - 2a07:c481:0:4::2 + - 185.161.128.67 + - 2a07:c481:0:4::3 From a4bb9a82d219bb319ac7644ffd889da6327dca8b Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:08:11 +0200 Subject: [PATCH 13/51] unbound(role): add FIXME note to unbound prometheus exporter install --- roles/unbound/tasks/prometheus-exporter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml index b794e07b..fba5090c 100644 --- a/roles/unbound/tasks/prometheus-exporter.yml +++ b/roles/unbound/tasks/prometheus-exporter.yml @@ -1,5 +1,5 @@ --- -- name: install unbound prometheus exporter +- name: install unbound prometheus exporter # FIXME: there is no prometheus-unbound-exporter in debian .deb exists in https://github.com/letsencrypt/unbound_exporter/releases/tag/v0.6.0 become: true ansible.builtin.package: name: prometheus-unbound-exporter From 9a5dafb2bce1ec28862783a8fcd0c0952b28b088 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:09:50 +0200 Subject: [PATCH 14/51] unbound(role): remove tags inside role --- roles/unbound/handlers/main.yml | 2 -- roles/unbound/tasks/main.yml | 1 - 2 files changed, 3 deletions(-) diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml index 222e8c50..09af6995 100644 --- a/roles/unbound/handlers/main.yml +++ b/roles/unbound/handlers/main.yml @@ -1,12 +1,10 @@ - name: unbound.restarted - tags: [ unbound, dns, dns_resolver ] become: true ansible.builtin.systemd: name: unbound.service state: restarted - name: unbound.reloaded - tags: [ unbound, dns, dns_resolver ] become: true ansible.builtin.systemd: name: unbound.service diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index eb88f931..a4a6896f 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -1,5 +1,4 @@ - name: unbound role main - tags: [ unbound, dns, dns_resolver ] block: - name: install unbound dns resolver From bb141ddab342555f795ed4d3022303a3c989fd41 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:19:42 +0200 Subject: [PATCH 15/51] unbound(role): reformat config template and use all vcpus --- roles/unbound/templates/unbound.conf.j2 | 75 ++++++++++++------------- 1 file changed, 35 insertions(+), 40 deletions(-) diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2 index a1e310e0..96aa9cd5 100644 --- a/roles/unbound/templates/unbound.conf.j2 +++ b/roles/unbound/templates/unbound.conf.j2 @@ -1,22 +1,18 @@ # ref: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html # unbound.conf(5) man page server: - {% if unbound_enable_dnssec -%} - # disable chroot because unbound is the only thing running on the VM - # and because it has issues with how archlinux configures the systemd units write protection regarding the anchor file - chroot: "" - - # location of the trust anchor file that enables DNSSEC - # this file is generated by the `unbound-anchor` command - auto-trust-anchor-file: "/etc/unbound/trusted-key.key" - {% endif -%} + {% if unbound_enable_dnssec -%} + # location of the trust anchor file that enables DNSSEC + # this file is generated by the `unbound-anchor` command + auto-trust-anchor-file: "/etc/unbound/trusted-key.key" + {% endif -%} # use all CPUs - num-threads: 2 + num-threads: {{ ansible_facts['processor_vcpus'] }} # more cache memory - rrset-cache-size: 60m - msg-cache-size: 30m + rrset-cache-size: 60m + msg-cache-size: 30m # prefetch to keep the cache up to date prefetch: yes @@ -25,49 +21,48 @@ server: prefetch-key: yes # Faster UDP with multithreading (only on Linux). - so-reuseport: yes + so-reuseport: yes # disable special large send buffer handling and just use kernel defaults - so-sndbuf: 0 + so-sndbuf: 0 - # send minimal amount of information to upstream servers to enhance privacy - qname-minimisation: yes + # send minimal amount of information to upstream servers to enhance privacy + qname-minimisation: yes - # specify the interface to answer queries from by ip-address. - {% for i in unbound_bind_interfaces -%} - interface: "{{ i }}" - {% endfor %} + # specify the interface to answer queries from by ip-address. + {% for i in unbound_bind_interfaces -%} + interface: "{{ i }}" + {% endfor %} - # addresses from the IP range that are allowed to connect to the resolver - {% for i in unbound_access_control -%} - access-control: {{ i }} - {% endfor -%} + # addresses from the IP range that are allowed to connect to the resolver + {% for i in unbound_access_control -%} + access-control: {{ i }} + {% endfor -%} - {% for i in unbound_private_domain -%} - private-domain: {{ i }} - {% endfor -%} + {% for i in unbound_private_domain -%} + private-domain: {{ i }} + {% endfor -%} - # The number of seconds between printing statistics to the log for every thread. - statistics-interval: 0 + # The number of seconds between printing statistics to the log for every thread. + statistics-interval: 0 - # Extended statistics are printed, Keeping track of more statistics takes time. - extended-statistics: yes + # Extended statistics are printed, Keeping track of more statistics takes time. + extended-statistics: yes remote-control: - control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} - control-interface: /run/unbound-control.sock + control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} + control-interface: /run/unbound-control.sock # configure some zones for which this resolver will act authoritatively # https://www.dns.icann.org/services/axfr/ {% for i in [ ".", "in-addr.arpa.", "arpa.", "root-servers.net.", "ip6.arpa.", "ip6-servers.arpa.", "mcast.net." ] %} auth-zone: - name: "{{ i }}" - primary: "lax.xfr.dns.icann.org" - primary: "iad.xfr.dns.icann.org" - fallback-enabled: yes - for-downstream: no - for-upstream: yes - + name: "{{ i }}" + primary: "lax.xfr.dns.icann.org" + primary: "iad.xfr.dns.icann.org" + fallback-enabled: yes + for-downstream: no + for-upstream: yes {% endfor %} From 5423558ab42d831668cb3a52481e0a6792211a59 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:30:35 +0200 Subject: [PATCH 16/51] unbound(role): make unbound thread number configurable --- roles/unbound/README.md | 1 + roles/unbound/templates/unbound.conf.j2 | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/unbound/README.md b/roles/unbound/README.md index 806b9d8d..c44805ba 100644 --- a/roles/unbound/README.md +++ b/roles/unbound/README.md @@ -17,3 +17,4 @@ The following variables can be used to customize this role: | unbound_enable_dnssec | Boolean | `true` | Whether dnssec validation should be enabled | | unbound_access_control | List of Strings | `[]` | **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E) | | unbound_disable_systemd_networkd | Boolean | `true` | If true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. | +| unbound_thread_count | Integer | Max vCPU Count | The number of threads unbound uses | diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2 index 96aa9cd5..d9b612c4 100644 --- a/roles/unbound/templates/unbound.conf.j2 +++ b/roles/unbound/templates/unbound.conf.j2 @@ -7,8 +7,8 @@ server: auto-trust-anchor-file: "/etc/unbound/trusted-key.key" {% endif -%} - # use all CPUs - num-threads: {{ ansible_facts['processor_vcpus'] }} + # num of threads + num-threads: {{ unbound_thread_count | default(ansible_facts['processor_vcpus']) }} # more cache memory rrset-cache-size: 60m From a0b0e8188fe6298844210ab4bdd2b1f74fb95dd5 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:43:56 +0200 Subject: [PATCH 17/51] unbound(role): move resolvd vars to task --- roles/unbound/tasks/main.yml | 5 ++++- roles/unbound/vars/deploy_systemd_resolved_config.yaml | 9 --------- 2 files changed, 4 insertions(+), 10 deletions(-) delete mode 100644 roles/unbound/vars/deploy_systemd_resolved_config.yaml diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index a4a6896f..3b038c61 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -37,7 +37,10 @@ when: unbound_disable_systemd_networkd ansible.builtin.include_role: name: deploy_systemd_resolved_config - vars_from: deploy_systemd_resolved_config + vars: + deploy_systemd_resolved_config__enable: false + deploy_systemd_resolved_config__dns: + - 127.0.0.1 - name: install and configure prometheus-exporter for unbound ansible.builtin.import_tasks: prometheus-exporter.yml diff --git a/roles/unbound/vars/deploy_systemd_resolved_config.yaml b/roles/unbound/vars/deploy_systemd_resolved_config.yaml deleted file mode 100644 index 0da57c11..00000000 --- a/roles/unbound/vars/deploy_systemd_resolved_config.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -deploy_systemd_resolved_config__enable: false -deploy_systemd_resolved_config__dns: - - 127.0.0.1 -deploy_systemd_resolved_config__fallback_dns: # Fux DNS Server - - 185.161.128.66 - - 2a07:c481:0:4::2 - - 185.161.128.67 - - 2a07:c481:0:4::3 From 9e92a3c390d8d65f18459c61a3d7f1bc9007eea3 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 11:13:28 +0200 Subject: [PATCH 18/51] z9(group): remove all z9 references as subdomain --- inventories/z9/group_vars/all.yaml | 2 +- inventories/z9/host_vars/light.sops.yaml | 11 +++++------ inventories/z9/host_vars/light.yaml | 6 ------ inventories/z9/hosts.yaml | 6 ++++-- resources/z9/light/nginx/light.conf | 17 ----------------- 5 files changed, 10 insertions(+), 32 deletions(-) diff --git a/inventories/z9/group_vars/all.yaml b/inventories/z9/group_vars/all.yaml index 20a4e7f7..5cc32330 100644 --- a/inventories/z9/group_vars/all.yaml +++ b/inventories/z9/group_vars/all.yaml @@ -40,7 +40,7 @@ alloy_config_default: | source_labels = ["instance"] target_label = "instance" regex = "([^:]+)" - replacement = "${1}.z9.ccchh.net" + replacement = "${1}.ccchh.net" action = "replace" } } diff --git a/inventories/z9/host_vars/light.sops.yaml b/inventories/z9/host_vars/light.sops.yaml index afb4c680..76e103ca 100644 --- a/inventories/z9/host_vars/light.sops.yaml +++ b/inventories/z9/host_vars/light.sops.yaml @@ -1,11 +1,9 @@ ansible_pull__age_private_key: ENC[AES256_GCM,data:VEGxr8C7RlEhyQhf+to/OrbfPPKkyL7iUU1yDXGAzmmPCQ4VftK71eiyN7OS6pG8J89Mj4Sy/dcY4SUX+rTl/q1csZMn9t4NBN8=,iv:JcrdyFLX5srZfRj9SA+RXf+CRZi5GEcApgyYsHoHTGE=,tag:xdJ4GmK3afZDkXmkrriStg==,type:str] secret__acme_dns_api_key_light_ccchh_net: ENC[AES256_GCM,data:SLUNVJQ4Nkos+tYH0l9ndJI8mrfZFC9i/qQqkcHgfLaNjL1tFuAFfQ==,iv:cc7DsiqzMlc2lh3D63cElMQcOeYT7oNxmRy7irSr9/s=,tag:dBnTAJXvgWlmq5vVGxrykw==,type:str] -secret__acme_dns_api_key_light_z9_ccchh_net: ENC[AES256_GCM,data:m6+Sk533qTRfhrwv7U2RydJh/j7KjJKHiEetyzgvJV1dgWXmE5AhYA==,iv:lAGv4vfxA+DQfwaHiDp3NMel0tjmZl96nKUAN8QGFe4=,tag:h0wM/F9E4dIy+NYLIVUpxg==,type:str] secret__acme_dns_api_key_light_werkstatt_ccchh_net: ENC[AES256_GCM,data:zJ9hQo1jmQ5+d0oU+CD+cQh89HshPpguZCak7Nfjdb2bygUXJrEIIw==,iv:y+FSB/k5LixKJOm9egWsjhByQAdv7TfJHvv3job2oYg=,tag:CmuUqnCI3V/aOOUitzYT9Q==,type:str] sops: age: - - recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSNzBtc3lkZHlqeTFIa2RX ZWgyV0lZQ0wxRm4vZ0Q3Y1d4RTlhYzk0ZUdzCkQ5VjdlSldCc0ZqZlBIOTMrclV6 @@ -13,8 +11,9 @@ sops: azNiRDFuU2V4V25iV3dORW42UGZPRmsKOsa+36+NKjmS8xMAoCueJdhIIUtdhl15 3grlxNwv4axlKNy1ynSSmneyAZ6g+OF80b4YNxzZYcfnECB1VnDENA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-11T01:24:10Z" - mac: ENC[AES256_GCM,data:D7qAgDZX8B0oNdZovHE74sSZI5X3qd8oDPHWl13Q2ohLnp9vJsFxrKntXxeeHASzQceDv2RQ1exwq7ZPor62sLFx+xO1Dc0Awpq1eoclDlHPyKlvT3pgkcB8IxDO/FuO+7hg/bJkmTHhbHTiHLGQDWN2sQev309Eka86lQyCzIQ=,iv:OBCobeUp+GwdDQhrNtTJhiRVMxRJafq5g1rhMoEFhjc=,tag:OSAWMn2NPZnVKcRX+eJf+Q==,type:str] + recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q + lastmodified: "2026-05-26T09:09:21Z" + mac: ENC[AES256_GCM,data:NGVGI70dGuJS4qMfpy3tE9MTvX9O8Rwt+Nv+gdqLUkleMEe8sWKbAgfFyWIYxroo7AXFEl3jIFQ7pmcvnSTUBprR7mL3//3QcXQXthxW/mVCf4DRtr7fcqAtctTrC2iRZnZ1YrOz/sSO7G0bgmcx43tYDZPZ+udNKO2pvZvclCE=,iv:xvDS6QVfOPcLk0C12YES2CVKCs6pWl7xPReWtgCyMIw=,tag:pXfFkbWWQpMlwE6g6nO2hQ==,type:str] pgp: - created_at: "2026-05-20T02:08:48Z" enc: |- @@ -187,4 +186,4 @@ sops: -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted - version: 3.12.2 + version: 3.13.1 diff --git a/inventories/z9/host_vars/light.yaml b/inventories/z9/host_vars/light.yaml index c14515d2..2fb01e38 100644 --- a/inventories/z9/host_vars/light.yaml +++ b/inventories/z9/host_vars/light.yaml @@ -67,12 +67,6 @@ certbot__certs: subdomain: "e59f55ee-9013-469d-a146-a159721b6fea" apiUser: "33e96ec7-1f98-4f70-92be-85a42dabd211" apiKey: "{{ secret__acme_dns_api_key_light_ccchh_net }}" - - commonName: "light.z9.ccchh.net" - challengeType: "dns-01-acme-dns" - dns_01_acme_dns: - subdomain: "3bc9e7ce-03dd-4533-a059-b5d38407eaa5" - apiUser: "c3b00882-ca2a-4d11-9ebd-fccfb8618b75" - apiKey: "{{ secret__acme_dns_api_key_light_z9_ccchh_net }}" - commonName: "light-werkstatt.ccchh.net" challengeType: "dns-01-acme-dns" dns_01_acme_dns: diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 7c1264da..a4cea688 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -1,14 +1,16 @@ all: hosts: dooris: - ansible_host: dooris.z9.ccchh.net + ansible_host: dooris.ccchh.net ansible_user: chaos light: - ansible_host: light.z9.ccchh.net + ansible_host: light.ccchh.net ansible_user: chaos opensourcetorrents: ansible_host: opensourcetorrents.ccchh.net ansible_user: chaos + thinkcccore0: + ansible_host: thinkcccore0.ccchh.net waybackproxy: ansible_host: waybackproxy.ccchh.net ansible_user: chaos diff --git a/resources/z9/light/nginx/light.conf b/resources/z9/light/nginx/light.conf index 6217e045..8d902584 100644 --- a/resources/z9/light/nginx/light.conf +++ b/resources/z9/light/nginx/light.conf @@ -25,23 +25,6 @@ server { } } -server { - listen 443 ssl; - listen [::]:443 ssl; - http2 on; - - server_name light.z9.ccchh.net; - - ssl_certificate /etc/letsencrypt/live/light.z9.ccchh.net/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/light.z9.ccchh.net/privkey.pem; - # verify chain of trust of OCSP response using Root CA and Intermediate certs - ssl_trusted_certificate /etc/letsencrypt/live/light.z9.ccchh.net/chain.pem; - - location / { - return 307 https://light.ccchh.net$request_uri; - } -} - server { listen 443 ssl; listen [::]:443 ssl; From 04d24ccb6f1b6c4a15b7ed7703f6f1dfaf660057 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 20 Jun 2026 17:58:25 +0200 Subject: [PATCH 19/51] z9(group): remove all old ip references and change them to new ones --- .../chaosknoten/auth-dns/zones/ccchh.net.zone | 103 +++++++++++++++--- resources/z9/light/nginx/light.conf | 4 +- .../z9/yate/docker_compose/regexroute.conf.j2 | 2 +- resources/z9/z9-router/kea_dhcp.yaml | 25 ++++- 4 files changed, 115 insertions(+), 19 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index 8495dc9e..91519200 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -16,6 +16,8 @@ $TTL 60 ; 1 minutes ; rt-wan A 185.161.129.134 AAAA 2a07:c481::1:2 +z9-router A 10.89.213.1 + AAAA 2a07:c481:1:36::1 sw-rack-1 A 10.89.213.2 AAAA 2a07:c481:1:36::2 sw-rack-2-poe A 10.89.213.3 @@ -41,30 +43,100 @@ pve04 A 10.89.213.14 pbs A 10.89.213.15 AAAA 2a07:c481:1:36::15 unifi A 10.89.213.21 +; AAAA 2a07:c481:1:36::21 ; ; Club-Services ; -xr18 A 172.31.200.29 -dooris A 172.31.200.16 - AAAA 2a07:c481:1:d0::1c -hmdooris-ccu A 172.31.200.17 +xr18 A 10.89.208.15 +AtemMini A 10.89.212.234 -club-assistant AAAA 2a07:c481:1:d0::a - A 10.31.208.10 -_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de. -;esphome AAAA 2a07:c481:1:d0::66 -;zigbee2mqtt A 185.161.129.132 -;light AAAA 2a07:c481:1:d0::16 +beamer A 10.89.208.11 +ir-bridge-beamer A 10.89.212.213 +Big-Room-Beamer A 10.89.208.14 + +prusamk3 A 10.89.212.3 +prusamk4 A 10.89.212.4 + +wled-kueche A 10.89.212.33 +wled-serverschrank A 10.89.212.34 +wled-couch A 10.89.212.35 + +laser A 10.89.212.36 +laser-eth A 10.89.212.37 + +okilaser A 10.89.212.235 + +t-mix A 10.89.212.42 +fritz-fon A 10.89.212.86 + +staubi A 10.89.212.232 +staubiv2 A 10.89.212.233 + +hp-color A 10.89.209.28 + + +club-assistant A 10.89.213.22 + AAAA 2a07:c481:1:36::32 +_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de + + +esphome A 10.89.212.210 + AAAA 2a07:c481:1:34::66 +hauptraum-esphome A 10.89.212.211 +werkstatt-esphome A 10.89.212.212 + + +light A 10.89.213.28 + AAAA 2a07:c481:1:36::31 _acme-challenge.light CNAME e59f55ee-9013-469d-a146-a159721b6fea.auth.acmedns.hamburg.ccc.de. -;light-werkstatt AAAA 2a07:c481:1:d0::16 +light-werkstatt CNAME light.ccchh.net. _acme-challenge.light-werkstatt CNAME f408acc0-d9f5-4525-bb01-28938e3bb7d0.auth.acmedns.hamburg.ccc.de. -;buba A 10.31.211.137 + +pi-dmx-werkstatt A 10.89.212.215 + + +dooris A 10.89.208.16 + AAAA 2a07:c481:1:33::1c _acme-challenge.dooris CNAME 37caae1f-b77f-4eb1-aa71-dc3f7ed24360.auth.acmedns.hamburg.ccc.de. -yate A 10.31.208.12 -;staubiv2 A 10.31.210.233 -prusa-mk4 A 10.31.210.4 + +hmdooris-ccu A 10.89.208.17 + +dooris-ng A 10.89.209.29 + + +buba A 10.89.212.137 + +yate A 10.89.213.24 + +muzak A 10.89.208.13 + +encoder-ccchh A 10.89.209.166 + +ki10 A 10.89.209.254 + +Ziggy A 10.89.212.11 + +legacy A 10.89.212.12 + +foobarpay A 10.89.212.23 + +foobackup A 10.89.212.24 + +ender3v2-sonic-pad A 10.89.212.27 + +octopi A 10.89.212.31 + +433mhz-bridge A 10.89.212.32 + + +;SIP-T46S A 10.89.212.227 +;SIP-T46S A 10.89.212.230 + +;cisco-slm248p A 10.89.208.27 + +;zigbee2mqtt A 185.161.129.132 ; Old entry probably deprecadet ; @@ -73,3 +145,4 @@ prusa-mk4 A 10.31.210.4 opensourcetorrents A 185.161.130.67 AAAA 2a07:c481:1:35::42 + diff --git a/resources/z9/light/nginx/light.conf b/resources/z9/light/nginx/light.conf index 8d902584..18e2a41e 100644 --- a/resources/z9/light/nginx/light.conf +++ b/resources/z9/light/nginx/light.conf @@ -13,7 +13,7 @@ server { ssl_trusted_certificate /etc/letsencrypt/live/light-werkstatt.ccchh.net/chain.pem; # replace with the IP address of your resolver - resolver 10.31.208.1; + #resolver 10.31.208.1; # is this needed? location / { proxy_pass http://127.0.0.1:8081; @@ -38,7 +38,7 @@ server { ssl_trusted_certificate /etc/letsencrypt/live/light.ccchh.net/chain.pem; # replace with the IP address of your resolver - resolver 10.31.208.1; + #resolver 10.31.208.1; # is this needed? location / { proxy_pass http://127.0.0.1:8080; diff --git a/resources/z9/yate/docker_compose/regexroute.conf.j2 b/resources/z9/yate/docker_compose/regexroute.conf.j2 index aeecf6b2..0f7bd966 100644 --- a/resources/z9/yate/docker_compose/regexroute.conf.j2 +++ b/resources/z9/yate/docker_compose/regexroute.conf.j2 @@ -81,7 +81,7 @@ ${called}^fo370381tr317349_00$=inbound_fonial ^.*$=echo [z9] "\0" ${caller}->${called} ; log ; test service numbers -^91$=sip/sip:ha@10.31.208.10:5060; called=ha;format=opus ; Homeassistant +^91$=sip/sip:ha@10.89.213.22:5060; called=ha;format=opus ; Homeassistant ^98$=external/playrec/echo.sh ; Echotest ^99$=external/play/tts.sh;mode=text;text=Hallo Hallo Hallo ; TTS test diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index d1918813..8b9b9fb5 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -36,6 +36,9 @@ kea_dhcp__dhcp4: - ip-address: 10.89.208.14 hostname: Big-Room-Beamer hw-address: "64:d2:c4:db:08:5c" + - ip-address: 10.89.208.15 + hostname: xr18 + hw-address: "34:8d:13:13:1f:33" - ip-address: 10.89.208.16 hostname: dooris hw-address: "bc:24:11:b3:93:9c" @@ -115,9 +118,15 @@ kea_dhcp__dhcp4: - ip-address: 10.89.212.42 hostname: t-mix hw-address: "40:a5:ef:d9:eb:93" + - ip-address: 10.89.212.137 + hostname: ccchh-buba + hw-address: "b8:27:eb:29:bd:77" - ip-address: 10.89.212.86 hostname: fritz-fon hw-address: "00:1f:3f:c9:e5:b2" + - ip-address: 10.89.212.210 + hostname: esphome + hw-address: "7e:3c:f0:77:8a:f4" - ip-address: 10.89.212.211 hostname: hauptraum-esphome hw-address: "e8:db:84:e8:18:d2" @@ -246,10 +255,18 @@ kea_dhcp__dhcp6: subnet: "2a07:c481:1:33::/64" pools: - pool: "2a07:c481:1:33::1:1 - 2a07:c481:1:33::FFFF:FFFF" + reservations: + - ip-address: "2a07:c481:1:33::1c" + hostname: dooris + hw-address: "bc:24:11:b3:93:9c" - id: 2 subnet: "2a07:c481:1:34::/64" pools: - pool: "2a07:c481:1:34::1:1 - 2a07:c481:1:34::FFFF:FFFF" + reservations: + - ip-address: "2a07:c481:1:34::66" + hostname: esphome + hw-address: "7e:3c:f0:77:8a:f4" - id: 3 subnet: "2a07:c481:1:36::/64" pools: @@ -288,6 +305,12 @@ kea_dhcp__dhcp6: - ip-address: "2a07:c481:1:36::f" hostname: pbs hw-address: "BC:24:11:D6:2C:81" - - ip-address: "2a07:c481:1:36::14" + - ip-address: "2a07:c481:1:36::21" hostname: unifi hw-address: "BC:24:11:25:77:60" + - ip-address: "2a07:c481:1:36::31" + hostname: light + hw-address: "72:61:ea:e6:49:e3" + - ip-address: "2a07:c481:1:36::32" + hostname: club-assistant + hw-address: "7a:55:61:c3:a2:89" From fa916904856404fd641beec4e950cf9bd7637ef2 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 20 Jun 2026 18:33:37 +0200 Subject: [PATCH 20/51] z9(pve01): change thinkcccore0 to pve01 --- README.md | 2 +- inventories/z9/hosts.yaml | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index bd980d8f..62c785c7 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Folgende Geräte und Server werden duch dieses Ansible Repository verwaltet: -* Diverse VMs auf dem ThinkCCCluster +* Diverse VMs auf dem z9 (PVE Cluster) * Diverse VMs auf dem Chaosknoten Host-spezifische Konfigurationsdateien liegen unter `resources/` und werden für jeweils über eine `host_vars`-Datei im Inventory geladen. diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index a4cea688..ebbab18f 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -9,8 +9,8 @@ all: opensourcetorrents: ansible_host: opensourcetorrents.ccchh.net ansible_user: chaos - thinkcccore0: - ansible_host: thinkcccore0.ccchh.net + pve01: + ansible_host: pve01.ccchh.net waybackproxy: ansible_host: waybackproxy.ccchh.net ansible_user: chaos @@ -35,7 +35,7 @@ foobazdmx_hosts: light: hypervisors: hosts: - thinkcccore0: + pve01: infrastructure_authorized_keys_hosts: hosts: dooris: @@ -55,7 +55,7 @@ transmission: opensourcetorrents: proxmox_vm_template_hosts: hosts: - thinkcccore0: + pve01: systemd_networkd_hosts: hosts: z9-router: From db6ef3fcb2d3e01ba411a200939ed46844ec05ee Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 21 Jun 2026 20:01:55 +0200 Subject: [PATCH 21/51] kea_dhcp(role): fix include wars check --- roles/kea_dhcp/tasks/kea.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/kea_dhcp/tasks/kea.yaml b/roles/kea_dhcp/tasks/kea.yaml index 116c7dd7..0d2c5e39 100644 --- a/roles/kea_dhcp/tasks/kea.yaml +++ b/roles/kea_dhcp/tasks/kea.yaml @@ -1,6 +1,6 @@ --- - name: Include config vars - when: kea_dhcp__include_vars is not None + when: kea_dhcp__include_vars != None ansible.builtin.include_vars: file: "{{ kea_dhcp__include_vars }}" From 6b05c4b05a9dc1e2ee8a1e71f89016e41d57b49c Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 21 Jun 2026 20:06:32 +0200 Subject: [PATCH 22/51] unbound(role): fix unbound config template - fix some indentation problems - fix access control - fix remote control unix socket and thrust anchor file (because debain appamour ist annoying) - add unbound-anchor package --- roles/unbound/tasks/main.yml | 5 +++++ roles/unbound/templates/unbound.conf.j2 | 25 +++++++++++++------------ 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index 3b038c61..2cf22618 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -6,6 +6,11 @@ ansible.builtin.package: name: unbound + - name: install unbound-anchor + become: true + ansible.builtin.package: + name: unbound-anchor + - name: ensure correct directory permissions become: true ansible.builtin.file: diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2 index d9b612c4..3213f46d 100644 --- a/roles/unbound/templates/unbound.conf.j2 +++ b/roles/unbound/templates/unbound.conf.j2 @@ -4,26 +4,26 @@ server: {% if unbound_enable_dnssec -%} # location of the trust anchor file that enables DNSSEC # this file is generated by the `unbound-anchor` command - auto-trust-anchor-file: "/etc/unbound/trusted-key.key" + trust-anchor-file: "/usr/share/dns/root.key" {% endif -%} - # num of threads - num-threads: {{ unbound_thread_count | default(ansible_facts['processor_vcpus']) }} + # num of threads + num-threads: {{ unbound_thread_count | default(ansible_facts['processor_vcpus']) }} - # more cache memory + # more cache memory rrset-cache-size: 60m msg-cache-size: 30m - # prefetch to keep the cache up to date - prefetch: yes + # prefetch to keep the cache up to date + prefetch: yes - # fetch the DNSKEYs earlier in the validation process, when a DS record is encountered - prefetch-key: yes + # fetch the DNSKEYs earlier in the validation process, when a DS record is encountered + prefetch-key: yes - # Faster UDP with multithreading (only on Linux). + # Faster UDP with multithreading (only on Linux). so-reuseport: yes - # disable special large send buffer handling and just use kernel defaults + # disable special large send buffer handling and just use kernel defaults so-sndbuf: 0 # send minimal amount of information to upstream servers to enhance privacy @@ -36,7 +36,7 @@ server: # addresses from the IP range that are allowed to connect to the resolver {% for i in unbound_access_control -%} - access-control: {{ i }} + access-control: {{ i }} allow {% endfor -%} {% for i in unbound_private_domain -%} @@ -51,7 +51,8 @@ server: remote-control: control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} - control-interface: /run/unbound-control.sock + control-interface: "/run/unbound.ctl" # debian appamour does not allow any other path!!! + control-use-cert: no # configure some zones for which this resolver will act authoritatively From 83f654037a4e0ebb915083cf4a0b6f035fb26bcd Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 21 Jun 2026 20:13:29 +0200 Subject: [PATCH 23/51] unbound(role): fix unbound prometheus exporter install on debian - download debian image from github und verify checksum - setup systemd service unit --- .../files/prometheus-unbound-exporter.service | 12 +++++ roles/unbound/tasks/main.yml | 14 ++--- roles/unbound/tasks/prometheus-exporter.yml | 52 ++++++++++++++++--- 3 files changed, 65 insertions(+), 13 deletions(-) create mode 100644 roles/unbound/files/prometheus-unbound-exporter.service diff --git a/roles/unbound/files/prometheus-unbound-exporter.service b/roles/unbound/files/prometheus-unbound-exporter.service new file mode 100644 index 00000000..d3b4c9f9 --- /dev/null +++ b/roles/unbound/files/prometheus-unbound-exporter.service @@ -0,0 +1,12 @@ +[Unit] +Description=Prometheus exporter for Unbound metrics, written in Go with pluggable metric collectors. The metrics exporter converts Unbound metric names to Prometheus metric names and labels by using a set of regular expressions. +Documentation=https://github.com/letsencrypt/unbound_exporter +After=network.target + +[Service] +Type=simple +EnvironmentFile=/etc/prometheus-unbound-exporter.conf +ExecStart=/bin/unbound_exporter ${UNBOUND_EXPORTER_ARGS} + +[Install] +WantedBy=multi-user.target diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index 2cf22618..69b712f6 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -31,13 +31,6 @@ group: unbound mode: u=rw,g=r,o=r - - name: ensure unbound is running and enabled - become: true - ansible.builtin.systemd: - name: unbound.service - state: started - enabled: true - - name: disable systemd-resolved when: unbound_disable_systemd_networkd ansible.builtin.include_role: @@ -47,6 +40,13 @@ deploy_systemd_resolved_config__dns: - 127.0.0.1 + - name: ensure unbound is running and enabled + become: true + ansible.builtin.systemd: + name: unbound.service + state: started + enabled: true + - name: install and configure prometheus-exporter for unbound ansible.builtin.import_tasks: prometheus-exporter.yml when: unbound_install_prometheus_exporter diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml index fba5090c..bbf69e78 100644 --- a/roles/unbound/tasks/prometheus-exporter.yml +++ b/roles/unbound/tasks/prometheus-exporter.yml @@ -1,8 +1,48 @@ --- -- name: install unbound prometheus exporter # FIXME: there is no prometheus-unbound-exporter in debian .deb exists in https://github.com/letsencrypt/unbound_exporter/releases/tag/v0.6.0 +- name: install unbound prometheus exporter become: true - ansible.builtin.package: - name: prometheus-unbound-exporter + vars: + prometheus_unbound_exporter_version: "0.6.0" + prometheus_unbound_exporter_filename: "unbound_exporter-v{{ prometheus_unbound_exporter_version }}.x86_64.deb" + prometheus_unbound_exporter_github_api_url: "https://api.github.com/repos/letsencrypt/unbound_exporter/releases/tags/v{{ prometheus_unbound_exporter_version }}" + block: + - name: request github api + ansible.builtin.uri: + url: "{{ prometheus_unbound_exporter_github_api_url }}" + method: GET + body_format: json + headers: + 'Accept': 'application/vnd.github+json' + register: unbound_exporter_github_api_result + + - name: get prometheus-unbound-exporter download url and digest + ansible.builtin.set_fact: + unbound_exporter_download_url: "{{ unbound_exporter_github_api_result.json.assets[0].browser_download_url }}" + unbound_exporter_download_digest: "{{ unbound_exporter_github_api_result.json.assets[0].digest }}" + + - name: Download prometheus-unbound-exporter deb package with verified checksum + ansible.builtin.get_url: + url: "{{ unbound_exporter_download_url }}" + dest: "/tmp/{{ prometheus_unbound_exporter_filename }}" + checksum: "{{ unbound_exporter_download_digest }}" + mode: "u=r,g=r,o=r" + + - name: Install prometheus-unbound-exporter deb package + become: true + ansible.builtin.apt: + deb: "/tmp/{{ prometheus_unbound_exporter_filename }}" + state: present + notify: prometheus-unbound-exporter.restarted + +- name: deploy prometheus-unbound-exporter systemd service + become: true + ansible.builtin.copy: + src: "prometheus-unbound-exporter.service" + dest: "/etc/systemd/system/prometheus-unbound-exporter.service" + owner: root + group: root + mode: '0644' + notify: systemd-daemon-reload - name: enable unbound prometheus exporter become: true @@ -14,10 +54,10 @@ - name: configure unbound exporter become: true ansible.builtin.copy: - dest: /etc/conf.d/prometheus-unbound-exporter + dest: /etc/prometheus-unbound-exporter.conf content: | - UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound-control.sock" + UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound.ctl" owner: root group: root - mode: '0660' + mode: '0644' notify: prometheus-unbound-exporter.restarted From 4ec4c1f94292c0aea1b7c55ac8f224aa932fc618 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 22 Jun 2026 21:03:12 +0200 Subject: [PATCH 24/51] z9-router(host): fix systemd-networkd configs --- .../z9-router/systemd_networkd/10-netlan.51.netdev | 1 + .../z9-router/systemd_networkd/10-netlan.52.netdev | 1 + .../z9-router/systemd_networkd/10-netlan.53.netdev | 1 + .../z9-router/systemd_networkd/10-netlan.54.netdev | 1 + .../z9-router/systemd_networkd/10-netwan.400.netdev | 1 + .../z9/z9-router/systemd_networkd/20-netlan.network | 12 ++++++++---- .../z9/z9-router/systemd_networkd/20-netwan.network | 4 ++++ .../systemd_networkd/21-netlan.54-management.network | 2 +- .../21-netwan.400-fux_uplink.network | 2 ++ 9 files changed, 20 insertions(+), 5 deletions(-) diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev index b951ecc3..6baf6877 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netlan.51 Kind=vlan +MACAddress=BC:24:11:BD:D3:F9 [VLAN] Id=51 diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev index 1f345c72..48cc3a55 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netlan.52 Kind=vlan +MACAddress=BC:24:11:88:28:15 [VLAN] Id=52 diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev index c6dab812..b65d4066 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netlan.53 Kind=vlan +MACAddress=BC:24:11:3C:3C:BE [VLAN] Id=53 diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev index 6271e6c4..4ea5ec6a 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netlan.54 Kind=vlan +MACAddress=BC:24:11:D2:65:B4 [VLAN] Id=54 diff --git a/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev b/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev index e0b6afcf..a66dc79e 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netwan.400 Kind=vlan +MACAddress=BC:24:11:C3:27:45 [VLAN] Id=400 diff --git a/resources/z9/z9-router/systemd_networkd/20-netlan.network b/resources/z9/z9-router/systemd_networkd/20-netlan.network index 3aed7151..7fab501b 100644 --- a/resources/z9/z9-router/systemd_networkd/20-netlan.network +++ b/resources/z9/z9-router/systemd_networkd/20-netlan.network @@ -5,8 +5,12 @@ Name=netlan RequiredForOnline=no [Network] -VLAN=netwan.51 -VLAN=netwan.52 -VLAN=netwan.53 -VLAN=netwan.54 +LinkLocalAddressing=no +DHCP=no +IPv6AcceptRA=no + +VLAN=netlan.51 +VLAN=netlan.52 +VLAN=netlan.53 +VLAN=netlan.54 diff --git a/resources/z9/z9-router/systemd_networkd/20-netwan.network b/resources/z9/z9-router/systemd_networkd/20-netwan.network index 89a8494a..b42b95ab 100644 --- a/resources/z9/z9-router/systemd_networkd/20-netwan.network +++ b/resources/z9/z9-router/systemd_networkd/20-netwan.network @@ -5,5 +5,9 @@ Name=netwan RequiredForOnline=no [Network] +LinkLocalAddressing=no +DHCP=no +IPv6AcceptRA=no + VLAN=netwan.400 diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network b/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network index 2396da02..e1bf0c8a 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network +++ b/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network @@ -12,7 +12,7 @@ Description=Management IPv6SendRA=yes [Address] -Address=10.89.213.0/24 +Address=10.89.213.1/24 [IPv6SendRA] UplinkInterface=netwan.400 diff --git a/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network b/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network index 1657c40a..4ac0b8d9 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network +++ b/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network @@ -19,8 +19,10 @@ IPv6SendRA=no [Address] Address=185.161.129.134/25 +[Address] Address=2a07:c481::1:2/64 [Route] Gateway=185.161.129.129 +[Route] Gateway=2a07:c481::1 From 9271cbda972cfc79f5cde1b80bf77deeda3cc326 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 22 Jun 2026 21:09:43 +0200 Subject: [PATCH 25/51] unbound(role): fix systemd unit of prometheus exporter --- roles/unbound/files/prometheus-unbound-exporter.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/unbound/files/prometheus-unbound-exporter.service b/roles/unbound/files/prometheus-unbound-exporter.service index d3b4c9f9..523badd1 100644 --- a/roles/unbound/files/prometheus-unbound-exporter.service +++ b/roles/unbound/files/prometheus-unbound-exporter.service @@ -6,7 +6,7 @@ After=network.target [Service] Type=simple EnvironmentFile=/etc/prometheus-unbound-exporter.conf -ExecStart=/bin/unbound_exporter ${UNBOUND_EXPORTER_ARGS} +ExecStart=/bin/unbound_exporter $UNBOUND_EXPORTER_ARGS [Install] WantedBy=multi-user.target From 6006dbca27806f13c198e395bfceb5d69a427f73 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 31 Jul 2026 17:36:31 +0200 Subject: [PATCH 26/51] z9-router(host): nftables conf fix indent and allow dhcpv6 --- resources/z9/z9-router/nftables/nftables.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf index f6396894..88534127 100644 --- a/resources/z9/z9-router/nftables/nftables.conf +++ b/resources/z9/z9-router/nftables/nftables.conf @@ -75,7 +75,8 @@ table inet host { udp dport 51820 accept comment "allow WireGuard access" # Allow DHCP server access. - iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access" + iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access" + iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access" # Allow DNS server access from lan_ifs iifname { $lan_ifs, $if_wg55_management } udp dport 53 accept comment "allow dns server access from lan_ifs" From 8d9cb0007c84019a05bbb0ab58e18000b1163cd3 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 31 Jul 2026 17:48:58 +0200 Subject: [PATCH 27/51] kea_dhcp(role): update to newest fux noc version --- roles/kea_dhcp/defaults/main.yaml | 100 ++++++----- roles/kea_dhcp/handlers/main.yml | 51 +++--- roles/kea_dhcp/meta/argument_specs.yaml | 163 +++++++++--------- roles/kea_dhcp/tasks/install_debian.yaml | 21 +++ roles/kea_dhcp/tasks/install_debian.yml | 25 --- roles/kea_dhcp/tasks/kea.yaml | 21 +-- roles/kea_dhcp/tasks/main.yml | 13 +- roles/kea_dhcp/tasks/stork-agent.yaml | 29 +++- roles/kea_dhcp/templates/kea-dhcp4.conf.j2 | 32 ++++ roles/kea_dhcp/templates/kea-dhcp4.conf.jinja | 27 --- roles/kea_dhcp/templates/kea-dhcp6.conf.j2 | 36 ++++ roles/kea_dhcp/templates/kea-dhcp6.conf.jinja | 27 --- roles/kea_dhcp/templates/stork-agent.env.j2 | 44 +++++ .../kea_dhcp/templates/stork-agent.env.jinja | 20 --- 14 files changed, 350 insertions(+), 259 deletions(-) create mode 100644 roles/kea_dhcp/tasks/install_debian.yaml delete mode 100644 roles/kea_dhcp/tasks/install_debian.yml create mode 100644 roles/kea_dhcp/templates/kea-dhcp4.conf.j2 delete mode 100644 roles/kea_dhcp/templates/kea-dhcp4.conf.jinja create mode 100644 roles/kea_dhcp/templates/kea-dhcp6.conf.j2 delete mode 100644 roles/kea_dhcp/templates/kea-dhcp6.conf.jinja create mode 100644 roles/kea_dhcp/templates/stork-agent.env.j2 delete mode 100644 roles/kea_dhcp/templates/stork-agent.env.jinja diff --git a/roles/kea_dhcp/defaults/main.yaml b/roles/kea_dhcp/defaults/main.yaml index dc6453ad..51395ccb 100644 --- a/roles/kea_dhcp/defaults/main.yaml +++ b/roles/kea_dhcp/defaults/main.yaml @@ -1,6 +1,10 @@ -kea_dhcp__stork_agent: - enable: false - prometheus_only: true +--- +# Set Kea group name based on distribution +kea_dhcp__service_group: "{{ '_kea' if ansible_facts['distribution'] == 'Debian' else 'kea' }}" +kea_dhcp__unit_base_name: "{{ 'isc-kea' if ansible_facts['distribution'] == 'Debian' else 'kea' }}" +kea_dhcp__unit_base_sufix: "{{ '-server' if ansible_facts['distribution'] == 'Debian' else '' }}" + +kea_dhcp__version_repo: "kea-3-0" kea_dhcp__dns_servers: v6: - "2a07:c481:0:4::2" @@ -8,61 +12,75 @@ kea_dhcp__dns_servers: v4: - "185.161.128.66" - "185.161.128.67" -kea_dhcp__include_vars: +kea_dhcp__ntp_servers: + v4: + - "185.161.128.7" + - "185.161.128.8" + v6: "2a07:c481:0:3::7" + fqdn: ntp.z9.fux-eg.net +kea_dhcp__sntp_servers: + v6: + - "2a07:c481:0:3::7" + - "2a07:c481:0:3::8" -kea_dhcp__dhcp4: +kea_dhcp__stork_agent_defaults: + enable: false + prometheus_only: true +kea_dhcp__stork_agent: {} + +kea_dhcp__dhcp4_defaults: enable: false interfaces: [ ] control-sockets: - - socket-name: /var/run/kea-dhcp4-ctrl-agent.sock + - socket-name: /var/run/kea/dhcp4-ctrl-agent.sock socket-type: unix lease-database: type: memfile persist: true option-data: - - name: "domain-name-servers" + - name: domain-name-servers code: 6 csv-format: true data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}" - subnets: - - id: 0 - subnet: nil - pools: - - pool: nil - reservations: - - ip-address: nil - hostname: beispiel.test - hw-address: "00:11:22:33:44:55" - option-data: - - name: nil, - code: nil, - csv-format: true - data: nil -kea_dhcp__dhcp6: + - name: ntp-servers + code: 42 + data: "{{ kea_dhcp__ntp_servers.v4 | join(',') }}" + logging: + - name: kea-dhcp4 + output-options: + - output: stdout + severity: INFO +kea_dhcp__dhcp4: {} + +kea_dhcp__dhcp6_defaults: enable: false interfaces: [ ] + control-sockets: + - socket-name: /var/run/kea/dhcp6-ctrl-agent.sock + socket-type: unix lease-database: type: memfile persist: true - control-sockets: - - socket-name: /var/run/kea-dhcp6-ctrl-agent.sock - socket-type: unix option-data: - - name: "dns-servers" + - name: dns-servers code: 23 - csv-format: true data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}" - subnets: - - id: 0 - subnet: nil - pools: - - pool: nil - reservations: - - ip-address: nil - hostname: beispiel.test - hw-address: "00:11:22:33:44:55" - option-data: - - name: nil, - code: nil, - csv-format: true - data: nil + - name: sntp-servers + code: 31 + data: "{{ kea_dhcp__sntp_servers.v6 | join(',') }}" + - name: ntp-server + code: 56 + - name: ntp-server-address + space: v6-ntp-server-suboptions + data: "{{ kea_dhcp__ntp_servers.v6 }}" + - name: ntp-server-fqdn + space: v6-ntp-server-suboptions + data: "{{ kea_dhcp__ntp_servers.fqdn }}" + logging: + - name: kea-dhcp6 + output-options: + - output: stdout + severity: INFO +kea_dhcp__dhcp6: {} + +kea_dhcp__include_vars: diff --git a/roles/kea_dhcp/handlers/main.yml b/roles/kea_dhcp/handlers/main.yml index d06aa1cc..04dbc09a 100644 --- a/roles/kea_dhcp/handlers/main.yml +++ b/roles/kea_dhcp/handlers/main.yml @@ -1,29 +1,40 @@ --- -- name: Systemd.daemon_reload +- name: Systemd_daemon_reload become: true ansible.builtin.systemd_service: daemon_reload: true -- name: Kea_dhcp4.restarted - ansible.builtin.service: - name: kea-dhcp4 - state: restarted - enabled: true - -- name: Kea_dhcp6.restarted - ansible.builtin.service: - name: kea-dhcp6 - state: restarted - enabled: true - -- name: Kea_ctrl.restarted - ansible.builtin.systemd: - name: kea-ctrl-agent - state: restarted - enabled: true - -- name: Stork_agent.restarted +- name: Kea_dhcp4.restarted_debian + listen: Kea_dhcp4.restarted become: true + when: ansible_facts['distribution'] == 'Debian' + ansible.builtin.service: + name: isc-kea-dhcp4-server + state: restarted + enabled: true + +- name: Kea_dhcp6.restarted_debian + listen: Kea_dhcp6.restarted + become: true + when: ansible_facts['distribution'] == 'Debian' + ansible.builtin.service: + name: isc-kea-dhcp6-server + state: restarted + enabled: true + +- name: Kea_ctrl.restarted_debian + listen: Kea_ctrl.restarted + become: true + when: ansible_facts['distribution'] == 'Debian' + ansible.builtin.systemd: + name: isc-kea-ctrl-agent + state: restarted + enabled: true + +- name: Stork_agent.restarted_debian + listen: Stork_agent.restarted + become: true + when: ansible_facts['distribution'] == 'Debian' ansible.builtin.systemd: name: isc-stork-agent state: restarted diff --git a/roles/kea_dhcp/meta/argument_specs.yaml b/roles/kea_dhcp/meta/argument_specs.yaml index 4d0d594f..13339ff3 100644 --- a/roles/kea_dhcp/meta/argument_specs.yaml +++ b/roles/kea_dhcp/meta/argument_specs.yaml @@ -3,9 +3,11 @@ argument_specs: main: short_description: "Role for managing Kea DHCP server" options: - kea_dhcp__stork_agent: + kea_dhcp__stork_agent_defaults: type: "dict" - description: "Configuration for Stork Agent" + description: + - "Default configuration for Stork Agent." + - "Merged with kea_dhcp__stork_agent using combine(recursive=True)." options: enable: type: "bool" @@ -13,10 +15,39 @@ argument_specs: prometheus_only: type: "bool" default: true + kea_dhcp__stork_agent: + type: "dict" + description: + - "Host/group override for Stork Agent configuration." + - "Merged on top of kea_dhcp__stork_agent_defaults using combine(recursive=True)." + - "Only specify the keys you want to override." kea_dhcp__version_repo: type: "str" - description: "Version of Kea DHCP repository to use" + description: + - "Version of Kea DHCP repository to use." + - "The versions can be found at https://cloudsmith.io/~isc/repos/" default: "kea-3-0" + kea_dhcp__ntp_servers: + type: "dict" + description: "Default NTP servers advertised to DHCP clients (DHCPv4 option 42, DHCPv6 option 56)." + options: + v4: + type: "list" + elements: "str" + v6: + type: "str" + fqdn: + type: "str" + kea_dhcp__sntp_servers: + type: "dict" + description: "Default SNTP servers advertised to DHCPv6 clients (option 31)." + options: + v4: + type: "list" + elements: "str" + v6: + type: "list" + elements: "str" kea_dhcp__dns_servers: type: "dict" description: "Default DNS servers for DHCP clients" @@ -27,9 +58,48 @@ argument_specs: v4: type: "list" elements: "str" + kea_dhcp__dhcp4_defaults: + type: "dict" + description: + - "Default configuration for DHCPv4 service." + - "Merged with kea_dhcp__dhcp4 using combine(recursive=True)." + options: + enable: + type: "bool" + default: false + interfaces: + type: "list" + elements: "str" + default: [] + control-sockets: + type: "list" + elements: "dict" + lease-database: + type: "dict" + hooks-libraries: + type: "list" + elements: "dict" + option-data: + type: "list" + elements: "dict" + subnets: + type: "list" + elements: "dict" + logging: + type: "list" + elements: "dict" kea_dhcp__dhcp4: type: "dict" - description: "Configuration for DHCPv4 service" + description: + - "Host/group override for DHCPv4 configuration." + - "Merged on top of kea_dhcp__dhcp4_defaults using combine(recursive=True)." + - "Only specify the keys you want to override." + - "See kea_dhcp__dhcp4_defaults for available options." + kea_dhcp__dhcp6_defaults: + type: "dict" + description: + - "Default configuration for DHCPv6 service." + - "Merged with kea_dhcp__dhcp6 using combine(recursive=True)." options: enable: type: "bool" @@ -37,89 +107,28 @@ argument_specs: interfaces: type: "list" elements: "str" - default: [ ] + default: [] control-sockets: type: "list" elements: "dict" lease-database: type: "dict" + hooks-libraries: + type: "list" + elements: "dict" option-data: type: "list" elements: "dict" subnets: type: "list" elements: "dict" - options: - id: - type: "int" - subnet: - type: "str" - pools: - type: "list" - elements: "dict" - options: - pool: - type: "str" - reservations: - type: "list" - elements: "dict" - options: - ip-address: - type: "str" - hostname: - type: "str" - hw-address: - type: "str" - duid: - type: "str" - option-data: - type: "list" - elements: "dict" + logging: + type: "list" + elements: "dict" kea_dhcp__dhcp6: type: "dict" - description: "Configuration for DHCPv6 service" - options: - enable: - type: "bool" - default: false - interfaces: - type: "list" - elements: "str" - default: [ ] - control-sockets: - type: "list" - elements: "dict" - lease-database: - type: "dict" - option-data: - type: "list" - elements: "dict" - subnets: - type: "list" - elements: "dict" - options: - id: - type: "int" - subnet: - type: "str" - pools: - type: "list" - elements: "dict" - options: - pool: - type: "str" - reservations: - type: "list" - elements: "dict" - options: - ip-address: - type: "str" - hostname: - type: "str" - hw-address: - type: "str" - duid: - type: "str" - option-data: - type: "list" - elements: "dict" + description: + - "Host/group override for DHCPv6 configuration." + - "Merged on top of kea_dhcp__dhcp6_defaults using combine(recursive=True)." + - "Only specify the keys you want to override." + - "See kea_dhcp__dhcp6_defaults for available options." diff --git a/roles/kea_dhcp/tasks/install_debian.yaml b/roles/kea_dhcp/tasks/install_debian.yaml new file mode 100644 index 00000000..233546d8 --- /dev/null +++ b/roles/kea_dhcp/tasks/install_debian.yaml @@ -0,0 +1,21 @@ +--- +- name: Register isc-kea apt repository + become: true + register: kea_dhcp__repo + ansible.builtin.deb822_repository: + name: "isc-{{ kea_dhcp__version_repo }}" + uris: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/deb/debian" + suites: "{{ ansible_facts['distribution_release'] }}" + components: main + signed_by: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/gpg.key" + +- name: Install Kea packages + become: true + ansible.builtin.apt: + name: + - isc-kea-dhcp4 + - isc-kea-dhcp6 + - isc-kea-hooks + - isc-kea-ctrl-agent + - isc-kea-admin + update_cache: "{{ kea_dhcp__repo.changed }}" diff --git a/roles/kea_dhcp/tasks/install_debian.yml b/roles/kea_dhcp/tasks/install_debian.yml deleted file mode 100644 index f897ddbd..00000000 --- a/roles/kea_dhcp/tasks/install_debian.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- -- name: Install Kea packages - become: true - when: ansible_facts['distribution'] == "Debian" - block: - - name: Install Kea dhcp4 - when: kea_dhcp__dhcp4.enable - ansible.builtin.apt: - name: - - isc-kea-dhcp4 - - name: Install Kea dhcp6 - when: kea_dhcp__dhcp6.enable - ansible.builtin.apt: - name: - - isc-kea-dhcp6 - - name: Install Kea ctrl agent - when: kea_dhcp__stork_agent.enable - ansible.builtin.apt: - name: - - isc-kea-ctrl-agent - - name: Install Kea admin - when: kea_dhcp__stork_agent.enable - ansible.builtin.apt: - name: - - isc-kea-admin diff --git a/roles/kea_dhcp/tasks/kea.yaml b/roles/kea_dhcp/tasks/kea.yaml index 0d2c5e39..d068b6f5 100644 --- a/roles/kea_dhcp/tasks/kea.yaml +++ b/roles/kea_dhcp/tasks/kea.yaml @@ -1,20 +1,15 @@ --- -- name: Include config vars - when: kea_dhcp__include_vars != None - ansible.builtin.include_vars: - file: "{{ kea_dhcp__include_vars }}" - - name: Deploy kea-dhcp4 configuration file become: true when: kea_dhcp__dhcp4.enable ansible.builtin.template: - src: kea-dhcp4.conf.jinja + src: kea-dhcp4.conf.j2 dest: /etc/kea/kea-dhcp4.conf backup: true owner: root - group: kea + group: "{{ kea_dhcp__service_group }}" mode: "u=rw,g=r,o=" - validate: kea-dhcp4 -T %s + validate: "/usr/sbin/kea-dhcp4 -T %s" # does not work with debian apparmor policys notify: - Kea_dhcp4.restarted @@ -22,13 +17,13 @@ become: true when: kea_dhcp__dhcp6.enable ansible.builtin.template: - src: kea-dhcp6.conf.jinja + src: kea-dhcp6.conf.j2 dest: /etc/kea/kea-dhcp6.conf backup: true owner: root - group: kea + group: "{{ kea_dhcp__service_group }}" mode: "u=rw,g=r,o=" - validate: kea-dhcp6 -T %s + validate: /usr/sbin/kea-dhcp6 -T %s # does not work with debian apparmor policys notify: - Kea_dhcp6.restarted @@ -39,9 +34,9 @@ src: kea-ctrl-agent.conf.j2 dest: /etc/kea/kea-ctrl-agent.conf owner: root - group: kea + group: "{{ kea_dhcp__service_group }}" mode: "u=rw,g=r,o=" - validate: kea-ctrl-agent -t %s + validate: /usr/sbin/kea-ctrl-agent -t %s # does not work with debian apparmor policys notify: - Kea_ctrl.restarted - Stork_agent.restarted diff --git a/roles/kea_dhcp/tasks/main.yml b/roles/kea_dhcp/tasks/main.yml index 6fced088..8150672b 100644 --- a/roles/kea_dhcp/tasks/main.yml +++ b/roles/kea_dhcp/tasks/main.yml @@ -1,9 +1,20 @@ --- +- name: Include config vars + when: kea_dhcp__include_vars != None + ansible.builtin.include_vars: + file: "{{ kea_dhcp__include_vars }}" + +- name: Merge default vars with host_vars + ansible.builtin.set_fact: + kea_dhcp__stork_agent: "{{ kea_dhcp__stork_agent_defaults | combine(kea_dhcp__stork_agent, recursive=True) }}" + kea_dhcp__dhcp4: "{{ kea_dhcp__dhcp4_defaults | combine(kea_dhcp__dhcp4, recursive=True) }}" + kea_dhcp__dhcp6: "{{ kea_dhcp__dhcp6_defaults | combine(kea_dhcp__dhcp6, recursive=True) }}" + - name: Setup Kea DHCP block: - name: Install Kea on Debian when: ansible_facts['distribution'] == "Debian" - ansible.builtin.import_tasks: install_debian.yml + ansible.builtin.import_tasks: install_debian.yaml - name: Configure Kea ansible.builtin.include_tasks: kea.yaml diff --git a/roles/kea_dhcp/tasks/stork-agent.yaml b/roles/kea_dhcp/tasks/stork-agent.yaml index 0e777d42..9e65e9e4 100644 --- a/roles/kea_dhcp/tasks/stork-agent.yaml +++ b/roles/kea_dhcp/tasks/stork-agent.yaml @@ -1,26 +1,39 @@ --- - name: Install stork-agent block: - - name: Install isc-stork-agent + - name: Install stork-agent on Debian when: ansible_facts['distribution'] == "Debian" - become: true - ansible.builtin.apt: - name: isc-stork-agent + block: + - name: Register isc-stork apt repository + become: true + register: "kea_dhcp_install_repo" + ansible.builtin.deb822_repository: + name: isc-stork + uris: https://dl.cloudsmith.io/public/isc/stork/deb/debian + suites: any-version + components: main + signed_by: https://dl.cloudsmith.io/public/isc/stork/gpg.key - - name: Add stork-agent user to _kea group on Debian + - name: Install isc-stork-agent + become: true + ansible.builtin.apt: + name: isc-stork-agent + update_cache: "{{ kea_dhcp_install_repo.changed }}" + + - name: Add stork-agent user to kea group on Debian when: ansible_facts['distribution'] == "Debian" become: true ansible.builtin.user: name: stork-agent - groups: [ "_kea" ] + groups: [ "{{ kea_dhcp__service_group }}" ] append: true - name: Config for stork-agent ansible.builtin.template: - src: stork-agent.env.jinja + src: stork-agent.env.j2 dest: /etc/stork/agent.env owner: root - group: root + group: "{{ kea_dhcp__service_group }}" mode: "0660" notify: - Systemd_daemon_reload diff --git a/roles/kea_dhcp/templates/kea-dhcp4.conf.j2 b/roles/kea_dhcp/templates/kea-dhcp4.conf.j2 new file mode 100644 index 00000000..7a5d9251 --- /dev/null +++ b/roles/kea_dhcp/templates/kea-dhcp4.conf.j2 @@ -0,0 +1,32 @@ +{ + "Dhcp4": { + "interfaces-config": { + "interfaces": {{ kea_dhcp__dhcp4.interfaces | to_nice_json | indent(12) }} + }, + "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json | indent(8) }}, + "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json | indent(8) }}, +{% if kea_dhcp__dhcp4['hooks-libraries'] is defined and kea_dhcp__dhcp4['hooks-libraries'] %} + "hooks-libraries": {{ kea_dhcp__dhcp4['hooks-libraries'] | to_nice_json | indent(8) }}, +{% endif %} +{% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %} + "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json | indent(8) }}, +{% endif %} + "loggers": {{ kea_dhcp__dhcp4['logging'] | to_nice_json | indent(8) }}, + "subnet4": [ +{% for subnet in kea_dhcp__dhcp4.subnets %} + { + "id": {{ subnet.id }}, + "subnet": "{{ subnet.subnet }}", + "pools": {{ subnet.pools | to_nice_json | indent(16) }}, +{% if subnet.reservations is defined and subnet.reservations %} + "reservations": {{ subnet.reservations | to_nice_json | indent(16) }}, +{% endif %} +{% if subnet['option-data'] is defined and subnet['option-data'] %} + "option-data": {{ subnet['option-data'] | to_nice_json | indent(16) }} +{% endif %} + }{% if not loop.last %},{% endif %} + +{% endfor %} + ] + } +} diff --git a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja deleted file mode 100644 index fa7cfd56..00000000 --- a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja +++ /dev/null @@ -1,27 +0,0 @@ -{ - "Dhcp4": { - "interfaces-config": { - "interfaces": {{ kea_dhcp__dhcp4.interfaces | to_nice_json }} - }, - "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json }}, - "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json }}, - {% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %} - "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json }}, - {% endif %} - "subnet4": [ - {% for subnet in kea_dhcp__dhcp4.subnets %} - { - "id": {{ subnet.id }}, - "subnet": "{{ subnet.subnet }}", - "pools": {{ subnet.pools | to_nice_json }}, - {% if subnet.reservations is defined and subnet.reservations %} - "reservations": {{ subnet.reservations | to_nice_json }}, - {% endif %} - {% if subnet['option-data'] is defined and subnet['option-data'] %} - "option-data": {{ subnet['option-data'] | to_nice_json }} - {% endif %} - }{% if not loop.last %},{% endif %} - {% endfor %} - ] - } -} diff --git a/roles/kea_dhcp/templates/kea-dhcp6.conf.j2 b/roles/kea_dhcp/templates/kea-dhcp6.conf.j2 new file mode 100644 index 00000000..8ad701b2 --- /dev/null +++ b/roles/kea_dhcp/templates/kea-dhcp6.conf.j2 @@ -0,0 +1,36 @@ +{ + "Dhcp6": { + "interfaces-config": { + "interfaces": {{ kea_dhcp__dhcp6.interfaces | to_nice_json | indent(12) }} + }, + "control-sockets": {{ kea_dhcp__dhcp6['control-sockets'] | to_nice_json | indent(8) }}, + "lease-database": {{ kea_dhcp__dhcp6['lease-database'] | to_nice_json | indent(8) }}, +{% if kea_dhcp__dhcp6['hooks-libraries'] is defined and kea_dhcp__dhcp6['hooks-libraries'] %} + "hooks-libraries": {{ kea_dhcp__dhcp6['hooks-libraries'] | to_nice_json | indent(8) }}, +{% endif %} +{% if kea_dhcp__dhcp6['option-data'] is defined and kea_dhcp__dhcp6['option-data'] %} + "option-data": {{ kea_dhcp__dhcp6['option-data'] | to_nice_json | indent(8) }}, +{% endif %} + "loggers": {{ kea_dhcp__dhcp6['logging'] | to_nice_json | indent(8) }}{% if kea_dhcp__dhcp6.subnets is defined and kea_dhcp__dhcp6.subnets %},{% endif %} +{% if kea_dhcp__dhcp6.subnets is defined and kea_dhcp__dhcp6.subnets %} + "subnet6": [ +{% for subnet in kea_dhcp__dhcp6.subnets %} + { + "id": {{ subnet.id }}, + "subnet": "{{ subnet.subnet }}", + "interface": "{{ subnet.interface }}", + "allocator": "{{ subnet.allocator | default("iterative") }}", + "pools": {{ subnet.pools | to_nice_json | indent(16) }}, +{% if subnet.reservations is defined and subnet.reservations %} + "reservations": {{ subnet.reservations | to_nice_json | indent(16) }}, +{% endif %} +{% if subnet['option-data'] is defined and subnet['option-data'] %} + "option-data": {{ subnet['option-data'] | to_nice_json | indent(16) }} +{% endif %} + }{% if not loop.last %},{% endif %} + +{% endfor %} + ] +{% endif %} + } +} diff --git a/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja b/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja deleted file mode 100644 index da1929a5..00000000 --- a/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja +++ /dev/null @@ -1,27 +0,0 @@ -{ - "Dhcp6": { - "interfaces-config": { - "interfaces": {{ kea_dhcp__dhcp6.interfaces | to_nice_json }} - }, - "control-sockets": {{ kea_dhcp__dhcp6['control-sockets'] | to_nice_json }}, - "lease-database": {{ kea_dhcp__dhcp6['lease-database'] | to_nice_json }}, - {% if kea_dhcp__dhcp6['option-data'] is defined and kea_dhcp__dhcp6['option-data'] %} - "option-data": {{ kea_dhcp__dhcp6['option-data'] | to_nice_json }}, - {% endif %} - "subnet6": [ - {% for subnet in kea_dhcp__dhcp6.subnets %} - { - "id": {{ subnet.id }}, - "subnet": "{{ subnet.subnet }}", - "pools": {{ subnet.pools | to_nice_json }}, - {% if subnet.reservations is defined and subnet.reservations %} - "reservations": {{ subnet.reservations | to_nice_json }}, - {% endif %} - {% if subnet['option-data'] is defined and subnet['option-data'] %} - "option-data": {{ subnet['option-data'] | to_nice_json }} - {% endif %} - }{% if not loop.last %},{% endif %} - {% endfor %} - ] - } -} diff --git a/roles/kea_dhcp/templates/stork-agent.env.j2 b/roles/kea_dhcp/templates/stork-agent.env.j2 new file mode 100644 index 00000000..bdfa4d2d --- /dev/null +++ b/roles/kea_dhcp/templates/stork-agent.env.j2 @@ -0,0 +1,44 @@ +### the IP or hostname to listen on for incoming Stork server connections +# STORK_AGENT_HOST= + +### the TCP port to listen on for incoming Stork server connections +# STORK_AGENT_PORT=8081 + +### listen for commands from the Stork server only, but not for Prometheus requests +# STORK_AGENT_LISTEN_STORK_ONLY=true + +{% if kea_dhcp__stork_agent.prometheus_only %} +### listen for Prometheus requests only, but not for commands from the Stork server +STORK_AGENT_LISTEN_PROMETHEUS_ONLY=true +{% endif %} + +### settings for exporting stats to Prometheus +### the IP or hostname on which the agent exports Kea statistics to Prometheus +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS= +### the port on which the agent exports Kea statistics to Prometheus +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT= +## enable or disable collecting per-subnet stats from Kea +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PER_SUBNET_STATS=true +### the IP or hostname on which the agent exports BIND 9 statistics to Prometheus +# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_ADDRESS= +### the port on which the agent exports BIND 9 statistics to Prometheus +# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_PORT= + +### Stork Server URL used by the agent to send REST commands to the server during agent registration +# STORK_AGENT_SERVER_URL= + +### skip TLS certificate verification when the Stork Agent connects +### to Kea over TLS and Kea uses self-signed certificates +# STORK_AGENT_SKIP_TLS_CERT_VERIFICATION=true + + +### Logging parameters + +### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR +STORK_LOG_LEVEL=DEBUG +### disable output colorization +# CLICOLOR=false + +### path to the hook directory +# STORK_AGENT_HOOK_DIRECTORY= + diff --git a/roles/kea_dhcp/templates/stork-agent.env.jinja b/roles/kea_dhcp/templates/stork-agent.env.jinja deleted file mode 100644 index 75250b06..00000000 --- a/roles/kea_dhcp/templates/stork-agent.env.jinja +++ /dev/null @@ -1,20 +0,0 @@ -### Stork Agent env file -### (created and managed by ansible kea_dhcp role) - - -{% if kea_dhcp__stork_agent.prometheus_only %} -### listen for Prometheus requests only, but not for commands from the Stork server -STORK_AGENT_LISTEN_PROMETHEUS_ONLY=true -{% endif %} - -### settings for exporting stats to Prometheus -### the IP or hostname on which the agent exports Kea statistics to Prometheus -STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS=localhost -### the port on which the agent exports Kea statistics to Prometheus -# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT= - -### Logging parameters - -### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR -STORK_LOG_LEVEL=DEBUG - From 32caa40f77483bcfe3b78c651a083f6f35199922 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 31 Jul 2026 17:59:35 +0200 Subject: [PATCH 28/51] unbound(role): fix some unbound setup stuff --- roles/unbound/handlers/main.yml | 5 +++++ roles/unbound/tasks/main.yml | 3 +++ 2 files changed, 8 insertions(+) diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml index 09af6995..72d71734 100644 --- a/roles/unbound/handlers/main.yml +++ b/roles/unbound/handlers/main.yml @@ -16,3 +16,8 @@ name: prometheus-unbound-exporter.service state: restarted enabled: true + +- name: systemd-daemon-reload + become: true + ansible.builtin.systemd_service: + daemon_reload: true diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index 69b712f6..d83e95a3 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -40,6 +40,9 @@ deploy_systemd_resolved_config__dns: - 127.0.0.1 + - name: flush handlers + ansible.builtin.meta: flush_handlers + - name: ensure unbound is running and enabled become: true ansible.builtin.systemd: From 58ea3ef7a39cf09df3016baf7cd07e061f94a7ef Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 31 Jul 2026 18:07:35 +0200 Subject: [PATCH 29/51] z9-router(host): update host kea config - edit config to work with update kea role - fix ipv6 addresses --- resources/z9/z9-router/kea_dhcp.yaml | 102 ++++++++++++--------------- 1 file changed, 47 insertions(+), 55 deletions(-) diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index 8b9b9fb5..5859b65b 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -7,20 +7,14 @@ kea_dhcp__dns_servers: kea_dhcp__dhcp4: enable: true interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] - control-sockets: - - socket-name: /var/run/kea-dhcp4-ctrl-agent.sock - socket-type: unix - lease-database: - type: memfile - persist: true - option-data: - - name: "domain-name-servers" - code: 6 - csv-format: true - data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}" subnets: - id: 1 subnet: 10.89.208.0/22 + option-data: + - name: domain-name-servers + data: "10.89.208.1" + - name: routers + data: 10.89.208.1 pools: - pool: "10.89.208.32 - 10.89.211.250" reservations: @@ -64,12 +58,13 @@ kea_dhcp__dhcp4: - ip-address: 10.89.209.254 hostname: ki10 hw-address: "dc:a6:32:a9:ff:82" - option-data: - - name: routers, - csv-format: true - data: 10.89.208.1 - id: 2 subnet: 10.89.212.0/24 + option-data: + - name: domain-name-servers + data: "10.89.212.1" + - name: routers + data: 10.89.212.1 pools: - pool: "10.89.212.32 - 10.89.212.250" reservations: @@ -157,14 +152,13 @@ kea_dhcp__dhcp4: - ip-address: 10.89.212.235 hostname: okilaser hw-address: "2c:ff:65:22:b4:63" - - ip-address: 10.89.212.236 - hw-address: "b8:27:eb:29:bd:77" - option-data: - - name: routers, - csv-format: true - data: 10.89.212.1 - id: 3 subnet: 10.89.213.0/24 + option-data: + - name: domain-name-servers + data: "10.89.213.1" + - name: routers + data: 10.89.213.1 pools: - pool: "10.89.213.32 - 10.89.213.250" reservations: @@ -231,86 +225,84 @@ kea_dhcp__dhcp4: - ip-address: 10.89.213.30 hostname: proxmox-backup-server hw-address: "8a:48:dd:a3:22:40" - option-data: - - name: routers, - csv-format: true - data: 10.89.213.1 kea_dhcp__dhcp6: enable: true interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] - control-sockets: - - socket-name: /var/run/kea-dhcp6-ctrl-agent.sock - socket-type: unix - lease-database: - type: memfile - persist: true - option-data: - - name: "dns-servers" - code: 23 - csv-format: true - data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}" subnets: - id: 1 subnet: "2a07:c481:1:33::/64" + interface: "netlan.51" + option-data: + - name: "dns-servers" + data: "2a07:c481:1:33::1" pools: - - pool: "2a07:c481:1:33::1:1 - 2a07:c481:1:33::FFFF:FFFF" + - pool: "2a07:c481:1:33::/64" + allocator: random reservations: - - ip-address: "2a07:c481:1:33::1c" + - ip-addresses: ["2a07:c481:1:33::1c"] hostname: dooris hw-address: "bc:24:11:b3:93:9c" - id: 2 subnet: "2a07:c481:1:34::/64" + interface: "netlan.52" + option-data: + - name: "dns-servers" + data: "2a07:c481:1:34::1" pools: - - pool: "2a07:c481:1:34::1:1 - 2a07:c481:1:34::FFFF:FFFF" + - pool: "2a07:c481:1:34::/64" reservations: - - ip-address: "2a07:c481:1:34::66" + - ip-addresses: ["2a07:c481:1:34::66"] hostname: esphome hw-address: "7e:3c:f0:77:8a:f4" - id: 3 subnet: "2a07:c481:1:36::/64" + interface: "netlan.54" + option-data: + - name: "dns-servers" + data: "2a07:c481:1:36::1" pools: - - pool: "2a07:c481:1:36::1:1 - 2a07:c481:1:36::FFFF:FFFF" + - pool: "2a07:c481:1:36::/64" reservations: - - ip-address: "2a07:c481:1:36::2" + - ip-addresses: ["2a07:c481:1:36::2"] hostname: sw-rack-1 hw-address: "F0:9F:C2:10:C3:AA" - - ip-address: "2a07:c481:1:36::3" + - ip-addresses: ["2a07:c481:1:36::3"] hostname: sw-rack-2-peo hw-address: "44:d9:e7:06:69:5d" - - ip-address: "2a07:c481:1:36::4" + - ip-addresses: ["2a07:c481:1:36::4"] hostname: sw-main-1 hw-address: "a8:9c:6c:16:df:cc" - - ip-address: "2a07:c481:1:36::5" + - ip-addresses: ["2a07:c481:1:36::5"] hostname: sw-main-2 hw-address: "a8:9c:6c:16:e8:86" - - ip-address: "2a07:c481:1:36::6" + - ip-addresses: ["2a07:c481:1:36::6"] hostname: sw-shop-1 hw-address: "C0:4A:00:FB:DA:C5" - - ip-address: "2a07:c481:1:36::7" + - ip-addresses: ["2a07:c481:1:36::7"] hostname: sw-shop-2-peo hw-address: "f4:e2:c6:bf:20:ee" - - ip-address: "2a07:c481:1:36::8" + - ip-addresses: ["2a07:c481:1:36::8"] hostname: sw-shop-3-peo hw-address: "d8:b3:70:85:72:76" - - ip-address: "2a07:c481:1:36::b" + - ip-addresses: ["2a07:c481:1:36::b"] hostname: pve01 hw-address: "38:05:25:30:80:35" - - ip-address: "2a07:c481:1:36::c" + - ip-addresses: ["2a07:c481:1:36::c"] hostname: pve02 hw-address: "b8:85:84:b1:57:b6" - - ip-address: "2a07:c481:1:36::d" + - ip-addresses: ["2a07:c481:1:36::d"] hostname: pve03 hw-address: "98:fa:9b:a2:ed:e8" - - ip-address: "2a07:c481:1:36::f" + - ip-addresses: ["2a07:c481:1:36::f"] hostname: pbs hw-address: "BC:24:11:D6:2C:81" - - ip-address: "2a07:c481:1:36::21" + - ip-addresses: ["2a07:c481:1:36::21"] hostname: unifi hw-address: "BC:24:11:25:77:60" - - ip-address: "2a07:c481:1:36::31" + - ip-addresses: ["2a07:c481:1:36::31"] hostname: light hw-address: "72:61:ea:e6:49:e3" - - ip-address: "2a07:c481:1:36::32" + - ip-addresses: ["2a07:c481:1:36::32"] hostname: club-assistant hw-address: "7a:55:61:c3:a2:89" From b76fac2255db89b7ebd28acb559659454e6f6bf3 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 31 Jul 2026 18:10:34 +0200 Subject: [PATCH 30/51] general: update gitignore --- .gitignore | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 70dd5766..8bcf2f51 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ .ansible/ -**/__pycache__ \ No newline at end of file +**/__pycache__ +**/.DS_store + From ffb88164ee3b07b15d66103e7d7a147b9836787c Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 1 Aug 2026 23:30:36 +0200 Subject: [PATCH 31/51] z9-router(host): change vlan 54 to 55 and remove netwan move vlan 400 to netlan --- resources/z9/z9-router/kea_dhcp.yaml | 4 +-- resources/z9/z9-router/nftables/nftables.conf | 18 ++++++------- .../z9-router/systemd_networkd/00-netwan.link | 6 ----- ...0-netlan.54.netdev => 10-netlan.55.netdev} | 4 +-- .../{10-wg55.netdev => 10-wg56.netdev} | 2 +- .../systemd_networkd/20-netlan.network | 27 ++++++++++++++++--- .../systemd_networkd/20-netwan.network | 13 --------- .../{20-wg55.network => 20-wg56.network} | 2 +- ...etwork => 21-netlan.55-management.network} | 2 +- 9 files changed, 40 insertions(+), 38 deletions(-) delete mode 100644 resources/z9/z9-router/systemd_networkd/00-netwan.link rename resources/z9/z9-router/systemd_networkd/{10-netlan.54.netdev => 10-netlan.55.netdev} (73%) rename resources/z9/z9-router/systemd_networkd/{10-wg55.netdev => 10-wg56.netdev} (99%) delete mode 100644 resources/z9/z9-router/systemd_networkd/20-netwan.network rename resources/z9/z9-router/systemd_networkd/{20-wg55.network => 20-wg56.network} (87%) rename resources/z9/z9-router/systemd_networkd/{21-netlan.54-management.network => 21-netlan.55-management.network} (95%) diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index 5859b65b..4f7ea31f 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -6,7 +6,7 @@ kea_dhcp__dns_servers: kea_dhcp__dhcp4: enable: true - interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] + interfaces: ["netlan.51", "netlan.52", "netlan"] subnets: - id: 1 subnet: 10.89.208.0/22 @@ -228,7 +228,7 @@ kea_dhcp__dhcp4: kea_dhcp__dhcp6: enable: true - interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] + interfaces: ["netlan.51", "netlan.52", "netlan"] subnets: - id: 1 subnet: "2a07:c481:1:33::/64" diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf index 88534127..e59e5bda 100644 --- a/resources/z9/z9-router/nftables/nftables.conf +++ b/resources/z9/z9-router/nftables/nftables.conf @@ -6,26 +6,26 @@ # Interfaces -define if_netwan = "netwan" +#define if_netwan = "netwan" define if_netlan = "netlan" -define if_wg55_management = "wg55" +define if_wg56_management = "wg56" define if_netwan_400_fux_uplink = "netwan.400" define if_netlan_51_clients = "netlan.51" define if_netlan_52_iot = "netlan.52" define if_netlan_53_public = "netlan.53" -define if_netlan_54_management = "netlan.54" +define if_netlan_55_management = "netlan" # Interface Groups define wan_ifs = { $if_netwan_400_fux_uplink } define lan_ifs = { $if_netlan_51_clients, $if_netlan_52_iot, $if_netlan_53_public, - $if_netlan_54_management } + $if_netlan_55_management } define v4_exposed_ifs = { $if_netlan_53_public } define v6_exposed_ifs = { $if_netlan_53_public } define v4_nat_ifs = { $if_netlan_51_clients, $if_netlan_52_iot, - $if_netlan_54_management } + $if_netlan_55_management } ## Rules @@ -79,7 +79,7 @@ table inet host { iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access" # Allow DNS server access from lan_ifs - iifname { $lan_ifs, $if_wg55_management } udp dport 53 accept comment "allow dns server access from lan_ifs" + iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs" } } @@ -91,7 +91,7 @@ table ip v4nat { chain postrouting { type nat hook postrouting priority srcnat; policy accept; - iifname { $v4_nat_ifs, $if_wg55_management } oifname $wan_ifs masquerade + iifname { $v4_nat_ifs, $if_wg56_management } oifname $wan_ifs masquerade } } @@ -103,13 +103,13 @@ table inet forward { ct state established,related accept # Allow internet access. - iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access" + iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access" # Allow access to exposed networks from internet. meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access" meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access" # Allow clients and management to most - iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces" + iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces" } } diff --git a/resources/z9/z9-router/systemd_networkd/00-netwan.link b/resources/z9/z9-router/systemd_networkd/00-netwan.link deleted file mode 100644 index 523e18a9..00000000 --- a/resources/z9/z9-router/systemd_networkd/00-netwan.link +++ /dev/null @@ -1,6 +0,0 @@ -[Match] -MACAddress=BC:24:11:CF:65:57 -Type=ether - -[Link] -Name=netwan diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev similarity index 73% rename from resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev index 4ea5ec6a..74bd182d 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev @@ -1,8 +1,8 @@ [NetDev] -Name=netlan.54 +Name=netlan.55 Kind=vlan MACAddress=BC:24:11:D2:65:B4 [VLAN] -Id=54 +Id=55 diff --git a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev b/resources/z9/z9-router/systemd_networkd/10-wg56.netdev similarity index 99% rename from resources/z9/z9-router/systemd_networkd/10-wg55.netdev rename to resources/z9/z9-router/systemd_networkd/10-wg56.netdev index f2de509a..70966e22 100644 --- a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-wg56.netdev @@ -1,7 +1,7 @@ [NetDev] Description=Admin-Wireguard Kind=wireguard -Name=wg55 +Name=wg56 [WireGuard] ListenPort=51820 diff --git a/resources/z9/z9-router/systemd_networkd/20-netlan.network b/resources/z9/z9-router/systemd_networkd/20-netlan.network index 7fab501b..75767b56 100644 --- a/resources/z9/z9-router/systemd_networkd/20-netlan.network +++ b/resources/z9/z9-router/systemd_networkd/20-netlan.network @@ -5,12 +5,33 @@ Name=netlan RequiredForOnline=no [Network] -LinkLocalAddressing=no +#LinkLocalAddressing=no DHCP=no -IPv6AcceptRA=no +#IPv6AcceptRA=no VLAN=netlan.51 VLAN=netlan.52 VLAN=netlan.53 -VLAN=netlan.54 +#VLAN=netlan.55 +VLAN=netwan.400 + +#Description=Management + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=10.89.213.1/24 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:36::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/z9-router/systemd_networkd/20-netwan.network b/resources/z9/z9-router/systemd_networkd/20-netwan.network deleted file mode 100644 index b42b95ab..00000000 --- a/resources/z9/z9-router/systemd_networkd/20-netwan.network +++ /dev/null @@ -1,13 +0,0 @@ -[Match] -Name=netwan - -[Link] -RequiredForOnline=no - -[Network] -LinkLocalAddressing=no -DHCP=no -IPv6AcceptRA=no - -VLAN=netwan.400 - diff --git a/resources/z9/z9-router/systemd_networkd/20-wg55.network b/resources/z9/z9-router/systemd_networkd/20-wg56.network similarity index 87% rename from resources/z9/z9-router/systemd_networkd/20-wg55.network rename to resources/z9/z9-router/systemd_networkd/20-wg56.network index 750e8445..6c56251b 100644 --- a/resources/z9/z9-router/systemd_networkd/20-wg55.network +++ b/resources/z9/z9-router/systemd_networkd/20-wg56.network @@ -1,5 +1,5 @@ [Match] -Name=wg55 +Name=wg56 [Network] Address=10.89.214.1/24 diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network b/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network similarity index 95% rename from resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network index e1bf0c8a..1e8086a1 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network +++ b/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network @@ -1,5 +1,5 @@ [Match] -Name=netlan.54 +Name=netlan.55 Type=vlan [Link] From 8043198569c9c7da853acdd4f4392868527bf508 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 1 Aug 2026 23:31:06 +0200 Subject: [PATCH 32/51] z9-router(host): add dhcp and dns for dooris-legacy --- resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 2 ++ resources/z9/z9-router/kea_dhcp.yaml | 3 +++ 2 files changed, 5 insertions(+) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index 91519200..7e7099b6 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -101,6 +101,8 @@ dooris A 10.89.208.16 AAAA 2a07:c481:1:33::1c _acme-challenge.dooris CNAME 37caae1f-b77f-4eb1-aa71-dc3f7ed24360.auth.acmedns.hamburg.ccc.de. +dooris-legacy A 10.89.208.31 + hmdooris-ccu A 10.89.208.17 dooris-ng A 10.89.209.29 diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index 4f7ea31f..1970c3ef 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -49,6 +49,9 @@ kea_dhcp__dhcp4: - ip-address: 10.89.209.28 hostname: hp-color hw-address: "3c:52:82:29:21:79" + - ip-address: 10.89.208.31 + hostname: dooris-legacy + hw-address: "b8:27:eb:80:a5:66" - ip-address: 10.89.209.29 hostname: dooris-ng hw-address: "6c:4b:90:19:21:a1" From 1452c85b9d95722ad841cd72d203274634b55f33 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 1 Aug 2026 23:58:27 +0200 Subject: [PATCH 33/51] z9-router(host): change mac address of yate in dhcp --- resources/z9/z9-router/kea_dhcp.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index 1970c3ef..a54b9962 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -209,7 +209,7 @@ kea_dhcp__dhcp4: hw-address: "f2:20:75:5a:2f:8c" - ip-address: 10.89.213.24 hostname: yate - hw-address: "bc:24:11:73:3e:f7" + hw-address: "bc:24:11:bf:8f:95" - ip-address: 10.89.213.25 hostname: ptouch-print-server hw-address: "bc:24:11:f2:cf:8f" From 49f07b087202c7088cdc1d05d83031fb23d1ee7c Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 2 Aug 2026 00:03:07 +0200 Subject: [PATCH 34/51] z9-router(host): move yate from vlan 55 to 52 --- resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 2 +- resources/z9/z9-router/kea_dhcp.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index 7e7099b6..6083fb02 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -110,7 +110,7 @@ dooris-ng A 10.89.209.29 buba A 10.89.212.137 -yate A 10.89.213.24 +yate A 10.89.212.25 muzak A 10.89.208.13 diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index a54b9962..67a5ce03 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -89,6 +89,9 @@ kea_dhcp__dhcp4: - ip-address: 10.89.212.24 hostname: foobackup hw-address: "bc:24:11:20:1a:a8" + - ip-address: 10.89.212.25 + hostname: yate + hw-address: "bc:24:11:bf:8f:95" - ip-address: 10.89.212.27 hostname: ender3v2-sonic-pad hw-address: "fc:ee:91:00:0e:14" @@ -207,9 +210,6 @@ kea_dhcp__dhcp4: - ip-address: 10.89.213.23 hostname: automation hw-address: "f2:20:75:5a:2f:8c" - - ip-address: 10.89.213.24 - hostname: yate - hw-address: "bc:24:11:bf:8f:95" - ip-address: 10.89.213.25 hostname: ptouch-print-server hw-address: "bc:24:11:f2:cf:8f" From 14b54797ec4b245650568412b9ff457e5f0a3736 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 2 Aug 2026 02:35:23 +0200 Subject: [PATCH 35/51] README.md: correct sentence --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 62c785c7..a9ab72b3 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Folgende Geräte und Server werden duch dieses Ansible Repository verwaltet: -* Diverse VMs auf dem z9 (PVE Cluster) +* Diverse VMs im z9 (PVE Cluster) * Diverse VMs auf dem Chaosknoten Host-spezifische Konfigurationsdateien liegen unter `resources/` und werden für jeweils über eine `host_vars`-Datei im Inventory geladen. From c2130adbb57d6fc51aa83f7b611dd2e90785ab49 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 2 Aug 2026 16:43:12 +0200 Subject: [PATCH 36/51] auth-dns(host): remove unused unfi ipv6 and specify comments --- resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index 6083fb02..db63fdd8 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -43,11 +43,10 @@ pve04 A 10.89.213.14 pbs A 10.89.213.15 AAAA 2a07:c481:1:36::15 unifi A 10.89.213.21 -; AAAA 2a07:c481:1:36::21 ; -; Club-Services +; Internal Club-Services ; xr18 A 10.89.208.15 AtemMini A 10.89.212.234 From 82760d2bc2d04f3a24efe8a294906b735ee05b48 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 2 Aug 2026 16:45:50 +0200 Subject: [PATCH 37/51] light(host): remove resolver from nginx conf --- resources/z9/light/nginx/light.conf | 6 ------ 1 file changed, 6 deletions(-) diff --git a/resources/z9/light/nginx/light.conf b/resources/z9/light/nginx/light.conf index 18e2a41e..7c10e96e 100644 --- a/resources/z9/light/nginx/light.conf +++ b/resources/z9/light/nginx/light.conf @@ -12,9 +12,6 @@ server { # verify chain of trust of OCSP response using Root CA and Intermediate certs ssl_trusted_certificate /etc/letsencrypt/live/light-werkstatt.ccchh.net/chain.pem; - # replace with the IP address of your resolver - #resolver 10.31.208.1; # is this needed? - location / { proxy_pass http://127.0.0.1:8081; proxy_set_header Host $host; @@ -37,9 +34,6 @@ server { # verify chain of trust of OCSP response using Root CA and Intermediate certs ssl_trusted_certificate /etc/letsencrypt/live/light.ccchh.net/chain.pem; - # replace with the IP address of your resolver - #resolver 10.31.208.1; # is this needed? - location / { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; From 7eabd88e2c4cd707396e4c7ad1ed28b5eb1fd686 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 22:27:48 +0200 Subject: [PATCH 38/51] unbound(role): update readme and move task block to top level and remove unused --- roles/unbound/README.md | 26 +++--- roles/unbound/files/no-resolved.resolv.conf | 1 - roles/unbound/handlers/main.yml | 6 -- roles/unbound/tasks/main.yml | 93 ++++++++++----------- 4 files changed, 61 insertions(+), 65 deletions(-) delete mode 100644 roles/unbound/files/no-resolved.resolv.conf diff --git a/roles/unbound/README.md b/roles/unbound/README.md index c44805ba..6043e749 100644 --- a/roles/unbound/README.md +++ b/roles/unbound/README.md @@ -1,6 +1,6 @@ # Unbound DNS resolver -Role fora a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/). +Role for a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/). It is designed to be fast and lean and incorporates modern features based on open standards. - [Documentation](https://unbound.docs.nlnetlabs.nl/en/latest/) @@ -9,12 +9,18 @@ It is designed to be fast and lean and incorporates modern features based on ope The following variables can be used to customize this role: -| Variable | Type | Default | Description | -|------------------------------------------|-----------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| unbound_install_prometheus_exporter | Boolean | `true` | Whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format. | -| unbound_bind_interfaces | List of Strings | `[0.0.0.0, ::]` | List of interface names or IP addresses on which unbound will listen for dns queries | -| unbound_enable_unbound_control | Boolean | `true` | Whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured. | -| unbound_enable_dnssec | Boolean | `true` | Whether dnssec validation should be enabled | -| unbound_access_control | List of Strings | `[]` | **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E) | -| unbound_disable_systemd_networkd | Boolean | `true` | If true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. | -| unbound_thread_count | Integer | Max vCPU Count | The number of threads unbound uses | +- `unbound_install_prometheus_exporter`: Boolean of whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format. + Defaults to `true`. +- `unbound_bind_interfaces`: List of interface names or IP addresseson which unbound will listen for dns queries. + Defaults to `[0.0.0.0, ::]`. +- `unbound_enable_unbound_control`: Boolean of whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured. + Defaults to `true`. +- `unbound_enable_dnssec`: Boolean of whether dnssec validation should be enabled. + Defaults to `true`. +- `unbound_access_control`: **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E). + Defaults to `[]`. +- `unbound_disable_systemd_networkd`: Boolean if true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. + Defaults to `true`. +- `unbound_thread_count`: The number of threads unbound uses. + Defaults to max vCPU Count. + diff --git a/roles/unbound/files/no-resolved.resolv.conf b/roles/unbound/files/no-resolved.resolv.conf deleted file mode 100644 index bbc8559c..00000000 --- a/roles/unbound/files/no-resolved.resolv.conf +++ /dev/null @@ -1 +0,0 @@ -nameserver 127.0.0.1 diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml index 72d71734..8104b4a0 100644 --- a/roles/unbound/handlers/main.yml +++ b/roles/unbound/handlers/main.yml @@ -4,12 +4,6 @@ name: unbound.service state: restarted -- name: unbound.reloaded - become: true - ansible.builtin.systemd: - name: unbound.service - state: reloaded - - name: prometheus-unbound-exporter.restarted become: true ansible.builtin.systemd: diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index d83e95a3..8f9275cf 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -1,55 +1,52 @@ -- name: unbound role main - block: +- name: install unbound dns resolver + become: true + ansible.builtin.package: + name: unbound - - name: install unbound dns resolver - become: true - ansible.builtin.package: - name: unbound +- name: install unbound-anchor + become: true + ansible.builtin.package: + name: unbound-anchor - - name: install unbound-anchor - become: true - ansible.builtin.package: - name: unbound-anchor +- name: ensure correct directory permissions + become: true + ansible.builtin.file: + path: /etc/unbound + state: directory + mode: u=rwX,g=rX,o=rX + recurse: true + owner: unbound + group: unbound - - name: ensure correct directory permissions - become: true - ansible.builtin.file: - path: /etc/unbound - state: directory - mode: u=rwX,g=rX,o=rX - recurse: true - owner: unbound - group: unbound +- name: configure unbound dns resolver + become: true + notify: unbound.restarted + ansible.builtin.template: + src: unbound.conf.j2 + dest: /etc/unbound/unbound.conf + owner: unbound + group: unbound + mode: u=rw,g=r,o=r - - name: configure unbound dns resolver - become: true - notify: unbound.restarted - ansible.builtin.template: - src: unbound.conf.j2 - dest: /etc/unbound/unbound.conf - owner: unbound - group: unbound - mode: u=rw,g=r,o=r +- name: disable systemd-resolved + when: unbound_disable_systemd_networkd + ansible.builtin.include_role: + name: deploy_systemd_resolved_config + vars: + deploy_systemd_resolved_config__enable: false + deploy_systemd_resolved_config__dns: + - 127.0.0.1 - - name: disable systemd-resolved - when: unbound_disable_systemd_networkd - ansible.builtin.include_role: - name: deploy_systemd_resolved_config - vars: - deploy_systemd_resolved_config__enable: false - deploy_systemd_resolved_config__dns: - - 127.0.0.1 +- name: flush handlers + ansible.builtin.meta: flush_handlers - - name: flush handlers - ansible.builtin.meta: flush_handlers +- name: ensure unbound is running and enabled + become: true + ansible.builtin.systemd: + name: unbound.service + state: started + enabled: true - - name: ensure unbound is running and enabled - become: true - ansible.builtin.systemd: - name: unbound.service - state: started - enabled: true - - - name: install and configure prometheus-exporter for unbound - ansible.builtin.import_tasks: prometheus-exporter.yml - when: unbound_install_prometheus_exporter +- name: install and configure prometheus-exporter for unbound + ansible.builtin.import_tasks: prometheus-exporter.yml + when: unbound_install_prometheus_exporter From 897ee5fa43b5821eceb8ebbb9e92677fe9b8856e Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 22:28:44 +0200 Subject: [PATCH 39/51] kea_dhcp(role): remove unused --- roles/kea_dhcp/handlers/main.yml | 4 --- roles/kea_dhcp/tasks/main.yml | 1 - roles/kea_dhcp/tasks/stork-agent.yaml | 2 -- roles/kea_dhcp/templates/stork-agent.env.j2 | 34 +-------------------- 4 files changed, 1 insertion(+), 40 deletions(-) diff --git a/roles/kea_dhcp/handlers/main.yml b/roles/kea_dhcp/handlers/main.yml index 04dbc09a..6d9f111f 100644 --- a/roles/kea_dhcp/handlers/main.yml +++ b/roles/kea_dhcp/handlers/main.yml @@ -7,7 +7,6 @@ - name: Kea_dhcp4.restarted_debian listen: Kea_dhcp4.restarted become: true - when: ansible_facts['distribution'] == 'Debian' ansible.builtin.service: name: isc-kea-dhcp4-server state: restarted @@ -16,7 +15,6 @@ - name: Kea_dhcp6.restarted_debian listen: Kea_dhcp6.restarted become: true - when: ansible_facts['distribution'] == 'Debian' ansible.builtin.service: name: isc-kea-dhcp6-server state: restarted @@ -25,7 +23,6 @@ - name: Kea_ctrl.restarted_debian listen: Kea_ctrl.restarted become: true - when: ansible_facts['distribution'] == 'Debian' ansible.builtin.systemd: name: isc-kea-ctrl-agent state: restarted @@ -34,7 +31,6 @@ - name: Stork_agent.restarted_debian listen: Stork_agent.restarted become: true - when: ansible_facts['distribution'] == 'Debian' ansible.builtin.systemd: name: isc-stork-agent state: restarted diff --git a/roles/kea_dhcp/tasks/main.yml b/roles/kea_dhcp/tasks/main.yml index 8150672b..44fffb53 100644 --- a/roles/kea_dhcp/tasks/main.yml +++ b/roles/kea_dhcp/tasks/main.yml @@ -13,7 +13,6 @@ - name: Setup Kea DHCP block: - name: Install Kea on Debian - when: ansible_facts['distribution'] == "Debian" ansible.builtin.import_tasks: install_debian.yaml - name: Configure Kea diff --git a/roles/kea_dhcp/tasks/stork-agent.yaml b/roles/kea_dhcp/tasks/stork-agent.yaml index 9e65e9e4..45de32ba 100644 --- a/roles/kea_dhcp/tasks/stork-agent.yaml +++ b/roles/kea_dhcp/tasks/stork-agent.yaml @@ -2,7 +2,6 @@ - name: Install stork-agent block: - name: Install stork-agent on Debian - when: ansible_facts['distribution'] == "Debian" block: - name: Register isc-stork apt repository become: true @@ -21,7 +20,6 @@ update_cache: "{{ kea_dhcp_install_repo.changed }}" - name: Add stork-agent user to kea group on Debian - when: ansible_facts['distribution'] == "Debian" become: true ansible.builtin.user: name: stork-agent diff --git a/roles/kea_dhcp/templates/stork-agent.env.j2 b/roles/kea_dhcp/templates/stork-agent.env.j2 index bdfa4d2d..b1db70ab 100644 --- a/roles/kea_dhcp/templates/stork-agent.env.j2 +++ b/roles/kea_dhcp/templates/stork-agent.env.j2 @@ -1,44 +1,12 @@ -### the IP or hostname to listen on for incoming Stork server connections -# STORK_AGENT_HOST= - -### the TCP port to listen on for incoming Stork server connections -# STORK_AGENT_PORT=8081 - -### listen for commands from the Stork server only, but not for Prometheus requests -# STORK_AGENT_LISTEN_STORK_ONLY=true +# See example config at: https://gitlab.isc.org/isc-projects/stork/-/blob/stable/etc/agent.env?ref_type=tags {% if kea_dhcp__stork_agent.prometheus_only %} ### listen for Prometheus requests only, but not for commands from the Stork server STORK_AGENT_LISTEN_PROMETHEUS_ONLY=true {% endif %} -### settings for exporting stats to Prometheus -### the IP or hostname on which the agent exports Kea statistics to Prometheus -# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS= -### the port on which the agent exports Kea statistics to Prometheus -# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT= -## enable or disable collecting per-subnet stats from Kea -# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PER_SUBNET_STATS=true -### the IP or hostname on which the agent exports BIND 9 statistics to Prometheus -# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_ADDRESS= -### the port on which the agent exports BIND 9 statistics to Prometheus -# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_PORT= - -### Stork Server URL used by the agent to send REST commands to the server during agent registration -# STORK_AGENT_SERVER_URL= - -### skip TLS certificate verification when the Stork Agent connects -### to Kea over TLS and Kea uses self-signed certificates -# STORK_AGENT_SKIP_TLS_CERT_VERIFICATION=true - - ### Logging parameters ### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR STORK_LOG_LEVEL=DEBUG -### disable output colorization -# CLICOLOR=false - -### path to the hook directory -# STORK_AGENT_HOOK_DIRECTORY= From 47fbd966421a1064c601a4879d6e99a26c2320b4 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 22:29:08 +0200 Subject: [PATCH 40/51] kea_dhcp(role): update README --- roles/kea_dhcp/README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/roles/kea_dhcp/README.md b/roles/kea_dhcp/README.md index 9938cf98..5a49e768 100644 --- a/roles/kea_dhcp/README.md +++ b/roles/kea_dhcp/README.md @@ -35,6 +35,9 @@ None. Defaults to `memfile`. - `kea_dhcp__dhcp4.lease-database.persist`: Persist the lease database. Defaults to `true`. +- `kea_dhcp__dhcp4.hooks-libraries`: List of custom processing hooks. + Details at: https://kea.readthedocs.io/en/kea-3.0.0/arm/hooks.html#hooks-libraries. + Defaults to `undefined`. - `kea_dhcp__dhcp4.option-data`: List of DHCP4 Options. Defaults to a list with one entry (see below). - `kea_dhcp__dhcp4.option-data.*.name`: Name of DHCP4 Option. @@ -45,6 +48,8 @@ None. Defaults to `kea_dhcp__dhcp4.option-data.0.csv-format: true`. - `kea_dhcp__dhcp4.option-data.*.data`: DHCP4 Option data. Defaults to `kea_dhcp__dhcp4.option-data.0.data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}"`. +- `kea_dhcp__dhcp4.logging`: List of loggers. + Defaults to one logger to `stdout`. - `kea_dhcp__dhcp4.subnets`: List of subnets the DHCP4 server should manage. Defaults to the empty list (`[ ]`). - `kea_dhcp__dhcp4.subnets.*.id`: ID of interface (starts with 1). @@ -74,6 +79,9 @@ None. Defaults to `memfile`. - `kea_dhcp__dhcp6.lease-database.persist`: Persist the lease database. Defaults to `true`. +- `kea_dhcp__dhcp6.hooks-libraries`: List of custom processing hooks. + Details at: https://kea.readthedocs.io/en/kea-3.0.0/arm/hooks.html#hooks-libraries. + Defaults to `undefined`. - `kea_dhcp__dhcp6.option-data`: List of DHCP6 Options. Defaults to a list with one entry (see below). - `kea_dhcp__dhcp6.option-data.*.name`: Name of DHCP6 Option. @@ -84,6 +92,8 @@ None. Defaults to `kea_dhcp__dhcp6.option-data.0.csv-format: true`. - `kea_dhcp__dhcp6.option-data.*.data`: DHCP6 Option data. Defaults to `kea_dhcp__dhcp6.option-data.0.data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}"`. +- `kea_dhcp__dhcp6.logging`: List of loggers. + Defaults to one logger to `stdout`. - `kea_dhcp__dhcp6.subnets`: List of subnets the DHCP6 server should manage. Defaults to the empty list (`[ ]`). - `kea_dhcp__dhcp6.subnets.*.id`: ID of interface (starts with 1). From c45fb91f76392123b8972db8583ae6a8257d1fe9 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 22:29:34 +0200 Subject: [PATCH 41/51] kea_dhcp(role): seperate package installes --- roles/kea_dhcp/tasks/install_debian.yaml | 37 +++++++++++++++++++----- 1 file changed, 29 insertions(+), 8 deletions(-) diff --git a/roles/kea_dhcp/tasks/install_debian.yaml b/roles/kea_dhcp/tasks/install_debian.yaml index 233546d8..fca302d6 100644 --- a/roles/kea_dhcp/tasks/install_debian.yaml +++ b/roles/kea_dhcp/tasks/install_debian.yaml @@ -11,11 +11,32 @@ - name: Install Kea packages become: true - ansible.builtin.apt: - name: - - isc-kea-dhcp4 - - isc-kea-dhcp6 - - isc-kea-hooks - - isc-kea-ctrl-agent - - isc-kea-admin - update_cache: "{{ kea_dhcp__repo.changed }}" + block: + - name: Update cache + ansible.builtin.apt: + update_cache: "{{ kea_dhcp__repo.changed }}" + - name: Install isc-kea-dhcp4 + when: kea_dhcp__dhcp4.enable + ansible.builtin.apt: + name: + - isc-kea-dhcp4 + - name: Install isc-kea-dhcp6 + when: kea_dhcp__dhcp6.enable + ansible.builtin.apt: + name: + - isc-kea-dhcp6 + - name: Install isc-kea-hooks + when: kea_dhcp__dhcp4.enable or kea_dhcp__dhcp6.enable + ansible.builtin.apt: + name: + - isc-kea-hooks + - name: Install isc-kea-ctrl-agent + when: kea_dhcp__stork_agent.enable + ansible.builtin.apt: + name: + - isc-kea-ctrl-agent + - name: Install isc-kea-admin + when: kea_dhcp__dhcp4.enable or kea_dhcp__dhcp6.enable + ansible.builtin.apt: + name: + - isc-kea-admin From 51b2cac907200f44cb8c8c367e832e4c0b76d6c0 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 22:32:58 +0200 Subject: [PATCH 42/51] z9-router(host): remove netwan, vlan55 untagged, add and fix DNS, fix formatting --- inventories/z9/host_vars/z9-router.yaml | 5 +++- resources/z9/z9-router/nftables/nftables.conf | 15 ++++++----- .../systemd_networkd/10-netlan.55.netdev | 8 ------ .../systemd_networkd/20-netlan.network | 7 +++-- .../21-netlan.51-clients.network | 2 ++ .../systemd_networkd/21-netlan.52-iot.network | 2 ++ .../21-netlan.53-public.network | 2 ++ .../21-netlan.55-management.network | 27 ------------------- 8 files changed, 22 insertions(+), 46 deletions(-) delete mode 100644 resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev delete mode 100644 resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network diff --git a/inventories/z9/host_vars/z9-router.yaml b/inventories/z9/host_vars/z9-router.yaml index c9d2b6fd..2cd3ee14 100644 --- a/inventories/z9/host_vars/z9-router.yaml +++ b/inventories/z9/host_vars/z9-router.yaml @@ -3,5 +3,8 @@ systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/nftables/nftables.conf') }}" ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin" ansible_pull__timer_randomized_delay_sec: 0min -unbound_access_control: [ "10.89.208.0/20" ] +unbound_access_control: [ "10.89.208.0/20", "2a07:c481:1::/48" ] +deploy_systemd_resolved_config__enable: false +deploy_systemd_resolved_config__dns: + - 127.0.0.1 kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf index e59e5bda..5e5716ae 100644 --- a/resources/z9/z9-router/nftables/nftables.conf +++ b/resources/z9/z9-router/nftables/nftables.conf @@ -1,4 +1,5 @@ #!/usr/sbin/nft -f +flush ruleset ## Variables @@ -6,9 +7,8 @@ # Interfaces -#define if_netwan = "netwan" define if_netlan = "netlan" -define if_wg56_management = "wg56" +define if_wg56_management = "wg56" define if_netwan_400_fux_uplink = "netwan.400" define if_netlan_51_clients = "netlan.51" define if_netlan_52_iot = "netlan.52" @@ -29,7 +29,6 @@ define v4_nat_ifs = { $if_netlan_51_clients, ## Rules - table inet reverse-path-forwarding { chain rpf-filter { type filter hook prerouting priority mangle + 10; policy drop; @@ -49,7 +48,7 @@ table inet host { ct state invalid drop ct state established,related accept - ip protocol icmp accept + ip protocol icmp accept # ICMPv6 # https://datatracker.ietf.org/doc/html/rfc4890#autoid-24 # Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped" @@ -79,7 +78,7 @@ table inet host { iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access" # Allow DNS server access from lan_ifs - iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs" + iifname { $lan_ifs, $if_wg56_management } meta l4proto { tcp, udp } dport 53 accept comment "allow dns server access from lan_ifs" } } @@ -103,7 +102,7 @@ table inet forward { ct state established,related accept # Allow internet access. - iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access" + iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access" # Allow access to exposed networks from internet. meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access" @@ -111,5 +110,9 @@ table inet forward { # Allow clients and management to most iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces" + + # Fux PVE backups + ip6 saddr { 2a07:c481:0:1::/64 } ip6 daddr { 2a07:c481:1:36::15/128 } accept comment "allow Fux PVE to access CCCHH PBS" } } + diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev deleted file mode 100644 index 74bd182d..00000000 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev +++ /dev/null @@ -1,8 +0,0 @@ -[NetDev] -Name=netlan.55 -Kind=vlan -MACAddress=BC:24:11:D2:65:B4 - -[VLAN] -Id=55 - diff --git a/resources/z9/z9-router/systemd_networkd/20-netlan.network b/resources/z9/z9-router/systemd_networkd/20-netlan.network index 75767b56..24783430 100644 --- a/resources/z9/z9-router/systemd_networkd/20-netlan.network +++ b/resources/z9/z9-router/systemd_networkd/20-netlan.network @@ -5,14 +5,14 @@ Name=netlan RequiredForOnline=no [Network] -#LinkLocalAddressing=no DHCP=no -#IPv6AcceptRA=no +DNS=10.89.213.1 +DNS=2a07:c481:1:36::1 VLAN=netlan.51 VLAN=netlan.52 VLAN=netlan.53 -#VLAN=netlan.55 +#VLAN=netlan.55 # vlan 55 ist untaged im pve VLAN=netwan.400 #Description=Management @@ -34,4 +34,3 @@ Prefix=2a07:c481:1:36::/64 Assign=true Token=static:::1 - diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network b/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network index 5e9635f6..36201b89 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network +++ b/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network @@ -7,6 +7,8 @@ RequiredForOnline=no [Network] Description=clients +DNS=10.89.208.1 +DNS=2a07:c481:1:33::1 # Masquerading done in nftables (nftables.conf). IPv6SendRA=yes diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network b/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network index 5b586103..a823763b 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network +++ b/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network @@ -7,6 +7,8 @@ RequiredForOnline=no [Network] Description=IoT +DNS=10.89.212.1 +DNS=2a07:c481:1:34::1 # Masquerading done in nftables (nftables.conf). IPv6SendRA=yes diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network b/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network index f544a5bc..94ee7fce 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network +++ b/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network @@ -7,6 +7,8 @@ RequiredForOnline=no [Network] Description=public +DNS=185.161.130.65 +DNS=2a07:c481:1:35::1 # Masquerading done in nftables (nftables.conf). IPv6SendRA=yes diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network b/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network deleted file mode 100644 index 1e8086a1..00000000 --- a/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network +++ /dev/null @@ -1,27 +0,0 @@ -[Match] -Name=netlan.55 -Type=vlan - -[Link] -RequiredForOnline=no - -[Network] -Description=Management - -# Masquerading done in nftables (nftables.conf). -IPv6SendRA=yes - -[Address] -Address=10.89.213.1/24 - -[IPv6SendRA] -UplinkInterface=netwan.400 -EmitDomains=true -Domains=ccchh.net -Managed=true - -[IPv6Prefix] -Prefix=2a07:c481:1:36::/64 -Assign=true -Token=static:::1 - From 5378c3f360f641397933fbc87e0fb4e762719998 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 22:35:22 +0200 Subject: [PATCH 43/51] auth-dns(host): ccchh.net remove unused --- resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 6 ------ 1 file changed, 6 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index db63fdd8..b76a81cf 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -131,14 +131,8 @@ octopi A 10.89.212.31 433mhz-bridge A 10.89.212.32 - -;SIP-T46S A 10.89.212.227 -;SIP-T46S A 10.89.212.230 - ;cisco-slm248p A 10.89.208.27 -;zigbee2mqtt A 185.161.129.132 ; Old entry probably deprecadet - ; ; Public Club Services From 4fbac5cfe66774c8ed5d4ad17a21d972e06a38a1 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 22:48:55 +0200 Subject: [PATCH 44/51] unbound(role): add config flag in README --- roles/unbound/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/unbound/README.md b/roles/unbound/README.md index 6043e749..0c2ad8f1 100644 --- a/roles/unbound/README.md +++ b/roles/unbound/README.md @@ -23,4 +23,6 @@ The following variables can be used to customize this role: Defaults to `true`. - `unbound_thread_count`: The number of threads unbound uses. Defaults to max vCPU Count. +- `unbound_private_domain`: List of domains from witch unbound for the domain and its subdomains to allows resolving of RFC1918 addresses. (Not relevent on Debian) + Defaults to `[]` From 1ec54ad5025c15d8fafea0b1304d986660158750 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 23:10:54 +0200 Subject: [PATCH 45/51] secrets(role): add parent folder settings --- roles/secrets/README.md | 7 +++++++ roles/secrets/meta/argument_specs.yaml | 10 ++++++++++ roles/secrets/tasks/main.yaml | 6 +++--- 3 files changed, 20 insertions(+), 3 deletions(-) diff --git a/roles/secrets/README.md b/roles/secrets/README.md index ec04665e..dc5e5bd7 100644 --- a/roles/secrets/README.md +++ b/roles/secrets/README.md @@ -22,3 +22,10 @@ None. Defaults to `root`. - `secrets__secrets.*.mode`: The mode of the secret file. Defaults to `0640`. +- `secrets__folder.owner`: The owner of `/etc/ansible_secrets`. + Defaults to `root`. +- `secrets__folder.group`: The group of `/etc/ansible_secrets`. + Defaults to `root`. +- `secrets__folder.mode`: The mode of `/etc/ansible_secrets`. + Defaults to `0750`. + diff --git a/roles/secrets/meta/argument_specs.yaml b/roles/secrets/meta/argument_specs.yaml index 25621389..2856d577 100644 --- a/roles/secrets/meta/argument_specs.yaml +++ b/roles/secrets/meta/argument_specs.yaml @@ -4,3 +4,13 @@ argument_specs: secrets__secrets: type: list required: false + secrets__folder: + owner: + type: string + required: false + group: + type: string + required: false + mode: + type: string + required: false diff --git a/roles/secrets/tasks/main.yaml b/roles/secrets/tasks/main.yaml index 8923397d..3d77b50b 100644 --- a/roles/secrets/tasks/main.yaml +++ b/roles/secrets/tasks/main.yaml @@ -35,9 +35,9 @@ ansible.builtin.file: path: "/etc/ansible_secrets" state: directory - owner: root - group: root - mode: "0750" + owner: "{{ secrets__folder.owner | default('root') }}" + group: "{{ secrets__folder.group | default('root') }}" + mode: "{{ secrets__folder.mode | default('0750') }}" become: true - name: ensure secrets are present From 22ace3c537adfcd7a5bfa5864f5200c73ac31560 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 23:13:44 +0200 Subject: [PATCH 46/51] z9-router(host): fix file permissions --- inventories/z9/host_vars/z9-router.sops.yaml | 15 ++++++++++++--- inventories/z9/host_vars/z9-router.yaml | 4 ++++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/inventories/z9/host_vars/z9-router.sops.yaml b/inventories/z9/host_vars/z9-router.sops.yaml index 33bd3c83..f5e40d1d 100644 --- a/inventories/z9/host_vars/z9-router.sops.yaml +++ b/inventories/z9/host_vars/z9-router.sops.yaml @@ -2,22 +2,31 @@ ansible_pull__age_private_key: ENC[AES256_GCM,data:TlMDo9sUTYznxKOGityGLexk54mM7 secrets__secrets: - name: ENC[AES256_GCM,data:gt9BarzsfE/GJ5gQeelgePquW6KAgE3Exv4=,iv:IPpUQI+zkf8O+ej+ZxLFyWUOrxGGlZvmDRG0ut2cNsA=,tag:GP66MvcKyCqyKV814+uMYg==,type:str] content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str] + group: ENC[AES256_GCM,data:SnVl,iv:GgdWFZ1tMFaUacisA47oJBXDgG11uHfw8tBYcPQt844=,tag:pHtSdg+9qPmm+Vm5gTanpg==,type:int] - name: ENC[AES256_GCM,data:9i4hZU7Hv/IMlI/1oYthx8g57nrst9LHZQk=,iv:IQanD/CA64A+hVyTQBiTvWdXyY8qNF9BpehWZxI5a9c=,tag:RiY0OJe2xbFPG6wfe5XjiA==,type:str] content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str] + group: ENC[AES256_GCM,data:9zAa,iv:Cb4tNsiPKWrkdIHHSGvK10FwGeInPetReVnW0JUTEHw=,tag:THD3QfnWb5fLXluVRFzuag==,type:int] - name: ENC[AES256_GCM,data:2lJUcDJ7ECJ1bF4Fg1VwOR2tBIQ77ZvDAbFF8w==,iv:HrPWIetjN/lOyQ7Mvk0sM1w+bWldlNfWhvw7/sfqKN8=,tag:AJL0s+f0O/yR4G3RVd1IHQ==,type:str] content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str] + group: ENC[AES256_GCM,data:Pv0/,iv:Gh6X7H+DkIO64lpcDrsH5nmWwRZRU9avs40HG1eiFcA=,tag:oGMD/kqgd0pl+BeQO7LqQw==,type:int] - name: ENC[AES256_GCM,data:ESxpEp9k9BdD1GJv+af+U3ny0+RPuaJjWDhQ,iv:DxsZLiDF8F+ixepbUdlitMJ7DLHjGNFNuxRwLl7efo8=,tag:STnv/oLzbchdiwXfKP3fow==,type:str] content: ENC[AES256_GCM,data:W2h5AcoT85OkekPeRkrf1m0bDdBjG/YNSbWlrcZtP7FjaPh/F+cx+J6oRRI=,iv:CLVXTqfstpIU3BX/Zdcnp9w0gWxeGDI/G1MNl6xr4ZU=,tag:yCqN4r1MV/VTWQvZ6COfIw==,type:str] + group: ENC[AES256_GCM,data:m3q2,iv:BKsE9OL4FMZpDS9zS+TiNvjR5jQ7EAsw9ER73Q9oSEE=,tag:r31ZCaMO4S2Pmk+FdDsdQA==,type:int] - name: ENC[AES256_GCM,data:IRwwy+WQxgQ8cDpB8HaCLpKwJj7oC87p0XOxWRo=,iv:BLXNMcigvaOeY6y4NlLPMMWQt9XFi6nodRwIYFgAAnU=,tag:OdQalmujOgrzW8oi64xMRg==,type:str] content: ENC[AES256_GCM,data:C5oIcuEYtODsvjQZnbqbWVfP63mQzcRuh8f5rlBCyjwSq2mZiYGQe9t0T78=,iv:sITUDo9SKZTSwPfsMv4m4U0ruuVCcaxu7SUT52U4FSE=,tag:4CsSMJWQQPAIeK8DwUDBqg==,type:str] + group: ENC[AES256_GCM,data:UEeH,iv:P/maaKER4lCW9/oASsJH+QBy5U1uHythvefRRnlXjn0=,tag:aXSow6dtU7VeGEtQQacHIw==,type:int] - name: ENC[AES256_GCM,data:r0sbpjaGjezoNlyl1khy+Dly+8xbbfQZNB8om/E4/tj9lmM=,iv:MLrglBJA6BrHGmFRprlQcf5/Hqh952e5OyQQ9nPxumY=,tag:Se05kMBkSQ7TRxzij7Fo8A==,type:str] content: ENC[AES256_GCM,data:/c1nRf1eZhbUmoQWvcj8yDaVPtyAN7Uu+S054q3C1/kXlQ7CgOe4CrMXnmk=,iv:ppar0aCKuIU3DOjwAoliZ5TOL199Z+Ffo4pCktjs0W8=,tag:nfaGutK+5KnlWBKU1MTxkQ==,type:str] + group: ENC[AES256_GCM,data:P/P+,iv:B0WlRVgZEgSQRsiRfi5o2+lXkFIZ8Oy5uemtwU06zPw=,tag:D5fs5HF1pKckRNVm+6r/pg==,type:int] - name: ENC[AES256_GCM,data:7mwuykEqbGISOa2n+pWb6INLsHYdjyf2HxTtWpAr5xP1,iv:NMcg+L2DFtBO1nhyPid31yzLr+ZX7DUGl/WxV1MnrqU=,tag:65/BiUEI8v5oMlQqpKNDRg==,type:str] content: ENC[AES256_GCM,data:SObbA3D/sGN5/i5ps4Zz3alygIXKbSgptFjfPHlwC8G588O+gKAkvKQwU/s=,iv:PY2vLfI3gInFeQbse49KC2/zZ9O4jeXAQ0fpP84GHHE=,tag:214Mb8hIYDkQ4+UkRWtc9w==,type:str] + group: ENC[AES256_GCM,data:ysBR,iv:ewZ73lNcdx5KQTM/HQRhptSqAqKgZzAhIubrqDp0ueg=,tag:RqcrNGQwkLufo2bdn1WJXQ==,type:int] - name: ENC[AES256_GCM,data:bES9O6JI4wTnuZsup9gflfaozeUDkfjVGNIFn8RnZQ==,iv:98kigM3KZIN5qXNdgfLg5WLmxzAsYCjNqVzyUPco/BI=,tag:1fwEtwQ6i9QQC3OCewN0eA==,type:str] content: ENC[AES256_GCM,data:flO3Nb4u2WfWNVhn8k5Bgo3LmsHo2cVnLCsrz8ST9Ip7gO9FY9d27FQgphM=,iv:aiDoq+41cSjwcCZRaIPLtbltkOpc7FeuNN7swPqkHXQ=,tag:OhzcY2xKKJF2jZVRseXCFg==,type:str] + group: ENC[AES256_GCM,data:YGOs,iv:QjGXlX90R7zqIeUQGIblD6aYtzqpGxc6hW0nT+2q84c=,tag:7kRcKtQTp9teaP+Yw1x4MA==,type:int] - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str] content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str] + group: ENC[AES256_GCM,data:2P64,iv:mOdlGn9zSb/Z97R6FBAJSZhk/g4hVOBwCI4/j3BwhPQ=,tag:OcvhT6QVfJvAYYBQyHPykg==,type:int] sops: age: - enc: | @@ -29,8 +38,8 @@ sops: tnFHmQgnEPypIhVvZtzL7i64kL6sHizTmNhbw+hlnCztvsdEV5T0cw== -----END AGE ENCRYPTED FILE----- recipient: age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp - lastmodified: "2026-05-25T17:15:30Z" - mac: ENC[AES256_GCM,data:IW9eN5H2J5cnXUHlK2aD+yd2ORx+weSFKBGWd7pIolFb5txg0WlGVp8UpD4h+Tv0SJ9NkQOT6KpcXDez/L7r7xNYtmgf7AdrdGpy3IOkEYzHJ+oHUMd/aL+h5w6/RahrpxlPSrNKAC+AfpY+l0iodwQ09iuLp4YXFxRaRDGpGZw=,iv:6M7RkDN9D9Zlyq1MCRoiT4f1bd6OBZNg+C65oEuSWn4=,tag:wRsq4lt4mHVyY6ruGkYNKQ==,type:str] + lastmodified: "2026-08-07T21:01:32Z" + mac: ENC[AES256_GCM,data:pVSBNwQVHta0vrUi9ZIo/+FLHZaeS+/R/xtNCvC+/NlEaksqcP7jQ8/Dk4DZAlPVtdupkKco0YqfTomccrp59BcAL9DAw1HpHJOeLhBdgB99fcWAkbGnzNIRS0/bOco+sDQUXGxg2HlQpFuwMFYQIfHFyqD0ivNSwLSHflrSwAM=,iv:7U9X87wd6/3SDun+BLgILH9XHJJY+GAlJd6kRSBfRGQ=,tag:wk/Hb1nw8MmLE5B08AC3jA==,type:str] pgp: - created_at: "2026-05-25T17:17:14Z" enc: |- @@ -206,4 +215,4 @@ sops: -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted - version: 3.13.1 + version: 3.13.3 diff --git a/inventories/z9/host_vars/z9-router.yaml b/inventories/z9/host_vars/z9-router.yaml index 2cd3ee14..ee5ab3f4 100644 --- a/inventories/z9/host_vars/z9-router.yaml +++ b/inventories/z9/host_vars/z9-router.yaml @@ -8,3 +8,7 @@ deploy_systemd_resolved_config__enable: false deploy_systemd_resolved_config__dns: - 127.0.0.1 kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml +secrets__folder: + owner: "root" + mode: "0754" + group: 998 From ebdafb997f882230916d7e36f6016f5c04715e85 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 23:36:22 +0200 Subject: [PATCH 47/51] unbound(role): also over write fallback_dns in resolvd --- roles/unbound/tasks/main.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index 8f9275cf..6dc35e5a 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -36,6 +36,8 @@ deploy_systemd_resolved_config__enable: false deploy_systemd_resolved_config__dns: - 127.0.0.1 + deploy_systemd_resolved_config__fallback_dns: + - 127.0.0.1 - name: flush handlers ansible.builtin.meta: flush_handlers From d97c22cc8ebec4b5df1eca11b33abc139f325723 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 23:36:37 +0200 Subject: [PATCH 48/51] z9-router(host): fix dns --- inventories/z9/host_vars/z9-router.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/inventories/z9/host_vars/z9-router.yaml b/inventories/z9/host_vars/z9-router.yaml index ee5ab3f4..62df2ba5 100644 --- a/inventories/z9/host_vars/z9-router.yaml +++ b/inventories/z9/host_vars/z9-router.yaml @@ -7,6 +7,8 @@ unbound_access_control: [ "10.89.208.0/20", "2a07:c481:1::/48" ] deploy_systemd_resolved_config__enable: false deploy_systemd_resolved_config__dns: - 127.0.0.1 +deploy_systemd_resolved_config__fallback_dns: + - 127.0.0.1 kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml secrets__folder: owner: "root" From 3ab9f8303955f7b04cec9d74908413aa6b0c5272 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 23:36:56 +0200 Subject: [PATCH 49/51] z9-router(host): fix nftables --- resources/z9/z9-router/nftables/nftables.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf index 5e5716ae..95379121 100644 --- a/resources/z9/z9-router/nftables/nftables.conf +++ b/resources/z9/z9-router/nftables/nftables.conf @@ -78,7 +78,7 @@ table inet host { iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access" # Allow DNS server access from lan_ifs - iifname { $lan_ifs, $if_wg56_management } meta l4proto { tcp, udp } dport 53 accept comment "allow dns server access from lan_ifs" + iifname { $lan_ifs, $if_wg56_management } meta l4proto { tcp, udp } th dport 53 accept comment "allow dns server access from lan_ifs" } } From f5d1c6deee8bd7bb399fe6b9277c76e3293f88fb Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Fri, 7 Aug 2026 23:50:57 +0200 Subject: [PATCH 50/51] z9-router(host): add firewall rule staubis to club assistant --- resources/z9/z9-router/nftables/nftables.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf index 95379121..b82c3e02 100644 --- a/resources/z9/z9-router/nftables/nftables.conf +++ b/resources/z9/z9-router/nftables/nftables.conf @@ -113,6 +113,9 @@ table inet forward { # Fux PVE backups ip6 saddr { 2a07:c481:0:1::/64 } ip6 daddr { 2a07:c481:1:36::15/128 } accept comment "allow Fux PVE to access CCCHH PBS" + + # staubi and staubiv2 to club-assistant + ip saddr { 10.89.212.232/32, 10.89.212.233/32 } ip daddr { 10.89.213.22/32 } accept comment "allow staubi and staubiv2 to club-assistant" } } From ea76a396704e5953269e92d56420eb9f92835a0f Mon Sep 17 00:00:00 2001 From: Renovate Date: Sat, 8 Aug 2026 00:17:36 +0000 Subject: [PATCH 51/51] Update docker.io/library/postgres Docker tag to v14 --- resources/chaosknoten/lists/docker_compose/compose.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index b4372c05..a718128a 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -62,7 +62,7 @@ services: - POSTGRES_DB=mailmandb - POSTGRES_USER=mailman - "POSTGRES_PASSWORD={{ secret__lists__postgres_password }}" - image: docker.io/library/postgres:12-alpine + image: docker.io/library/postgres:14-alpine volumes: - /opt/mailman/database:/var/lib/postgresql/data networks: