- create unbound role
- create kea_dhcp role
- configure unbound and keadhcp on rt1(z9 host)

@@ -1,6 +1,7 @@
 skip_list:
   - "yaml[line-length]"
   - "name[casing]"
+  - "yaml[brackets]"

@@ -14,6 +14,9 @@ all:
     yate:
       ansible_host: yate.ccchh.net
       ansible_user: chaos
+    rt1:

@@ -53,3 +69,4 @@
     dooris:
+    rt1:
 ansible_pull_hosts:
   hosts:

@@ -0,0 +49,4 @@
+        ct state invalid drop
+        ct state established,related accept
+
+		    ip protocol icmp accept

@@ -0,0 +75,4 @@
+        udp dport 51820 accept comment "allow WireGuard access"
+
+        # Allow DHCP server access.
+		    iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access"

@@ -0,0 +102,4 @@
+        ct state established,related accept
+
+        # Allow internet access.
+		    iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access"

@@ -0,0 +108,4 @@
+        meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
+        meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access"
+
+        # Allow clients and managment to most

@@ -0,0 +5,4 @@
+
+[WireGuard]
+ListenPort=51820
+PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_privat_key

@@ -0,0 +75,4 @@
+
+[WireGuardPeer]
+# friendly_name = lilly-lillysLaptop
+AllowedIPs = 10.89.214.16/32 #,2a07:c481:1:37::/128

@@ -0,0 +80,4 @@
+
+[WireGuardPeer]
+# friendly_name = bitwhisker
+AllowedIPs = 10.89.214.17/32,2a07:c481:1:37::a/128

@@ -0,0 +17,4 @@
+[IPv6SendRA]
+UplinkInterface=netwan.400
+EmitDomains=true
+Domains=ccchh.net

@@ -0,0 +4,4 @@
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+
+- name: Kea_dhcp4.reloaded

@@ -0,0 +10,4 @@
+    state: restarted
+    enabled: true
+
+- name: Kea_dhcp6.reloaded

@@ -0,0 +16,4 @@
+    state: restarted
+    enabled: true
+
+- name: Kea_ctrl.reloaded

@@ -0,0 +1,8 @@
+---
+- name: Install Kea on Archlinux

@@ -0,0 +5,4 @@
+  when: ansible_facts['distribution'] == "Debian"
+  ansible.builtin.deb822_repository:
+    name: "isc-{{ kea_dhcp__version_repo }}"
+    uris: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/deb/debian"

@@ -0,0 +16,4 @@
+  ansible.builtin.apt:
+    name:
+      - isc-kea-dhcp4
+      - isc-kea-dhcp6

@@ -0,0 +1,51 @@
+---
+- name: Include config vars
+  tags: [ kea, include_vars ]

@@ -0,0 +3,4 @@
+  tags: [kea, dhcp]
+  block:
+    - name: Install Kea on Archlinux
+      when: ansible_facts['distribution'] == "Archlinux"

@@ -0,0 +18,4 @@
+
+        - name: Install stork-agent with aur_pkg_install
+          ansible.builtin.include_role:
+            name: aur_pkg_install

@@ -0,0 +12,4 @@
+      {% for subnet in kea_dhcp__dhcp6.subnets %}
+      {
+        "id": {{ subnet.id }},
+	      "subnet": "{{ subnet.subnet }}",

@@ -0,0 +1,44 @@
+### the IP or hostname to listen on for incoming Stork server connections
+# STORK_AGENT_HOST=

@@ -0,0 +1 @@
+nameserver 127.0.0.1

@@ -0,0 +1,27 @@
+- name: unbound.restarted
+  tags: [ unbound, dns, dns_resolver ]

@@ -0,0 +10,4 @@
+    - name: install extra dns tooling
+      become: true
+      ansible.builtin.package:
+        name: [ bind ]  # the bind package includes tools like dig in archlinux

@@ -0,0 +39,4 @@
+        state: started
+        enabled: true
+
+    - name: disable systemd-resolved

@@ -0,0 +1,17 @@
+---
+- name: install unbound prometheus exporter
+  become: true
+  ansible.builtin.package:

@@ -0,0 +3,4 @@
+  become: true
+  ansible.builtin.package:
+    name: prometheus-unbound-exporter
+  notify: prometheus-unbound-exporter.enabled

@@ -0,0 +3,4 @@
+server:
+    {% if unbound_enable_dnssec -%}
+    # disable chroot because unbound is the only thing running on the VM
+    # and because it has issues with how archlinux configures the systemd units write protection regarding the anchor file

@@ -0,0 +12,4 @@
+    {% endif -%}
+
+	# use all CPUs
+	num-threads: 2

@@ -3,3 +3,3 @@
 Folgende Geräte und Server werden duch dieses Ansible Repository verwaltet:
 
-* Diverse VMs auf dem ThinkCCCluster
+* Diverse VMs auf dem z9 (PVE Cluster)

@@ -41,30 +43,102 @@ pve04          A    10.89.213.14
 pbs            A    10.89.213.15
                AAAA 2a07:c481:1:36::15
 unifi          A    10.89.213.21
+;               AAAA 2a07:c481:1:36::21

@@ -44,4 +47,4 @@
 
 
 ;
 ; Club-Services

@@ -68,0 +134,4 @@
+
+
+;SIP-T46S                        A    10.89.212.227
+;SIP-T46S                        A    10.89.212.230

@@ -14,3 +14,3 @@
 
     # replace with the IP address of your resolver
-    resolver 10.31.208.1;
+    #resolver 10.31.208.1; # is this needed?

@@ -56,3 +39,3 @@
 
     # replace with the IP address of your resolver
-    resolver 10.31.208.1;
+    #resolver 10.31.208.1; # is this needed?

@@ -0,0 +6,4 @@
+
+
+# Interfaces
+#define if_netwan = "netwan"

@@ -0,0 +49,4 @@
+        ct state invalid drop
+        ct state established,related accept
+
+		    ip protocol icmp accept

@@ -0,0 +103,4 @@
+        ct state established,related accept
+
+        # Allow internet access.
+		    iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"

@@ -0,0 +7,4 @@
+[Network]
+#LinkLocalAddressing=no
+DHCP=no
+#IPv6AcceptRA=no

@@ -0,0 +12,4 @@
+IPv6SendRA=yes
+
+[Address]
+Address=10.89.213.1/24

@@ -0,0 +7,4 @@
+- name: Kea_dhcp4.restarted_debian
+  listen: Kea_dhcp4.restarted
+  become: true
+  when: ansible_facts['distribution'] == 'Debian'

@@ -0,0 +4,4 @@
+  register: kea_dhcp__repo
+  ansible.builtin.deb822_repository:
+    name: "isc-{{ kea_dhcp__version_repo }}"
+    uris: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/deb/debian"

@@ -0,0 +13,4 @@
+  become: true
+  ansible.builtin.apt:
+    name:
+      - isc-kea-dhcp4

@@ -0,0 +9,4 @@
+    owner: root
+    group: "{{ kea_dhcp__service_group }}"
+    mode: "u=rw,g=r,o="
+    validate: "/usr/sbin/kea-dhcp4 -T %s" # does not work with debian apparmor policys

@@ -0,0 +13,4 @@
+- name: Setup Kea DHCP
+  block:
+    - name: Install Kea on Debian
+      when: ansible_facts['distribution'] == "Debian"

@@ -0,0 +2,4 @@
+- name: Install stork-agent
+  block:
+    - name: Install stork-agent on Debian
+      when: ansible_facts['distribution'] == "Debian"

@@ -0,0 +6,4 @@
+        "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json | indent(8) }},
+        "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json | indent(8) }},
+{% if kea_dhcp__dhcp4['hooks-libraries'] is defined and kea_dhcp__dhcp4['hooks-libraries'] %}
+        "hooks-libraries": {{ kea_dhcp__dhcp4['hooks-libraries'] | to_nice_json | indent(8) }},

@@ -0,0 +11,4 @@
+{% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %}
+        "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json | indent(8) }},
+{% endif %}
+        "loggers": {{ kea_dhcp__dhcp4['logging'] | to_nice_json | indent(8) }},

@@ -0,0 +6,4 @@
+        "control-sockets": {{ kea_dhcp__dhcp6['control-sockets'] | to_nice_json | indent(8) }},
+        "lease-database": {{ kea_dhcp__dhcp6['lease-database'] | to_nice_json | indent(8) }},
+{% if kea_dhcp__dhcp6['hooks-libraries'] is defined and kea_dhcp__dhcp6['hooks-libraries'] %}
+        "hooks-libraries": {{ kea_dhcp__dhcp6['hooks-libraries'] | to_nice_json | indent(8) }},

@@ -0,0 +11,4 @@
+{% if kea_dhcp__dhcp6['option-data'] is defined and kea_dhcp__dhcp6['option-data'] %}
+        "option-data": {{ kea_dhcp__dhcp6['option-data'] | to_nice_json | indent(8) }},
+{% endif %}
+        "loggers": {{ kea_dhcp__dhcp6['logging'] | to_nice_json | indent(8) }}{% if kea_dhcp__dhcp6.subnets is defined and kea_dhcp__dhcp6.subnets %},{% endif %}

@@ -0,0 +1,44 @@
+### the IP or hostname to listen on for incoming Stork server connections

@@ -0,0 +1,20 @@
+# Unbound DNS resolver
+
+Role fora a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/). 

@@ -0,0 +9,4 @@
+
+The following variables can be used to customize this role:
+
+| Variable                                 | Type            | Default         | Description                                                                                                                                                                               |

@@ -0,0 +1 @@
+nameserver 127.0.0.1

@@ -0,0 +4,4 @@
+    name: unbound.service
+    state: restarted
+
+- name: unbound.reloaded

@@ -0,0 +1,55 @@
+- name: unbound role main
+  block:

@@ -0,0 +8,4 @@
+  block:
+    - name: request github api
+      ansible.builtin.uri:
+        url: "{{ prometheus_unbound_exporter_github_api_url }}"

@@ -0,0 +39,4 @@
+  access-control: {{ i }} allow
+  {% endfor -%}
+
+  {% for i in unbound_private_domain -%}