- create unbound role
- create kea_dhcp role
- configure unbound and keadhcp on rt1(z9 host)

@@ -1,6 +1,7 @@
 skip_list:
   - "yaml[line-length]"
   - "name[casing]"
+  - "yaml[brackets]"

@@ -14,6 +14,9 @@ all:
     yate:
       ansible_host: yate.ccchh.net
       ansible_user: chaos
+    rt1:

@@ -53,3 +69,4 @@
     dooris:
+    rt1:
 ansible_pull_hosts:
   hosts:

@@ -0,0 +49,4 @@
+        ct state invalid drop
+        ct state established,related accept
+
+		    ip protocol icmp accept

@@ -0,0 +75,4 @@
+        udp dport 51820 accept comment "allow WireGuard access"
+
+        # Allow DHCP server access.
+		    iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access"

@@ -0,0 +102,4 @@
+        ct state established,related accept
+
+        # Allow internet access.
+		    iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access"

@@ -0,0 +108,4 @@
+        meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
+        meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access"
+
+        # Allow clients and managment to most

@@ -0,0 +5,4 @@
+
+[WireGuard]
+ListenPort=51820
+PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_privat_key

@@ -0,0 +75,4 @@
+
+[WireGuardPeer]
+# friendly_name = lilly-lillysLaptop
+AllowedIPs = 10.89.214.16/32 #,2a07:c481:1:37::/128

@@ -0,0 +80,4 @@
+
+[WireGuardPeer]
+# friendly_name = bitwhisker
+AllowedIPs = 10.89.214.17/32,2a07:c481:1:37::a/128

@@ -0,0 +17,4 @@
+[IPv6SendRA]
+UplinkInterface=netwan.400
+EmitDomains=true
+Domains=ccchh.net

@@ -0,0 +4,4 @@
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+
+- name: Kea_dhcp4.reloaded

@@ -0,0 +10,4 @@
+    state: restarted
+    enabled: true
+
+- name: Kea_dhcp6.reloaded

@@ -0,0 +16,4 @@
+    state: restarted
+    enabled: true
+
+- name: Kea_ctrl.reloaded

@@ -0,0 +1,8 @@
+---
+- name: Install Kea on Archlinux

@@ -0,0 +5,4 @@
+  when: ansible_facts['distribution'] == "Debian"
+  ansible.builtin.deb822_repository:
+    name: "isc-{{ kea_dhcp__version_repo }}"
+    uris: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/deb/debian"

@@ -0,0 +16,4 @@
+  ansible.builtin.apt:
+    name:
+      - isc-kea-dhcp4
+      - isc-kea-dhcp6

@@ -0,0 +1,51 @@
+---
+- name: Include config vars
+  tags: [ kea, include_vars ]

@@ -0,0 +3,4 @@
+  tags: [kea, dhcp]
+  block:
+    - name: Install Kea on Archlinux
+      when: ansible_facts['distribution'] == "Archlinux"

@@ -0,0 +18,4 @@
+
+        - name: Install stork-agent with aur_pkg_install
+          ansible.builtin.include_role:
+            name: aur_pkg_install

@@ -0,0 +12,4 @@
+      {% for subnet in kea_dhcp__dhcp6.subnets %}
+      {
+        "id": {{ subnet.id }},
+	      "subnet": "{{ subnet.subnet }}",

@@ -0,0 +1,44 @@
+### the IP or hostname to listen on for incoming Stork server connections
+# STORK_AGENT_HOST=

@@ -0,0 +1 @@
+nameserver 127.0.0.1

@@ -0,0 +1,27 @@
+- name: unbound.restarted
+  tags: [ unbound, dns, dns_resolver ]

@@ -0,0 +10,4 @@
+    - name: install extra dns tooling
+      become: true
+      ansible.builtin.package:
+        name: [ bind ]  # the bind package includes tools like dig in archlinux

@@ -0,0 +39,4 @@
+        state: started
+        enabled: true
+
+    - name: disable systemd-resolved

@@ -0,0 +1,17 @@
+---
+- name: install unbound prometheus exporter
+  become: true
+  ansible.builtin.package:

@@ -0,0 +3,4 @@
+  become: true
+  ansible.builtin.package:
+    name: prometheus-unbound-exporter
+  notify: prometheus-unbound-exporter.enabled

@@ -0,0 +3,4 @@
+server:
+    {% if unbound_enable_dnssec -%}
+    # disable chroot because unbound is the only thing running on the VM
+    # and because it has issues with how archlinux configures the systemd units write protection regarding the anchor file

@@ -0,0 +12,4 @@
+    {% endif -%}
+
+	# use all CPUs
+	num-threads: 2