diff options
| author | heqnx <root@heqnx.com> | 2025-06-24 10:29:19 +0300 |
|---|---|---|
| committer | heqnx <root@heqnx.com> | 2025-06-24 10:29:19 +0300 |
| commit | ba4199955a0d9b273299649b67f9592b27d00617 (patch) | |
| tree | 8a5c7547dbfe7cacd98e7e07ac5aa4e368be4195 /tasks/pve_configure.yaml | |
| parent | 4d996aff99c9c31ed66f82afb11c74569ccc6763 (diff) | |
| download | ansible-pve-host-ba4199955a0d9b273299649b67f9592b27d00617.tar.gz ansible-pve-host-ba4199955a0d9b273299649b67f9592b27d00617.zip | |
added working wg setup + internal access
Diffstat (limited to 'tasks/pve_configure.yaml')
| -rw-r--r-- | tasks/pve_configure.yaml | 24 |
1 files changed, 23 insertions, 1 deletions
diff --git a/tasks/pve_configure.yaml b/tasks/pve_configure.yaml index 0f769e8..757c7b4 100644 --- a/tasks/pve_configure.yaml +++ b/tasks/pve_configure.yaml @@ -32,10 +32,17 @@ block: | *nat :POSTROUTING ACCEPT [0:0] - -A POSTROUTING -s {{ nat_subnet }} -o {{ public_interface }} -j MASQUERADE + -A POSTROUTING -s {{ nat_subnet }} -o vmbr0 -j MASQUERADE COMMIT marker: "# {mark} ANSIBLE MANAGED NAT MASQUERADE RULE" +- name: set DEFAULT_FORWARD_POLICY to ACCEPT + lineinfile: + path: /etc/default/ufw + regexp: '^DEFAULT_FORWARD_POLICY=' + line: 'DEFAULT_FORWARD_POLICY="ACCEPT"' + backrefs: yes + - name: enable ipv4 forwarding persistently sysctl: name: net.ipv4.ip_forward @@ -58,6 +65,21 @@ enabled: true when: ansible_service_mgr == 'systemd' +- name: allow pve port + ufw: + rule: allow + port: 8006 + proto: tcp + +- name: deploy static /etc/resolv.conf + copy: + src: files/resolv.conf + dest: /etc/resolv.conf + mode: '0644' + +- name: make /etc/resolv.conf immutable with chattr + command: chattr +i /etc/resolv.conf + - name: generate secure 32-character password set_fact: pve_admin_user: "pveadmin@pve" |