diff options
Diffstat (limited to 'tasks')
| -rw-r--r-- | tasks/preflight.yaml | 6 | ||||
| -rw-r--r-- | tasks/pve_configure.yaml | 24 | ||||
| -rw-r--r-- | tasks/pve_setup.yaml | 14 | ||||
| -rw-r--r-- | tasks/wg_setup.yaml | 39 |
4 files changed, 62 insertions, 21 deletions
diff --git a/tasks/preflight.yaml b/tasks/preflight.yaml index aef9dcf..6c67ae7 100644 --- a/tasks/preflight.yaml +++ b/tasks/preflight.yaml @@ -1,17 +1,17 @@ - name: ensure script is run as root - ansible.builtin.assert: + assert: that: - ansible_effective_user_id == 0 fail_msg: "this playbook must be run as root" - name: check if system is debian-based - ansible.builtin.command: dpkg -l + command: dpkg -l register: dpkg_check changed_when: false failed_when: false - name: fail if not debian-based - ansible.builtin.fail: + fail: msg: "distribution not Debian-based" when: dpkg_check.rc != 0 diff --git a/tasks/pve_configure.yaml b/tasks/pve_configure.yaml index 0f769e8..757c7b4 100644 --- a/tasks/pve_configure.yaml +++ b/tasks/pve_configure.yaml @@ -32,10 +32,17 @@ block: | *nat :POSTROUTING ACCEPT [0:0] - -A POSTROUTING -s {{ nat_subnet }} -o {{ public_interface }} -j MASQUERADE + -A POSTROUTING -s {{ nat_subnet }} -o vmbr0 -j MASQUERADE COMMIT marker: "# {mark} ANSIBLE MANAGED NAT MASQUERADE RULE" +- name: set DEFAULT_FORWARD_POLICY to ACCEPT + lineinfile: + path: /etc/default/ufw + regexp: '^DEFAULT_FORWARD_POLICY=' + line: 'DEFAULT_FORWARD_POLICY="ACCEPT"' + backrefs: yes + - name: enable ipv4 forwarding persistently sysctl: name: net.ipv4.ip_forward @@ -58,6 +65,21 @@ enabled: true when: ansible_service_mgr == 'systemd' +- name: allow pve port + ufw: + rule: allow + port: 8006 + proto: tcp + +- name: deploy static /etc/resolv.conf + copy: + src: files/resolv.conf + dest: /etc/resolv.conf + mode: '0644' + +- name: make /etc/resolv.conf immutable with chattr + command: chattr +i /etc/resolv.conf + - name: generate secure 32-character password set_fact: pve_admin_user: "pveadmin@pve" diff --git a/tasks/pve_setup.yaml b/tasks/pve_setup.yaml index 9fcea47..88a92c3 100644 --- a/tasks/pve_setup.yaml +++ b/tasks/pve_setup.yaml @@ -54,13 +54,13 @@ environment: DEBIAN_FRONTEND: noninteractive -- name: reboot to activate proxmox ve kernel - reboot: - msg: "rebooting to activate proxmox ve kernel" - connect_timeout: 10 - reboot_timeout: 600 - pre_reboot_delay: 5 - post_reboot_delay: 10 + #- name: reboot to activate proxmox ve kernel + # reboot: + # msg: "rebooting to activate proxmox ve kernel" + # connect_timeout: 10 + # reboot_timeout: 600 + # pre_reboot_delay: 5 + # post_reboot_delay: 10 - name: install pve packages apt: diff --git a/tasks/wg_setup.yaml b/tasks/wg_setup.yaml index 9557a79..abe818f 100644 --- a/tasks/wg_setup.yaml +++ b/tasks/wg_setup.yaml @@ -18,44 +18,44 @@ - name: create wireguard server directory file: - path: "{{ wireguard_server_home }}" + path: "{{ wg_server_home }}" state: directory mode: "0700" - name: create wireguard peers directory file: - path: "{{ wireguard_peers_home }}" + path: "{{ wg_peers_home }}" state: directory mode: "0700" - name: generate wireguard server keys shell: cmd: | - wg genpsk > "{{ wireguard_server_home }}/psk.key" - wg genkey > "{{ wireguard_server_home }}/server.key" - creates: "{{ wireguard_server_home }}/server.key" + wg genpsk > "{{ wg_server_home }}/psk.key" + wg genkey > "{{ wg_server_home }}/server.key" + creates: "{{ wg_server_home }}/server.key" args: - chdir: "{{ wireguard_server_home }}" + chdir: "{{ wg_server_home }}" - name: get server public key shell: - cmd: wg pubkey < "{{ wireguard_server_home }}/server.key" + cmd: wg pubkey < "{{ wg_server_home }}/server.key" register: server_pubkey changed_when: false - name: read wireguard server.key from remote host slurp: - src: "{{ wireguard_server_home }}/server.key" + src: "{{ wg_server_home }}/server.key" register: wg_key - name: set private key from remote file set_fact: private_key: "{{ wg_key.content | b64decode }}" -- name: deploy {{ wireguard_server_home }}/wg0.conf +- name: deploy {{ wg_server_home }}/wg0.conf template: src: wg0.conf.j2 - dest: "{{ wireguard_server_home }}/wg0.conf" + dest: "{{ wg_server_home }}/wg0.conf" mode: "0600" - name: deploy manage_wg_peers.sh @@ -70,3 +70,22 @@ state: restarted enabled: true when: ansible_service_mgr == 'systemd' + +- name: allow wg port + ufw: + rule: allow + port: "{{ wg_port }}" + proto: udp + +- name: set wg-only pveproxy config + template: + src: pveproxy + dest: /etc/default/pveproxy + mode: '0644' + +- name: restart pveproxy + systemd: + name: pveproxy + state: restarted + enabled: true + when: ansible_service_mgr == 'systemd' |