From a5752fa5774d9d9ee8aa53404a215b37db116fbd Mon Sep 17 00:00:00 2001 From: Kyattsukuro Date: Sun, 16 Aug 2026 22:05:50 +0200 Subject: [PATCH] Funktional ipv4 and 6 --- dev-helpers.sh | 17 ++- inventory/host_vars/beDebianMain.yml | 15 ++ playbooks/dns.yml | 6 + .../base_server/files/etc.docker.deamon.json | 4 + roles/base_server/tasks/main.yml | 22 ++- roles/pihole/README.md | 1 + roles/pihole/defaults/main.yml | 7 + roles/pihole/handlers/main.yml | 8 ++ roles/pihole/meta/main.yml | 17 +++ roles/pihole/tasks/main.yml | 33 +++++ roles/pihole/templates/compose.yml.j2 | 34 +++++ .../dmasq.conf/02-pihole-dhcp.conf.j2 | 1 + .../dmasq.conf/99-local-wildcard.conf.j2 | 5 + shelf/be.urmel.md | 128 ++++++++++++++++++ 14 files changed, 291 insertions(+), 7 deletions(-) create mode 100644 playbooks/dns.yml create mode 100644 roles/base_server/files/etc.docker.deamon.json create mode 100644 roles/pihole/README.md create mode 100644 roles/pihole/defaults/main.yml create mode 100644 roles/pihole/handlers/main.yml create mode 100644 roles/pihole/meta/main.yml create mode 100644 roles/pihole/tasks/main.yml create mode 100644 roles/pihole/templates/compose.yml.j2 create mode 100644 roles/pihole/templates/dmasq.conf/02-pihole-dhcp.conf.j2 create mode 100644 roles/pihole/templates/dmasq.conf/99-local-wildcard.conf.j2 create mode 100644 shelf/be.urmel.md diff --git a/dev-helpers.sh b/dev-helpers.sh index 210f52f..7a30878 100755 --- a/dev-helpers.sh +++ b/dev-helpers.sh @@ -52,8 +52,13 @@ function create-role-here(){ cat < tasks/main.yml --- - name: "set local variables from overrides and defaults" - set_fact: - ${rolename}: "{{ (${rolename}_defaults | combine(${rolename}_override, recursive=True)) if ${rolename}_override else ${rolename}_defaults }}" + set_fact: + ${rolename}: "{{ (${rolename}_defaults | combine(${rolename}_override, recursive=True)) if ${rolename}_override else ${rolename}_defaults }}" + +- name: ensure that path exists + file: + path: "{{ path }}/config/${rolename}" + state: directory EOF cat < defaults/main.yml @@ -82,19 +87,19 @@ galaxy_info: # NOTE: A tag is limited to a single word comprised of alphanumeric characters. # Maximum 20 tags per role. -dependencies: - - role: base +# dependencies: +# - role: base EOF cat < handlers/main.yml - name: restart container - community.docker.docker_compose_v2: +community.docker.docker_compose_v2: project_src: "{{ path }}" project_name: "{{ role_name }}" recreate: "always" services: ["${rolename}"] state: "restarted" - when: not _${rolename}_already_restarted +when: not _${rolename}_already_restarted EOF } diff --git a/inventory/host_vars/beDebianMain.yml b/inventory/host_vars/beDebianMain.yml index 0aaecae..57d7852 100644 --- a/inventory/host_vars/beDebianMain.yml +++ b/inventory/host_vars/beDebianMain.yml @@ -7,10 +7,18 @@ ddns_override: domain: "be.urmel.de" ip_version: "ipv4" token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}" + - provider: "hetznercloud" + domain: "be.urmel.de" + ip_version: "ipv6" + token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}" - provider: "hetznercloud" domain: "*.be.urmel.de" ip_version: "ipv4" token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}" + - provider: "hetznercloud" + domain: "*.be.urmel.de" + ip_version: "ipv6" + token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}" traefik_override: main_domain: "be.urmel.de" @@ -19,3 +27,10 @@ traefik_override: hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}" basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}" + +dns_override: + api_key: "{{ bitwarden_records_urmel_services['Pihole'].login.password }}" + domain: "pihole.arpa.be.urmel.de" + local_domain: "be.urmel.de" + domain_host: 192.168.1.2 + domain_host_v6: fd00:0000:1000::2 diff --git a/playbooks/dns.yml b/playbooks/dns.yml new file mode 100644 index 0000000..5247fc8 --- /dev/null +++ b/playbooks/dns.yml @@ -0,0 +1,6 @@ +--- +- hosts: beDebianMain + pre_tasks: + - include_tasks: _lazy_lookup_workaround.yml + tasks: + - import_role: name=pihole diff --git a/roles/base_server/files/etc.docker.deamon.json b/roles/base_server/files/etc.docker.deamon.json new file mode 100644 index 0000000..787c925 --- /dev/null +++ b/roles/base_server/files/etc.docker.deamon.json @@ -0,0 +1,4 @@ +{ + "ipv6": true, + "fixed-cidr-v6": "fd00:0000:0000:0001::/64" +} diff --git a/roles/base_server/tasks/main.yml b/roles/base_server/tasks/main.yml index d5f298d..00ab13b 100644 --- a/roles/base_server/tasks/main.yml +++ b/roles/base_server/tasks/main.yml @@ -3,12 +3,13 @@ set_fact: base: "{{ (base_defaults | combine(base_override, recursive=True)) if base_override else base_defaults }}" -- name: Install docker +- name: Install requirerd packages package: name: - docker.io - docker-compose - docker-doc + - netfilter-persistent state: latest - name: Install devhelpers @@ -16,3 +17,22 @@ name: - vim state: latest + +- name: copy docker deamon.json + ansible.builtin.copy: + src: etc.docker.deamon.json + dest: /etc/docker/daemon.json + +- name: Restart docker + ansible.builtin.systemd_service: + state: restarted + daemon_reload: true + name: docker + + +- name: Add shell alias + ansible.builtin.lineinfile: + path: "root/.bashrc" + line: "alias dc='docker compose'" + regexp: '^alias dc=' + create: true diff --git a/roles/pihole/README.md b/roles/pihole/README.md new file mode 100644 index 0000000..07d23aa --- /dev/null +++ b/roles/pihole/README.md @@ -0,0 +1 @@ +# dns diff --git a/roles/pihole/defaults/main.yml b/roles/pihole/defaults/main.yml new file mode 100644 index 0000000..c6c2717 --- /dev/null +++ b/roles/pihole/defaults/main.yml @@ -0,0 +1,7 @@ +path: /srv/{{ role_name }} + +dns_override: {} +dns_defaults: + api_key: "" + domain: "" + domain_host: "" diff --git a/roles/pihole/handlers/main.yml b/roles/pihole/handlers/main.yml new file mode 100644 index 0000000..4fe9e61 --- /dev/null +++ b/roles/pihole/handlers/main.yml @@ -0,0 +1,8 @@ +- name: restart container + community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + recreate: "always" + services: ["pihole"] + state: "restarted" + when: not _dns_already_restarted diff --git a/roles/pihole/meta/main.yml b/roles/pihole/meta/main.yml new file mode 100644 index 0000000..7480d5e --- /dev/null +++ b/roles/pihole/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + author: "Niklas Freese " + description: dns + company: "Urmel Services" + license: AGPL-3.0-or-later + min_ansible_version: 2.1 + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml new file mode 100644 index 0000000..a52c818 --- /dev/null +++ b/roles/pihole/tasks/main.yml @@ -0,0 +1,33 @@ +--- +- name: "set local variables from overrides and defaults" + set_fact: + dns: "{{ (dns_defaults | combine(dns_override, recursive=True)) if dns_override else dns_defaults }}" + +- name: ensure that path exists + file: + path: "{{ path }}/config/dns" + state: directory + +- name: template docker-compose + template: + src: compose.yml.j2 + dest: "{{ path }}/compose.yml" + +- name: populate dmasq + ansible.builtin.template: + src: "dmasq.conf/{{ item.path }}" + dest: "{{ path }}/config/etc-dnsmasq.d/{{ item.path | regex_replace('\\.j2$', '') }}" + with_filetree: "{{ role_path }}/templates/dmasq.conf" + when: + - item.state == "file" + notify: restart container + +- name: ensure container is running + community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + state: "present" + pull: "always" + wait: true + services: ["pihole"] + register: _compose_result diff --git a/roles/pihole/templates/compose.yml.j2 b/roles/pihole/templates/compose.yml.j2 new file mode 100644 index 0000000..83dca49 --- /dev/null +++ b/roles/pihole/templates/compose.yml.j2 @@ -0,0 +1,34 @@ +--- +services: + pihole: + image: pihole/pihole:latest + ports: + - "53:53/tcp" + - "53:53/udp" + - "67:67/udp" + environment: + TZ: 'Europe/Berlin' + FTLCONF_webserver_api_password: '{{ dns.api_key }}' + FTLCONF_dns_listeningMode: 'ALL' # recomendet for docker bridge + volumes: + - './data/pihole:/etc/pihole' + - './config/etc-dnsmasq.d:/etc/dnsmasq.d' + networks: + - exposed + cap_add: + - NET_ADMIN # For DHCP + restart: unless-stopped + labels: + traefik.enable: true + + traefik.http.routers.pihole.entrypoints: https + traefik.http.routers.pihole.rule: Host(`{{ dns.domain }}`) + traefik.http.services.pihole.loadbalancer.server.port: 80 + traefik.http.routers.pihole.tls: "true" + traefik.http.routers.pihole.tls.certresolver: hetzner + traefik.http.routers.pihole.middlewares: local-only@file + +networks: + exposed: + name: traefik_exposed + external: true diff --git a/roles/pihole/templates/dmasq.conf/02-pihole-dhcp.conf.j2 b/roles/pihole/templates/dmasq.conf/02-pihole-dhcp.conf.j2 new file mode 100644 index 0000000..44d8961 --- /dev/null +++ b/roles/pihole/templates/dmasq.conf/02-pihole-dhcp.conf.j2 @@ -0,0 +1 @@ +dhcp-option=6,{{ ansible_facts.default_ipv4.address }} diff --git a/roles/pihole/templates/dmasq.conf/99-local-wildcard.conf.j2 b/roles/pihole/templates/dmasq.conf/99-local-wildcard.conf.j2 new file mode 100644 index 0000000..619c7a2 --- /dev/null +++ b/roles/pihole/templates/dmasq.conf/99-local-wildcard.conf.j2 @@ -0,0 +1,5 @@ +address=/.{{ dns.local_domain }}/{{ dns.domain_host | default(ansible_facts.default_ipv4.address, true) }} +address=/.arpa.{{ dns.local_domain }}/{{ dns.domain_host | default(ansible_facts.default_ipv4.address, true) }} + +address=/.{{ dns.local_domain }}/{{ dns.domain_host_v6 | default(ansible_facts.default_ipv6.address, true) }} +address=/.arpa.{{ dns.local_domain }}/{{ dns.domain_host_v6 | default(ansible_facts.default_ipv6.address, true) }} diff --git a/shelf/be.urmel.md b/shelf/be.urmel.md new file mode 100644 index 0000000..687ef1c --- /dev/null +++ b/shelf/be.urmel.md @@ -0,0 +1,128 @@ +# Proxmox WLAN IP-Tables +### V4 +``` +# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026 +*filter +:INPUT ACCEPT [479923:96015305] +:FORWARD ACCEPT [309996:354561575] +:OUTPUT ACCEPT [475252:104246097] +-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 51820 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 51820 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 80 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 80 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 443 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 443 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8080 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8080 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8443 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8443 -j ACCEPT +# -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT +# -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT +-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 67 -j ACCEPT + +COMMIT +# Completed on Sun Jul 26 18:26:48 2026 +# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026 +*raw +:PREROUTING ACCEPT [936759:484955391] +:OUTPUT ACCEPT [475255:104246408] +-A PREROUTING -i fwbr+ -j CT --zone 1 +-A PREROUTING -i fwbr+ -j CT --zone 100 +-A PREROUTING -i fwbr+ -j CT --zone 1 +-A PREROUTING -i fwbr+ -j CT --zone 100 +-A PREROUTING -i fwbr+ -j CT --zone 100 +-A PREROUTING -i fwbr+ -j CT --zone 1 +-A PREROUTING -i fwbr+ -j CT --zone 1 +-A PREROUTING -i fwbr+ -j CT --zone 1 +COMMIT +# Completed on Sun Jul 26 18:26:48 2026 +# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026 +*nat +:PREROUTING ACCEPT [157187:35876890] +:INPUT ACCEPT [9697:1450815] +:OUTPUT ACCEPT [12692:835211] +:POSTROUTING ACCEPT [12719:836855] +-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820 +-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820 +-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080 +-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080 +-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443 +-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443 +-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080 +-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.250.2:8080 +-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443 +-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination 192.168.250.2:8443 + +# -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53 +# -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.250.2:53 +-A PREROUTING -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67 + +-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE +-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j SNAT --to-source 192.168.1.2 +-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE + +COMMIT +# Completed on Sun Jul 26 18:26:48 2026 +``` + +### V6 +``` +# /etc/iptables/rules.v6 + +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] + +-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 51820 -j ACCEPT +-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 51820 -j ACCEPT + +-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 80 -j ACCEPT +-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 80 -j ACCEPT + +-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 443 -j ACCEPT +-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 443 -j ACCEPT + +-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 8080 -j ACCEPT +-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 8080 -j ACCEPT + +-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 8443 -j ACCEPT +-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 8443 -j ACCEPT + +COMMIT + + +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] + +-A PREROUTING -i fwbr+ -j CT --zone 1 + +COMMIT + + +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] + +-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820 +-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820 + +-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080 +-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080 + +-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 +-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 + +-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080 +-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080 + +-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 +-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443 + +-A POSTROUTING -s fd00:0:ffff::/64 -o wlp2s0 -j MASQUERADE + +COMMIT +```