Funktional ipv4 and 6

dev-helpers.sh

@@ -54,6 +54,11 @@ function create-role-here(){
 - name: "set local variables from overrides and defaults"
   set_fact:
     ${rolename}: "{{ (${rolename}_defaults | combine(${rolename}_override, recursive=True)) if ${rolename}_override else ${rolename}_defaults }}"
+
+- name: ensure that path exists
+  file:
+    path: "{{ path }}/config/${rolename}"
+    state: directory
 EOF
 
 cat <<EOF> defaults/main.yml
@@ -82,19 +87,19 @@ galaxy_info:
     # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
     #       Maximum 20 tags per role.
 
-dependencies:
+# dependencies:
-  - role: base
+#  - role: base
 EOF
 
 cat <<EOF> handlers/main.yml
 - name: restart container
-  community.docker.docker_compose_v2:
+community.docker.docker_compose_v2:
     project_src: "{{ path }}"
     project_name: "{{ role_name }}"
     recreate: "always"
     services: ["${rolename}"]
     state: "restarted"
-  when: not _${rolename}_already_restarted
+when: not _${rolename}_already_restarted
 
 EOF
 }

inventory/host_vars/beDebianMain.yml

@@ -7,10 +7,18 @@ ddns_override:
       domain: "be.urmel.de"
       ip_version: "ipv4"
       token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
+    - provider: "hetznercloud"
+      domain: "be.urmel.de"
+      ip_version: "ipv6"
+      token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
     - provider: "hetznercloud"
       domain: "*.be.urmel.de"
       ip_version: "ipv4"
       token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
+    - provider: "hetznercloud"
+      domain: "*.be.urmel.de"
+      ip_version: "ipv6"
+      token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
 
 traefik_override:
   main_domain: "be.urmel.de"
@@ -19,3 +27,10 @@ traefik_override:
 
   hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
   basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}"
+
+dns_override:
+  api_key: "{{ bitwarden_records_urmel_services['Pihole'].login.password }}"
+  domain: "pihole.arpa.be.urmel.de"
+  local_domain: "be.urmel.de"
+  domain_host: 192.168.1.2
+  domain_host_v6: fd00:0000:1000::2

playbooks/dns.yml

@@ -0,0 +1,6 @@
+---
+- hosts: beDebianMain
+  pre_tasks:
+    - include_tasks: _lazy_lookup_workaround.yml
+  tasks:
+    - import_role: name=pihole

roles/base_server/files/etc.docker.deamon.json

@@ -0,0 +1,4 @@
+{
+  "ipv6": true,
+  "fixed-cidr-v6": "fd00:0000:0000:0001::/64"
+}

roles/base_server/tasks/main.yml

@@ -3,12 +3,13 @@
   set_fact:
     base: "{{ (base_defaults | combine(base_override, recursive=True)) if base_override else base_defaults }}"
 
-- name: Install docker
+- name: Install requirerd packages
   package:
     name:
       - docker.io
       - docker-compose
       - docker-doc
+      - netfilter-persistent
     state: latest
 
 - name: Install devhelpers
@@ -16,3 +17,22 @@
     name:
       - vim
     state: latest
+
+- name: copy docker deamon.json
+  ansible.builtin.copy:
+    src: etc.docker.deamon.json
+    dest: /etc/docker/daemon.json
+
+- name: Restart docker
+  ansible.builtin.systemd_service:
+    state: restarted
+    daemon_reload: true
+    name: docker
+
+
+- name: Add shell alias
+  ansible.builtin.lineinfile:
+    path: "root/.bashrc"
+    line: "alias dc='docker compose'"
+    regexp: '^alias dc='
+    create: true

roles/pihole/README.md

@@ -0,0 +1 @@
+# dns

roles/pihole/defaults/main.yml

@@ -0,0 +1,7 @@
+path: /srv/{{ role_name }}
+
+dns_override: {}
+dns_defaults:
+  api_key: ""
+  domain: ""
+  domain_host: ""

roles/pihole/handlers/main.yml

@@ -0,0 +1,8 @@
+- name: restart container
+  community.docker.docker_compose_v2:
+    project_src: "{{ path }}"
+    project_name: "{{ role_name }}"
+    recreate: "always"
+    services: ["pihole"]
+    state: "restarted"
+  when: not _dns_already_restarted

roles/pihole/meta/main.yml

@@ -0,0 +1,17 @@
+---
+galaxy_info:
+  author: "Niklas Freese <niklas@urmel.de>"
+  description: dns
+  company: "Urmel Services"
+  license: AGPL-3.0-or-later
+  min_ansible_version: 2.1
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.

roles/pihole/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: "set local variables from overrides and defaults"
+  set_fact:
+    dns: "{{ (dns_defaults | combine(dns_override, recursive=True)) if dns_override else dns_defaults }}"
+
+- name: ensure that path exists
+  file:
+    path: "{{ path }}/config/dns"
+    state: directory
+
+- name: template docker-compose
+  template:
+    src: compose.yml.j2
+    dest: "{{ path }}/compose.yml"
+
+- name: populate dmasq
+  ansible.builtin.template:
+    src: "dmasq.conf/{{ item.path }}"
+    dest: "{{ path }}/config/etc-dnsmasq.d/{{ item.path | regex_replace('\\.j2$', '') }}"
+  with_filetree: "{{ role_path }}/templates/dmasq.conf"
+  when:
+    - item.state == "file"
+  notify: restart container
+
+- name: ensure container is running
+  community.docker.docker_compose_v2:
+    project_src: "{{ path }}"
+    project_name: "{{ role_name }}"
+    state: "present"
+    pull: "always"
+    wait: true
+    services: ["pihole"]
+  register: _compose_result

roles/pihole/templates/compose.yml.j2

@@ -0,0 +1,34 @@
+---
+services:
+  pihole:
+    image: pihole/pihole:latest
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+      - "67:67/udp"
+    environment:
+      TZ: 'Europe/Berlin'
+      FTLCONF_webserver_api_password: '{{ dns.api_key }}'
+      FTLCONF_dns_listeningMode: 'ALL' # recomendet for docker bridge
+    volumes:
+      - './data/pihole:/etc/pihole'
+      - './config/etc-dnsmasq.d:/etc/dnsmasq.d'
+    networks:
+      - exposed
+    cap_add:
+      - NET_ADMIN       # For DHCP
+    restart: unless-stopped
+    labels:
+      traefik.enable: true
+
+      traefik.http.routers.pihole.entrypoints: https
+      traefik.http.routers.pihole.rule: Host(`{{ dns.domain }}`)
+      traefik.http.services.pihole.loadbalancer.server.port: 80
+      traefik.http.routers.pihole.tls: "true"
+      traefik.http.routers.pihole.tls.certresolver: hetzner
+      traefik.http.routers.pihole.middlewares: local-only@file
+
+networks:
+    exposed:
+        name: traefik_exposed
+        external: true

roles/pihole/templates/dmasq.conf/02-pihole-dhcp.conf.j2

@@ -0,0 +1 @@
+dhcp-option=6,{{ ansible_facts.default_ipv4.address }}

roles/pihole/templates/dmasq.conf/99-local-wildcard.conf.j2

@@ -0,0 +1,5 @@
+address=/.{{ dns.local_domain }}/{{ dns.domain_host | default(ansible_facts.default_ipv4.address, true) }}
+address=/.arpa.{{ dns.local_domain }}/{{ dns.domain_host | default(ansible_facts.default_ipv4.address, true) }}
+
+address=/.{{ dns.local_domain }}/{{ dns.domain_host_v6 | default(ansible_facts.default_ipv6.address, true) }}
+address=/.arpa.{{ dns.local_domain }}/{{ dns.domain_host_v6 | default(ansible_facts.default_ipv6.address, true) }}

shelf/be.urmel.md

@@ -0,0 +1,128 @@
+# Proxmox WLAN IP-Tables
+### V4
+```
+# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
+*filter
+:INPUT ACCEPT [479923:96015305]
+:FORWARD ACCEPT [309996:354561575]
+:OUTPUT ACCEPT [475252:104246097]
+-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 51820 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 51820 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 80 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 80 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 443 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 443 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8080 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8080 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8443 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8443 -j ACCEPT
+# -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT
+# -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT
+-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 67 -j ACCEPT
+
+COMMIT
+# Completed on Sun Jul 26 18:26:48 2026
+# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
+*raw
+:PREROUTING ACCEPT [936759:484955391]
+:OUTPUT ACCEPT [475255:104246408]
+-A PREROUTING -i fwbr+ -j CT --zone 1
+-A PREROUTING -i fwbr+ -j CT --zone 100
+-A PREROUTING -i fwbr+ -j CT --zone 1
+-A PREROUTING -i fwbr+ -j CT --zone 100
+-A PREROUTING -i fwbr+ -j CT --zone 100
+-A PREROUTING -i fwbr+ -j CT --zone 1
+-A PREROUTING -i fwbr+ -j CT --zone 1
+-A PREROUTING -i fwbr+ -j CT --zone 1
+COMMIT
+# Completed on Sun Jul 26 18:26:48 2026
+# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
+*nat
+:PREROUTING ACCEPT [157187:35876890]
+:INPUT ACCEPT [9697:1450815]
+:OUTPUT ACCEPT [12692:835211]
+:POSTROUTING ACCEPT [12719:836855]
+-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
+-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
+-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
+-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
+-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
+-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
+-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
+-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
+-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
+-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
+
+# -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
+# -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.250.2:53
+-A PREROUTING -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67
+
+-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
+-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j SNAT --to-source 192.168.1.2
+-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
+
+COMMIT
+# Completed on Sun Jul 26 18:26:48 2026
+```
+
+### V6
+```
+# /etc/iptables/rules.v6
+
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+
+-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 51820 -j ACCEPT
+-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 51820 -j ACCEPT
+
+-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 80 -j ACCEPT
+-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 80 -j ACCEPT
+
+-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 443 -j ACCEPT
+-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 443 -j ACCEPT
+
+-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 8080 -j ACCEPT
+-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 8080 -j ACCEPT
+
+-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 8443 -j ACCEPT
+-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 8443 -j ACCEPT
+
+COMMIT
+
+
+*raw
+:PREROUTING ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+
+-A PREROUTING -i fwbr+ -j CT --zone 1
+
+COMMIT
+
+
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+
+-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
+-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
+
+-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
+-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
+
+-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
+-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
+
+-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
+-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
+
+-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
+-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
+
+-A POSTROUTING -s fd00:0:ffff::/64 -o wlp2s0 -j MASQUERADE
+
+COMMIT
+```