Urmel/ansible
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Funktional ipv4 and 6

Browse Source
This commit is contained in:
Kyattsukuro 2026-08-16 22:05:50 +02:00
parent bd187d0fe9
commit a5752fa577
14 changed files with 291 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
dev-helpers.sh
View File

@ -54,6 +54,11 @@ function create-role-here(){
- name: "set local variables from overrides and defaults"
set_fact:
${rolename}: "{{ (${rolename}_defaults | combine(${rolename}_override, recursive=True)) if ${rolename}_override else ${rolename}_defaults }}"
- name: ensure that path exists
file:
path: "{{ path }}/config/${rolename}"
state: directory
EOF
cat <<EOF> defaults/main.yml
@ -82,19 +87,19 @@ galaxy_info:
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies:
- role: base
# dependencies:
# - role: base
EOF
cat <<EOF> handlers/main.yml
- name: restart container
community.docker.docker_compose_v2:
community.docker.docker_compose_v2:
project_src: "{{ path }}"
project_name: "{{ role_name }}"
recreate: "always"
services: ["${rolename}"]
state: "restarted"
when: not _${rolename}_already_restarted
when: not _${rolename}_already_restarted
EOF
}

15
inventory/host_vars/beDebianMain.yml
View File

@ -7,10 +7,18 @@ ddns_override:
domain: "be.urmel.de"
ip_version: "ipv4"
token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
- provider: "hetznercloud"
domain: "be.urmel.de"
ip_version: "ipv6"
token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
- provider: "hetznercloud"
domain: "*.be.urmel.de"
ip_version: "ipv4"
token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
- provider: "hetznercloud"
domain: "*.be.urmel.de"
ip_version: "ipv6"
token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
traefik_override:
main_domain: "be.urmel.de"
@ -19,3 +27,10 @@ traefik_override:
hetzner_api_token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}"
dns_override:
api_key: "{{ bitwarden_records_urmel_services['Pihole'].login.password }}"
domain: "pihole.arpa.be.urmel.de"
local_domain: "be.urmel.de"
domain_host: 192.168.1.2
domain_host_v6: fd00:0000:1000::2

6
playbooks/dns.yml Normal file
View File

@ -0,0 +1,6 @@
---
- hosts: beDebianMain
pre_tasks:
- include_tasks: _lazy_lookup_workaround.yml
tasks:
- import_role: name=pihole

4
roles/base_server/files/etc.docker.deamon.json Normal file
View File

@ -0,0 +1,4 @@
{
"ipv6": true,
"fixed-cidr-v6": "fd00:0000:0000:0001::/64"
}

22
roles/base_server/tasks/main.yml
View File

@ -3,12 +3,13 @@
set_fact:
base: "{{ (base_defaults | combine(base_override, recursive=True)) if base_override else base_defaults }}"
- name: Install docker
- name: Install requirerd packages
package:
name:
- docker.io
- docker-compose
- docker-doc
- netfilter-persistent
state: latest
- name: Install devhelpers
@ -16,3 +17,22 @@
name:
- vim
state: latest
- name: copy docker deamon.json
ansible.builtin.copy:
src: etc.docker.deamon.json
dest: /etc/docker/daemon.json
- name: Restart docker
ansible.builtin.systemd_service:
state: restarted
daemon_reload: true
name: docker
- name: Add shell alias
ansible.builtin.lineinfile:
path: "root/.bashrc"
line: "alias dc='docker compose'"
regexp: '^alias dc='
create: true

1
roles/pihole/README.md Normal file
View File

@ -0,0 +1 @@
# dns

7
roles/pihole/defaults/main.yml Normal file
View File

@ -0,0 +1,7 @@
path: /srv/{{ role_name }}
dns_override: {}
dns_defaults:
api_key: ""
domain: ""
domain_host: ""

8
roles/pihole/handlers/main.yml Normal file
View File

@ -0,0 +1,8 @@
- name: restart container
community.docker.docker_compose_v2:
project_src: "{{ path }}"
project_name: "{{ role_name }}"
recreate: "always"
services: ["pihole"]
state: "restarted"
when: not _dns_already_restarted

17
roles/pihole/meta/main.yml Normal file
View File

@ -0,0 +1,17 @@
---
galaxy_info:
author: "Niklas Freese <niklas@urmel.de>"
description: dns
company: "Urmel Services"
license: AGPL-3.0-or-later
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.

33
roles/pihole/tasks/main.yml Normal file
View File

@ -0,0 +1,33 @@
---
- name: "set local variables from overrides and defaults"
set_fact:
dns: "{{ (dns_defaults | combine(dns_override, recursive=True)) if dns_override else dns_defaults }}"
- name: ensure that path exists
file:
path: "{{ path }}/config/dns"
state: directory
- name: template docker-compose
template:
src: compose.yml.j2
dest: "{{ path }}/compose.yml"
- name: populate dmasq
ansible.builtin.template:
src: "dmasq.conf/{{ item.path }}"
dest: "{{ path }}/config/etc-dnsmasq.d/{{ item.path | regex_replace('\\.j2$', '') }}"
with_filetree: "{{ role_path }}/templates/dmasq.conf"
when:
- item.state == "file"
notify: restart container
- name: ensure container is running
community.docker.docker_compose_v2:
project_src: "{{ path }}"
project_name: "{{ role_name }}"
state: "present"
pull: "always"
wait: true
services: ["pihole"]
register: _compose_result

34
roles/pihole/templates/compose.yml.j2 Normal file
View File

@ -0,0 +1,34 @@
---
services:
pihole:
image: pihole/pihole:latest
ports:
- "53:53/tcp"
- "53:53/udp"
- "67:67/udp"
environment:
TZ: 'Europe/Berlin'
FTLCONF_webserver_api_password: '{{ dns.api_key }}'
FTLCONF_dns_listeningMode: 'ALL' # recomendet for docker bridge
volumes:
- './data/pihole:/etc/pihole'
- './config/etc-dnsmasq.d:/etc/dnsmasq.d'
networks:
- exposed
cap_add:
- NET_ADMIN # For DHCP
restart: unless-stopped
labels:
traefik.enable: true
traefik.http.routers.pihole.entrypoints: https
traefik.http.routers.pihole.rule: Host(`{{ dns.domain }}`)
traefik.http.services.pihole.loadbalancer.server.port: 80
traefik.http.routers.pihole.tls: "true"
traefik.http.routers.pihole.tls.certresolver: hetzner
traefik.http.routers.pihole.middlewares: local-only@file
networks:
exposed:
name: traefik_exposed
external: true

1
roles/pihole/templates/dmasq.conf/02-pihole-dhcp.conf.j2 Normal file
View File

@ -0,0 +1 @@
dhcp-option=6,{{ ansible_facts.default_ipv4.address }}

5
roles/pihole/templates/dmasq.conf/99-local-wildcard.conf.j2 Normal file
View File

@ -0,0 +1,5 @@
address=/.{{ dns.local_domain }}/{{ dns.domain_host | default(ansible_facts.default_ipv4.address, true) }}
address=/.arpa.{{ dns.local_domain }}/{{ dns.domain_host | default(ansible_facts.default_ipv4.address, true) }}
address=/.{{ dns.local_domain }}/{{ dns.domain_host_v6 | default(ansible_facts.default_ipv6.address, true) }}
address=/.arpa.{{ dns.local_domain }}/{{ dns.domain_host_v6 | default(ansible_facts.default_ipv6.address, true) }}

128
shelf/be.urmel.md Normal file
View File

@ -0,0 +1,128 @@
# Proxmox WLAN IP-Tables
### V4
```
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
*filter
:INPUT ACCEPT [479923:96015305]
:FORWARD ACCEPT [309996:354561575]
:OUTPUT ACCEPT [475252:104246097]
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 51820 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 51820 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 80 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 443 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8080 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8080 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8443 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8443 -j ACCEPT
# -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT
# -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 67 -j ACCEPT
COMMIT
# Completed on Sun Jul 26 18:26:48 2026
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
*raw
:PREROUTING ACCEPT [936759:484955391]
:OUTPUT ACCEPT [475255:104246408]
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 1
COMMIT
# Completed on Sun Jul 26 18:26:48 2026
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
*nat
:PREROUTING ACCEPT [157187:35876890]
:INPUT ACCEPT [9697:1450815]
:OUTPUT ACCEPT [12692:835211]
:POSTROUTING ACCEPT [12719:836855]
-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
# -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
# -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.250.2:53
-A PREROUTING -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j SNAT --to-source 192.168.1.2
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
COMMIT
# Completed on Sun Jul 26 18:26:48 2026
```
### V6
```
# /etc/iptables/rules.v6
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 51820 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 51820 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 80 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 443 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 8080 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 8080 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 8443 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 8443 -j ACCEPT
COMMIT
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -i fwbr+ -j CT --zone 1
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A POSTROUTING -s fd00:0:ffff::/64 -o wlp2s0 -j MASQUERADE
COMMIT
```