163 lines
4.2 KiB
YAML
163 lines
4.2 KiB
YAML
---
|
|
##### Firewall pre-requisites #####
|
|
|
|
# - name: Enable and start firewalld
|
|
# ansible.builtin.systemd:
|
|
# name: firewalld
|
|
# enabled: yes
|
|
# state: started
|
|
|
|
# - name: firewall-cmd --get-zones
|
|
# ansible.builtin.command: firewall-cmd --get-zones
|
|
# register: firewalld_zones
|
|
|
|
# - name: firewall-cmd --get-active-zones
|
|
# ansible.builtin.command: firewall-cmd --get-active-zones
|
|
# register: firewalld_zones
|
|
|
|
# - name: Check existing zones
|
|
# ansible.builtin.debug:
|
|
# var: firewalld_zones.stdout
|
|
|
|
# - name: Create firewalld core zone
|
|
# ansible.posix.firewalld:
|
|
# zone: core
|
|
# state: present
|
|
# permanent: true
|
|
|
|
# - name: Create firewalld mgmt zone
|
|
# ansible.posix.firewalld:
|
|
# zone: mgmt
|
|
# state: present
|
|
# permanent: true
|
|
|
|
# - name: Create firewalld dmz zone
|
|
# ansible.posix.firewalld:
|
|
# zone: dmz
|
|
# state: present
|
|
# permanent: true
|
|
|
|
# - name: Reload firewalld to apply changes
|
|
# ansible.builtin.command: firewall-cmd --reload
|
|
|
|
# - name: Enable ssh rule in core
|
|
# ansible.posix.firewalld:
|
|
# zone: core
|
|
# service: ssh
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
# - name: Enable ssh rule in mgmt
|
|
# ansible.posix.firewalld:
|
|
# zone: mgmt
|
|
# service: ssh
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
# - name: Reload firewalld to apply changes
|
|
# ansible.builtin.command: firewall-cmd --reload
|
|
|
|
#### Network config ####
|
|
- name: Enable and start systemd-networkd
|
|
ansible.builtin.systemd:
|
|
name: systemd-networkd
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Ensure systemd-networkd directories exist
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
loop:
|
|
- /etc/systemd/network
|
|
- /etc/systemd/networkd.conf.d
|
|
|
|
- name: Rename default network interface via .link files
|
|
ansible.builtin.template:
|
|
src: rename-default-dev.link.j2
|
|
dest: "/etc/systemd/network/1-rename-{{ default_interface.ifname }}-to-{{ default_interface.name }}.link"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: Trigger udev for new interface names
|
|
|
|
- name: Rename network interfaces via .link files
|
|
ansible.builtin.template:
|
|
src: rename-auxiliary-dev.link.j2
|
|
dest: "/etc/systemd/network/1-rename-{{ item.ifname }}-to-{{ item.name }}.link"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
loop: "{{ network_interfaces }}"
|
|
notify: Trigger udev for new interface names
|
|
|
|
- name: Generate default interface .network file
|
|
ansible.builtin.template:
|
|
src: default-interface.network.j2
|
|
dest: "/etc/systemd/network/{{ default_interface.prefix }}-{{ default_interface.ifname }}-{{ default_interface.name }}.network"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: Restart systemd-networkd
|
|
|
|
- name: Generate auxiliary interfaces .network files
|
|
ansible.builtin.template:
|
|
src: auxiliary-interface.network.j2
|
|
dest: "/etc/systemd/network/{{ item.prefix }}-{{ item.ifname }}-{{ item.name }}.network"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
loop: "{{ network_interfaces }}"
|
|
notify: Restart systemd-networkd
|
|
|
|
# - name: Deploy .network files
|
|
# ansible.builtin.copy:
|
|
# src: "files/network/{{ item }}"
|
|
# dest: "/etc/systemd/network/{{ item }}"
|
|
# owner: root
|
|
# group: root
|
|
# mode: '0644'
|
|
# loop:
|
|
# - 10-ens18-core.network
|
|
# - 20-ens19-mgmt.network
|
|
# - 30-ens20-dmz.network
|
|
# notify: Restart systemd-networkd
|
|
|
|
- name: Deploy systemd-networkd global .conf files
|
|
ansible.builtin.copy:
|
|
src: "files/networkd.conf.d/{{ item }}"
|
|
dest: "/etc/systemd/networkd.conf.d/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
loop:
|
|
- 10-routes.conf
|
|
notify: Restart systemd-networkd
|
|
|
|
- name: Ensure networking is disabled
|
|
ansible.builtin.systemd_service:
|
|
name: networking
|
|
masked: true
|
|
enabled: false
|
|
state: stopped
|
|
ignore_errors: true
|
|
|
|
- name: Ensure NetworkManager is disabled
|
|
ansible.builtin.systemd_service:
|
|
name: NetworkManager
|
|
masked: true
|
|
enabled: false
|
|
state: stopped
|
|
ignore_errors: true
|
|
|
|
- name: Ensure NetworkManager-wait-online is disabled
|
|
ansible.builtin.systemd_service:
|
|
name: NetworkManager-wait-online
|
|
masked: true
|
|
enabled: false
|
|
state: stopped
|
|
ignore_errors: true
|