132 lines
3.5 KiB
YAML
132 lines
3.5 KiB
YAML
- name: Validate BIRD package track
|
|
ansible.builtin.assert:
|
|
that:
|
|
- bird_track in ['bird2', 'bird3']
|
|
fail_msg: "bird_track must be either bird2 or bird3."
|
|
when: bird_enable
|
|
|
|
- name: Install repository prerequisites
|
|
ansible.builtin.apt:
|
|
name:
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- python3-debian
|
|
state: present
|
|
update_cache: true
|
|
when: bird_enable and bird_cznic_repo_enabled
|
|
|
|
- name: Configure CZ.NIC Labs BIRD apt repository
|
|
ansible.builtin.deb822_repository:
|
|
name: "cznic-labs-{{ bird_track }}"
|
|
types: deb
|
|
uris: "{{ bird_cznic_repo_base_url }}/{{ bird_track }}"
|
|
suites: "{{ bird_cznic_repo_distribution }}"
|
|
components: main
|
|
signed_by: "{{ bird_cznic_key_url }}"
|
|
state: present
|
|
when: bird_enable and bird_cznic_repo_enabled
|
|
|
|
- name: Update package cache after configuring CZ.NIC repository
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
when: bird_enable and bird_cznic_repo_enabled
|
|
|
|
- name: Install WireGuard tools
|
|
ansible.builtin.apt:
|
|
name: "{{ wireguard_package_name }}"
|
|
state: present
|
|
when: wireguard_enable
|
|
|
|
- name: Install selected BIRD package
|
|
ansible.builtin.apt:
|
|
name: "{{ bird_package_name if bird_package_version | length == 0 else bird_package_name + '=' + bird_package_version }}"
|
|
state: present
|
|
when: bird_enable
|
|
|
|
- name: Configure router sysctl values
|
|
ansible.builtin.template:
|
|
src: router-sysctl.conf.j2
|
|
dest: /etc/sysctl.d/99-router.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: reload_sysctl
|
|
|
|
- name: Ensure WireGuard configuration directory exists
|
|
ansible.builtin.file:
|
|
path: /etc/wireguard
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
when: wireguard_enable
|
|
|
|
- name: Validate WireGuard private keys are provided
|
|
ansible.builtin.assert:
|
|
that:
|
|
- >-
|
|
(item.private_key is defined and item.private_key | length > 0)
|
|
or
|
|
(item.private_key_env is defined and lookup('ansible.builtin.env', item.private_key_env) | length > 0)
|
|
fail_msg: "Private key for {{ item.name }} is missing. Set it via Ansible Vault or the matching environment lookup."
|
|
loop: "{{ wireguard_interfaces }}"
|
|
no_log: true
|
|
when: wireguard_enable
|
|
|
|
- name: Configure WireGuard interfaces
|
|
ansible.builtin.template:
|
|
src: wg.conf.j2
|
|
dest: "/etc/wireguard/{{ item.name }}.conf"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
loop: "{{ wireguard_interfaces }}"
|
|
no_log: true
|
|
notify: restart_wireguard_interfaces
|
|
when: wireguard_enable
|
|
|
|
- name: Enable WireGuard interfaces
|
|
ansible.builtin.systemd:
|
|
name: "wg-quick@{{ item.name }}"
|
|
enabled: true
|
|
state: started
|
|
loop: "{{ wireguard_interfaces }}"
|
|
when: wireguard_enable
|
|
|
|
- name: Ensure BIRD log directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ bird_log_file | dirname }}"
|
|
state: directory
|
|
owner: "{{ bird_run_user }}"
|
|
group: "{{ bird_run_group }}"
|
|
mode: "0755"
|
|
when: bird_enable
|
|
|
|
- name: Configure BIRD environment
|
|
ansible.builtin.template:
|
|
src: bird-envvars.j2
|
|
dest: "{{ bird_envvars_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart_bird
|
|
when: bird_enable
|
|
|
|
- name: Configure BIRD
|
|
ansible.builtin.template:
|
|
src: bird.conf.j2
|
|
dest: "{{ bird_config_path }}"
|
|
owner: root
|
|
group: "{{ bird_run_group }}"
|
|
mode: "0640"
|
|
validate: "bird -p -c %s"
|
|
notify: restart_bird
|
|
when: bird_enable
|
|
|
|
- name: Enable BIRD service
|
|
ansible.builtin.systemd:
|
|
name: "{{ bird_service_name }}"
|
|
enabled: true
|
|
state: started
|
|
when: bird_enable
|