Refactor network role

Remove static IPv6 support from network role — all hosts use SLAAC
(method=auto). Simplifies NM templates, argument_specs, and resolved.conf.
gateway sysctl accept_ra=2 is now unconditional when gateway_enabled.

Co-authored-by: Claude.ai

9 files changed, 8 insertions, 56 deletions

diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example
index f93bc08e..f68e1ff0 100644
--- a/host_vars/rpi5.local.yml.example
+++ b/host_vars/rpi5.local.yml.example
@@ -2,8 +2,6 @@
 network_interface: "eth0"
 network_ipv4_address: "10.0.0.254"
 network_ipv4_gateway: "10.0.0.1"
-network_ipv6_address: "2a02:0000:0000:0000::254/64"
-network_ipv6_gateway: "fe00::0000:0000:0000:0001"
 
 pihole_hostname: "dns.home.arpa"
 wg_portal_hostname: "vpn.home.arpa"
@@ -45,7 +43,7 @@ wireguard_connections:
 gateway_enabled: true
 gateway_router_interface: "{{ network_interface }}"
 gateway_local_ipv4_subnet: "10.0.0.0/24"
-gateway_local_ipv6_subnet: "2a02:0000:0000:0000::/64"
+gateway_local_ipv6_subnet: "fd00:0000:0000:0000::/64"
 
 prometheus_host: "localhost"
 prometheus_port: 9090
diff --git a/roles/gateway/templates/99-gateway.conf.j2 b/roles/gateway/templates/99-gateway.conf.j2
index 54f81f0c..b0f99dd4 100644
--- a/roles/gateway/templates/99-gateway.conf.j2
+++ b/roles/gateway/templates/99-gateway.conf.j2
@@ -1,10 +1,8 @@
 {% if gateway_enabled %}
 net.ipv4.ip_forward=1
 net.ipv6.conf.all.forwarding=1
+net.ipv6.conf.{{ gateway_router_interface }}.accept_ra=2
 {% else %}
 net.ipv4.ip_forward=0
 net.ipv6.conf.all.forwarding=0
 {% endif %}
-{% if network_ipv6_address is defined %}
-net.ipv6.conf.{{ gateway_router_interface }}.accept_ra={{ 2 if gateway_enabled else 1 }}
-{% endif %}
diff --git a/roles/network/meta/argument_specs.yml b/roles/network/meta/argument_specs.yml
index 0c9f74fe..5f74b45c 100644
--- a/roles/network/meta/argument_specs.yml
+++ b/roles/network/meta/argument_specs.yml
@@ -21,15 +21,6 @@ argument_specs:
       network_ipv4_dns:
         type: "str"
         description: "The network IP(4) gateway to configure when provided"
-      network_ipv6_address:
-        type: "str"
-        description: "The network IP(6) address to configure when provided"
-      network_ipv6_gateway:
-        type: "str"
-        description: "The network IP(6) gateway to configure when provided"
-      network_ipv6_dns:
-        type: "str"
-        description: "The network IP(4) gateway to configure when provided"
       network_bridge_interface:
         type: "str"
         description: "Physical NIC to enslave as vmbr0 bridge port"
diff --git a/roles/network/tasks/main.yml b/roles/network/tasks/main.yml
index 967a0b30..3bd85040 100644
--- a/roles/network/tasks/main.yml
+++ b/roles/network/tasks/main.yml
@@ -13,14 +13,6 @@
     fail_msg: "network_ipv4_address and network_ipv4_gateway are required together"
   when: network_ipv4_address is defined or network_ipv4_gateway is defined
 
-- name: "Validate network_ipv6_* params"
-  ansible.builtin.assert:
-    that:
-      - network_ipv6_address is defined
-      - network_ipv6_gateway is defined
-    fail_msg: "network_ipv6_address and network_ipv6_gateway are required together"
-  when: network_ipv6_address is defined or network_ipv6_gateway is defined
-
 - name: "Ensure network enabled services are enabled"
   become: true
   ansible.builtin.systemd_service:
diff --git a/roles/network/templates/bridge.nmconnection.j2 b/roles/network/templates/bridge.nmconnection.j2
index 013acd6a..42c77380 100644
--- a/roles/network/templates/bridge.nmconnection.j2
+++ b/roles/network/templates/bridge.nmconnection.j2
@@ -17,13 +17,4 @@ dns={{ network_ipv4_dns }}
 
 [ipv6]
 addr-gen-mode=default
-{% if network_ipv6_address is defined %}
-method=manual
-addresses={{ network_ipv6_address }}
-gateway={{ network_ipv6_gateway }}
-{% if network_ipv6_dns is defined %}
-dns={{ network_ipv6_dns }}
-{% endif %}
-{% else %}
-method=disabled
-{% endif %}
+method=auto
diff --git a/roles/network/templates/eth0-connection.nmconnection.j2 b/roles/network/templates/eth0-connection.nmconnection.j2
index 56d562f9..b1bc87a8 100644
--- a/roles/network/templates/eth0-connection.nmconnection.j2
+++ b/roles/network/templates/eth0-connection.nmconnection.j2
@@ -30,13 +30,6 @@ method=auto
 addr-gen-mode=default
 {% if network_bridge_interface is defined %}
 method=disabled
-{% elif network_ipv6_address is defined %}
-method=manual
-addresses={{ network_ipv6_address }}
-gateway={{ network_ipv6_gateway }}
-{% if network_ipv6_dns is defined %}
-dns={{ network_ipv6_dns }}
-{% endif %}
 {% else %}
 method=auto
 {% endif %}
diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2
index ea4a818a..0354feeb 100644
--- a/roles/network/templates/resolved.conf.j2
+++ b/roles/network/templates/resolved.conf.j2
@@ -1,8 +1,8 @@
 [Resolve]
 DNS={{ network_ipv4_dns | default('1.1.1.1 2606:4700:4700::1111') }}
-FallbackDNS={{ network_ipv6_dns | default('8.8.8.8 2001:4860:4860::8888') }}
-DNSOverTLS={{ 'no' if (network_ipv4_dns is defined or network_ipv6_dns is defined) else 'yes' }}
-DNSSEC={{ 'no' if (network_ipv4_dns is defined or network_ipv6_dns is defined) else 'yes' }}
+FallbackDNS=8.8.8.8 2001:4860:4860::8888
+DNSOverTLS={{ 'no' if network_ipv4_dns is defined else 'yes' }}
+DNSSEC={{ 'no' if network_ipv4_dns is defined else 'yes' }}
 # use interface-specific DNS when available but fall back to global (required for VPN DNS to work)
 Domains=~.
 
diff --git a/roles/network/templates/wifi-connection.nmconnection.j2 b/roles/network/templates/wifi-connection.nmconnection.j2
index 0fd69cb1..3d7667c8 100644
--- a/roles/network/templates/wifi-connection.nmconnection.j2
+++ b/roles/network/templates/wifi-connection.nmconnection.j2
@@ -27,15 +27,6 @@ method=auto
 
 [ipv6]
 addr-gen-mode=default
-{% if network_ipv6_address is defined %}
-method=manual
-addresses={{ network_ipv6_address }}
-gateway={{ network_ipv6_gateway }}
-{% if network_ipv6_dns is defined %}
-dns={{ network_ipv6_dns }}
-{% endif %}
-{% else %}
 method=auto
-{% endif %}
 
 [proxy]
diff --git a/roles/pihole/README.md b/roles/pihole/README.md
index 65f16274..c690dffb 100644
--- a/roles/pihole/README.md
+++ b/roles/pihole/README.md
@@ -63,12 +63,10 @@ This role configure the [pihole](https://github.com/pi-hole/pi-hole) DNS Sinkhol
   - Router advertisement enable in the LAN > ✅
     - Always assign ULA addresses > ✅
     - Set ULA prefix > https://www.unique-local-ipv6.com/ example: `fd00:1234:5678::` > ✅
-    - Restart the Pi to obtain a new ULA address
-      (or run `sudo ip link set {{ network_interface }} down && sudo ip link set {{ network_interface }} up`)
-    - Run `ip address | grep "inet6 fd"` on the Pi to obtain the new IPv6 address
+    - This FRITZ!Box provides the standard internet connection > Low
   - DNSv6 Server in the Home Network >
     - Also announce DNSv6 server via router advertisement (RFC5006) > ✅
-    - Local DNSv6 Server > {{ pihole_ipv6 }}
+    - Local DNSv6 Server > {{ pihole_ipv6 `ip address | grep "inet6 fd"`}}
   - DHCPv6 Server in the home network >
     - Disable DHCPv6 server in the FRITZ!Box for the home network > ✅
       - There are no other DHCPv6 servers in the home network. > ✅