Fix pihole and network manger DNS when VPN isn't active

7 files changed, 42 insertions, 10 deletions

diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml
index f5eccb3b..7cc346e8 100644
--- a/host_vars/rpi5.local.yml
+++ b/host_vars/rpi5.local.yml
diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example
index 2b0e9dbb..626570e2 100644
--- a/host_vars/rpi5.local.yml.example
+++ b/host_vars/rpi5.local.yml.example
@@ -1,10 +1,10 @@
 ---
 network_ipv4_address: "10.0.0.200"
 network_ipv4_gateway: "10.0.0.1"
-network_ipv4_dns: "10.0.0.200"
+# network_ipv4_dns: Will be set by pihole role
 network_ipv6_address: "fd5c:fd8b:2b8c::200/64"
 network_ipv6_gateway: "fd5c:fd8b:2b8c::1"
-network_ipv6_dns: "fd5c:fd8b:2b8c::200"
+# network_ipv6_dns: Will be set by pihole role
 
 # TOTP generator: `openssl rand -base64 32 | head -c "20" | base32`
 pihole_totp_secret: "CHANGEME"
diff --git a/roles/network/tasks/main.yml b/roles/network/tasks/main.yml
index 5c733a48..3803c496 100644
--- a/roles/network/tasks/main.yml
+++ b/roles/network/tasks/main.yml
@@ -10,18 +10,16 @@
     that:
       - network_ipv4_address is defined
       - network_ipv4_gateway is defined
-      - network_ipv4_dns is defined
-    fail_msg: "network_ipv4_address, network_ipv4_gateway, and network_ipv4_dns are required together"
-  when: network_ipv4_address is defined or network_ipv4_gateway is defined or network_ipv4_dns is defined
+    fail_msg: "network_ipv4_address and network_ipv4_gateway are required together"
+  when: network_ipv4_address is defined or network_ipv4_gateway is defined
 
 - name: "Validate network_ipv6_* params"
   ansible.builtin.assert:
     that:
       - network_ipv6_address is defined
       - network_ipv6_gateway is defined
-      - network_ipv6_dns is defined
-    fail_msg: "network_ipv6_address, network_ipv6_gateway, and network_ipv6_dns are required together"
-  when: network_ipv6_address is defined or network_ipv6_gateway is defined or network_ipv6_dns is defined
+    fail_msg: "network_ipv6_address and network_ipv6_gateway are required together"
+  when: network_ipv6_address is defined or network_ipv6_gateway is defined
 
 - name: "Ensure network enabled services are enabled"
   become: true
diff --git a/roles/network/templates/eth0-connection.nmconnection.j2 b/roles/network/templates/eth0-connection.nmconnection.j2
index dab5a6de..493afdf7 100644
--- a/roles/network/templates/eth0-connection.nmconnection.j2
+++ b/roles/network/templates/eth0-connection.nmconnection.j2
@@ -10,7 +10,9 @@ autoconnect=true
 method=manual
 addresses={{ network_ipv4_address }}
 gateway={{ network_ipv4_gateway }}
+{% if network_ipv4_dns is defined %}
 dns={{ network_ipv4_dns }}
+{% endif %}
 {% else %}
 method=auto
 {% endif %}
@@ -21,7 +23,9 @@ addr-gen-mode=default
 method=manual
 addresses={{ network_ipv6_address }}
 gateway={{ network_ipv6_gateway }}
+{% if network_ipv6_dns is defined %}
 dns={{ network_ipv6_dns }}
+{% endif %}
 {% else %}
 method=auto
 {% endif %}
diff --git a/roles/network/templates/wifi-connection.nmconnection.j2 b/roles/network/templates/wifi-connection.nmconnection.j2
index c04077c0..0fd69cb1 100644
--- a/roles/network/templates/wifi-connection.nmconnection.j2
+++ b/roles/network/templates/wifi-connection.nmconnection.j2
@@ -18,7 +18,9 @@ psk={{ network_wifi_pass }}
 method=manual
 addresses={{ network_ipv4_address }}
 gateway={{ network_ipv4_gateway }}
+{% if network_ipv4_dns is defined %}
 dns={{ network_ipv4_dns }}
+{% endif %}
 {% else %}
 method=auto
 {% endif %}
@@ -29,7 +31,9 @@ addr-gen-mode=default
 method=manual
 addresses={{ network_ipv6_address }}
 gateway={{ network_ipv6_gateway }}
+{% if network_ipv6_dns is defined %}
 dns={{ network_ipv6_dns }}
+{% endif %}
 {% else %}
 method=auto
 {% endif %}
diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml
index cb61c094..f8fe8d7d 100644
--- a/roles/pihole/tasks/main.yml
+++ b/roles/pihole/tasks/main.yml
@@ -1,4 +1,30 @@
 ---
+- name: "Set Pi-hole DNS facts"
+  ansible.builtin.set_fact:
+    pihole_enabled: true
+    network_ipv4_dns: "{{ ansible_default_ipv4.address }}"
+    network_ipv6_dns: "{{ ansible_default_ipv6.address }}"
+
+- name: "Reconfigure systemd-resolved for Pi-hole"
+  become: true
+  ansible.builtin.template:
+    src: "{{ role_path }}/../network/templates/resolved.conf.j2"
+    dest: "/etc/systemd/resolved.conf"
+    mode: "0644"
+  notify:
+    - "Restart systemd-resolved"
+
+- name: "Reconfigure NetworkManager connections for Pi-hole DNS"
+  become: true
+  ansible.builtin.template:
+    src: "{{ role_path }}/../network/templates/eth0-connection.nmconnection.j2"
+    dest: "/etc/NetworkManager/system-connections/ethernet.nmconnection"
+    mode: "0600"
+    owner: "root"
+    group: "root"
+  notify:
+    - "Restart NetworkManager"
+
 - name: "Crete Pi-hole user"
   ansible.builtin.user:
     name: "pihole"
diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml
index a4fb43d8..14f31f54 100644
--- a/roles/wireguard_gateway/tasks/main.yml
+++ b/roles/wireguard_gateway/tasks/main.yml
@@ -26,7 +26,7 @@
   ansible.builtin.iptables:
     table: "nat"
     chain: "POSTROUTING"
-    source: "{{ ansible_default_ipv4.network }}/{{ ansible_default_ipv4.prefix }}"
+    source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
     out_interface: "{{ wireguard_autostart_connection }}"
     jump: "MASQUERADE"
     comment: "NAT local subnet traffic through VPN"
@@ -36,7 +36,7 @@
   become: true
   ansible.builtin.iptables:
     chain: "FORWARD"
-    source: "{{ ansible_default_ipv4.network }}/{{ ansible_default_ipv4.prefix }}"
+    source: "{{ (ansible_default_ipv4.address.split('.')[0:3] | join('.')) }}.0/24"
     jump: "ACCEPT"
     comment: "Allow forwarding from local subnet"
     state: "{{ 'present' if wireguard_gateway_enabled else 'absent' }}"