Replace avahi with systemd-resolved/systemd-networkd

6 files changed, 75 insertions, 9 deletions

diff --git a/roles/network/handlers/main.yml b/roles/network/handlers/main.yml
index 84dfff52..82634b3d 100644
--- a/roles/network/handlers/main.yml
+++ b/roles/network/handlers/main.yml
@@ -5,11 +5,26 @@
     daemon_reload: true
   when: not ansible_is_chroot
 
-- name: "Restart network services"
+- name: "Restart NetworkManager"
   become: true
   ansible.builtin.systemd_service:
-    name: "{{ item }}"
+    name: "NetworkManager"
     enabled: true
-    state: "started"
-  with_items: "{{ network_services }}"
+    state: "restarted"
+  when: not ansible_is_chroot
+
+- name: "Restart systemd-networkd"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "systemd-networkd"
+    enabled: true
+    state: "restarted"
+  when: not ansible_is_chroot
+
+- name: "Restart systemd-resolved"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "systemd-resolved"
+    enabled: true
+    state: "restarted"
   when: not ansible_is_chroot
diff --git a/roles/network/tasks/install-debian.yml b/roles/network/tasks/install-debian.yml
index 7263bc84..74c527d5 100644
--- a/roles/network/tasks/install-debian.yml
+++ b/roles/network/tasks/install-debian.yml
@@ -11,11 +11,12 @@
   ansible.builtin.set_fact:
     network_default_services:
       - "dhcpcd"
+      - "avahi-daemon"
       - "networking"
       - "wpa_supplicant"
   tags: [required_for_boot]
 
-- name: "Disable conflicting services"
+- name: "Stop/Disable conflicting services"
   become: true
   ansible.builtin.systemd_service:
     name: "{{ item }}"
@@ -23,7 +24,9 @@
     state: "stopped"
   with_items: "{{ network_default_services }}"
   when: not ansible_is_chroot
-  tags: [required_for_boot]
+  failed_when: false
+  # Not required for boot
+  tags: []
 
 - name: "(chroot): Disable conflicting services"
   ansible.builtin.command:
@@ -32,3 +35,14 @@
   when: ansible_is_chroot
   # noqa: command-instead-of-module module doesn't work inside chroot
   tags: [required_for_boot]
+
+- name: "Ensure avahi packages are removed"
+  become: true
+  ansible.builtin.apt:
+    pkg:
+      - "avahi-daemon"
+      - "avahi-utils"
+    state: "absent"
+    autoremove: true
+    purge: true
+  tags: [required_for_boot]
diff --git a/roles/network/tasks/main.yml b/roles/network/tasks/main.yml
index e8bca0be..cb8f1fd9 100644
--- a/roles/network/tasks/main.yml
+++ b/roles/network/tasks/main.yml
@@ -22,6 +22,7 @@
       ff02::2     ip6-allrouters
   when: hostname is defined
   # Not required for boot
+  tags: []
 
 - name: "Include OS-specific variables"
   ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
@@ -44,9 +45,17 @@
   become: true
   tags: [required_for_boot]
   notify:
-    - "Restart network services"
     - "Reload systemd"
+    - "Restart NetworkManager"
+    - "Restart systemd-networkd"
+    - "Restart systemd-resolved"
   block:
+    - name: "Configure systemd-resolved"
+      ansible.builtin.template:
+        src: "resolved.conf.j2"
+        dest: "/etc/systemd/resolved.conf"
+        mode: "0644"
+
     - name: "Configure NetworkManager"
       ansible.builtin.template:
         src: "NetworkManager.conf.j2"
diff --git a/roles/network/templates/NetworkManager.conf.j2 b/roles/network/templates/NetworkManager.conf.j2
index 2fb39f4d..49dcd9bf 100644
--- a/roles/network/templates/NetworkManager.conf.j2
+++ b/roles/network/templates/NetworkManager.conf.j2
@@ -4,6 +4,7 @@ uri=https://ping.archlinux.org
 [main]
 dhcp=dhcpcd
 plugins=ifupdown,keyfile
+dns=systemd-resolved
 
 [device-mac-randomization]
 wifi.scan-rand-mac-address=yes
@@ -18,6 +19,7 @@ wifi.cloned-mac-address=stable
 ipv6.ip6-privacy=2
 ipv6.dhcp-duid=stable-uuid
 wifi.powersave=2
+connection.mdns=2
 
 [logging]
 level=INFO
diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2
new file mode 100644
index 00000000..1893e882
--- /dev/null
+++ b/roles/network/templates/resolved.conf.j2
@@ -0,0 +1,24 @@
+[Resolve]
+DNS=1.1.1.1 2606:4700:4700::1111#cloudflare-dns.com 8.8.8.8 2001:4860:4860::8888#dns.google
+FallbackDNS=1.0.0.1 2606:4700:4700::1001#cloudflare-dns.com 8.8.4.4 2001:4860:4860::8844#dns.google 9.9.9.9 2620:fe::fe#quad9.net
+
+DNSSEC=yes
+DNSOverTLS=yes
+
+# Enable multicast DNS for .local domain resolution (replaces avahi functionality)
+MulticastDNS=yes
+
+# Enable LLMNR for Windows network compatibility
+LLMNR=yes
+
+Cache=yes
+CacheFromLocalhost=no
+
+# Enable DNS stub listener on 127.0.0.53:53
+DNSStubListener=yes
+
+# Read /etc/hosts file
+ReadEtcHosts=yes
+
+# Don't resolve single-label names via unicast DNS
+ResolveUnicastSingleLabel=no
diff --git a/roles/network/vars/debian.yml b/roles/network/vars/debian.yml
index 406fef9e..931a33e6 100644
--- a/roles/network/vars/debian.yml
+++ b/roles/network/vars/debian.yml
@@ -1,8 +1,10 @@
 ---
 network_packages:
-  - "avahi-daemon"
+  - "dhcpcd"
+  - "systemd-resolved"
   - "network-manager"
 
 network_services:
-  - "avahi-daemon"
+  - "systemd-resolved"
+  - "systemd-networkd"
   - "NetworkManager"