Refactor pve and add pve-network role to configure the pve network

7 files changed, 144 insertions, 0 deletions

diff --git a/roles/pve-network/defaults/main.yml b/roles/pve-network/defaults/main.yml
new file mode 100644
index 00000000..f56c943e
--- /dev/null
+++ b/roles/pve-network/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+pve_network_interface: "eth0"
diff --git a/roles/pve-network/handlers/main.yml b/roles/pve-network/handlers/main.yml
new file mode 100644
index 00000000..7a4ce4c0
--- /dev/null
+++ b/roles/pve-network/handlers/main.yml
@@ -0,0 +1,16 @@
+---
+- name: "Restart NetworkManager"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "NetworkManager"
+    state: "restarted"
+  async: 10
+  poll: 0
+
+- name: "Restart pveproxy"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "pveproxy"
+    state: "restarted"
+  tags:
+    - "molecule-notest"
diff --git a/roles/pve-network/meta/argument_specs.yml b/roles/pve-network/meta/argument_specs.yml
new file mode 100644
index 00000000..6f93a13b
--- /dev/null
+++ b/roles/pve-network/meta/argument_specs.yml
@@ -0,0 +1,32 @@
+---
+argument_specs:
+  main:
+    options:
+      pve_network_interface:
+        type: "str"
+        description: "Physical ethernet interface to add as bridge port"
+        default: "enp0s25"
+      network_ipv4_address:
+        type: "str"
+        description: "Static IPv4 address for vmbr0"
+        required: true
+      network_ipv4_prefix:
+        type: "int"
+        description: "IPv4 prefix length"
+        default: 24
+      network_ipv4_gateway:
+        type: "str"
+        description: "IPv4 default gateway"
+        required: true
+      network_ipv4_dns:
+        type: "str"
+        description: "IPv4 DNS server"
+      network_ipv6_address:
+        type: "str"
+        description: "Static IPv6 address for vmbr0 (optional)"
+      network_ipv6_gateway:
+        type: "str"
+        description: "IPv6 default gateway (required if network_ipv6_address is set)"
+      network_ipv6_dns:
+        type: "str"
+        description: "IPv6 DNS server"
diff --git a/roles/pve-network/meta/main.yml b/roles/pve-network/meta/main.yml
new file mode 100644
index 00000000..e7c9c044
--- /dev/null
+++ b/roles/pve-network/meta/main.yml
@@ -0,0 +1,13 @@
+---
+dependencies:
+  - role: "network"
+  - role: "pve"
+galaxy_info:
+  author: "a14m"
+  description: "Configure vmbr0 bridge on Proxmox VE via NetworkManager"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/pve-network/tasks/main.yml b/roles/pve-network/tasks/main.yml
new file mode 100644
index 00000000..dcaf0638
--- /dev/null
+++ b/roles/pve-network/tasks/main.yml
@@ -0,0 +1,36 @@
+---
+- name: "Set management IP in /etc/hosts for PVE cert generation"
+  become: true
+  ansible.builtin.lineinfile:
+    path: "/etc/hosts"
+    regexp: "^{{ network_ipv4_address }}"
+    line: "{{ network_ipv4_address }}  {{ ansible_facts['hostname'] }}"
+    state: present
+  notify: "Restart pveproxy"
+  tags:
+    - "molecule-notest"
+
+- name: "Deploy bridge master connection"
+  become: true
+  ansible.builtin.template:
+    src: "vmbr0.nmconnection.j2"
+    dest: "/etc/NetworkManager/system-connections/vmbr0.nmconnection"
+    owner: "root"
+    group: "root"
+    mode: "0600"
+  notify: "Restart NetworkManager"
+
+- name: "Override ethernet connection as bridge port"
+  become: true
+  ansible.builtin.template:
+    src: "ethernet.nmconnection.j2"
+    dest: "/etc/NetworkManager/system-connections/ethernet.nmconnection"
+    owner: "root"
+    group: "root"
+    mode: "0600"
+  notify: "Restart NetworkManager"
+
+- name: "Wait for connection to recover after bridge reconfiguration"
+  ansible.builtin.wait_for_connection:
+    delay: 5
+    timeout: 30
diff --git a/roles/pve-network/templates/ethernet.nmconnection.j2 b/roles/pve-network/templates/ethernet.nmconnection.j2
new file mode 100644
index 00000000..2aaa85b0
--- /dev/null
+++ b/roles/pve-network/templates/ethernet.nmconnection.j2
@@ -0,0 +1,16 @@
+[connection]
+id={{ pve_network_interface }}-bridge-port
+type=ethernet
+interface-name={{ pve_network_interface }}
+autoconnect=true
+controller=vmbr0
+port-type=bridge
+
+[ethernet]
+cloned-mac-address=permanent
+
+[ipv4]
+method=disabled
+
+[ipv6]
+method=disabled
diff --git a/roles/pve-network/templates/vmbr0.nmconnection.j2 b/roles/pve-network/templates/vmbr0.nmconnection.j2
new file mode 100644
index 00000000..013acd6a
--- /dev/null
+++ b/roles/pve-network/templates/vmbr0.nmconnection.j2
@@ -0,0 +1,29 @@
+[connection]
+id=vmbr0
+type=bridge
+interface-name=vmbr0
+autoconnect=true
+
+[bridge]
+stp=false
+
+[ipv4]
+method=manual
+addresses={{ network_ipv4_address }}/{{ network_ipv4_prefix | default(24) }}
+gateway={{ network_ipv4_gateway }}
+{% if network_ipv4_dns is defined %}
+dns={{ network_ipv4_dns }}
+{% endif %}
+
+[ipv6]
+addr-gen-mode=default
+{% if network_ipv6_address is defined %}
+method=manual
+addresses={{ network_ipv6_address }}
+gateway={{ network_ipv6_gateway }}
+{% if network_ipv6_dns is defined %}
+dns={{ network_ipv6_dns }}
+{% endif %}
+{% else %}
+method=disabled
+{% endif %}