Fix networking issues when VPN isn't active

5 files changed, 33 insertions, 5 deletions

diff --git a/roles/network/meta/argument_specs.yml b/roles/network/meta/argument_specs.yml
index 7cb3f62d..86df33c6 100644
--- a/roles/network/meta/argument_specs.yml
+++ b/roles/network/meta/argument_specs.yml
@@ -18,9 +18,15 @@ argument_specs:
       network_ipv4_gateway:
         type: "str"
         description: "The network IP(4) gateway to configure when provided"
+      network_ipv4_dns:
+        type: "str"
+        description: "The network IP(4) gateway to configure when provided"
       network_ipv6_address:
         type: "str"
         description: "The network IP(6) address to configure when provided"
       network_ipv6_gateway:
         type: "str"
         description: "The network IP(6) gateway to configure when provided"
+      network_ipv6_dns:
+        type: "str"
+        description: "The network IP(4) gateway to configure when provided"
diff --git a/roles/network/tasks/main.yml b/roles/network/tasks/main.yml
index c8c48268..5c733a48 100644
--- a/roles/network/tasks/main.yml
+++ b/roles/network/tasks/main.yml
@@ -10,8 +10,18 @@
     that:
       - network_ipv4_address is defined
       - network_ipv4_gateway is defined
-    fail_msg: "network_ipv4_address and network_ipv4_gateway are required together"
-  when: network_ipv4_address is defined or network_ipv4_gateway is defined
+      - network_ipv4_dns is defined
+    fail_msg: "network_ipv4_address, network_ipv4_gateway, and network_ipv4_dns are required together"
+  when: network_ipv4_address is defined or network_ipv4_gateway is defined or network_ipv4_dns is defined
+
+- name: "Validate network_ipv6_* params"
+  ansible.builtin.assert:
+    that:
+      - network_ipv6_address is defined
+      - network_ipv6_gateway is defined
+      - network_ipv6_dns is defined
+    fail_msg: "network_ipv6_address, network_ipv6_gateway, and network_ipv6_dns are required together"
+  when: network_ipv6_address is defined or network_ipv6_gateway is defined or network_ipv6_dns is defined
 
 - name: "Ensure network enabled services are enabled"
   become: true
diff --git a/roles/network/templates/eth0-connection.nmconnection.j2 b/roles/network/templates/eth0-connection.nmconnection.j2
index b981489a..dab5a6de 100644
--- a/roles/network/templates/eth0-connection.nmconnection.j2
+++ b/roles/network/templates/eth0-connection.nmconnection.j2
@@ -9,7 +9,8 @@ autoconnect=true
 {% if network_ipv4_address is defined %}
 method=manual
 addresses={{ network_ipv4_address }}
-gateway={{ network_ipv4_gateway  }}
+gateway={{ network_ipv4_gateway }}
+dns={{ network_ipv4_dns }}
 {% else %}
 method=auto
 {% endif %}
@@ -20,6 +21,7 @@ addr-gen-mode=default
 method=manual
 addresses={{ network_ipv6_address }}
 gateway={{ network_ipv6_gateway }}
+dns={{ network_ipv6_dns }}
 {% else %}
 method=auto
 {% endif %}
diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2
index cccffff1..5d70fb96 100644
--- a/roles/network/templates/resolved.conf.j2
+++ b/roles/network/templates/resolved.conf.j2
@@ -1,10 +1,18 @@
 [Resolve]
+{% if not (network_ipv4_dns is defined or network_ipv6_dns is defined) %}
+# Only set global DNS (and DoT) if not using Pi-hole
 # cloudflare-dns.com
 DNS=1.1.1.1 2606:4700:4700::1111
 # dns.google
 FallbackDNS=8.8.8.8 2001:4860:4860::8888
-DNSSEC=yes
 DNSOverTLS=yes
+DNSSEC=yes
+{% else %}
+# NetworkManager will provide DNS via Pi-hole, no global DNS needed
+# Pi-hole doesn't support DoT/DNSSEC
+DNSOverTLS=no
+DNSSEC=no
+{% endif %}
 # use interface-specific DNS when available but fall back to global (required for VPN DNS to work)
 Domains=~.
 
diff --git a/roles/network/templates/wifi-connection.nmconnection.j2 b/roles/network/templates/wifi-connection.nmconnection.j2
index 52cf2d19..c04077c0 100644
--- a/roles/network/templates/wifi-connection.nmconnection.j2
+++ b/roles/network/templates/wifi-connection.nmconnection.j2
@@ -17,7 +17,8 @@ psk={{ network_wifi_pass }}
 {% if network_ipv4_address is defined %}
 method=manual
 addresses={{ network_ipv4_address }}
-gateway={{ network_ipv4_gateway  }}
+gateway={{ network_ipv4_gateway }}
+dns={{ network_ipv4_dns }}
 {% else %}
 method=auto
 {% endif %}
@@ -28,6 +29,7 @@ addr-gen-mode=default
 method=manual
 addresses={{ network_ipv6_address }}
 gateway={{ network_ipv6_gateway }}
+dns={{ network_ipv6_dns }}
 {% else %}
 method=auto
 {% endif %}