Add network role

13 files changed, 280 insertions, 0 deletions

diff --git a/roles/network/README.md b/roles/network/README.md
new file mode 100644
index 00000000..ef0a566d
--- /dev/null
+++ b/roles/network/README.md
@@ -0,0 +1,12 @@
+# Ansible Role: network
+
+This role configure the basic networking functionality of a linux distro
+
+## Role Variables
+
+- `hostname` the hostname to be configure if provided.
+- `network_wifi_ssid` the name of the WIFI network to be configured (default: "").
+- `network_wifi_pass` the passphrase of the WIFI network to be configure (default: "").
+- `network_packages` the packages to install for a distro (default in distro vars).
+- `network_packages_removed` the packages to remove from a distro (default in distro vars).
+- `network_services` the services names to start/enable for a distro (default in distro vars).
diff --git a/roles/network/defaults/main.yml b/roles/network/defaults/main.yml
new file mode 100644
index 00000000..5e1076a7
--- /dev/null
+++ b/roles/network/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+network_wifi_ssid: ""
+network_wifi_pass: ""
diff --git a/roles/network/handlers/main.yml b/roles/network/handlers/main.yml
new file mode 100644
index 00000000..df50d41d
--- /dev/null
+++ b/roles/network/handlers/main.yml
@@ -0,0 +1,13 @@
+---
+- name: "Reload systemd"
+  become: true
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: not ansible_is_chroot
+
+- name: "Restart NetworkManager"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "NetworkManager"
+    state: "restarted"
+  when: not ansible_is_chroot
diff --git a/roles/network/meta/argument_specs.yml b/roles/network/meta/argument_specs.yml
new file mode 100644
index 00000000..cd30b69c
--- /dev/null
+++ b/roles/network/meta/argument_specs.yml
@@ -0,0 +1,29 @@
+---
+argument_specs:
+  main:
+    options:
+      hostname:
+        type: "str"
+        description: "The distro linux network hostname to be used"
+      network_wifi_ssid:
+        type: "str"
+        description: "The WIFI SSID to be configure when provided"
+        required: false
+        default: ""
+      network_wifi_pass:
+        type: "str"
+        description: "The WIFI Passphrase to be configure when provided"
+        required: false
+        default: ""
+      network_packages:
+        type: "list"
+        description: "The network packages to install"
+        elements: "str"
+      network_packages_removed:
+        type: "list"
+        description: "The network packages to remove"
+        elements: "str"
+      network_services:
+        type: "list"
+        description: "The network services to enable"
+        elements: "str"
diff --git a/roles/network/meta/main.yml b/roles/network/meta/main.yml
new file mode 100644
index 00000000..a129a772
--- /dev/null
+++ b/roles/network/meta/main.yml
@@ -0,0 +1,19 @@
+---
+dependencies: []
+galaxy_info:
+  role_name: network
+  author: a14m
+  description: "Configure basic distro networking features"
+  company: "kartoffeln.work GmbH."
+  license: "license MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: ArchLinux
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - noble
+    - name: Debian
+      versions:
+        - bookworm
diff --git a/roles/network/tasks/install-archlinux.yml b/roles/network/tasks/install-archlinux.yml
new file mode 100644
index 00000000..94384c5a
--- /dev/null
+++ b/roles/network/tasks/install-archlinux.yml
@@ -0,0 +1,15 @@
+---
+- name: "Ensure network_packages are installed"
+  become: true
+  community.general.pacman:
+    name: "{{ network_packages }}"
+    state: "present"
+  tags: [required_for_boot]
+
+- name: "Ensrue network_packages_removed are removed"
+  become: true
+  community.general.pacman:
+    name: "{{ network_packages_removed }}"
+    state: "absent"
+    extra_args: "-n" # Removes config files too
+  # Not required for boot
diff --git a/roles/network/tasks/install-debian.yml b/roles/network/tasks/install-debian.yml
new file mode 100644
index 00000000..057a4d0f
--- /dev/null
+++ b/roles/network/tasks/install-debian.yml
@@ -0,0 +1,15 @@
+---
+- name: "Ensure network_packages are installed"
+  become: true
+  ansible.builtin.apt:
+    pkg: "{{ network_packages }}"
+    state: "present"
+  tags: [required_for_boot]
+
+- name: "Ensrue network_packages_removed are removed"
+  become: true
+  ansible.builtin.apt:
+    name: "{{ network_packages_removed }}"
+    state: "absent"
+    purge: true
+  # Not required for boot
diff --git a/roles/network/tasks/main.yml b/roles/network/tasks/main.yml
new file mode 100644
index 00000000..44a9e300
--- /dev/null
+++ b/roles/network/tasks/main.yml
@@ -0,0 +1,89 @@
+---
+- name: "Configure /etc/hostname"
+  become: true
+  ansible.builtin.copy:
+    dest: "/etc/hostname"
+    mode: "0644"
+    content: |
+      {{ hostname }}
+  when: hostname is defined
+  tags: [required_for_boot]
+
+- name: "Configure /etc/hosts"
+  become: true
+  ansible.builtin.copy:
+    dest: "/etc/hosts"
+    mode: "0644"
+    content: |
+      127.0.0.1   localhost
+      127.0.1.1   {{ hostname }}
+      ::1         localhost ip6-localhost ip6-loopback
+      ff02::1     ip6-allnodes
+      ff02::2     ip6-allrouters
+  when: hostname is defined
+  # Not required for boot
+
+- name: "Include OS-specific variables"
+  ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
+  tags: [required_for_boot]
+
+- name: "Install OS-specific packages"
+  ansible.builtin.include_tasks: "install-{{ ansible_os_family | lower }}.yml"
+  tags: [required_for_boot]
+
+- name: "(chroot): Ensure network_services are enabled"
+  ansible.builtin.command:
+    cmd: "systemctl enable {{ item }}"
+  changed_when: true
+  with_items: "{{ network_services }}"
+  when: ansible_is_chroot
+  # noqa: command-instead-of-module module doesn't work inside chroot
+  tags: [required_for_boot]
+
+- name: "Ensure network_services are enabled"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "{{ item }}"
+    enabled: true
+    state: "started"
+  with_items: "{{ network_services }}"
+  when: not ansible_is_chroot
+  # Not required for boot
+
+- name: "Configure NetworkManager"
+  become: true
+  tags: [required_for_boot]
+  notify:
+    - "Restart NetworkManager"
+    - "Reload systemd"
+  block:
+    - name: "Configure NetworkManager"
+      ansible.builtin.template:
+        src: "NetworkManager.conf.j2"
+        dest: "/etc/NetworkManager/NetworkManager.conf"
+        mode: "0644"
+
+    - name: "Configure NetworkManager Captive Portals"
+      ansible.builtin.get_url:
+        dest: "/etc/NetworkManager/dispatcher.d/90-open_captive_portal"
+        # yamllint disable-line
+        url: "https://raw.githubusercontent.com/Seme4eg/captive-portal-sh/04751034437b6abd92647cab1b22cef586c86f4e/90-open_captive_portal"
+        checksum: "sha1:75f4c827939e7dd433357ab4776c787be02c485b"
+        mode: "0750"
+
+    - name: "Configure ethernet connection"
+      ansible.builtin.template:
+        src: "eth0-connection.nmconnection.j2"
+        dest: "/etc/NetworkManager/system-connections/ethernet.nmconnection"
+        mode: "0600"
+        owner: "root"
+        group: "root"
+
+    - name: "Configure wifi connection"
+      ansible.builtin.template:
+        src: "wifi-connection.nmconnection.j2"
+        dest: "/etc/NetworkManager/system-connections/{{ network_wifi_ssid }}.nmconnection"
+        mode: "0600"
+        owner: "root"
+        group: "root"
+      when: network_wifi_ssid != ""
diff --git a/roles/network/templates/NetworkManager.conf.j2 b/roles/network/templates/NetworkManager.conf.j2
new file mode 100644
index 00000000..32d8a442
--- /dev/null
+++ b/roles/network/templates/NetworkManager.conf.j2
@@ -0,0 +1,22 @@
+[connectivity]
+uri=https://ping.archlinux.org
+
+[main]
+dhcp=dhcpcd
+
+[device-mac-randomization]
+wifi.scan-rand-mac-address=yes
+
+[connection-mac-randomization]
+# Random MAC on every Ethernet connection
+ethernet.cloned-mac-address=random
+# Random (but permanent) MAC on every wifi network
+wifi.cloned-mac-address=stable
+
+[connection]
+ipv6.ip6-privacy=2
+ipv6.dhcp-duid=stable-uuid
+wifi.powersave=2
+
+[logging]
+level=INFO
diff --git a/roles/network/templates/eth0-connection.nmconnection.j2 b/roles/network/templates/eth0-connection.nmconnection.j2
new file mode 100644
index 00000000..b5cbe276
--- /dev/null
+++ b/roles/network/templates/eth0-connection.nmconnection.j2
@@ -0,0 +1,16 @@
+[connection]
+id=ethernet
+type=ethernet
+autoconnect=true
+interface-name=eth0
+
+[ethernet]
+
+[ipv4]
+method=auto
+
+[ipv6]
+addr-gen-mode=default
+method=auto
+
+[proxy]
diff --git a/roles/network/templates/wifi-connection.nmconnection.j2 b/roles/network/templates/wifi-connection.nmconnection.j2
new file mode 100644
index 00000000..9fffbd12
--- /dev/null
+++ b/roles/network/templates/wifi-connection.nmconnection.j2
@@ -0,0 +1,23 @@
+[connection]
+id={{ network_wifi_ssid }}
+uuid={{ network_wifi_ssid | to_uuid }}
+type=wifi
+autoconnect=true
+
+[wifi]
+mode=infrastructure
+ssid={{ network_wifi_ssid }}
+
+[wifi-security]
+auth-alg=open
+key-mgmt=wpa-psk
+psk={{ network_wifi_pass }}
+
+[ipv4]
+method=auto
+
+[ipv6]
+addr-gen-mode=default
+method=auto
+
+[proxy]
diff --git a/roles/network/vars/archlinux.yml b/roles/network/vars/archlinux.yml
new file mode 100644
index 00000000..c3732716
--- /dev/null
+++ b/roles/network/vars/archlinux.yml
@@ -0,0 +1,11 @@
+---
+network_packages:
+  - "dhcpcd"
+  - "networkmanager"
+
+network_packages_removed: []
+
+network_services:
+  - "dhcpcd"
+  - "systemd-resolved"
+  - "NetworkManager"
diff --git a/roles/network/vars/debian.yml b/roles/network/vars/debian.yml
new file mode 100644
index 00000000..5a9e8797
--- /dev/null
+++ b/roles/network/vars/debian.yml
@@ -0,0 +1,13 @@
+---
+network_packages:
+  - "dhcpcd"
+  - "network-manager"
+  - "systemd-resolved"
+
+network_packages_removed:
+  - "avahi-daemon"
+
+network_services:
+  - "dhcpcd"
+  - "systemd-resolved"
+  - "NetworkManager"