diff options
| -rw-r--r-- | host_vars/rpi5.local.yml | bin | 641 -> 547 bytes | |||
| -rw-r--r-- | host_vars/rpi5.local.yml.example | 3 | ||||
| -rw-r--r-- | roles/network/templates/resolved.conf.j2 | 18 | ||||
| -rw-r--r-- | roles/pihole/tasks/main.yml | 29 |
4 files changed, 9 insertions, 41 deletions
diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml Binary files differindex 7cc346e8..9793f631 100644 --- a/host_vars/rpi5.local.yml +++ b/host_vars/rpi5.local.yml diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index 626570e2..e195ccfc 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -1,10 +1,9 @@ --- network_ipv4_address: "10.0.0.200" network_ipv4_gateway: "10.0.0.1" -# network_ipv4_dns: Will be set by pihole role + network_ipv6_address: "fd5c:fd8b:2b8c::200/64" network_ipv6_gateway: "fd5c:fd8b:2b8c::1" -# network_ipv6_dns: Will be set by pihole role # TOTP generator: `openssl rand -base64 32 | head -c "20" | base32` pihole_totp_secret: "CHANGEME" diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2 index 5d70fb96..ea4a818a 100644 --- a/roles/network/templates/resolved.conf.j2 +++ b/roles/network/templates/resolved.conf.j2 @@ -1,18 +1,8 @@ [Resolve] -{% if not (network_ipv4_dns is defined or network_ipv6_dns is defined) %} -# Only set global DNS (and DoT) if not using Pi-hole -# cloudflare-dns.com -DNS=1.1.1.1 2606:4700:4700::1111 -# dns.google -FallbackDNS=8.8.8.8 2001:4860:4860::8888 -DNSOverTLS=yes -DNSSEC=yes -{% else %} -# NetworkManager will provide DNS via Pi-hole, no global DNS needed -# Pi-hole doesn't support DoT/DNSSEC -DNSOverTLS=no -DNSSEC=no -{% endif %} +DNS={{ network_ipv4_dns | default('1.1.1.1 2606:4700:4700::1111') }} +FallbackDNS={{ network_ipv6_dns | default('8.8.8.8 2001:4860:4860::8888') }} +DNSOverTLS={{ 'no' if (network_ipv4_dns is defined or network_ipv6_dns is defined) else 'yes' }} +DNSSEC={{ 'no' if (network_ipv4_dns is defined or network_ipv6_dns is defined) else 'yes' }} # use interface-specific DNS when available but fall back to global (required for VPN DNS to work) Domains=~. diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml index f8fe8d7d..4cd864ba 100644 --- a/roles/pihole/tasks/main.yml +++ b/roles/pihole/tasks/main.yml @@ -1,29 +1,8 @@ --- -- name: "Set Pi-hole DNS facts" - ansible.builtin.set_fact: - pihole_enabled: true - network_ipv4_dns: "{{ ansible_default_ipv4.address }}" - network_ipv6_dns: "{{ ansible_default_ipv6.address }}" - -- name: "Reconfigure systemd-resolved for Pi-hole" - become: true - ansible.builtin.template: - src: "{{ role_path }}/../network/templates/resolved.conf.j2" - dest: "/etc/systemd/resolved.conf" - mode: "0644" - notify: - - "Restart systemd-resolved" - -- name: "Reconfigure NetworkManager connections for Pi-hole DNS" - become: true - ansible.builtin.template: - src: "{{ role_path }}/../network/templates/eth0-connection.nmconnection.j2" - dest: "/etc/NetworkManager/system-connections/ethernet.nmconnection" - mode: "0600" - owner: "root" - group: "root" - notify: - - "Restart NetworkManager" +- name: "Validate network_ipv*_dns params" + ansible.builtin.fail: + msg: "Pihole role cannot work when network_ipv4_dns or network_ipv6_dns are defined" + when: network_ipv4_dns is defined or network_ipv6_dns is defined - name: "Crete Pi-hole user" ansible.builtin.user: |