diff options
| -rw-r--r-- | host_vars/rpi5.local.yml | bin | 491 -> 529 bytes | |||
| -rw-r--r-- | host_vars/rpi5.local.yml.example | 1 | ||||
| -rw-r--r-- | roles/network/templates/resolved.conf.j2 | 6 | ||||
| -rw-r--r-- | roles/pihole/defaults/main.yml | 9 | ||||
| -rw-r--r-- | roles/pihole/meta/argument_specs.yml | 13 | ||||
| -rw-r--r-- | roles/wireguard_gateway/tasks/main.yml | 23 | ||||
| -rw-r--r-- | site.yml | 2 |
7 files changed, 20 insertions, 34 deletions
diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml Binary files differindex 41ce15f2..e823df29 100644 --- a/host_vars/rpi5.local.yml +++ b/host_vars/rpi5.local.yml diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example index f8515fbd..af2e8dea 100644 --- a/host_vars/rpi5.local.yml.example +++ b/host_vars/rpi5.local.yml.example @@ -6,6 +6,7 @@ network_ipv4_gateway: "10.0.0.1" pihole_totp_secret: "CHANGEME" pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}" +wireguard_gateway_enabled: true wireguard_autostart_connection: "protonvpn-us-1" wireguard_connections: protonvpn-us-1: | diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2 index c083a214..cccffff1 100644 --- a/roles/network/templates/resolved.conf.j2 +++ b/roles/network/templates/resolved.conf.j2 @@ -1,6 +1,8 @@ [Resolve] -DNS=9.9.9.9 2620:fe::fe#quad9.net -FallbackDNS=1.1.1.1 2606:4700:4700::1111#cloudflare-dns.com 8.8.8.8 2001:4860:4860::8888#dns.google +# cloudflare-dns.com +DNS=1.1.1.1 2606:4700:4700::1111 +# dns.google +FallbackDNS=8.8.8.8 2001:4860:4860::8888 DNSSEC=yes DNSOverTLS=yes # use interface-specific DNS when available but fall back to global (required for VPN DNS to work) diff --git a/roles/pihole/defaults/main.yml b/roles/pihole/defaults/main.yml index 44744d98..7be113a4 100644 --- a/roles/pihole/defaults/main.yml +++ b/roles/pihole/defaults/main.yml @@ -2,9 +2,12 @@ pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}" pihole_totp_secret: "CHANGEME" pihole_dns: - - "9.9.9.9" # Quad9 - - "1.1.1.1" # Cloudflare - - "8.8.8.8" # Google + # Cloudflare + - "1.1.1.1" + - "2606:4700:4700::1111" + # Google + - "8.8.8.8" + - "2001:4860:4860:0:0:0:0:8888" pihole_interface: "{{ ansible_default_ipv4.interface }}" pihole_dns_blocking_enabled: true pihole_dhcp_enabled: false diff --git a/roles/pihole/meta/argument_specs.yml b/roles/pihole/meta/argument_specs.yml index e7cf04e7..9af61251 100644 --- a/roles/pihole/meta/argument_specs.yml +++ b/roles/pihole/meta/argument_specs.yml @@ -15,9 +15,12 @@ argument_specs: description: "The list of DNS servers to use as upstreams" elements: "str" default: - - "9.9.9.9" # Quad9 - - "1.1.1.1" # Cloudflare - - "8.8.8.8" # Google + # Cloudflare + - "1.1.1.1" + - "2606:4700:4700::1111" + # Google + - "8.8.8.8" + - "2001:4860:4860:0:0:0:0:8888" pihole_interface: type: "str" description: "The interface to bind the pi-hole on" @@ -38,9 +41,9 @@ argument_specs: type: "str" description: "The dhcp end address" default: "{{ ansible_default_ipv4.network }}.199" - pihole_dhcp_address: + pihole_dhcp_router: type: "str" - description: "The dhcp server address (local pihole address)" + description: "The dhcp server router (gateway) address" default: "{{ ansible_default_ipv4.address }}" pihole_dhcp_lease_time: type: "int" diff --git a/roles/wireguard_gateway/tasks/main.yml b/roles/wireguard_gateway/tasks/main.yml index 2b82ff66..a4fb43d8 100644 --- a/roles/wireguard_gateway/tasks/main.yml +++ b/roles/wireguard_gateway/tasks/main.yml @@ -20,29 +20,6 @@ net.ipv6.conf.all.forwarding=1 notify: "Reload sysctl" -- name: "Configure VPN gateway routing" - become: true - ansible.builtin.shell: | - {% if wireguard_gateway_enabled %} - # Add routes to custom table - ip route add default dev {{ wireguard_autostart_connection }} table 100 || true - ip -6 route add default dev {{ wireguard_autostart_connection }} table 100 || true - # Remove any incorrect policy routing rules first - ip -6 rule del iif {{ ansible_default_ipv6.interface }} table 100 || true - # Add correct policy routing rules - ip rule add iif {{ ansible_default_ipv4.interface }} table 100 priority 200 || true - ip -6 rule add iif {{ ansible_default_ipv4.interface }} table 100 priority 200 || true - {% else %} - # Remove policy routing rules - ip rule del iif {{ ansible_default_ipv4.interface }} table 100 || true - ip -6 rule del iif {{ ansible_default_ipv4.interface }} table 100 || true - # Remove routes from custom table - ip route del default dev {{ wireguard_autostart_connection }} table 100 || true - ip -6 route del default dev {{ wireguard_autostart_connection }} table 100 || true - {% endif %} - failed_when: false - changed_when: false - # IPv4 iptables rules - name: "Add IPv4 NAT masquerading for traffic through VPN" become: true @@ -17,7 +17,7 @@ become: true ansible.builtin.package: update_cache: true - async: 300 + async: 60 poll: 5 failed_when: false |