| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
domain = {{ pihole_domain }} rendered as an unquoted bareword containing
a dot (e.g. "pi.hole"), which is invalid TOML. TOML parsing is
all-or-nothing, not line-by-line, so pihole-FTL rejected the entire
config file on that one line and silently fell back to its compiled-in
defaults — including binding its webserver directly to ports 80/443.
That collided with caddy, which wants the same ports, causing caddy to
crash-loop and get reported as "changed" (needing a restart) on every
subsequent ansible run.
Quoting the domain value lets the file parse successfully, which in turn
surfaces a second, previously-unreachable bug: the custom webserver port
(pihole_port) was rendered as a bare number, but Pi-hole v6 FTL requires
each listener address to carry a trailing flag character (o = optional,
s = TLS). Without it FTL rejects the value the same way and reverts to
the 80/443 default. Appending "o" fixes that.
Both bugs had to be fixed together: the quoting bug was blocking the
parser from ever reaching the port line, so the port fix alone had no
effect until parsing succeeded end-to-end.
Co-Authored-By: Claude.ai
|
|
|
|
|
|
|
|
|
|
Co-Authored-By: Claude.ai
|
|
The APK approach never existed
AI made that up
Co-Authored-By: Claude.ai
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
This is refactoring the PoC for deploying cgit on pve, to now move to a
more standard deployment with dedicated agnonstic proxy role/container
|
|
|
|
|
|
|
|
Co-Authored-By: Claude.ai
|
|
Co-Authored-By: Claude.ai
|
|
This to make the role have less configurations, and less prune to human
errors
|
|
Since this role has never worked properly, this state with updating the
resolution and keeping the nouveau driver working with acceptable
performance on external monitors
|
|
|
|
Since the mac driver is still broken when connected to external
monitors, this is yet another attempt at fixing the pleasantly
apple quirky wifi and graphics to work on linux!
|
|
|
|
|
|
The nvidia_gtx1060 role rebuilds the initramfs via mkinitcpio but never
synced the result to the ESP that rEFInd actually boots from. The sync
only happens automatically via a pacman hook on `linux` package
upgrades, so a manual mkinitcpio rebuild (e.g. after changing this
role's modprobe.d config) left rEFInd booting a stale initramfs -
nouveau kept winning the race for the GPU until the next kernel
upgrade happened to trigger the hook.
Co-Authored-By: Claude.ai
|
|
Co-authored-By: Claude.ai
|
|
|
|
|
|
|
|
Root cause: Pi, the ISP router (FritzBox), and LAN clients share the same
L2 segment. When Pi forwards a client's IPv6 packet to an external GUA
destination, the Linux kernel detects that the ISP router is a "better"
next-hop on the same link and sends an ICMPv6 Redirect (type 137) to the
client. The client obeys the redirect and sends its first SYN to the ISP
router directly — Pi never forwards the original packet. The ISP router
applies per-device content filtering to the unmasqueraded client GUA and
issues a RST. This produced the symptom of the first IPv6 request failing
with "Connection reset by peer" every ~30-60 seconds (matching the FritzBox
RA interval, after which clients re-resolve their default gateway).
Diagnosis method: tcpdump with MAC addresses (-e flag) on Pi's end0 caught
the ICMPv6 Redirect being sent immediately after the first SYN arrived.
Inserting a DROP rule for icmpv6-type redirect at position 1 in ip6tables
OUTPUT confirmed the fix — 0 failures across extended testing.
Fix:
- Drop ICMPv6 Redirect (type 137) in ip6tables OUTPUT as the first rule,
before the ACCEPT rule, in both direct and VPN modes
- Flush ip6tables OUTPUT chain on clear_rules() instead of per-rule -D
deletion, which was fragile and left stale rules accumulating across
mode switches (previously caused duplicate/conflicting OUTPUT rules)
- Flush ip6tables nat POSTROUTING table instead of per-rule -D deletion
for the same reason
Also documents the ICMPv6 Redirect issue and IPv6 masquerade rationale
in roles/gateway/README.md for future reference.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
|
|
- Remove static network_ipv6_gateway from LAN hosts so they pick up
Pi's radvd RA (pref high) instead of FritzBox (pref low)
- Add missing ip6tables FORWARD ACCEPT rule for new connections in
direct mode (only ESTABLISHED was present, blocking new flows)
- Flush ip6tables nat POSTROUTING table on clear instead of fragile
per-rule -D deletion to prevent stale rule accumulation
|
|
Add radvd to gateway role to advertise Pi as high-preference IPv6
default router using the stable ULA prefix (fd1e:.../64). With
FritzBox also sending RAs, devices end up with ECMP between Pi and
FritzBox. To solve this, add network_ipv6_gateway (Pi's link-local)
as a static route with metric 100 to all managed hosts — beats RA
metric 425, ensuring all IPv6 default traffic goes through Pi.
Fix IPv6 MASQUERADE in gateway-apply-rules:
- Direct mode: add MASQUERADE on end0 (LAN devices use ULA source
addresses not known to FritzBox, so Pi must NAT them)
- FORWARD rules: restrict to RELATED,ESTABLISHED only — previously
the broad ACCEPT rule passed un-NAT'd packets alongside masqueraded
copies, causing duplicate SYNs, conntrack corruption, and RSTs
- MASQUERADE/clear rules: match by interface not by source subnet
(devices may use any source address, not just the ULA prefix)
- VPN mode return traffic: explicitly restrict to wg+→end0 direction
Add network_ipv6_gateway var (optional) to network role NM templates
(ethernet, wifi, bridge) — injects a static IPv6 default route at
metric 100 when set. Add rpi5 static route to FritzBox link-local so
Pi keeps IPv6 after FritzBox RA is disabled.
Force SSH to IPv4 for *.local hosts (AddressFamily inet) — prevents
Ansible from hanging on mDNS returning multiple IPv6 addresses.
Update gateway and pihole READMEs with two-step IPv6 setup process.
Co-Authored-By: Claude.ai
|
|
|
|
Remove static IPv6 support from network role — all hosts use SLAAC
(method=auto). Simplifies NM templates, argument_specs, and resolved.conf.
gateway sysctl accept_ra=2 is now unconditional when gateway_enabled.
Co-authored-by: Claude.ai
|
|
|
|
Using mise or python role broke on other machines so went with the
simplest solution for now, it's safe to break the system packages for
python as this is not used internally in other ways
Also proxmoxer 2+ is needed to work with the proxmox module
|
|
|
|
|
|
|
|
|
