From 6bca3c0f2a68b4c4a2a877de2fb8c343e8fda4f9 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Mon, 11 Aug 2025 00:32:03 +0200 Subject: Replace avahi with systemd-resolved/systemd-networkd --- roles/network/handlers/main.yml | 23 +++++++++++++++++++---- roles/network/tasks/install-debian.yml | 18 ++++++++++++++++-- roles/network/tasks/main.yml | 11 ++++++++++- roles/network/templates/NetworkManager.conf.j2 | 2 ++ roles/network/templates/resolved.conf.j2 | 24 ++++++++++++++++++++++++ roles/network/vars/debian.yml | 6 ++++-- 6 files changed, 75 insertions(+), 9 deletions(-) create mode 100644 roles/network/templates/resolved.conf.j2 diff --git a/roles/network/handlers/main.yml b/roles/network/handlers/main.yml index 84dfff52..82634b3d 100644 --- a/roles/network/handlers/main.yml +++ b/roles/network/handlers/main.yml @@ -5,11 +5,26 @@ daemon_reload: true when: not ansible_is_chroot -- name: "Restart network services" +- name: "Restart NetworkManager" become: true ansible.builtin.systemd_service: - name: "{{ item }}" + name: "NetworkManager" enabled: true - state: "started" - with_items: "{{ network_services }}" + state: "restarted" + when: not ansible_is_chroot + +- name: "Restart systemd-networkd" + become: true + ansible.builtin.systemd_service: + name: "systemd-networkd" + enabled: true + state: "restarted" + when: not ansible_is_chroot + +- name: "Restart systemd-resolved" + become: true + ansible.builtin.systemd_service: + name: "systemd-resolved" + enabled: true + state: "restarted" when: not ansible_is_chroot diff --git a/roles/network/tasks/install-debian.yml b/roles/network/tasks/install-debian.yml index 7263bc84..74c527d5 100644 --- a/roles/network/tasks/install-debian.yml +++ b/roles/network/tasks/install-debian.yml @@ -11,11 +11,12 @@ ansible.builtin.set_fact: network_default_services: - "dhcpcd" + - "avahi-daemon" - "networking" - "wpa_supplicant" tags: [required_for_boot] -- name: "Disable conflicting services" +- name: "Stop/Disable conflicting services" become: true ansible.builtin.systemd_service: name: "{{ item }}" @@ -23,7 +24,9 @@ state: "stopped" with_items: "{{ network_default_services }}" when: not ansible_is_chroot - tags: [required_for_boot] + failed_when: false + # Not required for boot + tags: [] - name: "(chroot): Disable conflicting services" ansible.builtin.command: @@ -32,3 +35,14 @@ when: ansible_is_chroot # noqa: command-instead-of-module module doesn't work inside chroot tags: [required_for_boot] + +- name: "Ensure avahi packages are removed" + become: true + ansible.builtin.apt: + pkg: + - "avahi-daemon" + - "avahi-utils" + state: "absent" + autoremove: true + purge: true + tags: [required_for_boot] diff --git a/roles/network/tasks/main.yml b/roles/network/tasks/main.yml index e8bca0be..cb8f1fd9 100644 --- a/roles/network/tasks/main.yml +++ b/roles/network/tasks/main.yml @@ -22,6 +22,7 @@ ff02::2 ip6-allrouters when: hostname is defined # Not required for boot + tags: [] - name: "Include OS-specific variables" ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml" @@ -44,9 +45,17 @@ become: true tags: [required_for_boot] notify: - - "Restart network services" - "Reload systemd" + - "Restart NetworkManager" + - "Restart systemd-networkd" + - "Restart systemd-resolved" block: + - name: "Configure systemd-resolved" + ansible.builtin.template: + src: "resolved.conf.j2" + dest: "/etc/systemd/resolved.conf" + mode: "0644" + - name: "Configure NetworkManager" ansible.builtin.template: src: "NetworkManager.conf.j2" diff --git a/roles/network/templates/NetworkManager.conf.j2 b/roles/network/templates/NetworkManager.conf.j2 index 2fb39f4d..49dcd9bf 100644 --- a/roles/network/templates/NetworkManager.conf.j2 +++ b/roles/network/templates/NetworkManager.conf.j2 @@ -4,6 +4,7 @@ uri=https://ping.archlinux.org [main] dhcp=dhcpcd plugins=ifupdown,keyfile +dns=systemd-resolved [device-mac-randomization] wifi.scan-rand-mac-address=yes @@ -18,6 +19,7 @@ wifi.cloned-mac-address=stable ipv6.ip6-privacy=2 ipv6.dhcp-duid=stable-uuid wifi.powersave=2 +connection.mdns=2 [logging] level=INFO diff --git a/roles/network/templates/resolved.conf.j2 b/roles/network/templates/resolved.conf.j2 new file mode 100644 index 00000000..1893e882 --- /dev/null +++ b/roles/network/templates/resolved.conf.j2 @@ -0,0 +1,24 @@ +[Resolve] +DNS=1.1.1.1 2606:4700:4700::1111#cloudflare-dns.com 8.8.8.8 2001:4860:4860::8888#dns.google +FallbackDNS=1.0.0.1 2606:4700:4700::1001#cloudflare-dns.com 8.8.4.4 2001:4860:4860::8844#dns.google 9.9.9.9 2620:fe::fe#quad9.net + +DNSSEC=yes +DNSOverTLS=yes + +# Enable multicast DNS for .local domain resolution (replaces avahi functionality) +MulticastDNS=yes + +# Enable LLMNR for Windows network compatibility +LLMNR=yes + +Cache=yes +CacheFromLocalhost=no + +# Enable DNS stub listener on 127.0.0.53:53 +DNSStubListener=yes + +# Read /etc/hosts file +ReadEtcHosts=yes + +# Don't resolve single-label names via unicast DNS +ResolveUnicastSingleLabel=no diff --git a/roles/network/vars/debian.yml b/roles/network/vars/debian.yml index 406fef9e..931a33e6 100644 --- a/roles/network/vars/debian.yml +++ b/roles/network/vars/debian.yml @@ -1,8 +1,10 @@ --- network_packages: - - "avahi-daemon" + - "dhcpcd" + - "systemd-resolved" - "network-manager" network_services: - - "avahi-daemon" + - "systemd-resolved" + - "systemd-networkd" - "NetworkManager" -- cgit v1.2.3