ansible-freifunk-gateways/gw-playbook-he-net.yml at main · Freifunk-Potsdam/ansible-freifunk-gateways · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
---
- hosts:
    - ffp_gw_he_net

  collections:
    - devsec.hardening
    - freifunk_potsdam.gluon

  roles:
    - weareinteractive.users
    - Frzk.nftables
    - stuvusit.systemd-journald
    - hafu.systemd_timesyncd
    - ssh_hardening
    # collection: freifunk_potsdam.gluon
    - system_packages
    - default_network
    - policy_routing
    - wireguard_client
    - batman_adv
    - gw2gw_l2tp
    - fastd_server
    - isc_dhcp_server
    - bind_server
    - radvd

  pre_tasks:

    - name: Allow users in group sudo to switch without password
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        state: present
        regexp: '^%sudo\sALL='
        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
        validate: /usr/sbin/visudo -cf %s

    - name: Remove tunneldigger client configuration
      block:
        - name: Check for tunneldigger service file
          register: tunneldigger_service_file_stat
          ansible.builtin.stat:
            path: "/etc/systemd/system/{{ tunneldigger_client_service_file_base_name | default('tunneldigger-client') }}.service"

        - name: Stop and disable tunneldigger service
          ansible.builtin.systemd:
            service: "{{ tunneldigger_client_service_file_base_name | default('tunneldigger-client') }}.service"
            state: stopped
            enabled: false
          when: tunneldigger_service_file_stat.stat.exists
          notify:
            - Restart systemd-networkd

        - name: Remeove service and network file
          ansible.builtin.file:
            path: "{{ item }}"
            state: absent
          loop:
            - "/etc/systemd/system/{{ tunneldigger_client_service_file_base_name | default('tunneldigger-client') }}.service"
            - "/etc/systemd/network/60-{{ tunneldigger_client_ifname | default('tunneldigger-client') }}.network"
          notify:
            - Restart systemd-networkd

    - name: Remove he.net tunnel network configuration
      block:
        - name: Remove systemd-network configuration files
          ansible.builtin.file:
            path: "/etc/systemd/network/40-he-ipv6.{{ item }}"
            state: absent
          loop:
            - netdev
            - network
          notify:
            - Restart systemd-networkd

  tasks: []

  handlers:
    - name: "Restart systemd-networkd"
      ansible.builtin.systemd:
        service: systemd-networkd
        state: restarted