Clément Désiles
8756eb1183
- smartctl_exporter (disks), fail2ban exporter, wireguard exporter - grafana dashboards for each exporter - prometheus: firewall source rules, honor_labels/params scrape config - node_exporter: zfs collector - wireguard: nftables dep, resolvconf wrapper, reload fix - remove superseded monitoring role
59 lines
2.0 KiB
YAML
59 lines
2.0 KiB
YAML
---
|
|
- name: Validate wireguard_tunnels is defined and non-empty
|
|
ansible.builtin.assert:
|
|
that:
|
|
- wireguard_tunnels is defined
|
|
- wireguard_tunnels | length > 0
|
|
fail_msg: |
|
|
wireguard_tunnels must be defined with at least one tunnel.
|
|
See roles/wireguard/defaults/main.yml for configuration instructions.
|
|
success_msg: "wireguard_tunnels validation passed"
|
|
|
|
- name: Install wireguard
|
|
ansible.builtin.package:
|
|
name: "{{ wireguard_package_name }}"
|
|
state: present
|
|
|
|
- name: Install nftables (Arch server_mode PostUp dependency)
|
|
ansible.builtin.package:
|
|
name: nftables
|
|
state: present
|
|
when:
|
|
- ansible_facts['os_family'] == 'Archlinux'
|
|
- wireguard_tunnels | selectattr('server_mode', 'defined') | selectattr('server_mode', 'equalto', true) | list | length > 0
|
|
|
|
# Use systemd-resolved for DNS management (modern approach on all distributions)
|
|
# wg-quick calls `resolvconf` (not resolvectl) to apply DNS, so the
|
|
# systemd-resolvconf compat wrapper must be installed wherever wg-quick is
|
|
# used to push DNS to the local host. On Arch, tunnels that need this should
|
|
# set `dns:` and install openresolv/systemd-resolvconf explicitly.
|
|
- name: Install systemd-resolvconf (provides resolvconf wrapper for wg-quick)
|
|
ansible.builtin.package:
|
|
name: systemd-resolvconf
|
|
state: present
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
|
|
- name: Ensure systemd-resolved is enabled and started
|
|
ansible.builtin.systemd:
|
|
name: systemd-resolved
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Ensure wireguard configuration is only owned by root
|
|
ansible.builtin.file:
|
|
path: "{{ wireguard_config_base_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
recurse: true
|
|
|
|
- name: Configure tunnel
|
|
ansible.builtin.include_tasks: tunnel.yml
|
|
loop: "{{ wireguard_tunnels }}"
|
|
loop_control:
|
|
loop_var: _tunnel
|
|
|
|
- name: Deploy Prometheus wireguard exporter
|
|
ansible.builtin.include_tasks: exporter.yml
|
|
when: wireguard_exporter_enabled | bool
|