mirror of
https://github.com/iiab/iiab.git
synced 2025-02-13 19:52:06 +00:00
43 lines
2.7 KiB
YAML
43 lines
2.7 KiB
YAML
- name: '2021-07-27: SEE ALSO ~3 networking packages EARLIER installed by https://github.com/iiab/iiab/blob/master/roles/1-prep/tasks/raspberry_pi.yml'
|
|
meta: noop
|
|
|
|
- name: '2021-07-27: SEE ALSO ~4 networking packages EARLIER installed by https://github.com/iiab/iiab/blob/master/roles/2-common/tasks/packages.yml'
|
|
meta: noop
|
|
|
|
- name: Install package networkd-dispatcher (OS's other than RaspiOS)
|
|
package:
|
|
name: networkd-dispatcher # Dispatcher service for systemd-networkd connection status changes
|
|
state: present
|
|
when: not is_raspbian
|
|
|
|
- name: 'Install network packages: hostapd, iproute2, iptables-persistent, netmask -- later used by https://github.com/iiab/iiab/tree/master/roles/network'
|
|
package:
|
|
name:
|
|
- hostapd # IEEE 802.11 AP and IEEE 802.1X/WPA/WPA2/EAP Authenticator -- has its service masked out of the box, and only used when IIAB's network roles detects the presence of WiFi and an AP is desired
|
|
- iproute2 # 2021-07-27: RaspiOS installs this regardless -- the new networking and traffic control tools, meant to replace net-tools
|
|
- iptables-persistent # Boot-time loader for netfilter rules, iptables (firewall) plugin -- however 'netfilter' is ever moving forward so keep an eye on it!
|
|
- netmask # Handy utility -- helps determine network masks
|
|
state: present
|
|
|
|
- name: Install /etc/network/if-pre-up.d/iptables from template (0755, debuntu)
|
|
template:
|
|
src: iptables
|
|
dest: /etc/network/if-pre-up.d/iptables
|
|
mode: '0755'
|
|
|
|
# Ongoing rework (e.g. PR #2652) arising from ansible.posix collection changes:
|
|
- name: "Use 'sysctl' to set 'kernel.core_uses_pid: 1' + 4 network settings in /etc/sysctl.conf -- e.g. disabling IPv6 (this might be overkill, as IPv6 should really only be disabled on the LAN side, i.e. br0)"
|
|
sysctl: # Places these settings in /etc/sysctl.conf, to survive reboot
|
|
name: "{{ item.name }}"
|
|
value: "{{ item.value }}"
|
|
with_items:
|
|
- { name: 'net.ipv4.ip_forward', value: '1' } # Masquerading LAN->Internet
|
|
- { name: 'net.ipv4.conf.default.rp_filter', value: '1' }
|
|
- { name: 'net.ipv4.conf.default.accept_source_route', value: '0' }
|
|
#- { name: 'kernel.sysrq', value: '1' } # OS values differ, Ok?
|
|
- { name: 'kernel.core_uses_pid', value: '1' }
|
|
#- { name: 'net.ipv4.tcp_syncookies', value: '1' } # Very standard in 2020
|
|
#- { name: 'kernel.shmmax', value: '268435456' } # OS values differ, Ok?
|
|
- { name: 'net.ipv6.conf.all.disable_ipv6', value: '1' } # IPv6 disabled
|
|
#- { name: 'net.ipv6.conf.default.disable_ipv6', value: '1' } # AUTO-SET
|
|
#- { name: 'net.ipv6.conf.lo.disable_ipv6', value: '1' } # BY ABOVE
|