improve vm-host network config

2 files changed, 63 insertions, 44 deletions

diff --git a/roles/vm/host/tasks/network.yml b/roles/vm/host/tasks/network.yml
index 0c7e36f9..abacf9ab 100644
--- a/roles/vm/host/tasks/network.yml
+++ b/roles/vm/host/tasks/network.yml
@@ -1,41 +1,60 @@
 ---
-- name: create interface config
-  copy:
-    dest: "/etc/network/interfaces.d/{{ vm_host.network.interface }}"
-    content: |
-      auto {{ vm_host.network.interface }}
-      iface {{ vm_host.network.interface }} inet static
-        address {{ vm_host.network.prefix | ipaddr('address') }}
-        netmask {{ vm_host.network.prefix | ipaddr('netmask') }}
-        bridge_ports none
-        bridge_stp off
-        bridge_waitport 0
-        bridge_fd 0
-        up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/accept_ra
-        up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/autoconf
-        up modprobe br_netfilter
-        up /sbin/sysctl net.bridge.bridge-nf-call-iptables=0
-        up /sbin/sysctl net.bridge.bridge-nf-call-ip6tables=0
-        up /sbin/sysctl net.bridge.bridge-nf-call-arptables=0
-      {% if 'nat' in vm_host.network and vm_host.network.nat %}
-        up echo 1 > /proc/sys/net/ipv4/conf/$IFACE/forwarding
-        up echo 1 > /proc/sys/net/ipv4/conf/{{ ansible_default_ipv4.interface }}/forwarding
-        up /sbin/iptables -t nat -A POSTROUTING -o {{ ansible_default_ipv4.interface }} -s {{ vm_host.network.prefix | ipaddr('network/prefix') }} -j SNAT --to {{ ansible_default_ipv4.address }}
-      {% endif %}
-      {% if 'public' in vm_host.network %}
-      {%   for dest in vm_host.network.public.mappings %}
-        up /bin/ip route add {{ (vm_host.network.public.prefix | ipaddr(vm_host.network.public.mappings[dest])).split('/')[0] }}/32 via {{ (vm_host.network.prefix | ipaddr(vm_host.network.offsets[dest])).split('/')[0] }}  # {{ dest }}
-      {%   endfor %}
-        up /bin/ip route add unreachable {{ vm_host.network.public.prefix }}
-        down /sbin/ip route del {{ vm_host.network.public.prefix }}
-      {% endif %}
-      {% if 'nat' in vm_host.network and vm_host.network.nat %}
-        down /sbin/iptables -t nat -D POSTROUTING -o {{ ansible_default_ipv4.interface }} -s {{ vm_host.network.prefix | ipaddr('network/prefix') }} -j SNAT --to {{ ansible_default_ipv4.address }}
-      {% endif %}
-  register: vmhost_interface_config
+- name: create network bridges
+  when: "'bridges' in vm_host.network"
+  block:
+    - name: generate bridge interface config
+      loop: "{{ vm_host.network.bridges | dict2items }}"
+      loop_control:
+        label: "{{ item.key }}"
+      copy:
+        dest: "/etc/network/interfaces.d/br-{{ item.key }}"
+        content: |
+          auto br-{{ item.key }}
+          {% if 'prefix' in item.value %}
+          iface br-{{ item.key }} inet static
+            address {{ item.value.prefix | ipaddr('address') }}
+            netmask {{ item.value.prefix | ipaddr('netmask') }}
+          {% else %}
+          iface br-{{ item.key }} inet manual
+          {% endif %}
+          {% if 'interfaces' in item.value and (item.value.interfaces | length) > 0 %}
+            bridge_ports {{ item.value.interfaces | join(' ') }}
+          {% else %}
+            bridge_ports none
+          {% endif %}
+            bridge_stp off
+            bridge_waitport 0
+            bridge_fd 0
+            up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/accept_ra
+            up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/autoconf
+            up modprobe br_netfilter
+            up /sbin/sysctl net.bridge.bridge-nf-call-iptables=0
+            up /sbin/sysctl net.bridge.bridge-nf-call-ip6tables=0
+            up /sbin/sysctl net.bridge.bridge-nf-call-arptables=0
+          {% if 'prefix' in item.value %}
+          {%   if 'nat' in item.value and item.value.nat %}
+            up echo 1 > /proc/sys/net/ipv4/conf/$IFACE/forwarding
+            up echo 1 > /proc/sys/net/ipv4/conf/{{ ansible_default_ipv4.interface }}/forwarding
+            up /sbin/iptables -t nat -A POSTROUTING -o {{ ansible_default_ipv4.interface }} -s {{ item.value.prefix | ipaddr('network/prefix') }} -j SNAT --to {{ ansible_default_ipv4.address }}
+          {%   endif %}
+          {%   if 'overlay' in item.value %}
+          {%     for dest in item.value.overlay.offsets %}
+            up /bin/ip route add {{ (item.value.overlay.prefix | ipaddr(item.value.overlay.offsets[dest])).split('/')[0] }}/32 via {{ (item.value.prefix | ipaddr(item.value.offsets[dest])).split('/')[0] }}  # {{ dest }}
+          {%     endfor %}
+            up /bin/ip route add unreachable {{ item.value.overlay.prefix }}
+            down /sbin/ip route del {{ item.value.overlay.prefix }}
+          {%   endif %}
+          {%   if 'nat' in item.value and item.value.nat %}
+            down /sbin/iptables -t nat -D POSTROUTING -o {{ ansible_default_ipv4.interface }} -s {{ item.value.prefix | ipaddr('network/prefix') }} -j SNAT --to {{ ansible_default_ipv4.address }}
+          {%   endif %}
+          {% endif %}
+      register: vmhost_bridge_config
 
-## We don't try to be to clever here: aka don't call ifdown before ifup because
-## if there are VMs running they would end up with a broken network
-- name: bring vm-host interface up
-  when: vmhost_interface_config is changed
-  command: "/sbin/ifup {{ vm_host.network.interface }}"
+    ## We don't try to be to clever here: aka don't call ifdown before ifup because
+    ## if there are VMs running they would end up with a broken network
+    - name: bring up bridge interfaces
+      loop: "{{ vmhost_bridge_config.results }}"
+      loop_control:
+        label: "br-{{ item.item.key }}"
+      when: item is changed
+      command: "/sbin/ifup br-{{ item.item.key }}"
diff --git a/roles/vm/network/templates/interfaces.j2 b/roles/vm/network/templates/interfaces.j2
index aa94440e..db0e322f 100644
--- a/roles/vm/network/templates/interfaces.j2
+++ b/roles/vm/network/templates/interfaces.j2
@@ -14,11 +14,11 @@ iface {{ network.primary.interface }} inet static
   pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/autoconf
   address {{ network.primary.ip }}
   netmask {{ network.primary.mask }}
-{% if 'public' in network.primary %}
-  up /bin/ip addr add dev $IFACE {{ network.primary.public }}/32
-  up /bin/ip route add default via {{ network.primary.gateway }} src {{ network.primary.public }}
-  down /bin/ip route del default via {{ network.primary.gateway }} src {{ network.primary.public }}
-  down /bin/ip addr del dev $IFACE {{ network.primary.public }}/32
+{% if 'overlay' in network.primary %}
+  up /bin/ip addr add dev $IFACE {{ network.primary.overlay }}/32
+  up /bin/ip route add default via {{ network.primary.gateway }} src {{ network.primary.overlay }}
+  down /bin/ip route del default via {{ network.primary.gateway }} src {{ network.primary.overlay }}
+  down /bin/ip addr del dev $IFACE {{ network.primary.overlay }}/32
 {% else %}
   gateway {{ network.primary.gateway }}
 {% endif %}