--- install: vm: memory: 64M numcpus: 1 autostart: true disks: primary: /dev/sda scsi: sda: type: image path: "/srv/nvme/{{ inventory_hostname }}/root.img" interfaces: - bridge: br-c3voc - bridge: br-svc openwrt_arch: x86 openwrt_target: 64 openwrt_profile: generic openwrt_output_image_suffixes: - "{{ openwrt_profile }}-ext4-combined.img.gz" openwrt_packages_remove: - ppp - ppp-mod-pppoe - dnsmasq - firewall - firewall4 - odhcpd - odhcpd-ipv6only openwrt_packages_add: - nftables - kmod-nft-nat - rng-tools - htop - ip - less - nano - tcpdump-mini - iperf - iperf3 - mtr - iptraf-ng - prometheus-node-exporter-lua - prometheus-node-exporter-lua-netstat - prometheus-node-exporter-lua-openwrt openwrt_mixin: /etc/dropbear/authorized_keys: content: "{{ ssh_keys_root | join('\n') }}\n" /etc/htoprc: file: "{{ global_files_dir }}/common/htoprc" /etc/rc.d/S21nftables: link: "../init.d/nftables" /etc/rc.d/K89nftables: link: "../init.d/nftables" /etc/init.d/nftables: mode: "0755" content: | #!/bin/sh /etc/rc.common START=21 STOP=89 start() { nft -f /etc/nftables.conf } stop() { nft flush ruleset } /etc/nftables.conf: content: | flush ruleset define nic_svc = eth1 define prefixes_internal = { 192.168.0.0/16 } define nic_c3voc = eth0 define prefix_c3voc = {{ network_zones.c3voc.prefix }} table inet global { ## INPUT chain input_svc { ip protocol icmp accept ip6 nexthdr ipv6-icmp accept tcp dport { {{ ansible_port }} } accept ip saddr {{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets[prometheus_server]) | ansible.utils.ipaddr('address') }} tcp dport 9100 accept } chain input_c3voc { ip saddr != $prefix_c3voc drop ip protocol icmp accept ip6 nexthdr ipv6-icmp accept udp dport { ntp } accept } chain input { type filter hook input priority filter; policy drop; ct state vmap { established: accept, related: accept, invalid: drop } iifname vmap { lo: accept, $nic_svc: jump input_svc, $nic_c3voc: jump input_c3voc } } ## FORWARD chain forward { type filter hook forward priority filter; policy drop; ct state vmap { established: accept, related: accept, invalid: drop } iif $nic_svc oif $nic_c3voc ip daddr $prefix_c3voc accept iif $nic_c3voc ip saddr $prefix_c3voc oifname $nic_svc ip daddr != $prefixes_internal accept } } openwrt_uci: system: - name: system options: hostname: '{{ host_name }}' timezone: 'CET-1CEST,M3.5.0,M10.5.0/3' ttylogin: '0' log_size: '64' urandom_seed: '0' - name: timeserver 'ntp' options: enabled: '1' enable_server: '1' interface: 'c3voc' server: - '0.at.pool.ntp.org' - '1.at.pool.ntp.org' - '2.at.pool.ntp.org' - '3.at.pool.ntp.org' - name: rngd options: enabled: '1' device: '/dev/hwrng' dropbear: - name: dropbear options: PasswordAuth: 'off' RootPasswordAuth: 'off' Port: '{{ ansible_port | default(22) }}' uhttpd: - name: uhttpd main options: enabled: '0' prometheus-node-exporter-lua: - name: prometheus-node-exporter-lua 'main' options: listen_interface: 'svc' listen_port: '9100' network: - name: globals 'globals' options: ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48" - name: interface 'loopback' options: device: lo proto: static ipaddr: 127.0.0.1 netmask: 255.0.0.0 - name: interface 'c3voc' options: device: eth0 proto: static ipaddr: "{{ network_zones.c3voc.prefix | ansible.utils.ipaddr(network_zones.c3voc.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}" netmask: "{{ network_zones.c3voc.prefix | ansible.utils.ipaddr('netmask') }}" - name: interface 'svc' options: device: eth1 proto: static ipaddr: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}" netmask: "{{ network_zones.svc.prefix | ansible.utils.ipaddr('netmask') }}" gateway: "{{ network_zones.svc.gateway }}" dns: "{{ network_zones.svc.dns }}" - name: route 'lan' options: interface: svc target: "{{ network_zones.lan.prefix | ansible.utils.ipaddr('network') }}" netmask: "{{ network_zones.lan.prefix | ansible.utils.ipaddr('netmask') }}" gateway: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets['ch-gw-lan']) | ansible.utils.ipaddr('address') }}" prometheus_scrape_endpoint: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}:9100" prometheus_exporters_default: - openwrt