--- ssh_users_root: - equinox - datacop openwrt_arch: x86 openwrt_target: geode openwrt_profile: generic openwrt_output_image_suffixes: - "{{ openwrt_profile }}-ext4-combined.img.gz" openwrt_packages_remove: - ppp - ppp-mod-pppoe - firewall - dnsmasq - odhcpd-ipv6only - linux-atm - kmod-pppoa - kmod-mppe - ppp-mod-pppoa - pppstats - pppdump - iwinfo - soloscli openwrt_packages_add: - haveged - htop - ip - less - nano - olsrd - olsrd-mod-txtinfo - tcpdump-mini - iperf - iperf3 - mtr - iptraf-ng - prometheus-node-exporter-lua - prometheus-node-exporter-lua-netstat - prometheus-node-exporter-lua-openwrt openwrt_mixin: /etc/dropbear/authorized_keys: content: "{{ ssh_keys_root | join('\n') }}\n" /etc/htoprc: file: "{{ global_files_dir }}/common/htoprc" /etc/rc.d/S22network-fw: link: "../init.d/network-fw" /etc/rc.d/K92network-fw: link: "../init.d/network-fw" /etc/init.d/network-fw: mode: "0755" content: | #!/bin/sh /etc/rc.common START=22 STOP=91 start() { FF_IF=$(uci get network.ff.device) FFSUBNET_IF=$(uci get network.ffsubnet.device) FFSUBNET_IPADDR=$(uci get network.ffsubnet.ipaddr) FFSUBNET_NETMASK=$(uci get network.ffsubnet.netmask) iptables -A FORWARD -i "$FFSUBNET_IF" -o "$FF_IF" -s "$FFSUBNET_IPADDR/$FFSUBNET_NETMASK" -j ACCEPT iptables -A FORWARD -i "$FF_IF" -o "$FFSUBNET_IF" -d "$FFSUBNET_IPADDR/$FFSUBNET_NETMASK" -j ACCEPT iptables -P FORWARD DROP } stop() { iptables -P FORWARD ACCEPT iptables -F FORWARD } openwrt_uci: system: - name: system options: hostname: '{{ host_name }}' timezone: 'CET-1CEST,M3.5.0,M10.5.0/3' ttylogin: '0' log_size: '64' urandom_seed: '0' - name: timeserver 'ntp' options: enabled: '1' enable_server: '0' server: - '0.lede.pool.ntp.org' - '1.lede.pool.ntp.org' - '2.lede.pool.ntp.org' - '3.lede.pool.ntp.org' dropbear: - name: dropbear options: PasswordAuth: 'off' RootPasswordAuth: 'off' Port: '{{ ansible_port }}' network: - name: globals 'globals' options: ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48" - name: interface 'loopback' options: device: lo proto: static ipaddr: 127.0.0.1 netmask: 255.0.0.0 - name: interface 'mgmt' options: device: eth2 proto: static ipaddr: "{{ network_zones.mgmt.prefix | ansible.utils.ipaddr(network_zones.mgmt.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}" netmask: "{{ network_zones.mgmt.prefix | ansible.utils.ipaddr('netmask') }}" - name: interface 'ffsubnet' options: device: eth1 proto: static ipaddr: "{{ network_zones.funkfeuer.prefix | ansible.utils.ipaddr(network_zones.funkfeuer.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}" netmask: "{{ network_zones.funkfeuer.prefix | ansible.utils.ipaddr('netmask') }}" - name: interface 'ff' options: device: eth0 proto: static ipaddr: 10.12.91.28 netmask: 255.255.0.0 dns: "{{ network_zones.funkfeuer.dns }}" olsrd: - name: olsrd options: IpVersion: '4' FIBMetric: 'flat' LinkQualityLevel: '2' LinkQualityAlgorithm: 'etx_ff' OlsrPort: '698' UseNiit: 'no' SmartGateway: 'no' MainIp: 10.12.91.28 RtTableDefault: 253 - name: LoadPlugin options: library: olsrd_txtinfo.so.1.1 accept: 127.0.0.1 - name: InterfaceDefaults options: Mode: ether - name: Interface options: interface: - ff IPv4Src: 10.12.91.28 - name: Hna4 options: netaddr: "{{ network_zones.funkfeuer.prefix | ansible.utils.ipaddr('network') }}" netmask: "{{ network_zones.funkfeuer.prefix | ansible.utils.ipaddr('netmask') }}" prometheus-node-exporter-lua: - name: prometheus-node-exporter-lua 'main' options: listen_interface: 'mgmt' listen_ipv6: '0' listen_port: '9100' prometheus_scrape_endpoint: "{{ network_zones.mgmt.prefix | ansible.utils.ipaddr(network_zones.mgmt.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}:9100" prometheus_exporters_default: - openwrt