il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(dns): set source of dns domain on fw.yaml

Browse Source
This commit is contained in:
il
2026-06-29 11:46:53 +09:00
parent 5ccb60bd2a
commit 88e85fff56
43 changed files with 606 additions and 406 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/node/app/nftables.conf.j2
+6 -6
View File
@@ -1,12 +1,12 @@
#!/usr/sbin/nft -f
flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }}
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_AUTH = {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
define PORTS_SSH = 22
define PORTS_HTTP = 80
define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
config/node/auth/nftables.conf.j2
+4 -4
View File
@@ -1,10 +1,10 @@
#!/usr/sbin/nft -f
flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22
define PORTS_HTTP = 80
define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
config/node/bk/nftables.conf.j2
+8 -8
View File
@@ -1,14 +1,14 @@
#!/usr/sbin/nft -f
flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network6']['infra']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network6']['app']['server'] }}
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_INFRA = {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network']['app']['ipv4']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network']['app']['ipv6']['server'] }}
define PORTS_SSH = 22
define PORTS_HTTPS = 443
define PORTS_KOPIA = {{ services['kopia']['ports']['https'] }}
config/node/common/hosts.j2
+34 -36
View File
@@ -1,36 +1,34 @@
# localhost
127.0.0.1 {{ node['local_san'] }}
::1 {{ node['local_san'] }}
{% if node['name'] == 'console' %}
# Hosts IPv4
{{ hostvars['fw']['network4']['firewall']['server'] }} fw.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['bk']['server'] }} bk.{{ domain['internal'] }} kopia.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['vmm']['client'] }} init.vmm.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['vmm']['server'] }} vmm.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['infra']['server'] }} infra.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['auth']['server'] }} auth.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['app']['server'] }} app.{{ domain['internal'] }}
# Hosts IPv6
{{ hostvars['fw']['network6']['firewall']['server'] }} fw.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['bk']['server'] }} bk.{{ domain['internal'] }} kopia.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['vmm']['client'] }} init.vmm.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['vmm']['server'] }} vmm.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['infra']['server'] }} infra.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['auth']['server'] }} auth.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['app']['server'] }} app.{{ domain['internal'] }}
{% else %}
# IPv4
# Crowdsec, blocky, bind(fw)
{{ hostvars['fw']['network4']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['blocky']['server'] }} blocky.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['bind']['server'] }} bind.{{ domain['internal'] }}
# DB, LDAP, CA, Prometheus, Loki, mail (infra)
{{ hostvars['fw']['network4']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
# IPv6
# Crowdsec, blocky, bind(fw)
{{ hostvars['fw']['network6']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['blocky']['server'] }} blocky.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['bind']['server'] }} bind.{{ domain['internal'] }}
# DB, LDAP, CA, Prometheus, Loki, mail (infra)
{{ hostvars['fw']['network6']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
{% endif %}
# Managed by Ansible
# Bootstrap name resolution only.
# Full service discovery is handled by BIND.
127.0.0.1 localhost
::1 localhost
{% set net = hostvars['fw']['network'] %}
{%
set server_hosts = (
net
| dict2items
| rejectattr('key', 'equalto', 'dns_serial')
| rejectattr('key', 'equalto', 'subnet')
| rejectattr('key', 'equalto', 'reverse_zone')
| selectattr('value.ipv4.server', 'defined')
| selectattr('value.ipv6.server', 'defined')
| map(attribute='key')
| list
)
%}
# node canonical names
{% for ip in ['ipv4', 'ipv6'] %}
# {{ ip }}
## vmm init
{{ "%-36s" | format(net['vmm'][ip]['client']) }} init.vmm init.vmm.{{ domain['internal'] }}
## console
{{ "%-36s" | format(net['console'][ip]['client']) }} console console.{{ domain['internal'] }}
## nodes
{% for service in server_hosts %}
{{ "%-36s" | format(net[service][ip]['server']) }} {{ service }} {{ service }}.{{ domain['internal'] }}{% for alias in net[service]['alias'] | default([]) %}{% if service in ['vmm', 'fw'] and alias != 'init.vmm' %} {{ alias }}.{{ domain['internal'] }}{% endif %}{% endfor %}{{ '' }}
{% endfor %}
{% endfor %}
config/node/common/networkd/20-eth0.network
+6 -6
View File
@@ -3,11 +3,11 @@ Name=eth0
[Network]
# IPv4
Address={{ hostvars['fw']['network4'][target_vm]['server'] }}/24
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network'][target_vm]['ipv4']['server'] }}/24
Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6
IPv6AcceptRA=false
Address={{ hostvars['fw']['network6'][target_vm]['server'] }}/64
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
Address={{ hostvars['fw']['network'][target_vm]['ipv6']['server'] }}/64
Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/networkd/21-fw-client.network
+4 -4
View File
@@ -9,8 +9,8 @@ IPv6AcceptRA=false
VLAN=server
VLAN=user
# IPv4
Address={{ hostvars['fw']['network4']['firewall']['client'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv4']['client'] }}/24
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6
Address={{ hostvars['fw']['network6']['firewall']['client'] }}/64
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv6']['client'] }}/64
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/networkd/22-fw-server.network
+8 -8
View File
@@ -6,19 +6,19 @@ IPForward=true
IPv6SendRA=false
IPv6AcceptRA=false
# IPv4
Address={{ hostvars['fw']['network4']['firewall']['server'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}/24
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6
Address={{ hostvars['fw']['network6']['firewall']['server'] }}/64
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}/64
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
[Address]
Address={{ hostvars['fw']['network4']['blocky']['server'] }}/24
Address={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}/24
[Address]
Address={{ hostvars['fw']['network4']['bind']['server'] }}/24
Address={{ hostvars['fw']['network']['bind']['ipv4']['server'] }}/24
[Address]
Address={{ hostvars['fw']['network6']['blocky']['server'] }}/64
Address={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}/64
PreferredLifetime=0
[Address]
Address={{ hostvars['fw']['network6']['bind']['server'] }}/64
Address={{ hostvars['fw']['network']['bind']['ipv6']['server'] }}/64
PreferredLifetime=0
config/node/fw/networkd/23-fw-user.network
+3 -3
View File
@@ -7,8 +7,8 @@ IPv6PrefixDelegation=true
IPv6SendRA=true
IPv6SendRAExtension=false
# IPv4
Address={{ hostvars['fw']['network4']['firewall']['user'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv4']['user'] }}/24
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
[IPv6PrefixDelegation]
SubnetId=20
@@ -22,4 +22,4 @@ Managed=false
# O-Flag: Other information form DHCPv6
OtherInformation=false
EmitDNS=true
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/nftables.conf.j2
+29 -29
View File
@@ -9,39 +9,39 @@ define IF_SERVER = "server"
define IF_USER = "user"
define IF_WG = "wg0"
define NET4_CLIENT = {{ hostvars['fw']['network4']['subnet']['client'] }}
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET4_USER = {{ hostvars['fw']['network4']['subnet']['user'] }}
define NET4_WG = {{ hostvars['fw']['network4']['subnet']['wg'] }}
define NET4_LLA = {{ hostvars['fw']['network4']['subnet']['lla'] }}
define NET4_CLIENT = {{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET4_USER = {{ hostvars['fw']['network']['subnet']['ipv4']['user'] }}
define NET4_WG = {{ hostvars['fw']['network']['subnet']['ipv4']['wg'] }}
define NET4_LLA = {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }}
define NET4_RFC1918 = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }
define NET6_CLIENT = {{ hostvars['fw']['network6']['subnet']['client'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define NET6_WG = {{ hostvars['fw']['network6']['subnet']['wg'] }}
define NET6_LLA = {{ hostvars['fw']['network6']['subnet']['lla'] }}
define NET6_CLIENT = {{ hostvars['fw']['network']['subnet']['ipv6']['client'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define NET6_WG = {{ hostvars['fw']['network']['subnet']['ipv6']['wg'] }}
define NET6_LLA = {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }}
define HOSTS4_FW = { {{ hostvars['fw']['network4']['firewall'].values() | join(', ') }} }
define HOSTS4_BLOCKY = {{ hostvars['fw']['network4']['blocky']['server'] }}
define HOSTS4_BIND = {{ hostvars['fw']['network4']['bind']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS4_VMM = { {{ hostvars['fw']['network4']['vmm'].values() | join(', ') }} }
define HOSTS4_BK = {{ hostvars['fw']['network4']['bk']['server'] }}
define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }}
define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }}
define HOSTS4_SWITCH = {{ hostvars['fw']['network4']['switch']['client'] }}
define HOSTS4_PRINTER = {{ hostvars['fw']['network4']['printer']['client'] }}
define HOSTS4_FW = { {{ hostvars['fw']['network']['fw']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_BLOCKY = {{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
define HOSTS4_BIND = {{ hostvars['fw']['network']['bind']['ipv4']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_VMM = { {{ hostvars['fw']['network']['vmm']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_BK = {{ hostvars['fw']['network']['bk']['ipv4']['server'] }}
define HOSTS4_INFRA = {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}
define HOSTS4_AUTH = {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network']['app']['ipv4']['server'] }}
define HOSTS4_SWITCH = {{ hostvars['fw']['network']['switch']['ipv4']['client'] }}
define HOSTS4_PRINTER = {{ hostvars['fw']['network']['printer']['ipv4']['client'] }}
define HOSTS6_FW = { {{ hostvars['fw']['network6']['firewall'].values() | join(', ') }} }
define HOSTS6_BLOCKY = {{ hostvars['fw']['network6']['blocky']['server'] }}
define HOSTS6_BIND = {{ hostvars['fw']['network6']['bind']['server'] }}
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define HOSTS6_VMM = { {{ hostvars['fw']['network6']['vmm'].values() | join(', ') }} }
define HOSTS6_BK = {{ hostvars['fw']['network6']['bk']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network6']['infra']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network6']['app']['server'] }}
define HOSTS6_FW = { {{ hostvars['fw']['network']['fw']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_BLOCKY = {{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
define HOSTS6_BIND = {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_VMM = { {{ hostvars['fw']['network']['vmm']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_BK = {{ hostvars['fw']['network']['bk']['ipv6']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network']['app']['ipv6']['server'] }}
define PORTS_SSH = 22
define PORTS_WEB = { 80, 443 }
config/node/fw/wireguard/30-fw-wg0.netdev
+1 -1
View File
@@ -7,4 +7,4 @@ PrivateKey={{ hostvars['console']['wireguard']['server']['private_key'] }}
[WireGuardPeer]
PublicKey={{ hostvars['console']['wireguard']['console']['public_key'] }}
PresharedKey={{ hostvars['console']['wireguard']['console']['preshared_key'] }}
AllowedIPs={{ hostvars['fw']["network4"]["console"]["wg"] }}/32, {{ hostvars['fw']["network6"]["console"]["wg"] }}/128
AllowedIPs={{ hostvars['fw']["network"]["console"]['ipv4']["wg"] }}/32, {{ hostvars['fw']["network"]["console"]['ipv6']["wg"] }}/128
config/node/fw/wireguard/31-fw-wg0.network
+2 -2
View File
@@ -1,6 +1,6 @@
[Match]
Name=wg0
[Network]
Address={{ hostvars['fw']["network4"]["firewall"]["wg"] }}/24
Address={{ hostvars['fw']["network6"]["firewall"]["wg"] }}/64
Address={{ hostvars['fw']["network"]["fw"]['ipv4']["wg"] }}/24
Address={{ hostvars['fw']["network"]["fw"]['ipv6']["wg"] }}/64
IPForward=yes
config/node/infra/nftables.conf.j2
+4 -4
View File
@@ -3,10 +3,10 @@
# iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something
flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22
define PORTS_DB = 5432
define PORTS_CA = {{ services['ca']['ports']['https'] }}
config/node/vmm/networkd/24-vmm-vlan1.network.j2
+6 -6
View File
@@ -3,26 +3,26 @@ Name=vlan1
[Network]
# IPv4
Address={{ hostvars['fw']['network4']['vmm']['client'] }}/24
Address={{ hostvars['fw']['network']['vmm']['ipv4']['client'] }}/24
# IPv6
Address={{ hostvars['fw']['network6']['vmm']['client'] }}/64
Address={{ hostvars['fw']['network']['vmm']['ipv6']['client'] }}/64
[RoutingPolicyRule]
From={{ hostvars['fw']['network4']['vmm']['client'] }}/32
From={{ hostvars['fw']['network']['vmm']['ipv4']['client'] }}/32
Table=1
Priority=100
[Route]
Destination={{ hostvars['fw']['network4']['subnet']['client'] }}
Destination={{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}
Scope=link
Table=1
[RoutingPolicyRule]
From={{ hostvars['fw']['network6']['vmm']['client'] }}/128
From={{ hostvars['fw']['network']['vmm']['ipv6']['client'] }}/128
Table=61
Priority=100
[Route]
Destination={{ hostvars['fw']['network6']['subnet']['client'] }}
Destination={{ hostvars['fw']['network']['subnet']['ipv6']['client'] }}
Scope=link
Table=61
config/node/vmm/networkd/25-vmm-vlan10.network.j2
+10 -10
View File
@@ -3,30 +3,30 @@ Name=vlan10
[Network]
RequiredForOnline=false
# IPv4
Address={{ hostvars['fw']['network4']['vmm']['server'] }}/24
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['vmm']['ipv4']['server'] }}/24
Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6
Address={{ hostvars['fw']['network6']['vmm']['server'] }}/64
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['vmm']['ipv6']['server'] }}/64
Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
[RoutingPolicyRule]
From={{ hostvars['fw']['network4']['vmm']['server'] }}/32
From={{ hostvars['fw']['network']['vmm']['ipv4']['server'] }}/32
Table=2
Priority=100
[Route]
Destination=0.0.0.0/0
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
Table=2
[RoutingPolicyRule]
From={{ hostvars['fw']['network6']['vmm']['server'] }}/128
From={{ hostvars['fw']['network']['vmm']['ipv6']['server'] }}/128
Table=62
Priority=100
[Route]
Destination=::/0
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
Table=62
config/node/vmm/nftables.conf.j2
+2 -2
View File
@@ -3,8 +3,8 @@
# iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something
flush ruleset
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22
table inet filter {