---

- name: Initial Gateway Setup

  become: true

  become_method: ansible.builtin.sudo

  tasks:

    # Update packages

    - name: Update all packages to their latest version

      ansible.builtin.apt:

        update_cache: true

        upgrade: "yes"

      tags: update

    - name: Install a list of packages

      ansible.builtin.apt:

        update_cache: true

        pkg:

          - git

          - bridge-utils

          - batctl

          - ntp

          - dnsmasq

          - iptables-persistent

          - openvpn

          - fastd

          - build-essential

          - pkg-config

          - checkinstall

          - libnl-3-dev

          - libnl-genl-3-dev

          - linux-headers-amd64

          - systemd-resolved # We current use it later, but we don't really need it

          - dkms

          - lsb-release

          - ethtool

          - python3

          - wget # for fastd-blacklist

      tags: update

    # fix systemd-resolved's default config

    - name: Stop systemd-resolved

      ansible.builtin.service:

        name: "systemd-resolved"

        state: "stopped"

      tags: config

    - name: Copy resolved.conf

      ansible.builtin.copy:

        src: "{{ server_config_dir }}/systemd-resolved/resolved.conf"

        dest: /etc/systemd/resolved.conf

        owner: root

        group: root

        mode: "0644"

      tags: config

    - name: Create a symbolic link for resolv.conf, replacing the initial resolv.conf

      ansible.builtin.file:

        src: /run/systemd/resolve/resolv.conf

        dest: /etc/resolv.conf

        owner: root

        group: root

        state: link

        force: true

      tags: config

    - name: Start systemd-resolved

      ansible.builtin.service:

        name: "systemd-resolved"

        state: "started"

        enabled: "true"

      tags: config

    - name: Add the routing table for freifunk

      ansible.builtin.blockinfile:

        path: /etc/iproute2/rt_tables

        backup: true

        block: |

          # freifunk

          33      lux

          42      icvpn

          100     vpn

      tags: config

    # Modules

    - name: Load `br_netfilter` kernel module

      community.general.modprobe:

        name: "br_netfilter"

        persistent: "present"

        state: "present"

    - name: Add `nf_conntrack` to modules

      community.general.modprobe:

        name: "nf_conntrack"

        state: "present"

        persistent: "present"

      tags: config

    # Sysctl

    - name: Add the freifunk settings to sysctl config

      ansible.builtin.blockinfile:

        path: /etc/sysctl.conf

        block: |

          # Freifunk specific settings

# server list is here

# ansible_host = IP address of remote machine

# network_index = last number of MAC address (10-19)

# dhcp range = 10.24.XXX.1 - 10.24.YYY.1 // X = start_range, Y = end_ranges

fflux-test ansible_host=89.58.3.252 network_index=19 dhcp_start_range=188 dhcp_end_range=191 gateway_status="True" hardware_model="VPS 200 G8"

# machines which are used for tests

[test]

fflux-test

# variable for the test group come here

[test:vars]

#mac1=ca:fe:ca:fe:00:19

#ipv4=10.24.128.19

#ipv6=fd4e:f2d7:88d2:fffe::19

#vars_files: /etc/ansible/host_vars/firmware.freifunk.lu

# all machine variables come here

[all:vars]

ansible_python_interpreter=/usr/bin/python3

ansible_ssh_private_key_file=/home/fflux/.ssh/fflux_fflux

server_config_dir=~/repos/Infrastructure-Intern/server_config

server_scripts_dir=~/repos/Infrastructure-Intern/scripts

# new machine come here

[initial]

fflux-test

# machines which run api.freifunk.lu

[API]

# machines which run map.freifunk.lu

[MAP]

# machines which run stats.freifunk.lu

[STATS]

# machines which run firmware.freifunk.lu

[FIRMWARE]

# machines which run freifunk.lu

[WORDPRESS]

# machine which are gateways for freifunk.lu

[fflux]

[gateway]

fflux-test

[gw1]

[gw2]

[gw3]