---

- name: Initial Gateway Setup

  hosts: initial-gateway

  become: true

  become_method: ansible.builtin.sudo

  tasks:

    # Update packages

    - name: Update all packages to their latest version

      ansible.builtin.apt:

        update_cache: true

        upgrade: "yes"

      tags: update

    - name: Install a list of packages

      ansible.builtin.apt:

        update_cache: true

        pkg:

          - git

          - bridge-utils

          - batctl

          - ntpsec

          - dnsmasq

          - iptables-persistent

          - openvpn

          - fastd

          - build-essential

          - pkg-config

          - checkinstall

          - libnl-3-dev

          - libnl-genl-3-dev

          - linux-headers-amd64

          - systemd-resolved # We current use it later, but we don't really need it

          - dkms

          - lsb-release

          - ethtool

          - python3

          - wget # for fastd-blacklist

      tags: update

    # fix systemd-resolved's default config

    - name: Stop systemd-resolved

      ansible.builtin.service:

        name: "systemd-resolved"

        state: "stopped"

      tags: config

    - name: Copy resolved.conf

      ansible.builtin.copy:

        src: "{{ server_config_dir }}/systemd-resolved/resolved.conf"

        dest: /etc/systemd/resolved.conf

        owner: root

        group: root

        mode: "0644"

      tags: config

    - name: Remove immutable attribute on resolv.conf

      ansible.builtin.file:

        dest: /etc/resolv.conf

        attributes: '-i'

      become: true

      tags: config

    - name: Create a symbolic link for resolv.conf, replacing the initial resolv.conf

      ansible.builtin.file:

        src: /run/systemd/resolve/resolv.conf

        dest: /etc/resolv.conf

        owner: root

        group: root

        state: link

        attributes: '-i'

        force: true

      become: true

      tags: config

    - name: Start systemd-resolved

      ansible.builtin.service:

        name: "systemd-resolved"

        state: "started"

        enabled: "true"

      tags: config

    - name: Ensure /etc/iproute2 exists

      ansible.builtin.file:

        path: /etc/iproute2

        state: directory

        mode: '0755'

      tags: config

    - name: Copy routing table if non-existing

      ansible.builtin.copy:

        remote_src: true

        src: /usr/share/iproute2/rt_tables

        dest: /etc/iproute2/rt_tables

        force: false

      tags: config

    - name: Add the routing table for freifunk

      ansible.builtin.blockinfile:

        path: /etc/iproute2/rt_tables

        backup: true

        block: |

          # freifunk

          33      lux

          42      icvpn

          100     vpn

      tags: config

    # Modules

    - name: Load `br_netfilter` kernel module

      community.general.modprobe:

        name: "br_netfilter"

        persistent: "present"

        state: "present"

    - name: Add `nf_conntrack` to modules

      community.general.modprobe:

        name: "nf_conntrack"

        state: "present"

        persistent: "present"

      tags: config

    # Sysctl

    - name: Add the freifunk settings to sysctl config

      ansible.builtin.blockinfile:

        block: |

          # Freifunk specific settings

          net.ipv4.ip_forward=1

          net.ipv4.icmp_errors_use_inbound_ifaddr=1

          net.bridge.bridge-nf-call-arptables = 0

          net.bridge.bridge-nf-call-ip6tables = 0

          net.bridge.bridge-nf-call-iptables = 0

          net.ipv6.conf.all.forwarding=1

          net.ipv6.conf.all.autoconf = 1

          net.ipv6.conf.default.autoconf = 0

          net.ipv6.conf.eth0.autoconf = 1

          net.ipv6.conf.all.accept_ra = 1

          net.ipv6.conf.default.accept_ra = 0

          net.ipv6.conf.eth0.accept_ra = 1

          net.ipv4.conf.default.rp_filter = 2

      tags: config

    - name: Reload sysctl config

      ansible.builtin.shell: sysctl -p /etc/sysctl.conf

      tags: config

    # Basic networking

    - name: Setup network interfaces (bridge + bat0)

      ansible.builtin.template:

        src: "{{ server_config_dir }}/interface/freifunk.j2"

        dest: /etc/network/interfaces.d/freifunk

        owner: root

        group: root

        mode: "0644"

      tags: config

    - name: Pull up new interfaces

      ansible.builtin.command: /usr/sbin/ifup -a

      tags: config

    - name: Copy iptables rulesv4

      ansible.builtin.copy:

        src: "{{ server_config_dir }}/iptables/rules.v4"

        dest: /etc/iptables/rules.v4

        owner: root

        group: root

        mode: "0644"

      tags: config

    - name: Restart iptables-persistent

      ansible.builtin.service:

        name: "netfilter-persistent"

        state: "restarted"

        enabled: true

      tags: config

    - name: Setup dnsmasq config w/ IPv4 ranges

      ansible.builtin.template:

        src: "{{ server_config_dir }}/dnsmasq/fflux.j2"

        dest: /etc/dnsmasq.d/fflux

        owner: root

        group: root

        mode: "0644"

      tags: config

    # fastd

    - name: Make sure fastd is disabled and stopped

      ansible.builtin.service:

        name: "fastd"

        state: "stopped"

        enabled: false

      tags: config

    - name: Create the fflux dir inside of fastd

      ansible.builtin.file:

        path: /etc/fastd/fflux

        state: directory

        mode: "0755"

      tags: config

    - name: Setup fastd (fflux) config w/ MAC address

      ansible.builtin.template:

        src: "{{ server_config_dir }}/fastd/fastd.conf.j2"

        dest: /etc/fastd/fflux/fastd.conf

        owner: root

        group: root

        mode: "0644"

      tags: config

    - name: Create peers-gw directory in fastd/fflux

      ansible.builtin.file:

        path: /etc/fastd/fflux/peers-gw

        state: directory

        mode: "0755"

      tags: config

    - name: List all peers but ourselves

      ansible.builtin.find:

        path: "{{ server_config_dir }}/fastd/peers-gw/"

        excludes: "{{ inventory_hostname }}"

      delegate_to: localhost

      become: false

      register: peers_to_copy

      tags: config

    - name: Copy fastd peers

      ansible.builtin.copy:

        src: "{{ item.path }}"

        dest: /etc/fastd/fflux/peers-gw/

        owner: root

        mode: "0644"

      with_items: "{{ peers_to_copy.files }}"

      tags: config

    - name: Copy fastd blacklist script

      ansible.builtin.copy:

        src: "{{ server_scripts_dir }}/fastd-blacklist.sh"

        dest: /etc/fastd/fflux/fastd-blacklist.sh

        owner: root

        group: root

        mode: "0755"

      tags: config

    - name: Copy fastd key

      ansible.builtin.copy:

        src: "~/keys/{{ inventory_hostname }}.conf"

        dest: /etc/fastd/fflux/secret.conf

        owner: root

        group: root

        mode: "0640"

    - name: Start + Enable fastd

      ansible.builtin.service:

        name: "fastd@fflux"

        state: "started"

        enabled: true

      tags: config

    # OpenVPN

    - name: Remove client directory

      ansible.builtin.file:

        path: /etc/openvpn/client

        state: absent

      tags: config

    - name: Remove server directory

      ansible.builtin.file:

        path: /etc/openvpn/server

        state: absent

      tags: config

    - name: Copy VPN config

      ansible.builtin.copy:

        src: "{{ server_config_dir }}/openvpn/mullvad.conf"

        dest: /etc/openvpn/mullvad.conf

        owner: root

        group: root

        mode: "0644"

      tags: config

    - name: Copy VPN auth file

      ansible.builtin.copy:

        src: "{{ server_config_dir }}/openvpn/mullvad_userpass.txt"

        dest: /etc/openvpn/mullvad_userpass.txt

        owner: root

        group: root

        mode: "0640"

      tags: config

    - name: Copy VPN CA file

      ansible.builtin.copy:

        src: "{{ server_config_dir }}/openvpn/mullvad_ca.crt"

        dest: /etc/openvpn/mullvad_ca.crt

        owner: root

        group: root

        mode: "0644"

      tags: config

    - name: Copy hideme-up script

      ansible.builtin.copy:

        src: "{{ server_scripts_dir }}/hideme-up"

        dest: /etc/openvpn/hideme-up

        owner: root

        group: root

        mode: "0755"

      tags: config

    - name: Copy hideme-down script

      ansible.builtin.copy:

        src: "{{ server_scripts_dir }}/hideme-down"

        dest: /etc/openvpn/hideme-down

        owner: root

        group: root

        mode: "0755"

      tags: config

    - name: Copy update-resolv-conf

      ansible.builtin.copy:

        src: "{{ server_config_dir }}/openvpn/update-resolv-conf"

        dest: /etc/openvpn/update-resolv-conf

        owner: root

        group: root

        mode: "0755"

      tags: config

    - name: Ensure OpenVPN sevice is enabled + starts

      ansible.builtin.service:

        name: "openvpn@mullvad"

        state: "started"

        enabled: true

      tags: config

    # batman-adv

    - name: Add batman-adv to modules

      community.general.modprobe:

        name: "batman-adv"

        state: "present"

        persistent: "present"

      tags: config

    - name: Add nf_conntrack to modules

      community.general.modprobe:

        name: "nf_conntrack"

        state: "present"

        persistent: "present"

      tags: config

    - name: Add ebtables to modules

      community.general.modprobe:

        name: "ebtables"

        state: "present"

        persistent: "present"

      tags: config

    # "check" scripts

    - name: Copy check gateway script

      ansible.builtin.copy:

        src: "{{ server_scripts_dir }}/check_gateway.sh"

        dest: /usr/local/bin

        owner: root

        group: root

        mode: "0755"

      tags: config

    - name: Copy check vpn script

      ansible.builtin.copy:

        src: "{{ server_scripts_dir }}/check_vpn.sh"

        dest: /usr/local/bin

        owner: root

        group: root

        mode: "0755"

      tags: config

    # mesh-announce

    - name: Clone mesh-announce git repo

      ansible.builtin.git:

        repo: "https://github.com/ffnord/mesh-announce"

        dest: /opt/mesh-announce

        # TODO: Verify that there has been no update!

        version: 40be9a18ee91fa058478bc04105cbd79fd70279e

        force: true # Removes local changes

      tags: config

    - name: Configure respondd.service file

      ansible.builtin.lineinfile:

        path: /opt/mesh-announce/respondd.service

        regexp: "^ExecStart="

        line: "ExecStart=/opt/mesh-announce/respondd.py -d /opt/mesh-announce/providers -f /opt/mesh-announce/respondd.conf"

        state: present

      tags: config

    - name: Symbolic link for respondd.service

      ansible.builtin.file:

        src: /opt/mesh-announce/respondd.service

        dest: /etc/systemd/system/respondd.service

        owner: root

        group: root

        state: link

        force: true

      tags: config

    - name: Copy respondd.conf template w/ IP + Hardware

      ansible.builtin.template:

        src: "{{ server_config_dir }}/respondd.conf.j2"

        dest: /opt/mesh-announce/respondd.conf

        owner: root

        mode: "0644"

      tags: config

    - name: Enable + Start respondd.service

      ansible.builtin.service:

        name: "respondd"

        state: "started"

        enabled: "true"

      tags: config

    # dnsmasq

    - name: Make sure dnsmasq is started

      ansible.builtin.service:

        name: "dnsmasq"

        state: "started"

        enabled: "true"

      tags: config

    - name: Reload dnsmasq

      ansible.builtin.service:

        name: "dnsmasq"

        state: "reloaded"

      tags: config

    # Crontab

    - name: Add check_gateway to cron

      ansible.builtin.cron:

        name: "check if gateway is online"

        user: root

        job: "/usr/local/bin/check_gateway.sh > /dev/null 2>&1"

        state: "present"

        minute: "*"

        hour: "*"

        day: "*"

        month: "*"

        weekday: "*"

      tags: config

    - name: Add check_vpn to cron

      ansible.builtin.cron:

        name: "check if vpn is online"

        user: root

        job: "/usr/local/bin/check_vpn.sh > /dev/null 2>&1"

        state: "present"

        minute: "*"

        hour: "*"

        day: "*"

        month: "*"

        weekday: "*"

      tags: config

    - name: Regularly download the peer blacklist

      ansible.builtin.cron:

        name: "download blacklist"

        user: root

        job: "echo \"TODO: add blacklist working download (accessible publicly via link\""

        state: "present"

        minute: "*/5"

        hour: "*"

        day: "*"

        month: "*"

        weekday: "*"

      tags: config

    # Reboot and reconnect

    - name: Reboot host and wait for it to restart

      ansible.builtin.reboot:

        msg: "Reboot initiated by Ansible"

        connect_timeout: 5

        reboot_timeout: 600

        pre_reboot_delay: 0

        post_reboot_delay: 30

        test_command: whoami