src: /run/systemd/resolve/resolv.conf

        dest: /etc/resolv.conf

        owner: root

        group: root

        state: link

        attributes: '-i'

        force: true

      become: true

      tags: config

    - name: Start systemd-resolved

      ansible.builtin.service:

        name: "systemd-resolved"

        state: "started"

        enabled: "true"

      tags: config

    - name: Ensure /etc/iproute2 exists

      ansible.builtin.file:

        path: /etc/iproute2

        state: directory

        mode: '0755'

      tags: config

    - name: Copy routing table if non-existing

      ansible.builtin.copy:

        src: /usr/share/iproute2/rt_tables

        dest: /etc/iptables2/rt_tables

        force: false

      tags: config

    - name: Add the routing table for freifunk

      ansible.builtin.blockinfile:

        path: /etc/iproute2/rt_tables

        backup: true

        block: |

          # freifunk

          33      lux

          42      icvpn

          100     vpn

      tags: config

    # Modules

    - name: Load `br_netfilter` kernel module

      community.general.modprobe:

        name: "br_netfilter"

        persistent: "present"

        state: "present"

    - name: Add `nf_conntrack` to modules

      community.general.modprobe:

        name: "nf_conntrack"