You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
93 lines
2.5 KiB
93 lines
2.5 KiB
--- |
|
- name: top level play for lxd server provisioning |
|
hosts: lxd_host |
|
tags: install_lxd |
|
tasks: |
|
- name: include variables |
|
include_vars: |
|
file: site_vars.yml |
|
|
|
# TODO: use template for lxd-init --preseed |
|
- name: copy ssh pubkey from controller to lxd host |
|
copy: |
|
src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}" |
|
dest: "{{ tmp_pubkey }}" |
|
|
|
# TODO: might make sense to add a cache redirect for alpine packages |
|
- include_tasks: tasks/container_common.yml |
|
vars: |
|
container_name: "{{ item.key }}" |
|
container_sshd_port: "{{ item.value.sshd_port }}" |
|
container_ip: "{{ item.value.ip }}" |
|
tmp_sshd_config: "/tmp/sshd_config_{{ item.key }}" |
|
with_items: "{{ containers | dict2items }}" |
|
|
|
#- name: testing ssh connection to container |
|
# hosts: dokuwiki |
|
# tags: containers |
|
# tasks: |
|
# - include_tasks: tasks/dokuwiki.yml |
|
- import_playbook: tasks/dokuwiki.yml |
|
|
|
# |
|
# DNAT routing |
|
# |
|
|
|
# NOTE: do host routing last so we can fail on no sudo pass |
|
|
|
- name: install iptables packages |
|
hosts: lxd_host |
|
tags: install_lxd |
|
tasks: |
|
- name: add DNAT rules for ssh to containers |
|
hosts: lxd_host |
|
tags: dnat_route |
|
tasks: |
|
- include_vars: |
|
file: site_vars.yml |
|
|
|
- name: install iptables and iptables-persistent |
|
become: yes |
|
apt: |
|
name: [iptables, iptables-persistent] |
|
state: present |
|
|
|
- name: add rules on containers |
|
iptables: |
|
table: nat |
|
chain: PREROUTING |
|
in_interface: "{{ host_iface }}" |
|
protocol: tcp |
|
match: tcp |
|
source: "{{ host_cidr }}" |
|
jump: DNAT |
|
destination_port: "{{ item.value.sshd_port }}" |
|
to_destination: "{{ item.value.ip }}" |
|
become: yes |
|
with_items: "{{ containers | dict2items }}" |
|
|
|
- name: save DNAT rules on lxd host |
|
become: yes |
|
community.general.iptables_state: |
|
table: nat |
|
state: saved |
|
path: /etc/iptables/rules.v4 |
|
|
|
- name: add DNAT rules for individual containers |
|
hosts: lxd_host |
|
tags: dnat_route_2 |
|
tasks: |
|
- include_vars: |
|
file: site_vars.yml |
|
|
|
- iptables: |
|
table: nat |
|
chain: PREROUTING |
|
in_interface: "{{ host_iface }}" |
|
protocol: tcp |
|
match: tcp |
|
source: "{{ host_cidr }}" |
|
jump: DNAT |
|
destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}" |
|
to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}" |
|
become: yes
|
|
|