You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
88 lines
2.6 KiB
88 lines
2.6 KiB
--- |
|
- name: main lxd_host block |
|
vars: |
|
img_server: https://images.linuxcontainers.org |
|
alp_img_alias: alpine/3.13/amd64 |
|
lxc_cmd: /snap/bin/lxc |
|
lxd_subnet_pfx: 10.98.46 |
|
lxd_bridge: lxdbr0 |
|
tmp_pubkey: /tmp/controller_key_rsa.pub |
|
host_iface: enp2s0 |
|
host_cidr: '192.168.11.0/24' |
|
block: |
|
# TODO: use template for lxd-init --preseed |
|
- name: copy ssh pubkey from controller to lxd host |
|
copy: |
|
src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}" |
|
dest: "{{ tmp_pubkey }}" |
|
|
|
# TODO: might make sense to add a cache redirect for alpine packages |
|
- include_tasks: tasks/container_install.yml |
|
tags: container_install |
|
vars: |
|
container_name: "{{ item }}" |
|
container_sshd_port: "{{ hostvars[item]['ansible_port'] }}" |
|
container_ip: "{{ hostvars[item]['internal_ip'] }}" |
|
tmp_sshd_config: "/tmp/sshd_config_{{ item }}" |
|
with_items: "{{ groups['containers'] }}" |
|
|
|
- name: install iptables and iptables-persistent |
|
tags: routing |
|
become: yes |
|
apt: |
|
name: [iptables, iptables-persistent] |
|
state: present |
|
when: "'routing' in ansible_run_tags" |
|
|
|
- name: add DNAT rules for containers |
|
tags: routing |
|
iptables: |
|
table: nat |
|
chain: PREROUTING |
|
in_interface: "{{ host_iface }}" |
|
protocol: tcp |
|
match: tcp |
|
source: "{{ host_cidr }}" |
|
jump: DNAT |
|
destination_port: "{{ hostvars[item]['ansible_port'] }}" |
|
to_destination: "{{ hostvars[item]['internal_ip'] }}" |
|
become: yes |
|
with_items: "{{ groups['containers'] }}" |
|
when: "'routing' in ansible_run_tags" |
|
|
|
- name: save DNAT rules on lxd host |
|
tags: routing |
|
become: yes |
|
community.general.iptables_state: |
|
table: nat |
|
state: saved |
|
path: /etc/iptables/rules.v4 |
|
when: "'routing' in ansible_run_tags" |
|
|
|
# TODO: add other dnat ports in above loop? |
|
#- name: add dokuwiki DNAT routing |
|
# iptables: |
|
# table: nat |
|
# chain: PREROUTING |
|
# in_interface: "{{ host_iface }}" |
|
# protocol: tcp |
|
# match: tcp |
|
# source: "{{ host_cidr }}" |
|
# jump: DNAT |
|
# destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}" |
|
# to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}" |
|
# become: yes |
|
# |
|
#- name: add freshrss DNAT routing |
|
# iptables: |
|
# table: nat |
|
# chain: PREROUTING |
|
# in_interface: "{{ host_iface }}" |
|
# protocol: tcp |
|
# match: tcp |
|
# source: "{{ host_cidr }}" |
|
# jump: DNAT |
|
# destination_port: "{{ hostvars['freshrss']['dnat_dest_port'] }}" |
|
# to_destination: "{{ hostvars['freshrss']['internal_ip'] }}" |
|
# become: yes |
|
|
|
|