mirror of
https://github.com/phfroidmont/self-hosting.git
synced 2025-12-25 13:46:59 +01:00
75 lines
2.1 KiB
YAML
75 lines
2.1 KiB
YAML
---
|
|
- name: Get the internet interface
|
|
shell: ip route get 1.1.1.1 | head -n1 | sed -E 's/^.+dev ([^ ]+).+$/\1/'
|
|
register: interface_result
|
|
changed_when: False
|
|
check_mode: False
|
|
|
|
- name: Check for internet access
|
|
shell: |-
|
|
false \{% for url in proxy_test_urls %}
|
|
|| curl -IsSL -m{{ proxy_test_timeout }} {{ url }} \
|
|
{% endfor %}
|
|
|| false
|
|
args:
|
|
warn: False
|
|
register: curl_result_initial
|
|
ignore_errors: True
|
|
changed_when: False
|
|
check_mode: False
|
|
|
|
- name: Set host interface facts
|
|
set_fact:
|
|
proxy_interface: "{{ interface_result.stdout | trim }}"
|
|
proxy_inet: "{{ curl_result_initial.rc == 0 }}"
|
|
|
|
- name: Assert at least one node has internet connectivity
|
|
assert:
|
|
that: hostvars.values() | selectattr('inventory_hostname', 'in', groups['k8s']) | selectattr('proxy_inet', '==', True) | list | length != 0
|
|
run_once: true
|
|
|
|
- name: Set router hostname fact
|
|
set_fact:
|
|
proxy_router_hostname: "{{ hostvars.values() | selectattr('inventory_hostname', 'in', groups['k8s']) | selectattr('proxy_inet', '==', True) | map(attribute='inventory_hostname') | first }}"
|
|
|
|
- name: Allow ip forwarding (kernel)
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: 1
|
|
sysctl_set: True
|
|
reload: True
|
|
when: inventory_hostname == tinc_primary_router
|
|
|
|
- name: Allow ip forwarding (iptables)
|
|
iptables:
|
|
table: nat
|
|
chain: POSTROUTING
|
|
out_interface: "{{ proxy_interface }}"
|
|
jump: MASQUERADE
|
|
register: iptables_result
|
|
|
|
- name: Set up SSH tunnels
|
|
include: ssh-up.yml
|
|
when: hostvars.values() | selectattr('inventory_hostname', 'in', groups['k8s']) | selectattr('proxy_inet', '==', False) | list | length != 0
|
|
|
|
- name: Set up tinc
|
|
include_role:
|
|
name: tinc
|
|
|
|
- name: Set up keepalived
|
|
include: keepalived.yml
|
|
|
|
- name: Tear down SSH tunnels
|
|
include: ssh-down.yml
|
|
|
|
- name: Check for internet access
|
|
shell: |-
|
|
false \{% for url in proxy_test_urls %}
|
|
|| curl -IsSL -m{{ proxy_test_timeout }} {{ url }} \
|
|
{% endfor %}
|
|
|| false
|
|
args:
|
|
warn: False
|
|
register: curl_result
|
|
changed_when: curl_result_initial.rc != curl_result.rc
|
|
check_mode: False
|