gateway: Enable server network config

Signed-off-by: David Galloway <dgallowa@redhat.com>

diff --git a/roles/gateway/handlers/main.yml b/roles/gateway/handlers/main.yml
new file mode 100644 (file)
index 0000000..b6612c4
--- /dev/null
+++ b/roles/gateway/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+# Restart networking
+- name: restart networking
+  service:
+    name: network
+    state: restarted

diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml
index 8977c1f32ee302363b0cfa103a1b5f018eb5c3e7..11a52a644873f97f0673806f359dbe2338866156 100644 (file)
--- a/roles/gateway/tasks/main.yml
+++ b/roles/gateway/tasks/main.yml
@@ -10,6 +10,11 @@
   tags:
     - packages
 
+# Configure networking
+- include: network.yml
+  tags:
+    - networking
+
 - name: Ensure data directory exists
   file:
     path: "{{ openvpn_data_dir }}"

diff --git a/roles/gateway/tasks/network.yml b/roles/gateway/tasks/network.yml
new file mode 100644 (file)
index 0000000..3c80efc
--- /dev/null
+++ b/roles/gateway/tasks/network.yml
@@ -0,0 +1,36 @@
+---
+- name: Write ifcfg scripts
+  template:
+    src: ifcfg.j2
+    dest: "/etc/sysconfig/network-scripts/ifcfg-{{ item.value.ifname }}"
+  with_dict: "{{ gw_networks }}"
+  register: interfaces
+
+# Restart networking right away if changes made.  This makes sure
+# the public interface is up and ready for OpenVPN to bind to.
+- name: Restart networking
+  service:
+    name: network
+    state: restarted
+  when: interfaces.changed
+
+- name: Write resolv.conf
+  template:
+    src: resolvconf.j2
+    dest: "/etc/resolv.conf"
+
+- name: Disable IPv6
+  sysctl:
+    name: net.ipv6.conf.all.disable_ipv6
+    value: 1
+    sysctl_set: yes
+    state: present
+    reload: yes
+
+- name: Enable IPv4 forwarding
+  sysctl:
+    name: net.ipv4.ip_forward
+    value: 1
+    sysctl_set: yes
+    state: present
+    reload: yes

diff --git a/roles/gateway/templates/ifcfg.j2 b/roles/gateway/templates/ifcfg.j2
new file mode 100644 (file)
index 0000000..36a564d
--- /dev/null
+++ b/roles/gateway/templates/ifcfg.j2
@@ -0,0 +1,27 @@
+#
+# {{ ansible_managed }}
+#
+NAME="{{ item.key }}"
+DEVICE="{{ item.value.ifname }}"
+HWADDR="{{ item.value.mac }}"
+NM_CONTROLLED="no"
+ONBOOT="yes"
+BOOTPROTO="static"
+IPADDR="{{ item.value.ip4 }}"
+NETMASK="{{ item.value.netmask }}"
+GATEWAY="{{ item.value.gw4 }}"
+DEFROUTE="{{ item.value.defroute }}"
+
+# Optional values
+{% if item.value.search is defined %}
+SEARCH="{{ item.value.search }}"
+{% endif %}
+{% if item.value.peerdns is defined %}
+PEERDNS="{{ item.value.peerdns }}"
+{% endif %}
+{% if item.value.dns1 is defined %}
+DNS1="{{ item.value.dns1 }}"
+{% endif %}
+{% if item.value.dns2 is defined %}
+DNS2="{{ item.value.dns2 }}"
+{% endif %}

diff --git a/roles/gateway/templates/resolvconf.j2 b/roles/gateway/templates/resolvconf.j2
new file mode 100644 (file)
index 0000000..71ded30
--- /dev/null
+++ b/roles/gateway/templates/resolvconf.j2
@@ -0,0 +1,7 @@
+#
+# {{ ansible_managed }}
+#
+search {{ gw_resolv_search }}
+{% for nameserver in gw_resolv_ns %}
+nameserver {{ nameserver }}
+{% endfor %}