new major update

roles/init-server/tasks/contingent/pkg/dsnet.yml

@@ -8,6 +8,32 @@
   ansible.builtin.shell:
     cmd: "echo {{ ansible_user }}"
   register: current_user
+- name: Checking if ZFS filesystem is present
+  ansible.builtin.shell:
+    cmd: "findmnt -D | awk '{ print $2 }' | tail -n +2"
+  register: fs_result
+- name: Logging presence of ZFS filesystem
+  when: "'zfs' in fs_result.stdout"
+  ansible.builtin.set_fact:
+    zfs_present: true
+- name: Logging absence of ZFS filesystem
+  when: "'zfs' not in fs_result.stdout"
+  ansible.builtin.set_fact:
+    zfs_present: false
+- name: Configuring ZFS support
+  when: zfs_present
+  block:
+    - name: Getting available pools
+      ansible.builtin.shell:
+        cmd: "zpool list | awk '{ print $1 }' | tail -n +2"
+      register: zpools
+    - name: Turning available pools into list
+      ansible.builtin.set_fact:
+        zpool_list: "{{ zpools | replace('\n', ' ') | split(' ') }}"
+    - name: Allowing choice of zpool
+      ansible.builtin.pause:
+        prompt: "Type preferred zpool from available (i.e., {{ zpool_list | join(', ') }})"
+      register: preferred_zpool
 - name: Initializing DSNet
   become: true
   ansible.builtin.command:
@@ -16,16 +42,35 @@
   become: true
   ansible.builtin.command:
     cmd: dsnet up
+- name: Creating a ZFS dataset for DSNet configuration
+  when: zfs_present
+  become: true
+  community.general.zfs:
+    name: "{{ preferred_zpool.user_input }}/wireguard_clients"
+    state: present
+    extra_zfs_properties:
+      canmount: "on"
+      mountpoint: "{{ ansible_user_home.stdout }}/.wg"
+- name: Creating a directory to house VPN service client configurations
+  become: true
+  ansible.builtin.file:
+    path: "{{ ansible_user_home.stdout }}/.wg"
+    recurse: true
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "700"
+    state: directory
 - name: Creating a directory to house VPN service client configurations
   ansible.builtin.file:
     path: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d"
     recurse: true
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
-    mode: "755"
+    mode: "700"
     state: directory
 - name: Adding peer device for DSNet VPN service interface
   become: true
+  when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
   ansible.builtin.shell:
     cmd: "dsnet add {{ item.name }}{{ idx }} --owner {{ current_user.stdout }} --description 'For {{ item.name }}--{{ item.desc }}' --confirm > {{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
     creates: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ idx }}.conf"
@@ -33,6 +78,7 @@
   loop_control:
     index_var: idx
 - name: Changing ownership of consequent DSNet VPN service client configurations
+  when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
   ansible.builtin.file:
     path: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
     owner: "{{ ansible_user }}"
@@ -42,6 +88,39 @@
   loop: "{{ vpn.clients }}"
   loop_control:
     index_var: idx
+- name: Acquiring VPN server subnet
+  block:
+    - name: Acquiring VPN server IPv4 subnet
+      ansible.builtin.shell:
+        cmd: echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*/\/24/g'
+      register: masq_target_net_ip
+    - name: Acquiring VPN server IPv6 subnet
+      when: ipv6_enabled
+      ansible.builtin.shell:
+        cmd: echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network6":/ { print $2 }' | sed 's/[",]//g'
+      register: masq_target_net_ip6
+- name: Getting public IP addresses
+  block:
+    - name: Getting public IPv4 address
+      community.general.ipify_facts:
+        validate_certs: false
+        timeout: 20
+    - name: Getting public IPv6 address
+      when: ipv6_enabled
+      ansible.builtin.shell:
+        cmd: curl -6 icanhazip.com
+      register: ipify_public_ip6
+- name: Getting VPN client IP addresses
+  block:
+    - name: Getting VPN client IPv4 address
+      ansible.builtin.shell:
+        cmd: wg showconf dsnet | awk -F ' = |, ' '/^AllowedIPs/ { print $2 }' | sed 's/\/[0-9]*//g'
+      register: vpn_client_ip
+    - name: Getting VPN client IPv4 address
+      when: ipv6_enabled
+      ansible.builtin.shell:
+        cmd: wg showconf dsnet | awk -F ' = |, ' '/^AllowedIPs/ { print $3 }' | sed 's/\/[0-9]*//g'
+      register: vpn_client_ip6
 - name: Pausing to inquire about how to proceed
   ansible.builtin.pause:
     prompt: "Type \"fetch\" to get the DSNet VPN service client configuration files, or \"show\" to see their contents for manual copying instead"
@@ -51,6 +130,7 @@
   when: data_method.user_input == "show"
   block:
     - name: Acquiring contents of DSNet VPN service client configuration files
+      when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
       ansible.builtin.slurp:
         src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
       loop: "{{ vpn.clients }}"
@@ -58,6 +138,7 @@
         index_var: idx
       register: vpn_client_configs
     - name: Presenting contents of DSNet VPN service client configurations to control node
+      when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
       ansible.builtin.debug:
         msg: "Copy this client configuration of the DSNet VPN service:\n {{ item.content | b64decode }}"
       loop: "{{ vpn_client_configs.results }}"
@@ -67,12 +148,12 @@
   when: data_method.user_input == "fetch"
   block:
     - name: Informing user of inventory requirements for VPN clients
-      when: ((fqdn is undefined or fqdn == None) and item.name != fqdn) or not item.name in groups.homeserver
+      when: ((fqdn is undefined or fqdn == None) or fqdn not in item.name) and (item.name not in groups.homeserver and item.name not in groups['homeserver.test'])
       ansible.builtin.fail:
         msg: The VPN client must be the name of an inventory host in a homeserver group
       loop: "{{ vpn.clients }}"
     - name: Dupliciating DSNet VPN service client configuration files to control node
-      when: ((fqdn is defined and fqdn != None) and item.name == fqdn) or item.name in groups.homeserver
+      when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
       ansible.builtin.fetch:
         src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
         dest: "./.tmp/{{ inventory_hostname }}-dsnet/"
@@ -100,13 +181,16 @@
 - name: Ensuring IP forwarding is allowed
   become: true
   ansible.posix.sysctl:
-    name: "net.{{ item }}.ip_forward"
+    name: "{{ item }}"
     value: "1"
+    sysctl_file: /etc/sysctl.d/10-security.conf
     sysctl_set: true
+    reload: true
     state: present
   loop:
-    - ipv4
-    # - ipv6
+    - net.ipv4.ip_forward
+    - net.ipv6.conf.all.forwarding
+    - net.ipv4.conf.all.src_valid_mark
 - name: Creating SystemD unit for placing up DSNet interface
   become: true
   ansible.builtin.copy:
@@ -120,13 +204,30 @@
   become: true
   ansible.builtin.systemd_service:
     name: dsnet
+    scope: system
     enabled: true
     daemon_reload: true
 - name: Copying script for DSNet iptables rules
   become: true
+  when: ipv6_enabled
   ansible.builtin.template:
-    src: usr/local/bin/dsnet-forward.sh.j2
-    dest: /usr/local/bin/dsnet-forward.sh
+    src: usr/local/bin/dsnet-routing6.sh.j2
+    dest: /usr/local/bin/dsnet-routing.sh
+    variable_start_string: "<%"
+    variable_end_string: "%>"
+    owner: root
+    group: root
+    mode: "755"
+    force: true
+    backup: true
+- name: Copying script for DSNet iptables rules
+  become: true
+  when: not ipv6_enabled
+  ansible.builtin.template:
+    src: usr/local/bin/dsnet-routing.sh.j2
+    dest: /usr/local/bin/dsnet-routing.sh
+    variable_start_string: "<%"
+    variable_end_string: "%>"
     owner: root
     group: root
     mode: "755"
@@ -144,16 +245,5 @@
 - name: Reloading SystemD
   become: true
   ansible.builtin.systemd_service:
-    name: thrunet
+    scope: system
     daemon_reload: true
-- name: Opening port 51820
-  become: true
-  ansible.builtin.iptables:
-    chain: INPUT
-    protocol: "{{ item }}"
-    destination_port: 51820
-    jump: ACCEPT
-    comment: Open up port 51820
-  loop:
-    - udp
-    - tcp