sukaato-ansible/roles/init-server/tasks/contingent/pkg/dsnet.yml

- name: Acquiring home of current user
  when: ansible_facts["system"] == "Linux"
  ansible.builtin.shell:
    cmd: "echo ~{{ ansible_user }}"
  register: ansible_user_home
- name: Acquiring current user
  when: ansible_facts["system"] == "Linux"
  ansible.builtin.shell:
    cmd: "echo {{ ansible_user }}"
  register: current_user
- name: Checking if ZFS filesystem is present
  ansible.builtin.shell:
    cmd: "findmnt -D | awk '{ print $2 }' | tail -n +2"
  register: fs_result
- name: Logging presence of ZFS filesystem
  when: "'zfs' in fs_result.stdout"
  ansible.builtin.set_fact:
    zfs_present: true
- name: Logging absence of ZFS filesystem
  when: "'zfs' not in fs_result.stdout"
  ansible.builtin.set_fact:
    zfs_present: false
- name: Configuring ZFS support
  when: zfs_present
  block:
    - name: Getting available pools
      ansible.builtin.shell:
        cmd: "zpool list | awk '{ print $1 }' | tail -n +2"
      register: zpools
    - name: Turning available pools into list
      ansible.builtin.set_fact:
        zpool_list: "{{ zpools | replace('\n', ' ') | split(' ') }}"
    - name: Allowing choice of zpool
      ansible.builtin.pause:
        prompt: "Type preferred zpool from available (i.e., {{ zpool_list | join(', ') }})"
      register: preferred_zpool
- name: Initializing DSNet
  become: true
  ansible.builtin.command:
    cmd: dsnet init
- name: Running DSNet VPN service interface
  become: true
  ansible.builtin.command:
    cmd: dsnet up
- name: Creating a ZFS dataset for DSNet configuration
  when: zfs_present
  become: true
  community.general.zfs:
    name: "{{ preferred_zpool.user_input }}/wireguard_clients"
    state: present
    extra_zfs_properties:
      canmount: "on"
      mountpoint: "{{ ansible_user_home.stdout }}/.wg"
- name: Creating a directory to house VPN service client configurations
  become: true
  ansible.builtin.file:
    path: "{{ ansible_user_home.stdout }}/.wg"
    recurse: true
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "700"
    state: directory
- name: Creating a directory to house VPN service client configurations
  ansible.builtin.file:
    path: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d"
    recurse: true
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "700"
    state: directory
- name: Adding peer device for DSNet VPN service interface
  become: true
  when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
  ansible.builtin.shell:
    cmd: "dsnet add {{ item.name }}{{ idx }} --owner {{ current_user.stdout }} --description 'For {{ item.name }}--{{ item.desc }}' --confirm > {{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
    creates: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ idx }}.conf"
  loop: "{{ vpn.clients }}"
  loop_control:
    index_var: idx
- name: Changing ownership of consequent DSNet VPN service client configurations
  when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
  ansible.builtin.file:
    path: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "600"
    state: file
  loop: "{{ vpn.clients }}"
  loop_control:
    index_var: idx
- name: Acquiring VPN server subnet
  block:
    - name: Acquiring VPN server IPv4 subnet
      ansible.builtin.shell:
        cmd: echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*/\/24/g'
      register: masq_target_net_ip
    - name: Acquiring VPN server IPv6 subnet
      when: ipv6_enabled
      ansible.builtin.shell:
        cmd: echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network6":/ { print $2 }' | sed 's/[",]//g'
      register: masq_target_net_ip6
- name: Getting public IP addresses
  block:
    - name: Getting public IPv4 address
      community.general.ipify_facts:
        validate_certs: false
        timeout: 20
    - name: Getting public IPv6 address
      when: ipv6_enabled
      ansible.builtin.shell:
        cmd: curl -6 icanhazip.com
      register: ipify_public_ip6
- name: Getting VPN client IP addresses
  block:
    - name: Getting VPN client IPv4 address
      ansible.builtin.shell:
        cmd: wg showconf dsnet | awk -F ' = |, ' '/^AllowedIPs/ { print $2 }' | sed 's/\/[0-9]*//g'
      register: vpn_client_ip
    - name: Getting VPN client IPv4 address
      when: ipv6_enabled
      ansible.builtin.shell:
        cmd: wg showconf dsnet | awk -F ' = |, ' '/^AllowedIPs/ { print $3 }' | sed 's/\/[0-9]*//g'
      register: vpn_client_ip6
- name: Pausing to inquire about how to proceed
  ansible.builtin.pause:
    prompt: "Type \"fetch\" to get the DSNet VPN service client configuration files, or \"show\" to see their contents for manual copying instead"
    echo: true
  register: data_method
- name: Presenting DSNet VPN service client configuration files to control node for copying
  when: data_method.user_input == "show"
  block:
    - name: Acquiring contents of DSNet VPN service client configuration files
      when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
      ansible.builtin.slurp:
        src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
      loop: "{{ vpn.clients }}"
      loop_control:
        index_var: idx
      register: vpn_client_configs
    - name: Presenting contents of DSNet VPN service client configurations to control node
      when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
      ansible.builtin.debug:
        msg: "Copy this client configuration of the DSNet VPN service:\n {{ item.content | b64decode }}"
      loop: "{{ vpn_client_configs.results }}"
    - name: Giving opportunity to manually copy contents of DSNet VPN service client configuration files
      ansible.builtin.pause:
- name: Providing DSNet VPN service client configuration files to control node machine
  when: data_method.user_input == "fetch"
  block:
    - name: Informing user of inventory requirements for VPN clients
      when: ((fqdn is undefined or fqdn == None) or fqdn not in item.name) and (item.name not in groups.homeserver and item.name not in groups['homeserver.test'])
      ansible.builtin.fail:
        msg: The VPN client must be the name of an inventory host in a homeserver group
      loop: "{{ vpn.clients }}"
    - name: Dupliciating DSNet VPN service client configuration files to control node
      when: "((fqdn is defined and fqdn != None) and fqdn in item.name) or (item.name in groups.homeserver or item.name in groups['homeserver.test'])"
      ansible.builtin.fetch:
        src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
        dest: "./.tmp/{{ inventory_hostname }}-dsnet/"
        flat: true
      loop: "{{ vpn.clients }}"
      loop_control:
        index_var: idx
    - name: Dupliciating DSNet VPN service client configuration files to control node
      ansible.builtin.fetch:
        src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
        dest: "./roles/init-server/files/user/wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
        flat: true
      loop: "{{ vpn.clients }}"
      loop_control:
        index_var: idx
    - name: Informing control node of acquired files
      ansible.builtin.debug:
        msg: "The DSNet VPS service client configuration files have been duplicated to \"{{ item }}\" at the control node."
      loop:
        - "./.tmp/{{ inventory_hostname }}-dsnet/"
        - "./roles/init-server/files/user/wg/"
    - name: Giving control node user time to read the aforementiioned message
      ansible.builtin.pause:
        seconds: 30
- name: Ensuring IP forwarding is allowed
  become: true
  ansible.posix.sysctl:
    name: "{{ item }}"
    value: "1"
    sysctl_file: /etc/sysctl.d/10-security.conf
    sysctl_set: true
    reload: true
    state: present
  loop:
    - net.ipv4.ip_forward
    - net.ipv6.conf.all.forwarding
    - net.ipv4.conf.all.src_valid_mark
- name: Creating SystemD unit for placing up DSNet interface
  become: true
  ansible.builtin.copy:
    src: systemd/system/dsnet.service
    dest: /etc/systemd/system/dsnet.service
    owner: root
    group: root
    force: true
    backup: true
- name: Reloading SystemD and enabling DSNet interface
  become: true
  ansible.builtin.systemd_service:
    name: dsnet
    scope: system
    enabled: true
    daemon_reload: true
- name: Copying script for DSNet iptables rules
  become: true
  when: ipv6_enabled
  ansible.builtin.template:
    src: usr/local/bin/dsnet-routing6.sh.j2
    dest: /usr/local/bin/dsnet-routing.sh
    variable_start_string: "<%"
    variable_end_string: "%>"
    owner: root
    group: root
    mode: "755"
    force: true
    backup: true
- name: Copying script for DSNet iptables rules
  become: true
  when: not ipv6_enabled
  ansible.builtin.template:
    src: usr/local/bin/dsnet-routing.sh.j2
    dest: /usr/local/bin/dsnet-routing.sh
    variable_start_string: "<%"
    variable_end_string: "%>"
    owner: root
    group: root
    mode: "755"
    force: true
    backup: true
- name: Creating SystemD unit for DSNet iptables rules
  become: true
  ansible.builtin.copy:
    src: systemd/system/thrunet.service
    dest: /etc/systemd/system/thrunet.service
    owner: root
    group: root
    force: true
    backup: true
- name: Reloading SystemD
  become: true
  ansible.builtin.systemd_service:
    scope: system
    daemon_reload: true