diff --git a/tasks/configure_network.yml b/tasks/configure_network.yml index c695d840d36d713545d64e70db38ba251ce6a9e8..bb1956c75b2538088648c83754359a7eb94c50ac 100644 --- a/tasks/configure_network.yml +++ b/tasks/configure_network.yml @@ -1,6 +1,64 @@ --- -- name: configure DNS settings - net_system: - domain-search: "{{ vault_domain_name }}" - name_servers: "{{ vault_name_servers }}" - state: present +# Sooo, WTF is this? +# In Debian 11 Bullseye's default configuration, network is managed by +#`ifupdown`. This is OK until you try to use NFS mounts, because they require +# the network to be fully up and reachable. As `ifupdown` won't properly report +# the actual network status, SystemD will try to mount NFS shares too early and +# fail inevitably, because the network is not reachable yet. +# +# The only proper solution is to swith over to `systemd-networkd`, where this +# kind of reporting works as expected and the task of mounting NFS shares is +# put into the correct position during startup ordering. +# +# After these tasks have run, you can use `networkctl` to check if the network +# is configured as expected. +# +# We seize the opportunity to switch over to `systemd-resolvd` as well, because +# it offers DNSSec etc., and, frankly, because we can. +# +# After these tasks have run, you can use `resolvectl` to check if the name +# resolution is configured as expected. +# +# As of the time of writing this (2023-01-12), this is a custom configuration, +# but @Zumpe already told me that the GUBS dev team has plans to make +# `systemd-networkd` and `systemd-resolved` the default for Debian 12 in GUBS +# installations, so once this is done, we can probably dispose of these tasks +# altogether. + +# Create a `systemd-networkd` config for ens192 and remove any configuration +# for that interface from the traditional '/etc/network/interfaces' config file +# to avoid any interference and hand over management for that interface to +# `systemd-networkd`. Now, '/etc/network/interfaces' will only contain the +# config for the loopback interface. +- name: deploy network interface config + ansible.builtin.template: + src: "{{ item }}.j2" + dest: "/{{ item }}" + mode: "0644" + loop: + - "etc/systemd/network/ens192.network" + - "etc/network/interfaces" + +- name: Link /etc/resolv.conf + ansible.builtin.file: + src: "/run/systemd/resolve/stub-resolv.conf" + dest: "/etc/resolv.conf" + state: link + force: true + +- name: Enable systemd-networkd but don't start now + ansible.builtin.systemd: + name: "{{ item.n }}" + enabled: true + state: "{{ item.s | default(omit) }}" + daemon_reload: true + loop: + - n: "systemd-networkd.service" + - n: "systemd-resolved.service" + s: started + - n: "systemd-networkd-wait-online.service" + +# The network changes require a reboot, so do that. +- name: reboot system + ansible.builtin.reboot: + changed_when: False diff --git a/tasks/main.yml b/tasks/main.yml index 97dbda6b3f681202b83bc50e9a72243c8009e101..785d766ddd4f12e58e8738282ff897b4a1a30daa 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -145,6 +145,10 @@ import_tasks: configure_ntp.yml tags: [ntp] +- name: Configure Network + ansible.builtin.import_tasks: "configure_network.yml" + tags: [network, dns, resolv] + # there's no way to get this task to become idempotent, so we have to skip the test - name: Flush handlers am Ende der Rolle ansible.builtin.meta: flush_handlers diff --git a/templates/etc/network/interfaces.j2 b/templates/etc/network/interfaces.j2 new file mode 100644 index 0000000000000000000000000000000000000000..abdf860510c5f860b0c2f2a463908fbabf103198 --- /dev/null +++ b/templates/etc/network/interfaces.j2 @@ -0,0 +1,9 @@ + +# This file describes the network interfaces available on your system +# and how to activate them. For more information, see interfaces(5). + +# The loopback network interface +auto lo +iface lo inet loopback + +# ALL OTHER INTERFACES ARE CONFIGURED BELOW "/etc/systemd/network/". diff --git a/templates/etc/systemd/network/ens192.network.j2 b/templates/etc/systemd/network/ens192.network.j2 new file mode 100644 index 0000000000000000000000000000000000000000..2818653833c13098dc50b1139ae3923be191403f --- /dev/null +++ b/templates/etc/systemd/network/ens192.network.j2 @@ -0,0 +1,11 @@ +[Match] +Name={{ ansible_facts.default_ipv4.interface }} + +[Network] +Address={{ ansible_facts.default_ipv4.address }}/{{ ansible_facts.default_ipv4.prefix }} +Gateway={{ ansible_facts.default_ipv4.gateway }} +DNS=194.95.142.200 +DNS=194.95.142.203 +DNS=194.95.142.157 +Domains=slub-dresden.de +LLMNR=no