From 17ebbf1fcaf6145a37e378fa78103a6b353a850f Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 15:11:23 +0300 Subject: [PATCH 01/19] add alertmanager role --- roles/alertmanager/README.md | 53 ++++++++++++ roles/alertmanager/defaults/main.yml | 7 ++ roles/alertmanager/handlers/main.yml | 7 ++ roles/alertmanager/meta/main.yml | 17 ++++ .../default/alertmanager/alertmanager.yml | 36 ++++++++ .../molecule/default/converge.yml | 6 ++ .../molecule/default/molecule.yml | 27 ++++++ .../alertmanager/molecule/default/verify.yml | 55 ++++++++++++ roles/alertmanager/tasks/configuration.yml | 24 ++++++ roles/alertmanager/tasks/install.yml | 85 +++++++++++++++++++ roles/alertmanager/tasks/main.yml | 9 ++ .../templates/alertmanager.service.j2 | 27 ++++++ roles/alertmanager/vars/main.yml | 1 + 13 files changed, 354 insertions(+) create mode 100644 roles/alertmanager/README.md create mode 100644 roles/alertmanager/defaults/main.yml create mode 100644 roles/alertmanager/handlers/main.yml create mode 100644 roles/alertmanager/meta/main.yml create mode 100644 roles/alertmanager/molecule/default/alertmanager/alertmanager.yml create mode 100644 roles/alertmanager/molecule/default/converge.yml create mode 100644 roles/alertmanager/molecule/default/molecule.yml create mode 100644 roles/alertmanager/molecule/default/verify.yml create mode 100644 roles/alertmanager/tasks/configuration.yml create mode 100644 roles/alertmanager/tasks/install.yml create mode 100644 roles/alertmanager/tasks/main.yml create mode 100644 roles/alertmanager/templates/alertmanager.service.j2 create mode 100644 roles/alertmanager/vars/main.yml diff --git a/roles/alertmanager/README.md b/roles/alertmanager/README.md new file mode 100644 index 0000000..a8a57da --- /dev/null +++ b/roles/alertmanager/README.md @@ -0,0 +1,53 @@ +genlab.alertmanager +========= + +The [Alertmanager](https://github.com/prometheus/alertmanager) handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. + +You'll need to manually specify the paths to your template files in the main Alertmanager configuration file (`alertmanager.yml`) on the target machine. The configuration file must have a `.yml` suffix, and template files must use a `.tmpl` suffix. + +Requirements +------------ + +None + +Role Variables +-------------- + +``` +alertmanager_version: 0.28.1 # version of Alertmanager (AM) +config_dir: "/etc/alertmanager/conf" # where to place AM configs +storage_dir: "/var/lib/alertmanager" # path to AM storage +alertmanager_dir: "/etc/alertmanager" # where to install AM on target +alertmanager_user: "alertmanager" # system user name +alertmanager_group: "alertmanager" # system group name +config_source_dir: "./alertmanager" # path to config files on source + +# Optional +template_source_dir: "./templates" # path to template files on source +``` + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.template + config_source_dir: alertmanager + alertmanager_version: 0.28.1 + +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/alertmanager/defaults/main.yml b/roles/alertmanager/defaults/main.yml new file mode 100644 index 0000000..88707b3 --- /dev/null +++ b/roles/alertmanager/defaults/main.yml @@ -0,0 +1,7 @@ +--- +alertmanager_version: 0.28.1 +config_dir: "/etc/alertmanager/conf" +storage_dir: "/var/lib/alertmanager" +alertmanager_dir: "/etc/alertmanager" +alertmanager_user: alertmanager +alertmanager_group: alertmanager diff --git a/roles/alertmanager/handlers/main.yml b/roles/alertmanager/handlers/main.yml new file mode 100644 index 0000000..4a0e813 --- /dev/null +++ b/roles/alertmanager/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: "(Re)start and enable Alertmanager" + ansible.builtin.systemd_service: + name: alertmanager.service + state: restarted + enabled: true + daemon_reload: true diff --git a/roles/alertmanager/meta/main.yml b/roles/alertmanager/meta/main.yml new file mode 100644 index 0000000..942b852 --- /dev/null +++ b/roles/alertmanager/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: "alertmanager" + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "" + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: [ "focal", "jammy", "noble" ] + + galaxy_tags: [ ] + +dependencies: [] diff --git a/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml new file mode 100644 index 0000000..7c3bff0 --- /dev/null +++ b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml @@ -0,0 +1,36 @@ +global: + # SMTP configuration for email notifications (if needed) + smtp_smarthost: 'mailserver.example.com:587' + smtp_from: 'alertmanager@example.com' + smtp_auth_username: 'alertmanager' + smtp_auth_password: 'your_password' + + # Other global settings like resolve_timeout, http_config, etc. + +route: + # Default receiver for alerts + receiver: 'default-receiver' + + # Labels used for grouping alerts + group_by: ['alertname', 'instance', 'severity'] + + # Timing settings (group_wait, group_interval, repeat_interval) + # You can have nested 'routes' for more complex routing logic + +receivers: + - name: 'default-receiver' + email_configs: + - to: 'ops-team@example.com' + +inhibit_rules: + # Rules to suppress alerts based on other alerts + # Example: + - source_match: + severity: 'critical' + target_match: + severity: 'warning' + # Suppress 'warning' alerts if a 'critical' alert is also firing + +templates: + # Paths to template files for customizing notifications + - '/etc/alertmanager/templates/*.tmpl' \ No newline at end of file diff --git a/roles/alertmanager/molecule/default/converge.yml b/roles/alertmanager/molecule/default/converge.yml new file mode 100644 index 0000000..3f7be92 --- /dev/null +++ b/roles/alertmanager/molecule/default/converge.yml @@ -0,0 +1,6 @@ +--- +- name: Converge + hosts: all + roles: + - role: genlab.alertmanager + config_source_dir: alertmanager diff --git a/roles/alertmanager/molecule/default/molecule.yml b/roles/alertmanager/molecule/default/molecule.yml new file mode 100644 index 0000000..d82158e --- /dev/null +++ b/roles/alertmanager/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2404}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/alertmanager/molecule/default/verify.yml b/roles/alertmanager/molecule/default/verify.yml new file mode 100644 index 0000000..0836d76 --- /dev/null +++ b/roles/alertmanager/molecule/default/verify.yml @@ -0,0 +1,55 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + + tasks: + + - name: "Include default vars" + ansible.builtin.include_vars: + dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/" + extensions: [ 'yml' ] + + - name: "Check if Alertmanager is installed" + changed_when: false + ansible.builtin.command: "alertmanager --version" + register: alertmanager_installed_version + + - name: "Check Alertmanager version" + ansible.builtin.assert: + that: "alertmanager_installed_version.stdout is regex('{{ alertmanager_version }}')" + success_msg: "Alertmanager version {{ alertmanager_version }} is installed and working" + fail_msg: "Alertmanager version {{ alertmanager_version }} is not installed or not working correctly" + + # kics-scan ignore-block + - name: "Check if Alertmanager is reachable" + ansible.builtin.uri: + url: "http://localhost:9093/-/healthy" + return_content: true + status_code: 200 + method: GET + body_format: json + register: alertmanager_health + + - name: "Assert Alertmanager health status" + ansible.builtin.assert: + that: "alertmanager_health.content == 'OK'" + success_msg: "Alertmanager is healthy" + fail_msg: "Alertmanager is not healthy" + + # kics-scan ignore-block + - name: "Check if Alertmanager is ready" + ansible.builtin.uri: + url: "http://localhost:9093/-/ready" + return_content: true + status_code: 200 + method: GET + body_format: json + register: alertmanager_ready + + - name: "Assert Alertmanager readiness status" + ansible.builtin.assert: + that: "alertmanager_ready.content == 'OK'" + success_msg: "Alertmanager is ready" + fail_msg: "Alertmanager is not ready" diff --git a/roles/alertmanager/tasks/configuration.yml b/roles/alertmanager/tasks/configuration.yml new file mode 100644 index 0000000..4932c8e --- /dev/null +++ b/roles/alertmanager/tasks/configuration.yml @@ -0,0 +1,24 @@ +--- + +- name: "Copy config file" + notify: "(Re)start and enable Alertmanager" + ansible.builtin.template: + src: "{{ item }}" + dest: "{{ config_dir }}/{{ item | basename }}" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" + with_fileglob: + - "{{ config_source_dir }}/*.yml" + +- name: "Copy templates if existed" + notify: "(Re)start and enable Alertmanager" + when: template_source_dir is defined + ansible.builtin.copy: + src: "{{ item }}" + dest: "{{ config_dir }}/{{ item | basename }}" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" + with_fileglob: + - "{{ template_source_dir }}/*.tmpl" diff --git a/roles/alertmanager/tasks/install.yml b/roles/alertmanager/tasks/install.yml new file mode 100644 index 0000000..f97a99e --- /dev/null +++ b/roles/alertmanager/tasks/install.yml @@ -0,0 +1,85 @@ +--- +- name: "Create Alertmanager system group" + ansible.builtin.group: + name: "{{ alertmanager_user }}" + system: true + state: present + +- name: "Create Alertmanager system user" + ansible.builtin.user: + name: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + system: true + shell: "/sbin/nologin" + create_home: false + state: present + +- name: "Install Alertmanager from binary" + block: + - name: "Check Alertmanager version" + changed_when: false + ansible.builtin.command: + cmd: "alertmanager --version" + register: alertmanager_ver + + - name: "Assert version correctness" + ansible.builtin.assert: + that: "alertmanager_ver.stdout is regex('{{ alertmanager_version }}')" + success_msg: "alertmanager version {{ alertmanager_version }} is installed and working" + fail_msg: "alertmanager version {{ alertmanager_version }} is not installed or not working correctly" + + rescue: + - name: "Create Alertmanager directories '{{ item }}'" + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0755" + with_items: + - "{{ config_dir }}" + - "{{ alertmanager_dir }}" + - "{{ storage_dir }}" + + - name: "Download Alertmanager binary" + ansible.builtin.get_url: + url: "https://github.com/prometheus/alertmanager/releases/download/v{{ alertmanager_version }}/\ + alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + dest: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0644" + + - name: "Unpack Alertmanager binaries" + notify: "(Re)start and enable Alertmanager" + ansible.builtin.unarchive: + src: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + dest: "{{ alertmanager_dir }}" + creates: "{{ alertmanager_dir }}/alertmanager-{{ alertmanager_version }}.linux-amd64" + remote_src: true + + - name: "Cleanup downloaded file" + ansible.builtin.file: + path: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + state: absent + + - name: "Move official alertmanager and amtool binaries" + ansible.builtin.copy: + src: "{{ alertmanager_dir }}/alertmanager-{{ alertmanager_version }}.linux-amd64/{{ item }}" + dest: "/usr/local/bin/{{ item }}" + mode: "0755" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + remote_src: true + with_items: + - alertmanager + - amtool + + +- name: "Create systemd service unit" + ansible.builtin.template: + src: alertmanager.service.j2 + dest: /etc/systemd/system/alertmanager.service + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" diff --git a/roles/alertmanager/tasks/main.yml b/roles/alertmanager/tasks/main.yml new file mode 100644 index 0000000..6bd62b2 --- /dev/null +++ b/roles/alertmanager/tasks/main.yml @@ -0,0 +1,9 @@ +--- +- name: "Run installation tasks" + ansible.builtin.include_tasks: install.yml + +- name: "Run configuration tasks" + ansible.builtin.include_tasks: configuration.yml + +- name: "Flush handlers" + ansible.builtin.meta: "flush_handlers" diff --git a/roles/alertmanager/templates/alertmanager.service.j2 b/roles/alertmanager/templates/alertmanager.service.j2 new file mode 100644 index 0000000..e4ee45a --- /dev/null +++ b/roles/alertmanager/templates/alertmanager.service.j2 @@ -0,0 +1,27 @@ +[Unit] +Description=Alertmanager Service +After=network.target +Documentation="https://prometheus.io/docs/alerting/latest/alertmanager/" + +[Service] +User={{ alertmanager_user }} +Group={{ alertmanager_group }} +Type=simple +ExecStart=/usr/local/bin/alertmanager \ + --config.file={{ config_dir }}/alertmanager.yml \ + --storage.path={{ storage_dir }} +Restart=on-failure + +# Security hardening +ReadWritePaths={{ storage_dir }} +ProtectSystem=strict +NoNewPrivileges=true +PrivateTmp=true +ProtectKernelModules=true +ProtectControlGroups=true +ProtectKernelTunables=true +ProtectClock=yes +RestrictSUIDSGID=true + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/roles/alertmanager/vars/main.yml b/roles/alertmanager/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/alertmanager/vars/main.yml @@ -0,0 +1 @@ +--- From 27ce34c42007c0d663c2c1bf2df53356b1ed5ffd Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 15:29:02 +0300 Subject: [PATCH 02/19] update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index dc6784a..eecffb1 100644 --- a/README.md +++ b/README.md @@ -6,3 +6,4 @@ ## Roles - [mount_device](roles/mount_device/README.md) +- [alertmanager](roles/alertmanager/README.md) From 48ced598f75a87759d3c6ddc0da5f27a151bca2a Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 15:29:16 +0300 Subject: [PATCH 03/19] add .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..feaf22e --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.ansible \ No newline at end of file From 56436fe607f4a8466e6e7cb0388ff6f4a55f5189 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 15:35:57 +0300 Subject: [PATCH 04/19] fix linter errors --- roles/alertmanager/README.md | 4 ++-- roles/alertmanager/defaults/main.yml | 4 ++-- roles/alertmanager/meta/main.yml | 6 +++--- .../default/alertmanager/alertmanager.yml | 18 +++++++++--------- .../alertmanager/molecule/default/converge.yml | 2 +- roles/alertmanager/molecule/default/verify.yml | 2 +- 6 files changed, 18 insertions(+), 18 deletions(-) diff --git a/roles/alertmanager/README.md b/roles/alertmanager/README.md index a8a57da..7ef20e9 100644 --- a/roles/alertmanager/README.md +++ b/roles/alertmanager/README.md @@ -15,8 +15,8 @@ Role Variables ``` alertmanager_version: 0.28.1 # version of Alertmanager (AM) -config_dir: "/etc/alertmanager/conf" # where to place AM configs -storage_dir: "/var/lib/alertmanager" # path to AM storage +alertmanager_config_dir: "/etc/alertmanager/conf" # where to place AM configs +alertmanager_storage_dir: "/var/lib/alertmanager" # path to AM storage alertmanager_dir: "/etc/alertmanager" # where to install AM on target alertmanager_user: "alertmanager" # system user name alertmanager_group: "alertmanager" # system group name diff --git a/roles/alertmanager/defaults/main.yml b/roles/alertmanager/defaults/main.yml index 88707b3..4e14295 100644 --- a/roles/alertmanager/defaults/main.yml +++ b/roles/alertmanager/defaults/main.yml @@ -1,7 +1,7 @@ --- alertmanager_version: 0.28.1 -config_dir: "/etc/alertmanager/conf" -storage_dir: "/var/lib/alertmanager" +alertmanager_config_dir: "/etc/alertmanager/conf" +alertmanager_storage_dir: "/var/lib/alertmanager" alertmanager_dir: "/etc/alertmanager" alertmanager_user: alertmanager alertmanager_group: alertmanager diff --git a/roles/alertmanager/meta/main.yml b/roles/alertmanager/meta/main.yml index 942b852..0cebb5a 100644 --- a/roles/alertmanager/meta/main.yml +++ b/roles/alertmanager/meta/main.yml @@ -1,6 +1,6 @@ --- galaxy_info: - role_name: "alertmanager" + role_name: alertmanager namespace: genlab author: "Alexander Gorelyshev" company: "Genlab, LLC" @@ -10,8 +10,8 @@ galaxy_info: platforms: - name: "Ubuntu" - versions: [ "focal", "jammy", "noble" ] + versions: ["focal", "jammy", "noble"] - galaxy_tags: [ ] + galaxy_tags: [] dependencies: [] diff --git a/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml index 7c3bff0..78e14ea 100644 --- a/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml +++ b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml @@ -7,20 +7,20 @@ global: # Other global settings like resolve_timeout, http_config, etc. -route: +route: # Default receiver for alerts receiver: 'default-receiver' - # Labels used for grouping alerts - group_by: ['alertname', 'instance', 'severity'] + # Labels used for grouping alerts + group_by: ['alertname', 'instance', 'severity'] - # Timing settings (group_wait, group_interval, repeat_interval) - # You can have nested 'routes' for more complex routing logic + # Timing settings (group_wait, group_interval, repeat_interval) + # You can have nested 'routes' for more complex routing logic receivers: - name: 'default-receiver' email_configs: - - to: 'ops-team@example.com' + - to: 'ops-team@example.com' inhibit_rules: # Rules to suppress alerts based on other alerts @@ -31,6 +31,6 @@ inhibit_rules: severity: 'warning' # Suppress 'warning' alerts if a 'critical' alert is also firing -templates: - # Paths to template files for customizing notifications - - '/etc/alertmanager/templates/*.tmpl' \ No newline at end of file +templates: + # Paths to template files for customizing notifications + - '/etc/alertmanager/templates/*.tmpl' diff --git a/roles/alertmanager/molecule/default/converge.yml b/roles/alertmanager/molecule/default/converge.yml index 3f7be92..470c151 100644 --- a/roles/alertmanager/molecule/default/converge.yml +++ b/roles/alertmanager/molecule/default/converge.yml @@ -2,5 +2,5 @@ - name: Converge hosts: all roles: - - role: genlab.alertmanager + - role: genlab.common.alertmanager config_source_dir: alertmanager diff --git a/roles/alertmanager/molecule/default/verify.yml b/roles/alertmanager/molecule/default/verify.yml index 0836d76..37eb46f 100644 --- a/roles/alertmanager/molecule/default/verify.yml +++ b/roles/alertmanager/molecule/default/verify.yml @@ -9,7 +9,7 @@ - name: "Include default vars" ansible.builtin.include_vars: dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/" - extensions: [ 'yml' ] + extensions: ['yml'] - name: "Check if Alertmanager is installed" changed_when: false From 756b5904373a2c017004b39f6ef0c568e5d7b51e Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 16:44:48 +0300 Subject: [PATCH 05/19] update variables --- roles/alertmanager/tasks/configuration.yml | 4 ++-- roles/alertmanager/tasks/install.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/alertmanager/tasks/configuration.yml b/roles/alertmanager/tasks/configuration.yml index 4932c8e..f06c996 100644 --- a/roles/alertmanager/tasks/configuration.yml +++ b/roles/alertmanager/tasks/configuration.yml @@ -4,7 +4,7 @@ notify: "(Re)start and enable Alertmanager" ansible.builtin.template: src: "{{ item }}" - dest: "{{ config_dir }}/{{ item | basename }}" + dest: "{{ alertmanager_config_dir }}/{{ item | basename }}" owner: "{{ alertmanager_user }}" group: "{{ alertmanager_group }}" mode: "0660" @@ -16,7 +16,7 @@ when: template_source_dir is defined ansible.builtin.copy: src: "{{ item }}" - dest: "{{ config_dir }}/{{ item | basename }}" + dest: "{{ alertmanager_config_dir }}/{{ item | basename }}" owner: "{{ alertmanager_user }}" group: "{{ alertmanager_group }}" mode: "0660" diff --git a/roles/alertmanager/tasks/install.yml b/roles/alertmanager/tasks/install.yml index f97a99e..db0b8c6 100644 --- a/roles/alertmanager/tasks/install.yml +++ b/roles/alertmanager/tasks/install.yml @@ -37,9 +37,9 @@ group: "{{ alertmanager_group }}" mode: "0755" with_items: - - "{{ config_dir }}" + - "{{ alertmanager_config_dir }}" - "{{ alertmanager_dir }}" - - "{{ storage_dir }}" + - "{{ alertmanager_storage_dir }}" - name: "Download Alertmanager binary" ansible.builtin.get_url: From ff206814345fe01326461f67dd3db4d52e99d5e3 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 16:48:41 +0300 Subject: [PATCH 06/19] update variables --- roles/alertmanager/templates/alertmanager.service.j2 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/alertmanager/templates/alertmanager.service.j2 b/roles/alertmanager/templates/alertmanager.service.j2 index e4ee45a..a85ae68 100644 --- a/roles/alertmanager/templates/alertmanager.service.j2 +++ b/roles/alertmanager/templates/alertmanager.service.j2 @@ -8,12 +8,12 @@ User={{ alertmanager_user }} Group={{ alertmanager_group }} Type=simple ExecStart=/usr/local/bin/alertmanager \ - --config.file={{ config_dir }}/alertmanager.yml \ - --storage.path={{ storage_dir }} + --config.file={{ alertmanager_config_dir }}/alertmanager.yml \ + --storage.path={{ alertmanager_storage_dir }} Restart=on-failure # Security hardening -ReadWritePaths={{ storage_dir }} +ReadWritePaths={{ alertmanager_storage_dir }} ProtectSystem=strict NoNewPrivileges=true PrivateTmp=true From 2902ab08b3bf06a28789a46ac29fdf9fa705b400 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Tue, 9 Dec 2025 17:05:08 +0300 Subject: [PATCH 07/19] add .vscode to .gitignore --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index feaf22e..1a7d3a3 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -.ansible \ No newline at end of file +.ansible +.vscode \ No newline at end of file From 19989e72d84e090b029404b54526bfcda87cd500 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:13:00 +0300 Subject: [PATCH 08/19] add wg_hub role with fixed ansible-lint errors --- roles/wg_hub/README.md | 43 +++++++++++++++++ roles/wg_hub/defaults/main.yml | 7 +++ roles/wg_hub/handlers/main.yml | 7 +++ roles/wg_hub/meta/main.yml | 17 +++++++ roles/wg_hub/molecule/default/converge.yml | 24 ++++++++++ roles/wg_hub/molecule/default/molecule.yml | 27 +++++++++++ roles/wg_hub/molecule/default/verify.yml | 13 ++++++ roles/wg_hub/tasks/main.yml | 54 ++++++++++++++++++++++ roles/wg_hub/vars/main.yml | 1 + 9 files changed, 193 insertions(+) create mode 100644 roles/wg_hub/README.md create mode 100644 roles/wg_hub/defaults/main.yml create mode 100644 roles/wg_hub/handlers/main.yml create mode 100644 roles/wg_hub/meta/main.yml create mode 100644 roles/wg_hub/molecule/default/converge.yml create mode 100644 roles/wg_hub/molecule/default/molecule.yml create mode 100644 roles/wg_hub/molecule/default/verify.yml create mode 100644 roles/wg_hub/tasks/main.yml create mode 100644 roles/wg_hub/vars/main.yml diff --git a/roles/wg_hub/README.md b/roles/wg_hub/README.md new file mode 100644 index 0000000..fe551c0 --- /dev/null +++ b/roles/wg_hub/README.md @@ -0,0 +1,43 @@ +template +========= + +Template for Ansible role monorepos. + +⚠️ Do not forget to update: + +- `meta/main.yml` +- Conda/Mamba manifests +- this README =) + +Requirements +------------ + +None + +Role Variables +-------------- + +None + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.template +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/wg_hub/defaults/main.yml b/roles/wg_hub/defaults/main.yml new file mode 100644 index 0000000..7bf9b28 --- /dev/null +++ b/roles/wg_hub/defaults/main.yml @@ -0,0 +1,7 @@ +--- +wg_hub_iface_name: wg0 +wg_hub_host_id: hub +wg_hub_ipv4_vpn_addr: 10.0.0.254 +wg_hub_ipv4_vpn_cidr: 24 +wg_hub_wg_port: 51820 +wg_hub_hide_secrets: true diff --git a/roles/wg_hub/handlers/main.yml b/roles/wg_hub/handlers/main.yml new file mode 100644 index 0000000..ff2cedb --- /dev/null +++ b/roles/wg_hub/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: "Run the Wireguard service" + ansible.builtin.systemd_service: + name: wg-quick@{{ wg_hub_iface_name | replace("-", "_") }} + state: restarted + enabled: true + daemon_reload: true diff --git a/roles/wg_hub/meta/main.yml b/roles/wg_hub/meta/main.yml new file mode 100644 index 0000000..e2da64a --- /dev/null +++ b/roles/wg_hub/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: "wg_hub" + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "" + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: ["jammy", "noble"] + + galaxy_tags: [] + +dependencies: [] diff --git a/roles/wg_hub/molecule/default/converge.yml b/roles/wg_hub/molecule/default/converge.yml new file mode 100644 index 0000000..e807dae --- /dev/null +++ b/roles/wg_hub/molecule/default/converge.yml @@ -0,0 +1,24 @@ +--- +- name: Converge + hosts: all + vars: + wg_hub_iface_name: adm + wg_hub_ipv4_vpn_addr: 10.0.0.254 + wg_hub_ipv4_vpn_cidr: 24 + wg_hub_wg_port: 51820 + wg_hub_wg_pkey: gABk6e/n3UDgudEVlUrEVcVdn0tc0YVDeCASsI10QFA= + wg_hub_wg_pubkey: EvcoZ21/p0AHz5y95jwjVIR9puljc2kXqh/f3U1A4nk= + wg_hub_hide_secrets: false + # dns_server: 127.0.0.1:5300 # doesn't work in Github Actions environment + peers: + - wg_hub_host_id: alpha + wg_hub_ipv4_vpn_addr: 10.0.0.1 + wg_hub_wg_pubkey: LfEJgNiJ05nx4nWB0Pj3wS3WRyFq567fsdDh4XZqRF0= + wg_psk: i3JCrQOfptZhgpL+BTm/65MPW/ljJexCgiuWMIqZJYo= + - wg_hub_host_id: beta + wg_hub_ipv4_vpn_addr: 10.0.0.2 + wg_hub_wg_pubkey: oq3Fcwwfxsi5f5UHcZKtxMwQ2aSeHOUe3r35soUUYzU= + wg_psk: Z/z7Qo8hW97UcImYE/ZbCxpNmizfVhvl0dzygtvtYYg= + + roles: + - role: genlab.common.wg_hub diff --git a/roles/wg_hub/molecule/default/molecule.yml b/roles/wg_hub/molecule/default/molecule.yml new file mode 100644 index 0000000..fd2f06d --- /dev/null +++ b/roles/wg_hub/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/wg_hub/molecule/default/verify.yml b/roles/wg_hub/molecule/default/verify.yml new file mode 100644 index 0000000..38f93ff --- /dev/null +++ b/roles/wg_hub/molecule/default/verify.yml @@ -0,0 +1,13 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + vars: + iface_name: adm + + tasks: + - name: "Check that the Wireguard service is running" + ansible.builtin.service: + name: wg-quick@{{ iface_name }} + state: started diff --git a/roles/wg_hub/tasks/main.yml b/roles/wg_hub/tasks/main.yml new file mode 100644 index 0000000..78551ea --- /dev/null +++ b/roles/wg_hub/tasks/main.yml @@ -0,0 +1,54 @@ +--- +- name: "Install wireguard system-wide" + ansible.builtin.apt: + name: wireguard + state: present + update_cache: true + cache_valid_time: 3600 + +- name: "Ensure no dashes in the interface name" + when: "'-' in wg_hub_iface_name" + ansible.builtin.fail: + msg: "The interface name must not contain dashes, got: '{{ wg_hub_iface_name }}'" + +- name: "Create the Hub configuration file" + no_log: "{{ wg_hub_hide_secrets }}" + notify: "Run the Wireguard service" + ansible.builtin.blockinfile: + path: "/etc/wireguard/{{ wg_hub_iface_name }}.conf" + create: true + owner: root + group: root + mode: "0600" + state: present + block: | + [Interface] + Address = {{ wg_hub_ipv4_vpn_addr }}/32 + ListenPort = {{ wg_hub_wg_port }} + PrivateKey = {{ wg_hub_wg_pkey }} + + PreUp = sysctl -w net.ipv4.ip_forward=1 + {% if dns_server is defined %} + PostUp = resolvectl dns %i {{ dns_server }}; resolvectl domain %i {{ wg_hub_iface_name }}.local + {% endif %} + PostDown = sysctl -w net.ipv4.ip_forward=0 + +- name: "Add [Peer] sections to the Hub configuration file" + no_log: "{{ wg_hub_hide_secrets }}" + notify: "Run the Wireguard service" + loop: "{{ peers }}" + vars: + domain_name: "{{ item.wg_hub_host_id }}.{{ wg_hub_iface_name }}.local" + ansible.builtin.blockinfile: + path: "/etc/wireguard/{{ wg_hub_iface_name }}.conf" + owner: root + group: root + mode: "0600" + marker: "# {mark} ANSIBLE MANAGED SPOKE BLOCK: {{ domain_name }}" + block: | + # + [Peer] # {{ domain_name }} + PublicKey = {{ item.wg_hub_wg_pubkey }} + PresharedKey = {{ item.wg_psk }} + AllowedIPs = {{ item.wg_hub_ipv4_vpn_addr }}/32 + # diff --git a/roles/wg_hub/vars/main.yml b/roles/wg_hub/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/wg_hub/vars/main.yml @@ -0,0 +1 @@ +--- From 6debe6fb7f530cfeafbf3451f345566aab454ecb Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:13:29 +0300 Subject: [PATCH 09/19] add wg_hub link to README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index eecffb1..241639d 100644 --- a/README.md +++ b/README.md @@ -7,3 +7,4 @@ - [mount_device](roles/mount_device/README.md) - [alertmanager](roles/alertmanager/README.md) +- [wg_hub](roles/wg_hub/README.md) \ No newline at end of file From 36fa1793247d89e726b9498cfc8377341723606d Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:13:40 +0300 Subject: [PATCH 10/19] update minor version --- galaxy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/galaxy.yml b/galaxy.yml index b17cb19..beac011 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -1,7 +1,7 @@ --- namespace: genlab name: common -version: 0.0.1 +version: 0.3.1 readme: README.md authors: - Alexander Gorelyshev (corvus-migratorius@proton.me) From d8118cdd8c47357c493dfe1b07ee83776a7d5853 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:27:01 +0300 Subject: [PATCH 11/19] add dnsmasq role --- .ansible-lint | 1 + roles/dnsmasq/.ansible-lint | 16 +++++++++ roles/dnsmasq/.gitignore | 2 ++ roles/dnsmasq/.yamllint | 8 +++++ roles/dnsmasq/README.md | 37 ++++++++++++++++++++ roles/dnsmasq/conda.dev.yml | 11 ++++++ roles/dnsmasq/conda.prod.yml | 9 +++++ roles/dnsmasq/defaults/main.yml | 3 ++ roles/dnsmasq/handlers/main.yml | 7 ++++ roles/dnsmasq/meta/main.yml | 17 +++++++++ roles/dnsmasq/molecule/default/converge.yml | 21 ++++++++++++ roles/dnsmasq/molecule/default/molecule.yml | 27 +++++++++++++++ roles/dnsmasq/molecule/default/verify.yml | 19 +++++++++++ roles/dnsmasq/renovate.json | 6 ++++ roles/dnsmasq/requirements.ci.txt | 6 ++++ roles/dnsmasq/requirements.txt | 1 + roles/dnsmasq/requirements.yml | 5 +++ roles/dnsmasq/tasks/main.yml | 38 +++++++++++++++++++++ roles/dnsmasq/vars/main.yml | 1 + 19 files changed, 235 insertions(+) create mode 100644 roles/dnsmasq/.ansible-lint create mode 100644 roles/dnsmasq/.gitignore create mode 100644 roles/dnsmasq/.yamllint create mode 100644 roles/dnsmasq/README.md create mode 100644 roles/dnsmasq/conda.dev.yml create mode 100644 roles/dnsmasq/conda.prod.yml create mode 100644 roles/dnsmasq/defaults/main.yml create mode 100644 roles/dnsmasq/handlers/main.yml create mode 100644 roles/dnsmasq/meta/main.yml create mode 100644 roles/dnsmasq/molecule/default/converge.yml create mode 100644 roles/dnsmasq/molecule/default/molecule.yml create mode 100644 roles/dnsmasq/molecule/default/verify.yml create mode 100644 roles/dnsmasq/renovate.json create mode 100644 roles/dnsmasq/requirements.ci.txt create mode 100644 roles/dnsmasq/requirements.txt create mode 100644 roles/dnsmasq/requirements.yml create mode 100644 roles/dnsmasq/tasks/main.yml create mode 100644 roles/dnsmasq/vars/main.yml diff --git a/.ansible-lint b/.ansible-lint index 43cae14..38f5606 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -7,3 +7,4 @@ loop_var_prefix: "^(__|{role}_)" exclude_paths: - .github/ + - .ansible/ diff --git a/roles/dnsmasq/.ansible-lint b/roles/dnsmasq/.ansible-lint new file mode 100644 index 0000000..f865478 --- /dev/null +++ b/roles/dnsmasq/.ansible-lint @@ -0,0 +1,16 @@ +--- +profile: production +strict: true + +# Enable checking of loop variable prefixes in roles +loop_var_prefix: "^(__|{role}_)" + +skip_list: + - var-naming[no-role-prefix] + +warn_list: + - role-name[path] + - var-naming[no-role-prefix] + +exclude_paths: + - .github/ diff --git a/roles/dnsmasq/.gitignore b/roles/dnsmasq/.gitignore new file mode 100644 index 0000000..8cd0df3 --- /dev/null +++ b/roles/dnsmasq/.gitignore @@ -0,0 +1,2 @@ +.vscode +.idea \ No newline at end of file diff --git a/roles/dnsmasq/.yamllint b/roles/dnsmasq/.yamllint new file mode 100644 index 0000000..611db54 --- /dev/null +++ b/roles/dnsmasq/.yamllint @@ -0,0 +1,8 @@ +--- +rules: + brackets: + forbid: false + min-spaces-inside: 0 + max-spaces-inside: 2 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: 2 diff --git a/roles/dnsmasq/README.md b/roles/dnsmasq/README.md new file mode 100644 index 0000000..2e1d6b4 --- /dev/null +++ b/roles/dnsmasq/README.md @@ -0,0 +1,37 @@ +ansible-dnsmasq +========= + +Deploy dnsmasq on the target node. For now, supports only DNS functionality (DHCP and TFTP are not configuratble). + +Requirements +------------ + +Take care to open the port you choose for dnsmasq to serve queries on. This role does not handle firewall configuration. + +Role Variables +-------------- + +None + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.dnsmasq +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/dnsmasq/conda.dev.yml b/roles/dnsmasq/conda.dev.yml new file mode 100644 index 0000000..d8f50de --- /dev/null +++ b/roles/dnsmasq/conda.dev.yml @@ -0,0 +1,11 @@ +--- +name: ansible-dnsmasq +channels: + - conda-forge +dependencies: + - python~=3.12.0 + - pip>=24.2 + - actionlint + - pip: + - -r requirements.txt + - -r requirements.ci.txt diff --git a/roles/dnsmasq/conda.prod.yml b/roles/dnsmasq/conda.prod.yml new file mode 100644 index 0000000..51dcb83 --- /dev/null +++ b/roles/dnsmasq/conda.prod.yml @@ -0,0 +1,9 @@ +--- +name: ansible-dnsmasq +channels: + - conda-forge +dependencies: + - python~=3.12.0 + - pip>=24.2 + - pip: + - -r requirements.txt diff --git a/roles/dnsmasq/defaults/main.yml b/roles/dnsmasq/defaults/main.yml new file mode 100644 index 0000000..0788c90 --- /dev/null +++ b/roles/dnsmasq/defaults/main.yml @@ -0,0 +1,3 @@ +--- +cache_size: 100 +dns_port: 5300 diff --git a/roles/dnsmasq/handlers/main.yml b/roles/dnsmasq/handlers/main.yml new file mode 100644 index 0000000..c30be1c --- /dev/null +++ b/roles/dnsmasq/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: "Restart dnsmasq" + ansible.builtin.systemd_service: + name: dnsmasq + state: restarted + daemon_reload: true + enabled: true diff --git a/roles/dnsmasq/meta/main.yml b/roles/dnsmasq/meta/main.yml new file mode 100644 index 0000000..414d68d --- /dev/null +++ b/roles/dnsmasq/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: dnsmasq + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "" + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: [ "focal", "jammy" ] + + galaxy_tags: [ ] + +dependencies: [] diff --git a/roles/dnsmasq/molecule/default/converge.yml b/roles/dnsmasq/molecule/default/converge.yml new file mode 100644 index 0000000..f41738d --- /dev/null +++ b/roles/dnsmasq/molecule/default/converge.yml @@ -0,0 +1,21 @@ +--- +- name: Converge + hosts: all + roles: + - role: genlab.ufw + disable_ipv6: true + rules: + - rule: allow + # proto: udp + port: 5300 + interface: lo + direction: in + comment: "Allow dnsmasq to serve DNS queries on the given interface" + + - role: genlab.dnsmasq + iface: lo + domain: adm.local + dns_port: 5300 + nodes: + - name: hub + ip: 127.0.0.1 diff --git a/roles/dnsmasq/molecule/default/molecule.yml b/roles/dnsmasq/molecule/default/molecule.yml new file mode 100644 index 0000000..fd2f06d --- /dev/null +++ b/roles/dnsmasq/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/dnsmasq/molecule/default/verify.yml b/roles/dnsmasq/molecule/default/verify.yml new file mode 100644 index 0000000..3a4ca5f --- /dev/null +++ b/roles/dnsmasq/molecule/default/verify.yml @@ -0,0 +1,19 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + + pre_tasks: + - name: "Install a package providing the `dig` tool" + ansible.builtin.apt: + name: dnsutils + state: present + + tasks: + - name: "Test the output of the `dig` command" + changed_when: false + register: dig + failed_when: 'dig.stdout != "127.0.0.1"' + ansible.builtin.command: + cmd: "dig @127.0.0.1 -p 5353 hub.adm.vpn +short" diff --git a/roles/dnsmasq/renovate.json b/roles/dnsmasq/renovate.json new file mode 100644 index 0000000..5db72dd --- /dev/null +++ b/roles/dnsmasq/renovate.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended" + ] +} diff --git a/roles/dnsmasq/requirements.ci.txt b/roles/dnsmasq/requirements.ci.txt new file mode 100644 index 0000000..f99c76a --- /dev/null +++ b/roles/dnsmasq/requirements.ci.txt @@ -0,0 +1,6 @@ +ansible-lint +molecule==24.12.0 +molecule-plugins[docker] +docker~=7.1.0 +requests==2.31.0 # pinned to the latest version not breaking Docker SDK +yamllint diff --git a/roles/dnsmasq/requirements.txt b/roles/dnsmasq/requirements.txt new file mode 100644 index 0000000..cd252b9 --- /dev/null +++ b/roles/dnsmasq/requirements.txt @@ -0,0 +1 @@ +ansible~=11.1.0 diff --git a/roles/dnsmasq/requirements.yml b/roles/dnsmasq/requirements.yml new file mode 100644 index 0000000..cf52e39 --- /dev/null +++ b/roles/dnsmasq/requirements.yml @@ -0,0 +1,5 @@ +# requirements file +--- +roles: + - name: genlab.ufw + src: https://github.com/corvus-migratorius/ansible-ufw.git diff --git a/roles/dnsmasq/tasks/main.yml b/roles/dnsmasq/tasks/main.yml new file mode 100644 index 0000000..6f7d0ec --- /dev/null +++ b/roles/dnsmasq/tasks/main.yml @@ -0,0 +1,38 @@ +--- +- name: "Install dnsmasq" + ansible.builtin.apt: + name: dnsmasq + state: present + update_cache: true + + +- name: "Create interface-specific configuration file" + notify: "Restart dnsmasq" + ansible.builtin.blockinfile: + path: /etc/dnsmasq.d/{{ domain }}.conf + create: true + owner: root + group: root + mode: "0660" + block: | + interface="{{ iface }}" + port="{{ dns_port }}" + cache-size="{{ cache_size }}" + log-queries + server=1.1.1.1 # Cloudflare DNS + server=8.8.8.8 # Google DNS + server=8.8.4.4 # Google DNS (secondary) + + +- name: "Add nodes to the configuration file" + notify: "Restart dnsmasq" + loop: "{{ nodes }}" + ansible.builtin.blockinfile: + path: /etc/dnsmasq.d/{{ domain }}.conf + marker: "# {mark} ANSIBLE MANAGED: {{ item.name }}.{{ domain }}" + block: | + address=/{{ item.name }}.{{ domain }}/{{ item.ip }} + + +- name: "Flush handlers" + ansible.builtin.meta: flush_handlers diff --git a/roles/dnsmasq/vars/main.yml b/roles/dnsmasq/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/dnsmasq/vars/main.yml @@ -0,0 +1 @@ +--- From 0b9ba8964fd3c711fb6dc34ce564bbb2b200ecf2 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:28:32 +0300 Subject: [PATCH 12/19] add ufw role --- roles/ufw/.ansible-lint | 17 ++++++++ roles/ufw/.gitignore | 2 + roles/ufw/.yamllint | 8 ++++ roles/ufw/README.md | 37 +++++++++++++++++ roles/ufw/defaults/main.yml | 4 ++ roles/ufw/environment.ci.yml | 10 +++++ roles/ufw/environment.yml | 9 +++++ roles/ufw/handlers/main.yml | 4 ++ roles/ufw/meta/main.yml | 17 ++++++++ roles/ufw/molecule/default/converge.yml | 17 ++++++++ roles/ufw/molecule/default/molecule.yml | 27 +++++++++++++ roles/ufw/molecule/default/verify.yml | 28 +++++++++++++ roles/ufw/renovate.json | 6 +++ roles/ufw/requirements.ci.txt | 6 +++ roles/ufw/requirements.txt | 1 + roles/ufw/tasks/main.yml | 54 +++++++++++++++++++++++++ roles/ufw/vars/main.yml | 1 + 17 files changed, 248 insertions(+) create mode 100644 roles/ufw/.ansible-lint create mode 100644 roles/ufw/.gitignore create mode 100644 roles/ufw/.yamllint create mode 100644 roles/ufw/README.md create mode 100644 roles/ufw/defaults/main.yml create mode 100644 roles/ufw/environment.ci.yml create mode 100644 roles/ufw/environment.yml create mode 100644 roles/ufw/handlers/main.yml create mode 100644 roles/ufw/meta/main.yml create mode 100644 roles/ufw/molecule/default/converge.yml create mode 100644 roles/ufw/molecule/default/molecule.yml create mode 100644 roles/ufw/molecule/default/verify.yml create mode 100644 roles/ufw/renovate.json create mode 100644 roles/ufw/requirements.ci.txt create mode 100644 roles/ufw/requirements.txt create mode 100644 roles/ufw/tasks/main.yml create mode 100644 roles/ufw/vars/main.yml diff --git a/roles/ufw/.ansible-lint b/roles/ufw/.ansible-lint new file mode 100644 index 0000000..64a836a --- /dev/null +++ b/roles/ufw/.ansible-lint @@ -0,0 +1,17 @@ +--- +profile: production +strict: true + +# Enable checking of loop variable prefixes in roles +loop_var_prefix: "^(__|{role}_)" + +skip_list: + - var-naming[no-role-prefix] + +warn_list: + - role-name[path] + - var-naming[no-role-prefix] + +exclude_paths: + - .github/ + - ufw-rules.yml diff --git a/roles/ufw/.gitignore b/roles/ufw/.gitignore new file mode 100644 index 0000000..8cd0df3 --- /dev/null +++ b/roles/ufw/.gitignore @@ -0,0 +1,2 @@ +.vscode +.idea \ No newline at end of file diff --git a/roles/ufw/.yamllint b/roles/ufw/.yamllint new file mode 100644 index 0000000..611db54 --- /dev/null +++ b/roles/ufw/.yamllint @@ -0,0 +1,8 @@ +--- +rules: + brackets: + forbid: false + min-spaces-inside: 0 + max-spaces-inside: 2 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: 2 diff --git a/roles/ufw/README.md b/roles/ufw/README.md new file mode 100644 index 0000000..7207f41 --- /dev/null +++ b/roles/ufw/README.md @@ -0,0 +1,37 @@ +template +========= + +Whitelist network ports with UFW + +Requirements +------------ + +None + +Role Variables +-------------- + +None + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.ufw +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/ufw/defaults/main.yml b/roles/ufw/defaults/main.yml new file mode 100644 index 0000000..7aa973f --- /dev/null +++ b/roles/ufw/defaults/main.yml @@ -0,0 +1,4 @@ +--- +rules: [] +limit_ssh: false +openssh_port: 22 diff --git a/roles/ufw/environment.ci.yml b/roles/ufw/environment.ci.yml new file mode 100644 index 0000000..b91f882 --- /dev/null +++ b/roles/ufw/environment.ci.yml @@ -0,0 +1,10 @@ +--- +name: ansible-ufw +channels: + - conda-forge +dependencies: + - python~=3.12.0 + - pip>=22.2 + - pip: + - -r requirements.txt + - -r requirements.ci.txt diff --git a/roles/ufw/environment.yml b/roles/ufw/environment.yml new file mode 100644 index 0000000..a5a6851 --- /dev/null +++ b/roles/ufw/environment.yml @@ -0,0 +1,9 @@ +--- +name: ansible-ufw +channels: + - conda-forge +dependencies: + - python~=3.12 + - pip>=22.2 + - pip: + - -r requirements.txt diff --git a/roles/ufw/handlers/main.yml b/roles/ufw/handlers/main.yml new file mode 100644 index 0000000..802d7ec --- /dev/null +++ b/roles/ufw/handlers/main.yml @@ -0,0 +1,4 @@ +--- +- name: "Reload-ufw" + community.general.ufw: + state: reloaded diff --git a/roles/ufw/meta/main.yml b/roles/ufw/meta/main.yml new file mode 100644 index 0000000..39c7f50 --- /dev/null +++ b/roles/ufw/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: ufw + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "Whitelist network ports with UFW" + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: [ "focal", "jammy" ] + + galaxy_tags: [ ] + +dependencies: [] diff --git a/roles/ufw/molecule/default/converge.yml b/roles/ufw/molecule/default/converge.yml new file mode 100644 index 0000000..26ef0bd --- /dev/null +++ b/roles/ufw/molecule/default/converge.yml @@ -0,0 +1,17 @@ +--- +- name: Converge + hosts: all + vars: + custom_rules: + - port: 80 + - port: 9080 + src: "10.2.1.0/24" + - interface: eth0@if288 + direction: in + comment: "Allow all incoming traffic on eth0@if288" + + roles: + - role: genlab.ufw + disable_ipv6: true + limit_ssh: true + rules: "{{ custom_rules }}" diff --git a/roles/ufw/molecule/default/molecule.yml b/roles/ufw/molecule/default/molecule.yml new file mode 100644 index 0000000..fd2f06d --- /dev/null +++ b/roles/ufw/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/ufw/molecule/default/verify.yml b/roles/ufw/molecule/default/verify.yml new file mode 100644 index 0000000..3130f87 --- /dev/null +++ b/roles/ufw/molecule/default/verify.yml @@ -0,0 +1,28 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + + tasks: + - name: "Get the UFW status" + register: ufw_status + changed_when: false + ansible.builtin.command: + cmd: ufw status + + - name: "Verify expected UFW status" + vars: + expected: + - "Status: active" + - "" + - "To Action From" + - "-- ------ ----" + - "22/tcp LIMIT Anywhere " + - "80 ALLOW Anywhere " + - "9080 ALLOW 10.2.1.0/24 " + - "Anywhere on eth0@if288 ALLOW Anywhere # Allow all incoming traffic on eth0@if288" + ansible.builtin.assert: + that: ufw_status.stdout_lines == expected + success_msg: "UFW has the expected state" + fail_msg: "Unexpected UFW state (some rules may have not been applied correctly)" diff --git a/roles/ufw/renovate.json b/roles/ufw/renovate.json new file mode 100644 index 0000000..5db72dd --- /dev/null +++ b/roles/ufw/renovate.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended" + ] +} diff --git a/roles/ufw/requirements.ci.txt b/roles/ufw/requirements.ci.txt new file mode 100644 index 0000000..2316ec9 --- /dev/null +++ b/roles/ufw/requirements.ci.txt @@ -0,0 +1,6 @@ +ansible-lint +molecule~=24.12.0 +molecule-plugins[docker] +docker==7.1.0 +requests==2.31.0 # pinned to the latest version not breaking Docker SDK +yamllint diff --git a/roles/ufw/requirements.txt b/roles/ufw/requirements.txt new file mode 100644 index 0000000..90d4055 --- /dev/null +++ b/roles/ufw/requirements.txt @@ -0,0 +1 @@ +ansible diff --git a/roles/ufw/tasks/main.yml b/roles/ufw/tasks/main.yml new file mode 100644 index 0000000..21973d5 --- /dev/null +++ b/roles/ufw/tasks/main.yml @@ -0,0 +1,54 @@ +--- +- name: "Ensure that ufw is installed" + ansible.builtin.apt: + name: ufw + update_cache: true + +- name: "Disable IPv6" + when: (disable_ipv6 is defined) and (disable_ipv6 is true) + ansible.builtin.lineinfile: + path: /etc/default/ufw + regexp: ^IPV6 + line: IPV6=no + +- name: "Deny incoming connections" + notify: Reload-ufw + community.general.ufw: + direction: incoming + proto: any + policy: deny + +- name: "Allow outgoing connections" + notify: Reload-ufw + community.general.ufw: + direction: outgoing + proto: any + policy: allow + +- name: "Allow SSH access" + notify: Reload-ufw + community.general.ufw: + rule: "{{ limit_ssh | ternary('limit', 'allow') }}" + port: "{{ openssh_port }}" + proto: tcp + +- name: "Set whitelist rules" + notify: Reload-ufw + loop: "{{ rules }}" + community.general.ufw: + rule: "{{ item.rule | default('allow') }}" + comment: "{{ item.comment | default(omit) }}" + port: "{{ item.port | default(omit) }}" + proto: "{{ item.proto | default('any') }}" + src: "{{ item.src | default('any') }}" + dest: "{{ item.dest | default(omit) }}" + interface: "{{ item.interface | default(omit) }}" + direction: "{{ item.direction | default(omit) }}" + route: "{{ item.route | default(false) }}" + +- name: "Enable the ufw service" + community.general.ufw: + state: enabled + +- name: "Flush handlers" + ansible.builtin.meta: flush_handlers diff --git a/roles/ufw/vars/main.yml b/roles/ufw/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/ufw/vars/main.yml @@ -0,0 +1 @@ +--- From 20f56a3d194528b209fbb32112ebed8df731642a Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:37:39 +0300 Subject: [PATCH 13/19] fix linter error --- roles/ufw/defaults/main.yml | 6 +++--- roles/ufw/meta/main.yml | 4 ++-- roles/ufw/molecule/default/converge.yml | 6 +++--- roles/ufw/tasks/main.yml | 6 +++--- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/roles/ufw/defaults/main.yml b/roles/ufw/defaults/main.yml index 7aa973f..702f638 100644 --- a/roles/ufw/defaults/main.yml +++ b/roles/ufw/defaults/main.yml @@ -1,4 +1,4 @@ --- -rules: [] -limit_ssh: false -openssh_port: 22 +ufw_rules: [] +ufw_limit_ssh: false +ufw_openssh_port: 22 diff --git a/roles/ufw/meta/main.yml b/roles/ufw/meta/main.yml index 39c7f50..004334a 100644 --- a/roles/ufw/meta/main.yml +++ b/roles/ufw/meta/main.yml @@ -10,8 +10,8 @@ galaxy_info: platforms: - name: "Ubuntu" - versions: [ "focal", "jammy" ] + versions: ["focal", "jammy"] - galaxy_tags: [ ] + galaxy_tags: [] dependencies: [] diff --git a/roles/ufw/molecule/default/converge.yml b/roles/ufw/molecule/default/converge.yml index 26ef0bd..ddd580c 100644 --- a/roles/ufw/molecule/default/converge.yml +++ b/roles/ufw/molecule/default/converge.yml @@ -11,7 +11,7 @@ comment: "Allow all incoming traffic on eth0@if288" roles: - - role: genlab.ufw + - role: genlab.common.ufw disable_ipv6: true - limit_ssh: true - rules: "{{ custom_rules }}" + ufw_limit_ssh: true + ufw_rules: "{{ custom_rules }}" diff --git a/roles/ufw/tasks/main.yml b/roles/ufw/tasks/main.yml index 21973d5..30885d3 100644 --- a/roles/ufw/tasks/main.yml +++ b/roles/ufw/tasks/main.yml @@ -28,13 +28,13 @@ - name: "Allow SSH access" notify: Reload-ufw community.general.ufw: - rule: "{{ limit_ssh | ternary('limit', 'allow') }}" - port: "{{ openssh_port }}" + rule: "{{ ufw_limit_ssh | ternary('limit', 'allow') }}" + port: "{{ ufw_openssh_port }}" proto: tcp - name: "Set whitelist rules" notify: Reload-ufw - loop: "{{ rules }}" + loop: "{{ ufw_rules }}" community.general.ufw: rule: "{{ item.rule | default('allow') }}" comment: "{{ item.comment | default(omit) }}" From 233987878e509005c68794429231ddc0e2fb474d Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:38:15 +0300 Subject: [PATCH 14/19] update galaxy version --- galaxy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/galaxy.yml b/galaxy.yml index beac011..1c0944f 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -1,7 +1,7 @@ --- namespace: genlab name: common -version: 0.3.1 +version: 0.4.0 readme: README.md authors: - Alexander Gorelyshev (corvus-migratorius@proton.me) From 0f9fdc9e93852d73e01248451684571d5c92c833 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:40:10 +0300 Subject: [PATCH 15/19] remove excessive files --- roles/ufw/.ansible-lint | 17 ----------------- roles/ufw/.gitignore | 2 -- roles/ufw/.yamllint | 8 -------- roles/ufw/environment.ci.yml | 10 ---------- roles/ufw/environment.yml | 9 --------- roles/ufw/renovate.json | 6 ------ roles/ufw/requirements.ci.txt | 6 ------ roles/ufw/requirements.txt | 1 - 8 files changed, 59 deletions(-) delete mode 100644 roles/ufw/.ansible-lint delete mode 100644 roles/ufw/.gitignore delete mode 100644 roles/ufw/.yamllint delete mode 100644 roles/ufw/environment.ci.yml delete mode 100644 roles/ufw/environment.yml delete mode 100644 roles/ufw/renovate.json delete mode 100644 roles/ufw/requirements.ci.txt delete mode 100644 roles/ufw/requirements.txt diff --git a/roles/ufw/.ansible-lint b/roles/ufw/.ansible-lint deleted file mode 100644 index 64a836a..0000000 --- a/roles/ufw/.ansible-lint +++ /dev/null @@ -1,17 +0,0 @@ ---- -profile: production -strict: true - -# Enable checking of loop variable prefixes in roles -loop_var_prefix: "^(__|{role}_)" - -skip_list: - - var-naming[no-role-prefix] - -warn_list: - - role-name[path] - - var-naming[no-role-prefix] - -exclude_paths: - - .github/ - - ufw-rules.yml diff --git a/roles/ufw/.gitignore b/roles/ufw/.gitignore deleted file mode 100644 index 8cd0df3..0000000 --- a/roles/ufw/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -.vscode -.idea \ No newline at end of file diff --git a/roles/ufw/.yamllint b/roles/ufw/.yamllint deleted file mode 100644 index 611db54..0000000 --- a/roles/ufw/.yamllint +++ /dev/null @@ -1,8 +0,0 @@ ---- -rules: - brackets: - forbid: false - min-spaces-inside: 0 - max-spaces-inside: 2 - min-spaces-inside-empty: -1 - max-spaces-inside-empty: 2 diff --git a/roles/ufw/environment.ci.yml b/roles/ufw/environment.ci.yml deleted file mode 100644 index b91f882..0000000 --- a/roles/ufw/environment.ci.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -name: ansible-ufw -channels: - - conda-forge -dependencies: - - python~=3.12.0 - - pip>=22.2 - - pip: - - -r requirements.txt - - -r requirements.ci.txt diff --git a/roles/ufw/environment.yml b/roles/ufw/environment.yml deleted file mode 100644 index a5a6851..0000000 --- a/roles/ufw/environment.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -name: ansible-ufw -channels: - - conda-forge -dependencies: - - python~=3.12 - - pip>=22.2 - - pip: - - -r requirements.txt diff --git a/roles/ufw/renovate.json b/roles/ufw/renovate.json deleted file mode 100644 index 5db72dd..0000000 --- a/roles/ufw/renovate.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:recommended" - ] -} diff --git a/roles/ufw/requirements.ci.txt b/roles/ufw/requirements.ci.txt deleted file mode 100644 index 2316ec9..0000000 --- a/roles/ufw/requirements.ci.txt +++ /dev/null @@ -1,6 +0,0 @@ -ansible-lint -molecule~=24.12.0 -molecule-plugins[docker] -docker==7.1.0 -requests==2.31.0 # pinned to the latest version not breaking Docker SDK -yamllint diff --git a/roles/ufw/requirements.txt b/roles/ufw/requirements.txt deleted file mode 100644 index 90d4055..0000000 --- a/roles/ufw/requirements.txt +++ /dev/null @@ -1 +0,0 @@ -ansible From bfdb8cad552fb0e49e7e34bf655496abea44e11f Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 11 Dec 2025 10:49:01 +0300 Subject: [PATCH 16/19] add community.general installation in github actions --- .github/workflows/linters.yml | 4 ++++ .github/workflows/molecule.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml index b90a6ea..0aace81 100644 --- a/.github/workflows/linters.yml +++ b/.github/workflows/linters.yml @@ -26,6 +26,10 @@ jobs: # run: ansible-galaxy install -r requirements.yml # shell: micromamba-shell {0} + - name: "Install community.general collection" + run: ansible-galaxy collection install community.general + shell: micromamba-shell {0} + - name: Check workflow files themselves with ActionLint run: actionlint shell: micromamba-shell {0} diff --git a/.github/workflows/molecule.yml b/.github/workflows/molecule.yml index 2fde508..97885ee 100644 --- a/.github/workflows/molecule.yml +++ b/.github/workflows/molecule.yml @@ -78,6 +78,10 @@ jobs: run: ansible-galaxy install -r requirements.yml shell: micromamba-shell {0} + - name: "Install community.general collection" + run: ansible-galaxy collection install community.general + shell: micromamba-shell {0} + - name: "Run Molecule tests" if: ${{ matrix.role != '__no_role__' }} working-directory: ${{ matrix.role }} From c1311a77c4a4d08e66bbae55485ba634711b779e Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Fri, 12 Dec 2025 10:32:18 +0300 Subject: [PATCH 17/19] fix linter errors --- roles/dnsmasq/defaults/main.yml | 4 ++-- roles/dnsmasq/meta/main.yml | 4 ++-- roles/dnsmasq/molecule/default/converge.yml | 12 ++++++------ roles/dnsmasq/molecule/default/verify.yml | 2 +- roles/dnsmasq/tasks/main.yml | 18 +++++++++--------- 5 files changed, 20 insertions(+), 20 deletions(-) diff --git a/roles/dnsmasq/defaults/main.yml b/roles/dnsmasq/defaults/main.yml index 0788c90..24e3d56 100644 --- a/roles/dnsmasq/defaults/main.yml +++ b/roles/dnsmasq/defaults/main.yml @@ -1,3 +1,3 @@ --- -cache_size: 100 -dns_port: 5300 +dnsmasq_cache_size: 100 +dnsmasq_dns_port: 5300 diff --git a/roles/dnsmasq/meta/main.yml b/roles/dnsmasq/meta/main.yml index 414d68d..03ddef7 100644 --- a/roles/dnsmasq/meta/main.yml +++ b/roles/dnsmasq/meta/main.yml @@ -10,8 +10,8 @@ galaxy_info: platforms: - name: "Ubuntu" - versions: [ "focal", "jammy" ] + versions: ["focal", "jammy"] - galaxy_tags: [ ] + galaxy_tags: [] dependencies: [] diff --git a/roles/dnsmasq/molecule/default/converge.yml b/roles/dnsmasq/molecule/default/converge.yml index f41738d..6a8f31d 100644 --- a/roles/dnsmasq/molecule/default/converge.yml +++ b/roles/dnsmasq/molecule/default/converge.yml @@ -2,7 +2,7 @@ - name: Converge hosts: all roles: - - role: genlab.ufw + - role: genlab.common.ufw disable_ipv6: true rules: - rule: allow @@ -12,10 +12,10 @@ direction: in comment: "Allow dnsmasq to serve DNS queries on the given interface" - - role: genlab.dnsmasq - iface: lo - domain: adm.local - dns_port: 5300 - nodes: + - role: genlab.common.dnsmasq + dnsmasq_iface: lo + dnsmasq_domain: adm.local + dnsmasq_dns_port: 5300 + dnsmasq_nodes: - name: hub ip: 127.0.0.1 diff --git a/roles/dnsmasq/molecule/default/verify.yml b/roles/dnsmasq/molecule/default/verify.yml index 3a4ca5f..8eaf15a 100644 --- a/roles/dnsmasq/molecule/default/verify.yml +++ b/roles/dnsmasq/molecule/default/verify.yml @@ -13,7 +13,7 @@ tasks: - name: "Test the output of the `dig` command" changed_when: false - register: dig + register: dnsmasq_dig failed_when: 'dig.stdout != "127.0.0.1"' ansible.builtin.command: cmd: "dig @127.0.0.1 -p 5353 hub.adm.vpn +short" diff --git a/roles/dnsmasq/tasks/main.yml b/roles/dnsmasq/tasks/main.yml index 6f7d0ec..ff29987 100644 --- a/roles/dnsmasq/tasks/main.yml +++ b/roles/dnsmasq/tasks/main.yml @@ -9,29 +9,29 @@ - name: "Create interface-specific configuration file" notify: "Restart dnsmasq" ansible.builtin.blockinfile: - path: /etc/dnsmasq.d/{{ domain }}.conf + path: /etc/dnsmasq.d/{{ dnsmasq_domain }}.conf create: true owner: root group: root mode: "0660" block: | - interface="{{ iface }}" - port="{{ dns_port }}" - cache-size="{{ cache_size }}" + interface="{{ dnsmasq_iface }}" + port="{{ dnsmasq_dns_port }}" + cache-size="{{ dnsmasq_cache_size }}" log-queries server=1.1.1.1 # Cloudflare DNS server=8.8.8.8 # Google DNS server=8.8.4.4 # Google DNS (secondary) -- name: "Add nodes to the configuration file" +- name: "Add dnsmasq_nodes to the configuration file" notify: "Restart dnsmasq" - loop: "{{ nodes }}" + loop: "{{ dnsmasq_nodes }}" ansible.builtin.blockinfile: - path: /etc/dnsmasq.d/{{ domain }}.conf - marker: "# {mark} ANSIBLE MANAGED: {{ item.name }}.{{ domain }}" + path: /etc/dnsmasq.d/{{ dnsmasq_domain }}.conf + marker: "# {mark} ANSIBLE MANAGED: {{ item.name }}.{{ dnsmasq_domain }}" block: | - address=/{{ item.name }}.{{ domain }}/{{ item.ip }} + address=/{{ item.name }}.{{ dnsmasq_domain }}/{{ item.ip }} - name: "Flush handlers" From a1323ea97a709cf37156b59a130870e616d7d2d2 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Fri, 12 Dec 2025 10:32:30 +0300 Subject: [PATCH 18/19] fix verify task --- roles/dnsmasq/molecule/default/verify.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/dnsmasq/molecule/default/verify.yml b/roles/dnsmasq/molecule/default/verify.yml index 8eaf15a..f9182a5 100644 --- a/roles/dnsmasq/molecule/default/verify.yml +++ b/roles/dnsmasq/molecule/default/verify.yml @@ -16,4 +16,4 @@ register: dnsmasq_dig failed_when: 'dig.stdout != "127.0.0.1"' ansible.builtin.command: - cmd: "dig @127.0.0.1 -p 5353 hub.adm.vpn +short" + cmd: "dig @127.0.0.1 -p 5300 hub.adm.local +short" From 640c26279be9eafffdf9dae4c689a7946837f4b6 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Fri, 12 Dec 2025 10:37:51 +0300 Subject: [PATCH 19/19] fix verify error --- roles/dnsmasq/molecule/default/verify.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/dnsmasq/molecule/default/verify.yml b/roles/dnsmasq/molecule/default/verify.yml index f9182a5..9a45b9e 100644 --- a/roles/dnsmasq/molecule/default/verify.yml +++ b/roles/dnsmasq/molecule/default/verify.yml @@ -14,6 +14,6 @@ - name: "Test the output of the `dig` command" changed_when: false register: dnsmasq_dig - failed_when: 'dig.stdout != "127.0.0.1"' + failed_when: 'dnsmasq_dig.stdout != "127.0.0.1"' ansible.builtin.command: cmd: "dig @127.0.0.1 -p 5300 hub.adm.local +short"