lvrt-lcl-system.yml

---
# Copyright (c) 2020-2024 Jakob Meng, <jakobmeng@web.de>
# vim:set fileformat=unix tabstop=2 shiftwidth=2 expandtab:
# kate: end-of-line unix; space-indent on; indent-width 2; remove-trailing-spaces modified;

ansible_connection: local

# For local connections use Python interpreter that is being used by Ansible on the controller.
#
# Rationale:
# For local connections Ansible will not necessarily use the same Python interpreter that is being used by Ansible
# on the controller. If Ansible on the controller is run from a virtual environment aka virtualenv, then Ansible
# will use interpreter discovery to choose a Python interpreter for local connections anyway. To reuse the Python
# interpreter from the controller, ansible_python_interpreter has to be set to ansible_playbook_python explicitly.
#
# Ref.:
#  https://github.com/ansible/ansible/issues/16724
#  https://willthames.github.io/2018/07/01/connection-local-vs-delegate_to-localhost.html
#  https://docs.ansible.com/ansible/latest/user_guide/playbooks_delegation.html
#  https://docs.ansible.com/ansible/latest/reference_appendices/interpreter_discovery.html
ansible_python_interpreter: "{{ ansible_playbook_python }}"

# Undo changes from group_vars/all.yml
files_config_early: []

# Undo changes from group_vars/all.yml
groups_config: []

iptables_config:
- # Enable masquerading for internet connectivity from libvirt domains on networks route-0-dhcp and route-1-no-dhcp
  # NOTE: The changes to nftables and iptables below are not persistant and will not survive reboots. Containerized
  #       setups with Docker oder Podman will run playbooks/site.yml and the following commands on each container start.
  #       But for non-containerized setups please refer to your operating system's documentation on how to store
  #       nftables / iptables rules persistently. Or run playbooks/site.yml again after rebooting.
  ansible.builtin.shell:
    argv:
      - sh
    stdin: |
      if command -v nft >/dev/null ; then
          if ! nft list chain ip nat POSTROUTING_CLOUDY >/dev/null 2>&1; then
              nft --file - << '________EOF'
      table ip nat {
          chain POSTROUTING_CLOUDY {
              type nat hook postrouting priority srcnat; policy accept;

              meta l4proto tcp ip saddr 192.168.157.0/24 ip daddr != 192.168.157.0/24 masquerade to :1024-65535
              meta l4proto udp ip saddr 192.168.157.0/24 ip daddr != 192.168.157.0/24 masquerade to :1024-65535
              ip saddr 192.168.157.0/24 ip daddr != 192.168.157.0/24 masquerade

              meta l4proto tcp ip saddr 192.168.158.0/24 ip daddr != 192.168.158.0/24 masquerade to :1024-65535
              meta l4proto udp ip saddr 192.168.158.0/24 ip daddr != 192.168.158.0/24 masquerade to :1024-65535
              ip saddr 192.168.158.0/24 ip daddr != 192.168.158.0/24 masquerade
          }
      }
      ________EOF
          fi
      else
          if ! iptables -t nat -C POSTROUTING -j POSTROUTING_CLOUDY >/dev/null 2>&1; then
              iptables-restore --noflush << '________EOF'
      *nat

      :POSTROUTING_CLOUDY ACCEPT [0:0]
      -A POSTROUTING_CLOUDY -s 192.168.157.0/24 ! -d 192.168.157.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
      -A POSTROUTING_CLOUDY -s 192.168.157.0/24 ! -d 192.168.157.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
      -A POSTROUTING_CLOUDY -s 192.168.157.0/24 ! -d 192.168.157.0/24 -j MASQUERADE
      -A POSTROUTING_CLOUDY -s 192.168.158.0/24 ! -d 192.168.158.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
      -A POSTROUTING_CLOUDY -s 192.168.158.0/24 ! -d 192.168.158.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
      -A POSTROUTING_CLOUDY -s 192.168.158.0/24 ! -d 192.168.158.0/24 -j MASQUERADE

      -A POSTROUTING -j POSTROUTING_CLOUDY
      COMMIT
      ________EOF
          fi
      fi

libvirt_images: []

libvirt_networks:
- # network without host ip, without dhcp, without forwarding and without masquerading
  acl: allow
  autostart: true
  bridge:
    delay: '0'
    name: 'virbr-local-0'
    stp: true
  #domain:
  #  name: 'isolated-0-no-ip'
  ignore:
  - '/network/uuid'
  - '/network/mac'
  name: 'isolated-0-no-ip'
  restart_on_change: true
  state: active
  xml_var: 'libvirt_network_template_isolated'

- # network with host ip, with dhcp, without forwarding and without masquerading
  acl: allow
  autostart: true
  bridge:
    delay: '0'
    name: 'virbr-local-1'
    stp: true
  #domain:
  #  name: 'isolated-1-dhcp'
  ip:
    address: '192.168.152.1'
    netmask: '255.255.255.0'
    dhcp:
      range:
        start: '192.168.152.2'
        end: '192.168.152.254'
  ignore:
  - '/network/uuid'
  - '/network/mac'
  name: 'isolated-1-dhcp'
  restart_on_change: true
  state: active
  xml_var: 'libvirt_network_template_isolated'

- # network with host ip, without dhcp, without forwarding and without masquerading
  acl: allow
  autostart: true
  bridge:
    delay: '0'
    name: 'virbr-local-2'
    stp: true
  #domain:
  #  name: 'isolated-2-no-dhcp'
  ip:
    address: '192.168.153.1'
    netmask: '255.255.255.0'
  ignore:
  - '/network/uuid'
  - '/network/mac'
  name: 'isolated-2-no-dhcp'
  restart_on_change: true
  state: active
  xml_var: 'libvirt_network_template_isolated'

- # network with host ip, without dhcp, without forwarding and without masquerading
  acl: allow
  autostart: true
  bridge:
    delay: '0'
    name: 'virbr-local-3'
    stp: true
  #domain:
  #  name: 'isolated-3-no-dhcp'
  ip:
    address: '192.168.154.1'
    netmask: '255.255.255.0'
  ignore:
  - '/network/uuid'
  - '/network/mac'
  name: 'isolated-3-no-dhcp'
  restart_on_change: true
  state: active
  xml_var: 'libvirt_network_template_isolated'

- # network with host ip, with dhcp, with forwarding and with masquerading
  acl: allow
  autostart: true
  bridge:
    delay: '0'
    name: 'virbr-local-4'
    stp: true
  #domain:
  #  name: 'nat-0-dhcp'
  ip:
    address: '192.168.155.1'
    netmask: '255.255.255.0'
    dhcp:
      range:
        start: '192.168.155.2'
        end: '192.168.155.254'
  ignore:
  - '/network/uuid'
  - '/network/mac'
  name: 'nat-0-dhcp'
  restart_on_change: true
  state: active
  xml_var: 'libvirt_network_template_nat'

- # network with host ip, without dhcp, with forwarding and with masquerading
  acl: allow
  autostart: true
  bridge:
    delay: '0'
    name: 'virbr-local-5'
    stp: true
  #domain:
  #  name: 'nat-1-no-dhcp'
  ip:
    address: '192.168.156.1'
    netmask: '255.255.255.0'
  ignore:
  - '/network/uuid'
  - '/network/mac'
  name: 'nat-1-no-dhcp'
  restart_on_change: true
  state: active
  xml_var: 'libvirt_network_template_nat'

- # network with host ip, with dhcp, with forwarding and without masquerading
  acl: allow
  autostart: true
  bridge:
    delay: '0'
    name: 'virbr-local-6'
    stp: true
  #domain:
  #  name: 'route-0-dhcp'
  ip:
    address: '192.168.157.1'
    netmask: '255.255.255.0'
    dhcp:
      range:
        start: '192.168.157.2'
        end: '192.168.157.254'
  ignore:
  - '/network/uuid'
  - '/network/mac'
  name: 'route-0-dhcp'
  restart_on_change: true
  state: active
  xml_var: 'libvirt_network_template_route'

- # network with host ip, without dhcp, with forwarding and without masquerading
  acl: allow
  autostart: true
  bridge:
    delay: '0'
    name: 'virbr-local-7'
    stp: true
  #domain:
  #  name: 'route-1-no-dhcp'
  ip:
    address: '192.168.158.1'
    netmask: '255.255.255.0'
  ignore:
  - '/network/uuid'
  - '/network/mac'
  name: 'route-1-no-dhcp'
  restart_on_change: true
  state: active
  xml_var: 'libvirt_network_template_route'

libvirt_pools:
# NOTE: When libvirt starts a domain, then libvirt will chown the storage volumes to libvirt-qemu:libvirt-qemu. When the
#       domain is stopped, then libvirt will restore the ownership of storage volumes back to root:root!
#       Ref.: https://bugzilla.redhat.com/show_bug.cgi?id=1004673#c3
- autostart: true
  hardware:
  - type: dir
  - target: /var/lib/libvirt/images
  ignore:
  - '/pool/uuid'
  - '/pool/capacity'
  - '/pool/allocation'
  - '/pool/available'
  - '/pool/target/permissions'
  name: 'default'
  restart_on_change: true
  state: 'active'
  xml_var: 'libvirt_pool_template_dir'

# Undo changes from group_vars/all.yml
sudoers_config: []

# Undo changes from group_vars/all.yml
ssh_authorized_keys: []

# Undo changes from group_vars/all.yml
users_config: []