bitnode-network.yml

- name: apt install
  with_items:
    - systemd
  apt:
    name: "{{ item }}"
    install_recommends: false

- name: enable systemd-networkd
  systemd:
    name: systemd-networkd
    state: started
    enabled: yes
    masked: no

- name: /etc/systemd/network/10-br0.netdev
  notify: systemctl restart systemd-networkd
  copy:
    dest: /etc/systemd/network/10-br0.netdev
    content: |
      [NetDev]
      Name=br0
      Kind=bridge

- name: /etc/systemd/network/11-br0.network
  notify: systemctl restart systemd-networkd
  copy:
    dest: /etc/systemd/network/11-br0.network
    content: |
      [Match]
      Name=br0

      [Network]
      Address={{ int_ipv4.address }}/{{ int_ipv4.netmask }}
      Address={{ int_ipv6.address }}/{{ int_ipv6.netmask }}

- name: /etc/systemd/network/12-int0.netdev
  notify: systemctl restart systemd-networkd
  copy:
    dest: /etc/systemd/network/12-int0.netdev
    content: |
      [NetDev]
      Name=int0
      Kind=dummy

- name: /etc/systemd/network/13-int0.network
  notify: systemctl restart systemd-networkd
  copy:
    dest: /etc/systemd/network/13-int0.network
    content: |
      [Match]
      Name=int0

      [Network]
      Bridge=br0

- name: sysctl net.ipv4.ip_forward
  sysctl:
    name: net.ipv4.ip_forward
    value: 1
    sysctl_set: yes
    state: present
    reload: yes
    sysctl_file: /etc/sysctl.d/99-bitraf-network.conf

- name: install NAT
  tags:
    - nat
    - ufw
  blockinfile:
    insertbefore: "# Don't delete these required lines, otherwise there will be errors"
    path: /etc/ufw/before.rules
    block: |
      # NAT table rules
      *nat
      :POSTROUTING ACCEPT [0:0]

      # Forward traffic through eth0 - Change to match you out-interface
      -A POSTROUTING -s 10.13.39.0/24 -o eth0 -j MASQUERADE

      # don't delete the 'COMMIT' line or these nat table rules won't
      # be processed
      COMMIT

- name: install /etc/default/ufw
  tags: ufw
  copy:
    dest: /etc/default/ufw
    content: |
      # /etc/default/ufw
      #

      # Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
      # accepted). You will need to 'disable' and then 'enable' the firewall for
      # the changes to take affect.
      IPV6=yes

      # Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
      # you change this you will most likely want to adjust your rules.
      DEFAULT_INPUT_POLICY="DROP"

      # Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if
      # you change this you will most likely want to adjust your rules.
      DEFAULT_OUTPUT_POLICY="ACCEPT"

      # Set the default forward policy to ACCEPT, DROP or REJECT.  Please note that
      # if you change this you will most likely want to adjust your rules
      DEFAULT_FORWARD_POLICY="DROP"

      # Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please
      # note that setting this to ACCEPT may be a security risk. See 'man ufw' for
      # details
      DEFAULT_APPLICATION_POLICY="SKIP"

      # By default, ufw only touches its own chains. Set this to 'yes' to have ufw
      # manage the built-in chains too. Warning: setting this to 'yes' will break
      # non-ufw managed firewall rules
      MANAGE_BUILTINS=no

      #
      # IPT backend
      #
      # only enable if using iptables backend
      IPT_SYSCTL=/etc/ufw/sysctl.conf

      # Extra connection tracking modules to load. Complete list can be found in
      # net/netfilter/Kconfig of your kernel source. Some common modules:
      # nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support
      # nf_conntrack_netbios_ns: NetBIOS (samba) client support
      # nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT
      # nf_conntrack_ftp, nf_nat_ftp: active FTP support
      # nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)
      IPT_MODULES="nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns"

- name: "Allow port 5432 from 10.13.39.0/14 rule"
  tags: ufw
  ufw:
    rule: allow
    port: 5432
    proto: tcp
    src: 10.13.39.1/24