Deconsolidate network setup for proxmox and debian roles

They are just different enough to be annoying.

roles/debian/files/sshd@mgmt.service

@@ -1,16 +0,0 @@
-[Unit]
-Description=OpenBSD Secure Shell server (management VRF)
-After=network.target auditd.service
-
-[Service]
-ExecStartPre=/usr/sbin/sshd -t
-ExecStart=ip vrf exec mgmt /usr/sbin/sshd -f /etc/ssh/sshd_config.mgmt
-ExecReload=/usr/sbin/sshd -t
-ExecReload=/bin/kill -HUP $MAINPID
-KillMode=process
-Restart=on-failure
-RestartPreventExitStatus=255
-Type=notify
-
-[Install]
-WantedBy=multi-user.target

roles/debian/files/sshd_config.mgmt

@@ -1,14 +0,0 @@
-# This is for sshd in management VRF, for ansible and other not-really-OOB stuff.
-PidFile none
-UsePAM no
-Subsystem sftp /usr/lib/openssh/sftp-server
-
-# Only allow pubkey auth.
-KbdInteractiveAuthentication no
-PasswordAuthentication no
-PermitRootLogin prohibit-password
-
-# Disable what we can.
-AllowTcpForwarding no
-GatewayPorts no
-X11Forwarding no

roles/debian/templates/10-network.rules.j2

@@ -1,3 +0,0 @@
-{% for iface in hostvars[inventory_hostname].interfaces | selectattr('mac_address') %}
-SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="{{ iface.mac_address|lower }}", NAME="{{ iface.name }}"
-{% endfor %}

roles/debian/templates/ansible.intf.j2

@@ -1,31 +0,0 @@
-{% for vrf in interfaces | selectattr('vrf') | map(attribute='vrf.name') | sort | unique %}
-auto {{ vrf }}
-iface {{ vrf }}
-    vrf-table auto
-    address 127.0.0.1/8
-    address ::1/128
-
-{%+ endfor %}
-
-{%- for iface in interfaces | selectattr('enabled') %}
-{% if iface.mgmt_only is not defined or not iface.mgmt_only %}
-auto {{ iface.name }}
-iface {{ iface.name }}{% if iface.name == 'lo' %} inet loopback{% endif +%}
-{% if iface.mtu %}
-    mtu {{ iface.mtu }}
-{% endif %}
-{% if iface.vrf %}
-    vrf {{ iface.vrf.name }}
-{% endif %}
-{% for ip in iface.ip_addresses %}
-    address {{ ip.address }}
-{% set subnet = ip.address | ipaddr('subnet') %}
-{% set prefix = prefixes | selectattr('prefix', '==', subnet) | first %}
-{% set gateway = prefix.custom_fields.gateway.address %}
-{% if gateway is defined %}
-    gateway {{ gateway | ipaddr('address') }}
-{% endif %}
-{% endfor %}
-
-{% endif %}
-{% endfor %}

roles/debian/templates/resolv.conf.j2

@@ -1,4 +0,0 @@
-search {{ domain }}
-{% for server in dns %}
-nameserver {{ server }}
-{% endfor %}

roles/proxmox/handlers/main.yml

@@ -1,3 +1,12 @@
+- name: reboot
+  reboot:
+  when: "'handler' not in ansible_skip_tags"
+
 - name: reload interfaces
   command: ifreload -a
   when: "'handler' not in ansible_skip_tags"
+
+- name: update package cache
+  package:
+    update_cache: yes
+  when: "'handler' not in ansible_skip_tags"

roles/proxmox/tasks/main.yml

@@ -1,41 +1,55 @@
 # choose a node for tasks that should only run on (any) one node, e.g. when writing to /etc/pve
 - name: Select the primary node
   set_fact:
-    is_primary: '{{ inventory_hostname == (nodes | map(attribute="inventory_hostname") | sort | first) }}'
+    is_primary: '{{ nodes is defined and inventory_hostname == (nodes | map(attribute="inventory_hostname") | sort | first) }}'
+
+- name: Set hostname
+  hostname:
+    name: '{{ inventory_hostname }}'
+
+- name: Set up hosts file
+  template:
+    dest: /etc/hosts
+    src: hosts.j2
+
+- name: Set up resolv.conf
+  template:
+    dest: /etc/resolv.conf
+    src: resolv.conf.j2
+    mode: 0644
+
+- include_tasks: network.yml
 
 - name: Disable enterprise repositories
   apt_repository:
     repo: '{{ item }}'
     state: absent
-    update_cache: '{{ ansible_loop.last }}'
+    update_cache: no
   loop:
     - 'deb https://enterprise.proxmox.com/debian/pve {{ ansible_distribution_release }} pve-enterprise'
     - 'deb https://enterprise.proxmox.com/debian/ceph-quincy {{ ansible_distribution_release }} enterprise'
-  loop_control:
-    extended: true
+  notify: update package cache
 
 - name: Enable no-subscription repository
   apt_repository:
     repo: 'deb http://download.proxmox.com/debian/pve {{ ansible_distribution_release }} pve-no-subscription'
+    update_cache: no
+  notify: update package cache
+
+- meta: flush_handlers
+
+- name: Install essential packages
+  package:
+    name:
+      - git
+      - vim
+      - tmux
 
 - name: Set up sysctls
   copy:
     dest: /etc/sysctl.d/local.conf
     src: sysctl.conf
 
-- name: Set VXLAN local tunnel IP
-  template:
-    dest: /etc/network/interfaces.d/loopback.intf
-    src: loopback.intf.j2
-  notify: reload interfaces
-
-- name: Set up bridges
-  template:
-    dest: /etc/network/interfaces
-    src: interfaces.j2
-    mode: 0644
-  notify: reload interfaces
-
 - include_tasks: firewall.yml
 
 - include_tasks: user.yml

roles/proxmox/tasks/network.yml

@@ -0,0 +1,51 @@
+- name: Add rules to rename network interfaces
+  template:
+    dest: /etc/udev/rules.d/10-network.rules
+    src: 10-network.rules.j2
+    mode: 0644
+  notify: reboot
+
+- name: Set up bridges
+  template:
+    dest: /etc/network/interfaces
+    src: interfaces.j2
+    mode: 0644
+  notify: reload interfaces
+
+- name: Set VXLAN local tunnel IP
+  template:
+    dest: /etc/network/interfaces.d/loopback.intf
+    src: loopback.intf.j2
+  notify: reload interfaces
+
+- name: Set up physical interfaces
+  template:
+    dest: /etc/network/interfaces.d/ansible.intf
+    src: ansible.intf.j2
+    mode: 0644
+  notify: reload interfaces
+
+- name: Run SSH instance in management VRF
+  when: interfaces | selectattr('vrf') | selectattr('vrf.name', '==', 'mgmt')
+  block:
+    - name: Configure SSH instance in management VRF
+      copy:
+        dest: /etc/ssh/
+        src: sshd_config.mgmt
+        mode: 0644
+      notify: reboot
+
+    - name: Set up a SSH instance in management VRF
+      copy:
+        dest: /etc/systemd/system/
+        src: sshd@mgmt.service
+        mode: 0644
+      notify: reboot
+
+    - name: Enable management SSH
+      service:
+        name: sshd@mgmt
+        enabled: yes
+      notify: reboot
+
+- meta: flush_handlers

roles/proxmox/templates/hosts.j2

@@ -0,0 +1,12 @@
+127.0.0.1 localhost.localdomain localhost
+
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+{% for address in interfaces | selectattr('name', '==', 'lo') | map(attribute='ip_addresses') | first %}
+{{ address.address | ipaddr('address') }} {{ address.dns_name }} {{ inventory_hostname }}
+{% endfor %}