diff --git a/roles/debian/tasks/main.yml b/roles/debian/tasks/main.yml index d9f7852..139c2a2 100644 --- a/roles/debian/tasks/main.yml +++ b/roles/debian/tasks/main.yml @@ -1,13 +1,4 @@ -- name: Set hostname - hostname: - name: '{{ inventory_hostname }}' - -- name: Set up management interface - template: - dest: /etc/network/interfaces - src: interfaces.j2 - mode: 0644 - notify: reboot +- include_tasks: mgmt.yml - name: Set up loopback interface template: @@ -23,32 +14,9 @@ mode: 0644 notify: reload interfaces -- name: Install ifupdown2 - package: name=ifupdown2 - notify: reboot - -- name: Create override directory for ssh service - file: - path: /etc/systemd/system/ssh.service.d - state: directory - -- name: Run ssh in mgmt VRF - copy: - dest: /etc/systemd/system/ssh.service.d/override.conf - src: ssh.service-override.conf - notify: reboot - -# With PAM enabled, login shell would run in default VRF instead of mgmt. -- name: Disable PAM for ssh - lineinfile: - path: /etc/ssh/sshd_config - regexp: '^UsePAM .*yes' - state: absent - notify: reboot - -# Reboot here if anything changed to ensure the new VRF is up and sshd -# listens there. -- meta: flush_handlers +- name: Set hostname + hostname: + name: '{{ inventory_hostname }}' - name: Set up resolv.conf template: diff --git a/roles/debian/tasks/mgmt.yml b/roles/debian/tasks/mgmt.yml new file mode 100644 index 0000000..9ac0754 --- /dev/null +++ b/roles/debian/tasks/mgmt.yml @@ -0,0 +1,39 @@ +- name: Add rules to rename network interfaces + template: + dest: /etc/udev/rules.d/10-network.rules + src: 10-network.rules.j2 + mode: 0644 + notify: reboot + +- name: Set up management interface + template: + dest: /etc/network/interfaces + src: interfaces.j2 + mode: 0644 + notify: reboot + +- name: Install ifupdown2 + package: name=ifupdown2 + notify: reboot + +- name: Create override directory for ssh service + file: + path: /etc/systemd/system/ssh.service.d + state: directory + +- name: Set up ssh to run in mgmt VRF + copy: + dest: /etc/systemd/system/ssh.service.d/override.conf + src: ssh.service-override.conf + notify: reboot + +# With PAM enabled, login shell would run in default VRF instead of mgmt. +- name: Disable PAM for ssh + lineinfile: + path: /etc/ssh/sshd_config + regexp: '^UsePAM .*yes' + state: absent + notify: reboot + +- meta: flush_handlers + diff --git a/roles/debian/templates/fabric.intf.j2 b/roles/debian/templates/fabric.intf.j2 index 7c743b3..ce46441 100644 --- a/roles/debian/templates/fabric.intf.j2 +++ b/roles/debian/templates/fabric.intf.j2 @@ -1,6 +1,6 @@ -{% for iface in ifaces_fabric %} -auto {{ iface }} -iface {{ iface }} +{% for iface in hostvars[inventory_hostname].interfaces | selectattr('name', 'match', '^lan') %} +auto {{ iface.name }} +iface {{ iface.name }} mtu 9216 {% endfor %} \ No newline at end of file diff --git a/roles/debian/templates/frr.conf.j2 b/roles/debian/templates/frr.conf.j2 index 072340a..7c79400 100644 --- a/roles/debian/templates/frr.conf.j2 +++ b/roles/debian/templates/frr.conf.j2 @@ -2,16 +2,16 @@ frr defaults datacenter service integrated-vtysh-config log syslog -router bgp {{ asn }} +router bgp {{ hostvars[inventory_hostname].custom_fields.asn.asn }} bgp bestpath as-path multipath-relax neighbor fabric peer-group neighbor fabric remote-as external neighbor fabric capability extended-nexthop -{% for iface in ifaces_fabric %} - neighbor {{ iface }} interface peer-group fabric - neighbor {{ iface }} bfd +{% for iface in hostvars[inventory_hostname].interfaces | selectattr('name', 'match', '^lan') %} + neighbor {{ iface.name }} interface peer-group fabric + neighbor {{ iface.name }} bfd {% endfor %} address-family ipv4 unicast diff --git a/roles/debian/templates/interfaces.j2 b/roles/debian/templates/interfaces.j2 index b97d474..3631206 100644 --- a/roles/debian/templates/interfaces.j2 +++ b/roles/debian/templates/interfaces.j2 @@ -7,8 +7,16 @@ iface mgmt address ::1/128 vrf-table auto -auto {{ iface_mgmt }} -iface {{ iface_mgmt }} +{% for iface in hostvars[inventory_hostname].interfaces | selectattr('name', 'match', '^mgmt') | selectattr('ip_addresses') %} +auto {{ iface.name }} +iface {{ iface.name }} vrf mgmt - address {{ ansible_host }}/{{ mgmt_gw | ipaddr('prefix') }} - gateway {{ mgmt_gw | ipaddr('address') }} +{% for ip in iface.ip_addresses %} + address {{ ip.address }} +{% set gw = query('netbox.netbox.nb_lookup', 'ip-addresses', api_filter=('tag=gateway parent=' + ip.address))|first %} +{% if gw is defined %} + gateway {{ gw.value.address | ipaddr('address') }} +{% endif %} +{% endfor %} + +{% endfor %} diff --git a/roles/debian/templates/loopback.intf.j2 b/roles/debian/templates/loopback.intf.j2 index b736e81..6b20c23 100644 --- a/roles/debian/templates/loopback.intf.j2 +++ b/roles/debian/templates/loopback.intf.j2 @@ -1,3 +1,6 @@ +{% set iface_lo = hostvars[inventory_hostname].interfaces | selectattr('name', 'equalto', 'lo') | first %} auto lo iface lo inet loopback - address {{ router_id }}/32 +{% for ip in iface_lo.ip_addresses %} + address {{ ip.address }} +{% endfor %} diff --git a/templates/10-network.rules.j2 b/templates/10-network.rules.j2 new file mode 100644 index 0000000..604ca7b --- /dev/null +++ b/templates/10-network.rules.j2 @@ -0,0 +1,3 @@ +{% for iface in hostvars[inventory_hostname].interfaces | selectattr('name', 'match', '^(lan|mgmt)') %} +SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="{{ iface.mac_address|lower }}", NAME="{{ iface.name }}" +{% endfor %}