frr: don’t BGP peer on disabled interfaces

Also factor firewall setup into a separate task. There is no good way
to distinguish Debian and Proxmox hosts in Ansible, so we rely on the
cluster_type NetBox variable.

roles/debian/tasks/firewall.yml

@@ -0,0 +1,26 @@
+- name: Install nftables
+  package:
+    name: nftables
+
+- name: Set up generic firewall rules
+  copy:
+    dest: /etc/nftables.conf
+    src: nftables.conf
+  notify: reload nftables
+
+- name: Create nftables include directory
+  file:
+    path: /etc/nftables.d
+    state: directory
+
+- name: Set up local firewall rules
+  template:
+    dest: /etc/nftables.d/services.nft
+    src: services.nft.j2
+  notify: reload nftables
+
+- name: Enable firewall
+  service:
+    name: nftables
+    enabled: yes
+    state: started

roles/debian/tasks/main.yml

@@ -5,9 +5,12 @@
 
 - name: Add rules to rename network interfaces
   template:
-    dest: /etc/udev/rules.d/10-network.rules
-    src: 10-network.rules.j2
-    mode: 0644
+    dest: "/etc/systemd/network/10-{{ item.name }}.link"
+    src: interface.link.j2
+    mode: "0644"
+  loop: "{{ interfaces | selectattr('mac_address') }}"
+  loop_control:
+    label: "{{ item.name }}"
   notify: reboot
 
 - name: Set hostname
@@ -27,7 +30,6 @@
     name:
       - git
       - ifupdown2
-      - nftables
       - rsync
       - vim
       - tmux
@@ -73,28 +75,9 @@
       value: 'prohibit-password'
   notify: reload sshd
 
-- name: Set up generic firewall rules
-  copy:
-    dest: /etc/nftables.conf
-    src: nftables.conf
-  notify: reload nftables
-
-- name: Create nftables include directory
-  file:
-    path: /etc/nftables.d
-    state: directory
-
-- name: Set up local firewall rules
-  template:
-    dest: /etc/nftables.d/services.nft
-    src: services.nft.j2
-  notify: reload nftables
-
-- name: Enable firewall
-  service:
-    name: nftables
-    enabled: yes
-    state: started
+- name: Set up firewall
+  include_tasks: firewall.yml
+  when: is_virtual or cluster_type != 'proxmox' # proxmox has its own firewall configuration
 
 - name: Install automatic upgrade package
   package:

roles/frr/templates/frr.conf.j2

@@ -16,7 +16,7 @@ router bgp {{ asn.asn }}
   neighbor fabric remote-as external
   neighbor fabric capability extended-nexthop
 
-{% for iface in interfaces | selectattr('name', 'match', '^lan') %}
+{% for iface in interfaces | selectattr('enabled') | selectattr('name', 'match', '^lan') %}
   neighbor {{ iface.name }} interface peer-group fabric
 {% endfor %}
 

roles/proxmox/handlers/main.yml

@@ -1,7 +1,3 @@
-- name: reboot
-  reboot:
-  when: "'handler' not in ansible_skip_tags"
-
 - name: reload interfaces
   command: ifreload -a
   when: "'handler' not in ansible_skip_tags"
@@ -12,12 +8,6 @@
     state: reloaded
   when: "'handler' not in ansible_skip_tags"
 
-- name: reload sshd
-  service:
-    name: sshd
-    state: reloaded
-  when: "'handler' not in ansible_skip_tags"
-
 - name: update package cache
   package:
     update_cache: yes

roles/proxmox/tasks/main.yml

@@ -3,44 +3,15 @@
   set_fact:
     is_primary: '{{ nodes is defined and inventory_hostname == (nodes | map(attribute="inventory_hostname") | sort | first) }}'
 
-- name: Set hostname
-  hostname:
-    name: '{{ inventory_hostname }}'
-
 - name: Set up hosts file
   template:
     dest: /etc/hosts
     src: hosts.j2
 
-- name: Set up resolv.conf
-  template:
-    dest: /etc/resolv.conf
-    src: resolv.conf.j2
-    mode: 0644
-
-- name: Disable SSH password authentication
-  lineinfile:
-    path: /etc/ssh/sshd_config
-    regexp: '^#?{{ item.key }}'
-    line: '{{ item.key }} {{ item.value }}'
-  loop:
-    - key: PasswordAuthentication
-      value: 'no'
-    - key: PermitRootLogin
-      value: 'prohibit-password'
-  notify: reload sshd
-
 - include_tasks: network.yml
 
 - include_tasks: repositories.yml
 
-- name: Install essential packages
-  package:
-    name:
-      - git
-      - vim
-      - tmux
-
 - name: Set up sysctls
   copy:
     dest: /etc/sysctl.d/local.conf

roles/proxmox/tasks/network.yml

@@ -1,13 +1,3 @@
-- name: Add rules to rename network interfaces
-  template:
-    dest: "/etc/systemd/network/10-{{ item.name }}.link"
-    src: interface.link.j2
-    mode: "0644"
-  loop: "{{ interfaces | selectattr('mac_address') }}"
-  loop_control:
-    label: "{{ item.name }}"
-  notify: reboot
-
 - name: Set up bridges
   template:
     dest: /etc/network/interfaces
@@ -21,34 +11,4 @@
     src: loopback.intf.j2
   notify: reload interfaces
 
-- name: Set up physical interfaces
-  template:
-    dest: /etc/network/interfaces.d/ansible.intf
-    src: ansible.intf.j2
-    mode: 0644
-  notify: reload interfaces
-
-- name: Run SSH instance in management VRF
-  when: interfaces | selectattr('vrf') | selectattr('vrf.name', '==', 'mgmt')
-  block:
-    - name: Configure SSH instance in management VRF
-      copy:
-        dest: /etc/ssh/
-        src: sshd_config.mgmt
-        mode: 0644
-      notify: reboot
-
-    - name: Set up a SSH instance in management VRF
-      copy:
-        dest: /etc/systemd/system/
-        src: sshd@mgmt.service
-        mode: 0644
-      notify: reboot
-
-    - name: Enable management SSH
-      service:
-        name: sshd@mgmt
-        enabled: yes
-      notify: reboot
-
 - meta: flush_handlers