diff --git a/.gitignore b/.gitignore index a309864..7d9d96c 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,5 @@ configs/*.mobileconfig configs/*.p12 configs/*.crt +configs/*.tmp +inventory_users diff --git a/config.cfg b/config.cfg index 2c6c6c1..d8a8780 100644 --- a/config.cfg +++ b/config.cfg @@ -10,8 +10,11 @@ easyrsa_reinit_existent: True dns_servers: - 8.8.8.8 - - 8.8.4.4 + - 8.8.4.4 + - 2001:4860:4860::8888 + - 2001:4860:4860::8844 vpn_network: 10.19.48.0/24 +vpn_network_ipv6: fd9d:bc11:4021:69ce::/64 server_name: "{{ ansible_ssh_host }}" users: diff --git a/digitalocean.yml b/digitalocean.yml index 48c6719..a435883 100644 --- a/digitalocean.yml +++ b/digitalocean.yml @@ -83,5 +83,56 @@ - name: Wait for SSH to become available local_action: "wait_for port=22 host={{ do.droplet.ip_address }} timeout=320" + + - name: Enable IPv6 on the droplet + uri: + url: "https://api.digitalocean.com/v2/droplets/{{ do.droplet.id }}/actions" + method: POST + body: + type: enable_ipv6 + body_format: json + status_code: 201 + HEADER_Authorization: "Bearer {{ do_access_token }}" + HEADER_Content-Type: "application/json" + + - name: Get Droplet networks + uri: + url: "https://api.digitalocean.com/v2/droplets/{{ do.droplet.id }}" + method: GET + status_code: 200 + HEADER_Authorization: "Bearer {{ do_access_token }}" + HEADER_Content-Type: "application/json" + register: droplet_info + + - name: IPv6 template created + template: src=20-ipv6.cfg.j2 dest=configs/20-ipv6.tmp + with_items: "{{ droplet_info.json.droplet.networks.v6 }}" + +- name: Post-provisioning tasks + hosts: vpn-host + gather_facts: false + user: root + vars_files: + - config.cfg + + pre_tasks: + - name: Install prerequisites + raw: sudo apt-get update -qq && sudo apt-get install -qq -y python2.7 + - name: Configure defaults + raw: sudo update-alternatives --install /usr/bin/python python /usr/bin/python2.7 1 + + tasks: + - name: IPv6 configured + copy: src=configs/20-ipv6.tmp dest=/etc/network/interfaces.d/20-ipv6.cfg owner=root group=root mode=0644 + + - name: IPv6 included into the network config + lineinfile: dest=/etc/network/interfaces line='source /etc/network/interfaces.d/20-ipv6.cfg' state=present + + - name: IPV6 is running + shell: sh -c 'ifdown eth0; ip addr flush dev eth0; ifup eth0' + + - name: Wait for SSH to become available + local_action: "wait_for port=22 host={{ inventory_hostname }} timeout=320" + become: false diff --git a/templates/20-ipv6.cfg.j2 b/templates/20-ipv6.cfg.j2 new file mode 100644 index 0000000..7db27bb --- /dev/null +++ b/templates/20-ipv6.cfg.j2 @@ -0,0 +1,6 @@ +iface eth0 inet6 static + address {{ item.ip_address }} + netmask {{ item.netmask }} + gateway {{ item.gateway }} + autoconf 0 + dns-nameservers 2001:4860:4860::8844 2001:4860:4860::8888 diff --git a/templates/ipsec.conf.j2 b/templates/ipsec.conf.j2 index aadccda..8bb6181 100644 --- a/templates/ipsec.conf.j2 +++ b/templates/ipsec.conf.j2 @@ -22,7 +22,7 @@ conn %default right=%any rightauth=pubkey - rightsourceip="{{ vpn_network }}" + rightsourceip={{ vpn_network }},{{ vpn_network_ipv6 }} {% if service_dns is defined and service_dns == "N" %} rightdns={% for host in dns_servers %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %} {% else %}