|
|
|
|
---
|
|
|
|
|
- name: FreeBSD | Install prerequisites
|
|
|
|
|
package:
|
|
|
|
|
name:
|
|
|
|
|
- python3
|
|
|
|
|
- sudo
|
|
|
|
|
vars:
|
|
|
|
|
ansible_python_interpreter: /usr/local/bin/python2.7
|
|
|
|
|
|
|
|
|
|
- name: Set python3 as the interpreter to use
|
|
|
|
|
set_fact:
|
|
|
|
|
ansible_python_interpreter: /usr/local/bin/python3
|
|
|
|
|
|
|
|
|
|
- name: Gather facts
|
|
|
|
|
setup:
|
|
|
|
|
- name: Gather additional facts
|
|
|
|
|
import_tasks: facts.yml
|
|
|
|
|
|
|
|
|
|
- name: Set OS specific facts
|
|
|
|
|
set_fact:
|
|
|
|
|
config_prefix: /usr/local/
|
|
|
|
|
strongswan_shell: /usr/sbin/nologin
|
|
|
|
|
strongswan_home: /var/empty
|
|
|
|
|
root_group: wheel
|
|
|
|
|
ssh_service_name: sshd
|
|
|
|
|
apparmor_enabled: false
|
|
|
|
|
strongswan_additional_plugins:
|
|
|
|
|
- kernel-pfroute
|
|
|
|
|
- kernel-pfkey
|
|
|
|
|
tools:
|
|
|
|
|
- git
|
|
|
|
|
- subversion
|
|
|
|
|
- screen
|
|
|
|
|
- coreutils
|
|
|
|
|
- openssl
|
|
|
|
|
- bash
|
|
|
|
|
- wget
|
|
|
|
|
sysctl:
|
|
|
|
|
- item: net.inet.ip.forwarding
|
|
|
|
|
value: 1
|
|
|
|
|
- item: "{{ 'net.inet6.ip6.forwarding' if ipv6_support else none }}"
|
|
|
|
|
value: 1
|
|
|
|
|
|
|
|
|
|
- name: Install tools
|
|
|
|
|
package: name="{{ item }}" state=present
|
|
|
|
|
with_items:
|
|
|
|
|
- "{{ tools|default([]) }}"
|
|
|
|
|
|
|
|
|
|
- name: Loopback included into the rc config
|
|
|
|
|
blockinfile:
|
|
|
|
|
dest: /etc/rc.conf
|
|
|
|
|
create: true
|
|
|
|
|
block: |
|
|
|
|
|
cloned_interfaces="lo100"
|
|
|
|
|
ifconfig_lo100="inet {{ local_service_ip }} netmask 255.255.255.255"
|
|
|
|
|
ifconfig_lo100_ipv6="inet6 {{ local_service_ipv6 }}/128"
|
|
|
|
|
notify:
|
|
|
|
|
- restart loopback bsd
|
|
|
|
|
|
|
|
|
|
- name: Enable the gateway features
|
|
|
|
|
lineinfile: dest=/etc/rc.conf regexp='^{{ item.param }}.*' line='{{ item.param }}={{ item.value }}'
|
|
|
|
|
with_items:
|
|
|
|
|
- { param: firewall_enable, value: '"YES"' }
|
|
|
|
|
- { param: firewall_type, value: '"open"' }
|
|
|
|
|
- { param: gateway_enable, value: '"YES"' }
|
|
|
|
|
- { param: natd_enable, value: '"YES"' }
|
|
|
|
|
- { param: natd_interface, value: '"{{ ansible_default_ipv4.device|default() }}"' }
|
|
|
|
|
- { param: natd_flags, value: '"-dynamic -m"' }
|
|
|
|
|
notify:
|
|
|
|
|
- restart ipfw
|
|
|
|
|
|
|
|
|
|
- name: FreeBSD | Activate IPFW
|
|
|
|
|
shell: >
|
|
|
|
|
kldstat -n ipfw.ko || kldload ipfw ; sysctl net.inet.ip.fw.enable=0 &&
|
|
|
|
|
bash /etc/rc.firewall && sysctl net.inet.ip.fw.enable=1
|
|
|
|
|
changed_when: false
|
|
|
|
|
|
|
|
|
|
- meta: flush_handlers
|
