Skip to content

Commit 72c1c12

Browse files
soupglassessoupglasses
committed
feat: create openwrt ansible configuration
1 parent 1ec796e commit 72c1c12

File tree

5 files changed

+204
-0
lines changed

5 files changed

+204
-0
lines changed

‎ansible/openwrt/README.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# OpenWRT
2+
3+
## First install
4+
5+
```
6+
ansible-galaxy install -r requirements.yml
7+
ansible-plabook playbook.yml
8+
ssh -i ~/.ssh/sofi -t [email protected] passwd
9+
```

‎ansible/openwrt/ansible.cfg

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[defaults]
2+
inventory = inventory.ini
3+
remote_user = root
4+
private_key_file = ~/.ssh/sofi
5+
nocows = 1
6+
stdout_callback = yaml
7+
8+
[connection]
9+
pipelining = true
10+
11+
[ssh_connection]
12+
scp_if_ssh: true
13+
scp_extra_args: "-O"

‎ansible/openwrt/inventory.ini

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[routers]
2+
router ansible_host=192.168.1.1 ansible_user=root
3+
4+
[openwrt:children]
5+
routers

‎ansible/openwrt/playbook.yml

+175
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
---
2+
- hosts: openwrt
3+
4+
roles:
5+
- gekmihesg.openwrt
6+
7+
handlers:
8+
- name: reload system
9+
service:
10+
name: system
11+
state: restarted
12+
- name: reload dropbear
13+
service:
14+
name: dropbear
15+
state: restarted
16+
- name: reload dnsmasq
17+
service:
18+
name: dnsmasq
19+
state: restarted
20+
- name: reload unbound
21+
service:
22+
name: unbound
23+
state: restarted
24+
- name: reload uhttpd
25+
service:
26+
name: uhttpd
27+
state: restarted
28+
29+
tasks:
30+
- name: uci - ensure no pending changes
31+
uci:
32+
command: revert
33+
34+
# Website
35+
36+
- name: uhttpd has https redirect
37+
uci:
38+
command: set
39+
key: uhttpd.main.redirect_https
40+
value: 'on'
41+
42+
- name: uhttpd - uci commit
43+
uci:
44+
command: commit
45+
key: uhttpd
46+
notify: reload uhttpd
47+
48+
# General system
49+
50+
- name: system - set hostname and timezone
51+
uci:
52+
command: set
53+
key: system.@system[0]
54+
value:
55+
hostname: router
56+
timezone: Europe/Copenhagen
57+
58+
- name: system - uci commit
59+
uci:
60+
command: commit
61+
key: system
62+
notify:
63+
- reload system
64+
- reload dnsmasq
65+
66+
# SSH
67+
68+
- name: dropbear - ensure authorized_keys
69+
lineinfile:
70+
path: /etc/dropbear/authorized_keys
71+
line: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJvgn0kSAboULv37yLS1fGwByGSudhbQGrP/RrO7+cH+ [email protected]
72+
create: yes
73+
74+
- name: dropbear only exposed to lan
75+
uci:
76+
command: set
77+
key: dropbear.@dropbear[0].Interface
78+
value: lan
79+
80+
- name: dropbear disable password authentication
81+
uci:
82+
command: set
83+
key: dropbear.@dropbear[0].PasswordAuth
84+
value: 'off'
85+
86+
- name: dropbear - uci commit
87+
uci:
88+
command: commit
89+
key: dropbear
90+
notify: reload dropbear
91+
92+
# Dnsmasq DHCP
93+
94+
- name: dnsmasq - ensure dns does not resolve
95+
uci:
96+
command: set
97+
key: dhcp.@dnsmasq[0].noresolv
98+
value: '1'
99+
100+
- name: dnsmasq - ensure on port 1053
101+
uci:
102+
command: set
103+
key: dhcp.@dnsmasq[0].port
104+
value: '1053'
105+
106+
- name: dnsmasq - ensure correct domain
107+
uci:
108+
command: set
109+
key: dhcp.@dnsmasq[0].domain
110+
value: lan
111+
112+
- name: dnsmasq - ensure dhcp uses local dns instead of internal
113+
uci:
114+
command: set
115+
key: dhcp.lan.dhcp_option
116+
value:
117+
- option:dns-server,0.0.0.0
118+
119+
- name: dnsmasq - uci commit
120+
uci:
121+
command: commit
122+
key: dhcp
123+
notify: reload dnsmasq
124+
125+
# Unbound DNS
126+
127+
# https://github.com/openwrt/packages/blob/master/net/unbound/files/README.md#parallel-dnsmasq
128+
129+
- name: unbound - ensure unbound-daemon is present
130+
opkg:
131+
name: unbound-daemon
132+
state: present
133+
134+
- name: unbound - ensure link to dhcp server
135+
uci:
136+
command: set
137+
key: unbound.ub_main.dhcp_link
138+
value: dnsmasq
139+
140+
- name: unbound - ensure domain for dhcp
141+
uci:
142+
command: set
143+
key: unbound.ub_main.domain
144+
value: lan
145+
146+
- name: unbound - ensure listen port is 53
147+
uci:
148+
command: set
149+
key: unbound.ub_main.listen_port
150+
value: '53'
151+
152+
- name: unbound - ensure cloudflare as dns
153+
uci:
154+
command: set
155+
key: unbound.fwd_cloudflare
156+
value:
157+
enabled: '1'
158+
fallback: '0'
159+
160+
- name: unbound - uci commit
161+
uci:
162+
command: commit
163+
key: unbound
164+
notify: reload unbound
165+
166+
- name: unbound - enable service
167+
service:
168+
name: unbound
169+
enabled: yes
170+
171+
# Clean-up
172+
173+
- name: uci - cleanup commit
174+
uci:
175+
command: commit

‎ansible/openwrt/requirements.yml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
- src: gekmihesg.openwrt

0 commit comments

Comments
 (0)