gw-playbook.yml

---
- hosts:
    - ffp-gw

  collections:
    - devsec.hardening

  roles:
    - Frzk.nftables
    - stuvusit.systemd-journald
    - hafu.systemd_timesyncd
    - ssh_hardening

  vars:
    packages_wanted:
      - htop
      - iftop
      - iotop
      - mc
      - ncdu
      - nftables
      - qemu-guest-agent
      - sudo
      - tmux
      - vim
      - zsh
      - build-essential
      - cmake             # tunneldigger
    batman:
      version:


  pre_tasks:

    - name: Make sure wanted packages are installed
      ansible.builtin.package:
        name: "{{ packages_wanted }}"
        state: present

    - name: "users: add administrative users"
      ansible.builtin.user:
        name: "{{ item.username }}"
        password: "{{ item.password|default('*') }}"
        update_password: "{{ item.update_password|default('on_create') }}"
        groups: "{{ item.groups }}"
      loop: "{{ administrative_users }}"

    - name: "users: add authorized_keys"
      ansible.posix.authorized_key:
        user: "{{ item.username }}"
        key: "{{ item.authorized_keys|join('\n') }}"
        exclusive: "{{ item.authorized_keys_exclusive|default('yes') }}"
      loop: "{{ administrative_users }}"

  tasks:

    # enable & start qemu-guest agent
    - name: start & enable gemu-guest agent
      ansible.builtin.service:
        name: qemu-guest-agent
        state: started
        enabled: True
    # END enable qemu-guest agent


    # ffp-gluon test
    - name: install batctl
      ansible.builtin.package:
        name: batctl
        state: present

    - name: install bridge-utils
      ansible.builtin.package:
        name: bridge-utils
        state: present

    # allow IPv4 forwarding
    - name:  "set net.ipv4.ip_forward true"
      ansible.posix.sysctl:
        reload: true
        state: present
        sysctl_file: /etc/sysctl.d/local-ffp.conf
        name: net.ipv4.ip_forward
        value: "1"

    # allow IPv6 forwarding (via link local)
    - name: "set net.ipv6.conf.all.forwarding"
      ansible.posix.sysctl:
        reload: true
        state: present
        sysctl_file: /etc/sysctl.d/local-ffp.conf
        name: net.ipv6.conf.all.forwarding
        value: "1"

    ## tunneldigger
    - name: "tunneldigger: checkout code"
      ansible.builtin.git:
        repo: "https://github.com/wlanslovenija/tunneldigger.git"
        dest: "/usr/src/tunneldigger"

    - name: "tunneldigger: cmake tunneldigger-client"
      ansible.builtin.command:
        chdir: "/usr/src/tunneldigger/client"
        cmd: cmake .

    - name: "tunneldigger: build tunneldigger-client"
      ansible.builtin.make:
        chdir: "/usr/src/tunneldigger/client"
        target: all

    - name: "tunneldigger: install tunneldigger-client"
      ansible.builtin.make:
        chdir: "/usr/src/tunneldigger/client"
        target: install

    - name: "tunneldigger: client uplink unit file"
      register: tunneldigger_service_file
      ansible.builtin.copy:
        dest: "/etc/systemd/system/tunneldigger-ffup.service"
        owner: root
        group: root
        mode: "644"
        content: |
          [Unit]
          Description=tunneldigger client ffup
          After=network.target network-online.target
          Wants=network-online.target

          [Service]
          ExecStart=/usr/local/bin/tunneldigger -f -i ffup -u 228e020e-8135-41db-b4e8-0b61f82739c6 -t 2 -b a.tunnel.berlin.freifunk.net:8942 -b b.tunnel.berlin.freifunk.net:8942 -b c.tunnel.berlin.freifunk.net:8942 -b d.tunnel.berlin.freifunk.net:8942
          #ProtectSystem=full
          #ProtectHome=on
          KillSignal=SIGINT
          # We pull in network-online.target for a configured network connection.
          # However this is not guaranteed to be the network connection our
          # networks are configured for. So try to restart on failure with a delay
          # of two seconds. Rate limiting kicks in after 12 seconds.
          RestartSec=2s
          Restart=on-failure
          StartLimitInterval=12s

          [Install]
          WantedBy=multi-user.target

    # - name: "tunneldigger: systemd daemon reload"
    #   when: tunneldigger_service_file.changed
    #   ansible.builtin.systemd:
    #     daemon_reload: true

    - name: "tunneldigger: add policy routing"
      ansible.builtin.lineinfile:
        path: "/etc/iproute2/rt_tables"
        line: "200 ffup"

    - name: "tunneldigger/systemd: create network file for ffup"
      ansible.builtin.copy:
        dest: /etc/systemd/network/60-ffup.network
        owner: root
        group: root
        mode: "644"
        content: |
          [Match]
          Name=ffup

          [Network]
          DHCP=yes
          Tunnel=he-ipv6

          # add routes into "ffup" routing table
          [DHCPv4]
          RouteTable=200
          RouteMetric=1024

          # add the policy route
          [RoutingPolicyRule]
          Table=200
          IncomingInterface=br90
          Priority=10000

    # the rules from dhcp:
    #   ip ro add default via 172.31.224.1 dev ffup table ffup
    #   ip ro add 172.31.224.0/20 dev ffup table
    #   ip ro add 172.31.224.1 dev ffup table ffup
    # the policy rule
    #   ip rule add iif br90 lookup ffup
    #
    # result:
    # $ ip ro sh table ffup
    #   default via 172.31.224.1 dev ffup
    #   172.31.224.0/20 dev ffup scope link
    #   172.31.224.1 dev ffup scope link
    # $ ip rule show
    # 0:      from all lookup local
    # 32763:  from all iif br90 lookup ffup
    # 32766:  from all lookup main
    # 32767:  from all lookup default

    - name: "tunneldigger: start tunneldigger-client"
      when: tunneldigger_service_file.changed
      ansible.builtin.systemd:
        daemon_reload: true
        enabled: true
        name: tunneldigger-ffup.service
        state: restarted
    ## tunneldigger END

    # IPv6 HE.net Tunnel
    - name: "Systemd-networkd; Create default interface configuration"
      ansible.builtin.copy:
        dest: /etc/systemd/network/10-default.network
        owner: root
        group: root
        mode: "0644"
        content: |
          # Same configuration as in /etc/netplan/50-cloud-init.yaml but with
          # Tunnel option in Network section. Netplan configuration is not
          # needed and redundant. This is only used to bring up the he-ipv6
          # tunnel.
          [Match]
          MACAddress=0a:d6:bf:d3:30:81

          [Network]
          Address=202.61.249.142/22
          Gateway=202.61.248.1
          Address=2a03:4000:54:ec8:8d6:bfff:fed3:3081/64
          Gateway=fe80::1

          DNS=2a03:4000:0:1::e1e6
          DNS=2a03:4000:8000::fce6
          DNS=46.38.225.230
          DNS=46.38.252.230

          Tunnel=he-ipv6

    - name: "Systemd-networkd: HE.net tunnel device"
      ansible.builtin.copy:
        dest: /etc/systemd/network/40-he-ipv6.netdev
        owner: root
        group: root
        mode: "0644"
        content: |
          # A virtual network device is only created if the [Match] section
          # matches the current environment, or if the section is empty.
          [Match]

          [NetDev]
          Description=HE.net Tunnelbroker sit device
          Name=he-ipv6
          Kind=sit
          MTUBytes=1480

          [Tunnel]
          Local=202.61.249.142
          Remote=216.66.80.30
          TTL=255
      notify:
        - restart systemd-networkd

    - name: "Systemd-networkd: HE.net tunnel network"
      ansible.builtin.copy:
        dest: /etc/systemd/network/40-he-ipv6.network
        owner: root
        group: root
        mode: "0644"
        content: |
          [Match]
          Name=he-ipv6

          [Network]
          Address=2001:470:1f0a:ba::2/64

          IPForward=true

          # only route subnet traffic via he ipv6 tunnel
          [Route]
          Source=2001:470:7042::/48
          Gateway=2001:470:1f0a:ba::1

          # add the policy route
          [RoutingPolicyRule]
          Table=200
          IncomingInterface=br90
          Priority=10000
      notify:
        - restart systemd-networkd

    # END: IPv6 HE.net Tunnel


    ## bat/br network devices
    - name: "systemd-networkd: BATMAN netdev for domain 90"
      ansible.builtin.copy:
        dest: /etc/systemd/network/50-bat90.netdev
        owner: root
        group: root
        mode: "644"
        content: |
          [NetDev]
          Description="BATMAN device for domain '90'"
          Name=bat90
          Kind=batadv

          [BatmanAdvanced]
          GatewayMode=server
          GatewayBandwidthDown=100M
          GatewayBandwidthUp=100M
          RoutingAlgorithm=batman-iv
      notify:
        - restart systemd-networkd

    - name: "systemd-networkd: BATMAN network for domain 90"
      ansible.builtin.copy:
        dest: /etc/systemd/network/50-bat90.network
        owner: root
        group: root
        mode: "644"
        content: |
          [Match]
          Name=bat90

          [Network]
          Bridge=br90
      notify:
        - restart systemd-networkd

    - name: "systemd-networkd: bridge netdev for domain 90"
      ansible.builtin.copy:
        dest: /etc/systemd/network/50-br90.netdev
        owner: root
        group: root
        mode: "644"
        content: |
          [NetDev]
          ; attach batman and client tunnel endpoints her
          Description="Bridge interface for domain '90'"
          Name=br90
          Kind=bridge
      notify:
        - restart systemd-networkd

    - name: "systemd-networkd: bridge network for domain 90"
      ansible.builtin.copy:
        dest: /etc/systemd/network/50-br90.network
        owner: root
        group: root
        mode: "644"
        content: |
          [Match]
          Name=br90

          [Network]
          ; 10.22.0.0/20 -> 10.22.0.1 - 10.22.15.255
          ; 255.255.240.0
          Address=10.22.0.1/20
          Address=fd28:a735:685c::3c0e:ecff:fe29:4b62/64
          Address=2001:470:7042:90:3c0e:ecff:fe29:4b62/64

          [RoutingPolicyRule]
          Table=local
          IncomingInterface=br90
          Priority=10010
          Type=unreachable
      notify:
        - restart systemd-networkd
    ## END bat/br network devices

    ## legacy fastd
    - name: "fastd: install required packages"
      ansible.builtin.package:
        name:
          - fastd
          - haveged
        state: present

    - name: "fastd: create config directory"
      ansible.builtin.file:
        path: "{{ item }}"
        state: directory
        owner: root
        group: root
      loop:
        - /etc/fastd/90/keys
        - /etc/fastd/90/peers

    - name: "fastd: check if secret key exists"
      ansible.builtin.stat:
        path: /etc/fastd/90/keys/secret.key
      register: fastd_secret_key

    - name: "fastd: check if public key exists"
      ansible.builtin.stat:
        path: /etc/fastd/90/keys/public.key
      register: fastd_public_key

    - name: "fastd: (re)generate keypair"
      ansible.builtin.command: fastd --generate-key
      register: fastd_generated_keypair
      when: not fastd_secret_key.stat.exists or not fastd_public_key.stat.exists

    - name: "fastd: write generated private key"
      ansible.builtin.copy:
        dest: /etc/fastd/90/keys/secret.key
        owner: root
        group: root
        mode: "600"
        content: |
          secret "{{ secret_key }}";
      vars:
        secret_key: "{{ fastd_generated_keypair.stdout_lines[0]|replace('Secret: ','') }}"
      when: fastd_generated_keypair.changed
      notify:
        - restart fastd

    - name: "fastd: write generated public key"
      ansible.builtin.copy:
        dest: /etc/fastd/90/keys/public.key
        owner: root
        group: root
        mode: "644"
        content: |
          key "{{ public_key }}";
      vars:
        public_key: "{{ fastd_generated_keypair.stdout_lines[1]|replace('Public: ','') }}"
      when: fastd_generated_keypair.changed
      notify:
        - restart fastd

    - name: "fastd: create dummy peer (or it won't start)"
      ansible.builtin.copy:
        dest: /etc/fastd/90/peers/dummy
        owner: root
        group: root
        mode: "644"
        content: |
          key "THIS-IS-A-DUMMY";
      notify:
        - restart fastd

    - name: "fastd: write config"
      ansible.builtin.copy:
        dest: /etc/fastd/90/fastd.conf
        owner: root
        group: root
        mode: "644"
        content: |
          # Bind to a fixed address and port, IPv4 and IPv6
          bind {{ ansible_default_ipv4.address }}:10090 interface "{{ ansible_default_ipv4.interface }}";
          bind [{{ ansible_default_ipv6.address }}]:10090 interface "{{ ansible_default_ipv6.interface }}";

          # Set the user, fastd will work as
          user "nobody";

          # Set the interface name
          interface "fastd90";

          # Set the mode, the interface will work as
          mode tap;

          # Set the mtu of the interface
          mtu 1312;     # fine tuning needed, 1406

          # Set the methods (aes128-gcm preferred, salsa2012+umac preferred for nodes)
          method "null@l2tp";
          # method "null";
          # method "aes128-gcm";
          # method "salsa2012+umac";
          # method "salsa2012+gmac";

          # Secret key generated by `fastd --generate-key`
          include "/etc/fastd/90/keys/secret.key";

          # Log everything to syslog
          #log to syslog level warn;
          #log to syslog level debug;
          log to stderr level info;

          # Hide IP addresses in log output
          #hide ip addresses yes;

          # Include peers (dummy only)
          include peers from "/etc/fastd/90/peers/";

          # Status Socket
          status socket "/run/fastd-90/fastd.sock";

          # accept any host
          on verify "
            exit 0
          ";

          # Configure a shell command that is run when fastd comes up
          on up "
            # Add fastd interface to bridge, then enable it
            # ip link set dev $INTERFACE master br90 && ip link set dev $INTERFACE up
            ip link set dev $INTERFACE up && batctl bat90 if add $INTERFACE
          ";
      notify:
        - restart fastd

    - name: "fastd: create folder for fastd@ service file"
      ansible.builtin.file:
        path: /etc/systemd/system/fastd@.service.d
        state: directory
        owner: root
        group: root
        mode: "755"

    - name: "fastd: override fastd@ service"
      ansible.builtin.copy:
        dest: /etc/systemd/system/fastd@.service.d/ansible-managed.conf
        owner: root
        group: root
        mode: "644"
        content: |
          [Service]
          Restart=on-failure
          RuntimeDirectory=fastd-%I
          RuntimeDirectoryMode=0777
      notify:
        - systemd daemon reload

    - name: "fastd/haveged: create folder for haveged service override file"
      ansible.builtin.file:
        path: /etc/systemd/system/haveged.service.d
        state: directory
        owner: root
        group: root
        mode: "755"

    - name: "fastd/haveged: override haveged service"
      ansible.builtin.copy:
        dest: /etc/systemd/system/haveged.service.d/ansible-managed.conf
        owner: root
        group: root
        mode: "644"
        content: |
          [Service]
          Restart=on-failure
      notify:
        - systemd daemon reload

    - name: "fastd: enable for domain 90"
      ansible.builtin.systemd:
        name: fastd@90
        enabled: yes
        masked: no
      notify:
        - restart fastd
    ## END legacy fastd

    ## TODO: L2TP

    ## TODO: BIRD (gateway 2 gateway?)

    ## DHCP
    - name: "dhcpd: install package(s)"
      ansible.builtin.package:
        name: isc-dhcp-server
        state: present

    - name: "dhcpd: disable default unit"
      ansible.builtin.systemd:
        name: isc-dhcp-server.service
        enabled: false
        masked: true    # do not allow to start, even manually
        state: stopped

    - name: "dhcpd: create configuration"
      ansible.builtin.copy:
        dest: /etc/dhcpd.conf
        owner: root
        group: root
        mode: "644"
        content: |
          default-lease-time 1800;
          max-lease-time 43200;

          authoritative;

          subnet 10.22.0.0 netmask 255.255.240.0 {
            interface br90;
            range 10.22.4.0 10.22.7.255;

            option routers 10.22.0.1;
            option domain-name-servers 10.22.0.1;
          }
      notify:
        - restart dhcpd

    - name: "dhcpd: create lease file if not exists"
      ansible.builtin.file:
        path: /var/lib/dhcp/dhcpd.leases
        state: file
        owner: dhcpd
        group: dhcpd
        mode: "644"

    - name: "dhcpd: create folder for dhcpd4@ service file"
      ansible.builtin.file:
        path: /etc/systemd/system/dhcpd4@.service.d
        state: directory
        owner: root
        group: root
        mode: "755"
      notify:
        - systemd daemon reload

    - name: "dhcpd: override dhcpd4@ service"
      ansible.builtin.copy:
        dest: /etc/systemd/system/dhcpd4@.service
        owner: root
        group: root
        mode: "644"
        content: |
          [Unit]
          Description=IPv4 DHCP server
          After=network.target network-online.target
          Wants=network-online.target

          [Service]
          Type=forking
          ExecStart=/usr/sbin/dhcpd -4 -q -cf /etc/dhcpd.conf -pf /run/dhcp-server/dhcpd.pid %I
          RuntimeDirectory=dhcp-server
          PIDFile=/run/dhcp-server/dhcpd.pid
          User=dhcpd
          AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
          #ProtectSystem=full
          #ProtectHome=on
          KillSignal=SIGINT
          # We pull in network-online.target for a configured network connection.
          # However this is not guaranteed to be the network connection our
          # networks are configured for. So try to restart on failure with a delay
          # of two seconds. Rate limiting kicks in after 12 seconds.
          RestartSec=2s
          Restart=on-failure
          StartLimitInterval=12s

          [Install]
          WantedBy=multi-user.target
      notify:
        - restart dhcpd

    - name: "dhcpd: start and enable dhcpd unit on br90 interface"
      ansible.builtin.systemd:
        name: dhcpd4@br90
        enabled: true
        state: started

    - name: "dhcpd: disable default unit (IPv6)"
      ansible.builtin.systemd:
        name: isc-dhcp-server6.service
        enabled: false
        masked: true    # do not allow to start, even manually
        state: stopped

    - name: "dhcpd: create configuration"
      ansible.builtin.copy:
        dest: /etc/dhcpd6.conf
        owner: root
        group: root
        mode: "644"
        content: |
          default-lease-time 1800;
          max-lease-time 43200;

          # Enable RFC 5007 support (same than for DHCPv4)
          allow leasequery;

          # subnet6 fd28:a735:685c::/64 {
          #   interface br90;
          #   range6 fd28:a735:685c::ffff fd28:a735:685c::ffff:ffff;

          #   option dhcp6.name-servers fd28:a735:685c::1;
          #   #option dhcp6.domain-search "ffp";
          # }
          subnet6 2001:470:7042:90::/64 {
            interface br90;
            range6 2001:470:7042:90::ffff 2001:470:7042:90::ffff:ffff;

            option dhcp6.name-servers
              fd28:a735:685c::1,
              fd28:a735:685c::3c0e:ecff:fe29:4b62,
              2001:470:7042:90:3c0e:ecff:fe29:4b62;
            option dhcp6.domain-search "ffp";
          }
      notify:
        - restart dhcpd6

    - name: "dhcpd: create lease file if not exists (IPv6)"
      ansible.builtin.file:
        path: /var/lib/dhcp/dhcpd6.leases
        state: file
        owner: dhcpd
        group: dhcpd
        mode: "644"

    - name: "dhcpd: create folder for dhcpd6@ service file"
      ansible.builtin.file:
        path: /etc/systemd/system/dhcpd6@.service.d
        state: directory
        owner: root
        group: root
        mode: "755"
      notify:
        - systemd daemon reload

    - name: "dhcpd: override dhcpd6@ service"
      ansible.builtin.copy:
        dest: /etc/systemd/system/dhcpd6@.service
        owner: root
        group: root
        mode: "644"
        content: |
          [Unit]
          Description=IPv6 DHCP server
          After=network.target network-online.target
          Wants=network-online.target

          [Service]
          Type=forking
          ExecStart=/usr/sbin/dhcpd -6 -q -cf /etc/dhcpd6.conf -pf /run/dhcp-server/dhcpd6.pid %I
          RuntimeDirectory=dhcp-server
          PIDFile=/run/dhcp-server/dhcpd6.pid
          User=dhcpd
          AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
          #ProtectSystem=full
          #ProtectHome=on
          KillSignal=SIGINT
          # We pull in network-online.target for a configured network connection.
          # However this is not guaranteed to be the network connection our
          # networks are configured for. So try to restart on failure with a delay
          # of two seconds. Rate limiting kicks in after 12 seconds.
          RestartSec=2s
          Restart=on-failure
          StartLimitInterval=12s

          [Install]
          WantedBy=multi-user.target
      notify:
        - restart dhcpd6

    - name: "dhcpd: start and enable dhcpd unit on br90 interface (IPv6)"
      ansible.builtin.systemd:
        name: dhcpd6@br90
        enabled: true
        state: started
    ## END DHCP

    ## Bind
    - name: Install bind package
      ansible.builtin.package:
        name: bind9

    - name: Create ffp zone file
      ansible.builtin.copy:
        dest: /etc/bind/db.ffp
        owner: root
        group: root
        mode: "0644"
        content: |
          $ORIGIN ffp.
          $TTL 5m
          ffp.     IN    SOA     ffp. info.freifunk-potsdam.de. (
                                    2022121102    ; serial
                                    4h            ; refresh
                                    15m           ; retry
                                    8h            ; expire
                                    4m)           ; negative caching TTL
          @               IN  NS    ns1.ffp.
          gw1.ffp.        IN  A     10.22.0.1
          gw1.ffp.        IN  AAAA  fd28:a735:685c:0:10ac:baff:fe38:befc
          ns1.ffp.        IN  A     10.22.0.1
          ns1.ffp.        IN  AAAA  fd28:a735:685c:0:10ac:baff:fe38:befc
          nextnode.ffp.   IN  A     10.22.0.255
          nextnode.ffp.   IN  AAAA  fd28:a735:685c::1
          nn.ffp.         IN  A     10.22.0.255
          nn.ffp.         IN  AAAA  fd28:a735:685c::1
      notify:
        - Restart bind

    - name: Create ffp reverse file (IPv4)
      ansible.builtin.copy:
        dest: /etc/bind/22.10.in-addr.arpa
        owner: root
        group: root
        mode: "0644"
        content: |
          $TTL 5m
          @         IN    SOA     ffp. info.freifunk-potsdam.de. (
                                    2022121104    ; serial
                                    4h            ; refresh
                                    15m           ; retry
                                    8h            ; expire
                                    4m)           ; negative caching TTL
          @               IN  NS    ns1.ffp.
          0.1             IN  PTR   gw1.ffp.
          0.255           IN  PTR   nextnode.ffp.
      notify:
        - Restart bind

    # Subnet:   fd28:a735:685c::
    # Nextnode: fd28:a735:685c::1
    # Gateway:  fd28:a735:685c::3c0e:ecff:fe29:4b62/64
    - name: Create ffp reverse file (IPv6)
      ansible.builtin.copy:
        dest: /etc/bind/c.5.8.6.5.3.7.a.8.2.d.f.ip6.arpa
        owner: root
        group: root
        mode: "0644"
        content: |
          $TTL 5m
          @         IN    SOA     ffp. info.freifunk-potsdam.de. (
                                    2022121106    ; serial
                                    4h            ; refresh
                                    15m           ; retry
                                    8h            ; expire
                                    4m)           ; negative caching TTL
          @               IN  NS    ns.ffp.
          ; fd28:a735:685c::3c0e:ecff:fe29:4b62/64
          2.6.b.4.9.2.e.f.f.f.c.e.e.0.c.3.0.0.0.0   IN  PTR   gw1.ffp.
          1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR   nextnode.ffp.
      notify:
        - Restart bind


    - name: Create ffp zone config file
      ansible.builtin.copy:
        dest: /etc/bind/named.conf.ffp-zones
        owner: root
        group: root
        mode: "0644"
        content: |
          zone "ffp" {
            type master;
            file "/etc/bind/db.ffp";
          };
          zone "22.10.in-addr.arpa" {
            type master;
            file "/etc/bind/22.10.in-addr.arpa";
          };
          zone "c.5.8.6.5.3.7.a.8.2.d.f.ip6.arpa" {
            type master;
            file "/etc/bind/c.5.8.6.5.3.7.a.8.2.d.f.ip6.arpa";
          };
      notify:
        - Restart bind

    - name: Add include for config
      ansible.builtin.lineinfile:
        path: /etc/bind/named.conf
        line: include "/etc/bind/named.conf.ffp-zones";
      notify:
        - Restart bind
    ## END: Bind

    ## radvd
    - name: Install package
      ansible.builtin.package:
        name: radvd

    - name: Create config
      ansible.builtin.copy:
        dest: /etc/radvd.conf
        owner: root
        group: root
        mode: "0644"
        content: |
          interface br90 {
              AdvSendAdvert on;
              IgnoreIfMissing on;
              AdvManagedFlag on;
              AdvOtherConfigFlag on;
              # https://forum.netgate.com/topic/163940/wireless-clients-lose-ipv6-gateway/24
              # MaxRtrAdvInterval 200;
              MaxRtrAdvInterval 1800;
              AdvLinkMTU 1280;
              prefix fd28:a735:685c::/64 {
                  AdvOnLink on;
                  AdvAutonomous on;
                  # AdvRouterAddr on;
              };
              prefix 2001:470:7042:90::/64 {
                  AdvOnLink on;
                  AdvAutonomous on;
                  # AdvRouterAddr on;
              };
              RDNSS fd28:a735:685c::1 fd28:a735:685c::3c0e:ecff:fe29:4b62 2001:470:7042:90:3c0e:ecff:fe29:4b62 {
              };
          };
      notify:
        - Restart radvd

    - name: Enable service
      ansible.builtin.service:
        name: radvd
        state: started
    ## END radvd

    # TODO: enable forwarding

    # END ffp-gluon test


  handlers:

    - name: restart systemd-networkd
      ansible.builtin.systemd:
        name: systemd-networkd
        state: restarted

    - name: restart fastd
      ansible.builtin.systemd:
        name: fastd@90
        state: restarted

    - name: systemd daemon reload
      ansible.builtin.systemd:
        daemon_reload: yes

    - name: restart dhcpd
      ansible.builtin.systemd:
        name: dhcpd4@br90
        state: restarted

    - name: restart dhcpd6
      ansible.builtin.systemd:
        name: dhcpd6@br90
        state: restarted

    - name: Restart radvd
      ansible.builtin.service:
        name: radvd
        state: restarted

    - name: Restart bind
      ansible.builtin.service:
        name: bind9
        state: restarted