Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
47 lines
1.9 KiB
YAML
47 lines
1.9 KiB
YAML
---
|
|
# Part of role: pia-gateway
|
|
# Handlers fire in the order listed here (not the order notified):
|
|
# 1. systemd daemon reload must stay first so unit-file content changes
|
|
# are picked up before any restart handler below acts on them.
|
|
# 2. "Reload ufw" must come before "Restart pia-killswitch" — a UFW
|
|
# reload rebuilds ufw's own chains and, depending on how it's
|
|
# triggered, can in principle disturb rules inserted directly into
|
|
# the base FORWARD chain (our position-1 jump to
|
|
# {{ pia_iptables_chain }}) outside ufw's own bookkeeping. Restarting
|
|
# pia-killswitch immediately after re-establishes that jump and the
|
|
# chain's contents idempotently, closing the window rather than
|
|
# leaving it open until the next reboot. This only protects against
|
|
# ufw reloads that happen *through this Ansible run* (i.e., a task
|
|
# here notifies both) — a `ufw reload` run manually and separately,
|
|
# outside of Ansible entirely, is not something a handler can react
|
|
# to; that residual gap is closed only by every real boot re-running
|
|
# pia-killswitch.service fresh (WantedBy=multi-user.target).
|
|
# 3. "Restart pia-killswitch" must come before "Restart pia-wg" — if
|
|
# both fire together (e.g. pia-wg's config changed AND the
|
|
# killswitch script changed in the same run), pia-wg's own PostUp
|
|
# needs to run last so its "open" route is the final word, not
|
|
# killswitch's route-table seeding.
|
|
|
|
- name: Reload systemd daemon
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Reload ufw
|
|
community.general.ufw:
|
|
state: reloaded
|
|
|
|
- name: Restart pia-killswitch
|
|
ansible.builtin.systemd:
|
|
name: pia-killswitch.service
|
|
state: restarted
|
|
|
|
- name: Restart pia-wg
|
|
ansible.builtin.systemd:
|
|
name: "wg-quick@{{ pia_wg_interface }}"
|
|
state: restarted
|
|
|
|
- name: Restart pia-gateway-healthcheck timer
|
|
ansible.builtin.systemd:
|
|
name: pia-gateway-healthcheck.timer
|
|
state: restarted
|