Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
---
|
|
# Part of role: pia-gateway
|
|
# Included by: tasks/main.yaml
|
|
# Description: Installs the observability-only health check (script,
|
|
# oneshot service, timer). See templates/pia-gateway-healthcheck.sh.j2
|
|
# for exactly what it checks and why it never remediates.
|
|
|
|
- name: Deploy the health check script
|
|
ansible.builtin.template:
|
|
src: pia-gateway-healthcheck.sh.j2
|
|
dest: /usr/local/sbin/pia-gateway-healthcheck.sh
|
|
mode: "0700"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Deploy the health check systemd service
|
|
ansible.builtin.template:
|
|
src: pia-gateway-healthcheck.service.j2
|
|
dest: /etc/systemd/system/pia-gateway-healthcheck.service
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
notify:
|
|
- Reload systemd daemon
|
|
- Restart pia-gateway-healthcheck timer
|
|
|
|
- name: Deploy the health check systemd timer
|
|
ansible.builtin.template:
|
|
src: pia-gateway-healthcheck.timer.j2
|
|
dest: /etc/systemd/system/pia-gateway-healthcheck.timer
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
notify:
|
|
- Reload systemd daemon
|
|
- Restart pia-gateway-healthcheck timer
|
|
|
|
- name: Enable and start the health check timer
|
|
ansible.builtin.systemd:
|
|
name: pia-gateway-healthcheck.timer
|
|
enabled: true
|
|
state: started
|