Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
35 lines
1.4 KiB
YAML
35 lines
1.4 KiB
YAML
---
|
|
# Part of role: pia-gateway
|
|
# Included by: tasks/main.yaml
|
|
# Description: Enables IP forwarding persistently (required for minisforum
|
|
# to route VLAN 50 traffic at all) and asserts the host's own default
|
|
# route is still the normal LAN gateway before any PIA-specific routing
|
|
# is touched. This is the guard behind "never change minisforum's normal
|
|
# default route globally" — it fails the play loudly instead of layering
|
|
# PIA routing on top of an already-wrong baseline.
|
|
|
|
- name: Enable IP forwarding persistently
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: "1"
|
|
sysctl_set: true
|
|
state: present
|
|
reload: true
|
|
|
|
- name: Read current default route
|
|
ansible.builtin.command: ip -4 route show default
|
|
register: pia_current_default_route
|
|
changed_when: false
|
|
|
|
- name: Assert the host default route is still the normal LAN interface
|
|
ansible.builtin.assert:
|
|
that:
|
|
- pia_current_default_route.stdout is search('dev ' + pia_lan_interface)
|
|
- not (pia_current_default_route.stdout is search('dev ' + pia_wg_interface))
|
|
fail_msg: >-
|
|
minisforum's default route is not via {{ pia_lan_interface }}
|
|
({{ pia_current_default_route.stdout }}). Refusing to continue —
|
|
this role must never run against a host whose own default route
|
|
has already been changed.
|
|
success_msg: "Host default route confirmed via {{ pia_lan_interface }}"
|