Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
---
|
|
# Part of role: pia-gateway
|
|
# Included by: tasks/main.yaml
|
|
# Description: Registers the dedicated PIA policy-routing table and
|
|
# installs+enables the boot-time kill-switch service that seeds it
|
|
# (rule, terminal unreachable route, static drop rule) before
|
|
# wg-quick@{{ pia_wg_interface }} is allowed to start. See
|
|
# templates/pia-killswitch.sh.j2 for what the seeded state actually is.
|
|
|
|
- name: Register the PIA routing table name
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/iproute2/rt_tables
|
|
line: "{{ pia_route_table_id }}\t{{ pia_route_table_name }}"
|
|
regexp: "^[0-9]+\\s+{{ pia_route_table_name }}$"
|
|
create: true
|
|
mode: "0644"
|
|
|
|
- name: Deploy the kill-switch seed script
|
|
ansible.builtin.template:
|
|
src: pia-killswitch.sh.j2
|
|
dest: /usr/local/sbin/pia-killswitch.sh
|
|
mode: "0700"
|
|
owner: root
|
|
group: root
|
|
notify: Restart pia-killswitch
|
|
|
|
- name: Deploy the pia-killswitch systemd unit
|
|
ansible.builtin.template:
|
|
src: pia-killswitch.service.j2
|
|
dest: /etc/systemd/system/pia-killswitch.service
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
notify:
|
|
- Reload systemd daemon
|
|
- Restart pia-killswitch
|
|
|
|
- name: Enable and start the kill-switch service now
|
|
ansible.builtin.systemd:
|
|
name: pia-killswitch.service
|
|
enabled: true
|
|
state: started
|