Update dependency ansible-lint to v24.2.2

This is mostly for monitoring

ansible/dev-requirements.txt

@@ -1,4 +1,4 @@
-ansible-lint==24.2.1
+ansible-lint==24.2.2
 yamllint==1.33.0
 ansible
 passlib

ansible/group_vars/all/pve.yml

@@ -17,6 +17,7 @@ pve_hosts:
     ip: 10.23.1.10
     external_ip: 192.168.2.201
     external_ipv6: "{{ vault_ingress_ipv6 }}"
+    link_local: fe80::d4e4:22ff:fe8b:429d
   homeassistant:
     ip: 192.168.2.203
   qbittorrent:

ansible/host_vars/pve/main.yml

@@ -25,7 +25,7 @@ sanoid_datasets:
 
 sanoid_templates:
   production:
-    frequently: 2
+    frequently: 4
     hourly: 48
     daily: 28
     monthly: 3

ansible/roles/forrest/tasks/main.yml

@@ -6,3 +6,30 @@
 
 - name: Prometheus
   include_tasks: prometheus.yml
+
+- name: Get routes
+  command:
+    argv:
+      - ip
+      - -6
+      - route
+      - show
+      - "{{ vps_hosts.private_ipv6_range }}"
+  register: routes
+  changed_when: false
+  become: true
+
+- name: Add route to private services via ingress
+  command:
+    argv:
+      - ip
+      - -6
+      - route
+      - add
+      - "{{ vps_hosts.private_ipv6_range }}"
+      - via
+      - "{{ pve_hosts.ingress.link_local }}"
+      - dev
+      - eth0
+  become: true
+  when: vps_hosts.private_ipv6_marker not in routes.stdout

ansible/roles/ingress/files/nftables.conf

@@ -30,7 +30,7 @@ table inet filter {
 
         # NAT - because the proxmox machines may not have routes back
         ip saddr {{ nebula.cidr }} ip daddr {{ pve_hosts.internal_cidr }} counter masquerade
-        ip saddr {{ tailscale_cidr }} ip daddr {{ pve_hosts.internal_cidr }} counter masquerade
+        ip saddr {{ tailscale_cidr }} counter masquerade
     }
 
     chain FORWARD {
@@ -44,8 +44,9 @@ table inet filter {
         # Allow monitoring of nebula network
         ip saddr {{ pve_hosts.forrest.ip }}/32 ip daddr {{ nebula.cidr }} accept
 
-        # Allow traffic from Tailscale to proxmox network
-        ip saddr {{ tailscale_cidr }} ip daddr {{ pve_hosts.internal_cidr }} accept
-        ip saddr {{ pve_hosts.internal_cidr }} ip daddr {{ tailscale_cidr }} ct state related,established accept
+        # Allow Tailscale exit node
+        ip saddr {{ tailscale_cidr }} ip daddr 192.168.0.0/16 drop
+        ip saddr {{ tailscale_cidr }} accept
+        ip daddr {{ tailscale_cidr }} ct state related,established accept
     }
 }

ansible/roles/traefik/files/file-provider-homeassistant.yml

@@ -3,6 +3,8 @@ http:
     router-homeassistant:
       rule: Host(`homeassistant.jakehoward.tech`)
       service: service-homeassistant
+      middlewares:
+        - tailscale-only@file
   services:
     service-homeassistant:
       loadBalancer:

ansible/roles/traefik/files/file-provider-main.yml

@@ -10,7 +10,16 @@ http:
           Permissions-Policy: interest-cohort=()
 
     tailscale-only:
-      ipAllowList:
+      ipWhiteList:
         sourceRange:
           - "{{ tailscale_cidr }}"
           - "{{ tailscale_cidr_ipv6 }}"
+          - "{{ pve_hosts.forrest.ip }}"
+
+    private-access:
+      ipWhiteList:
+        sourceRange:
+          - "{{ tailscale_cidr }}"
+          - "{{ tailscale_cidr_ipv6 }}"
+          - "{{ nebula.cidr }}"
+          - "{{ pve_hosts.internal_cidr }}"

ansible/roles/vaultwarden/files/docker-compose.yml

@@ -22,7 +22,7 @@ services:
       - traefik.http.middlewares.vaultwarden-ratelimit.ratelimit.average=5
       - traefik.http.middlewares.vaultwarden-ratelimit.ratelimit.burst=200
 
-      - traefik.http.routers.vaultwarden.middlewares=vaultwarden-ratelimit
+      - traefik.http.routers.vaultwarden.middlewares=vaultwarden-ratelimit,tailscale-only@file
     environment:
       - SIGNUPS_ALLOWED=false
       - DOMAIN=https://vaultwarden.jakehoward.tech

terraform/casey_vps.tf

@@ -7,7 +7,7 @@ resource "linode_instance" "casey" {
 }
 
 resource "linode_ipv6_range" "casey_extra" {
-  linode_id = linode_instance.casey.id
+  linode_id     = linode_instance.casey.id
   prefix_length = 64
 }
 

terraform/jakehoward.tech.tf

@@ -127,7 +127,7 @@ resource "cloudflare_record" "jakehowardtech_calibre" {
 resource "cloudflare_record" "jakehowardtech_homeassistant" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "homeassistant"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = cloudflare_record.sys_domain_pve_private.hostname
   type    = "CNAME"
   ttl     = 1
 }
@@ -143,7 +143,7 @@ resource "cloudflare_record" "jakehowardtech_grafana" {
 resource "cloudflare_record" "jakehowardtech_vaultwarden" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "vaultwarden"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = cloudflare_record.sys_domain_pve_private.hostname
   type    = "CNAME"
   ttl     = 1
 }

terraform/sys_domains.tf

@@ -38,9 +38,9 @@ resource "cloudflare_record" "sys_domain_pve" {
   ttl     = 1
 }
 
-resource "cloudflare_record" "sys_domain_private" {
+resource "cloudflare_record" "sys_domain_pve_private" {
   zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "private.sys"
+  name    = "pve-private.sys"
   value   = local.private_ipv6_marker
   type    = "AAAA"
   ttl     = 1

terraform/theorangeone.net.tf

@@ -29,7 +29,7 @@ resource "cloudflare_record" "theorangeonenet_whoami_cdn" {
 resource "cloudflare_record" "theorangeonenet_whoami_private" {
   zone_id = cloudflare_zone.theorangeonenet.id
   name    = "whoami-private"
-  value   = cloudflare_record.sys_domain_private.hostname
+  value   = cloudflare_record.sys_domain_pve_private.hostname
   type    = "CNAME"
   ttl     = 1
 }