Commit 60a46868 authored by nimrod's avatar nimrod
Browse files

Ansible: Updates for OpenWrt 25.12. 

Mainly the change to the apk package manager.
parent 04ef2210

Ansible/renew-certs.yaml

+4 −4
Original line number Diff line number Diff line
@@ -46,7 +46,7 @@ 
          - www.nehes.co

          - www.nehe.sr

          - www.shore.co.il

        handlers:

        _handlers:

          - Restart Nginx on ns4

        host: ns4

      tags:
@@ -70,7 +70,7 @@ 
          - matrix.shore.co.il

          - vouch.shore.co.il

          - zpush.shore.co.il

        handlers:

        _handlers:

          - Restart Nginx on host01

        host: host01

      tags:
@@ -88,7 +88,7 @@ 
          - kodi.shore.co.il

          - library.shore.co.il

          - transmission.shore.co.il

        handlers:

        _handlers:

          - Restart Nginx on kodi

        host: kodi

      tags:
@@ -110,7 +110,7 @@ 
          - mta-sts.shore.co.il

          - smtp.shore.co.il

        filename: mail

        handlers:

        _handlers:

          - Reload Dovecot

          - Reload Exim

          - Restart Nginx on host01

Ansible/roles/openwrt_bootstrap/tasks/main.yaml

+4 −4
Original line number Diff line number Diff line 
---

- name: Update package list

  ansible.builtin.raw: opkg update

  ansible.builtin.raw: apk update

  changed_when: false



- name: Install Python3

  ansible.builtin.raw: opkg install python3

  register: opkg_install_python3

  ansible.builtin.raw: apk add python3

  register: apk_add_python3

  changed_when: |

    'installing' in opkg_install_python3.stdout

    'installing' in apk_add_python3.stdout



- name: Gather facts

  ansible.builtin.setup:

Ansible/roles/wap/tasks/main.yaml

+4 −4
Original line number Diff line number Diff line
@@ -3,13 +3,13 @@ 
  ansible.builtin.assert:

    that:

      - ansible_facts.distribution == "OpenWrt"

      - ansible_facts.distribution_major_version == "23"

      - ansible_facts.distribution_major_version == "25"



- name: Install packages

  loop:

    - curl

    - luci-app-advanced-reboot

  community.general.opkg:

  community.general.apk:

    name: '{{ item }}'

    state: present

    update_cache: true
@@ -47,7 +47,7 @@ 
  community.crypto.openssl_privatekey:

    mode: 0o0444

    path: &local_private_key |-

      '{{ playbook_dir }}/{{ ansible_facts.hostname }}.key'

      {{ ansible_facts.hostname }}.key

    size: 4096

    state: present

    type: RSA
@@ -56,7 +56,7 @@ 
  delegate_to: localhost

  community.crypto.x509_certificate:

    path: &local_public_key |-

      '{{ playbook_dir }}/{{ ansible_facts.hostname }}.crt'

      {{ ansible_facts.hostname }}.crt

    privatekey_path: *local_private_key

    provider: selfsigned

    state: present

Ansible/roles/wap/templates/daily.j2

+2 −3
Original line number Diff line number Diff line 
#!/bin/sh

set -eu



opkg update

opkg list-upgradable | awk '{print $1}' | sort | xargs -rn1 opkg upgrade --download-only

apk update



[ -z "$(opkg list-upgradable)" ] ||

[ -z "$(apk list --upgradable)" ] ||

    curl https://notify.shore.co.il/send?message={{ (ansible_facts.hostname + " has pending updates.") | urlencode }}

Ansible/roles/wap/templates/uci.conf.j2

+246 −2
Original line number Diff line number Diff line 
package attendedsysupgrade



config server 'server'

	option url 'https://sysupgrade.openwrt.org'



config client 'client'

	option upgrade_packages '1'

	option auto_search '0'

	option advanced_mode '0'

	option login_check_for_upgrades '1'



config owut 'owut'



package dhcp



config dnsmasq
@@ -36,9 +49,45 @@ config dhcp 'lan' 


config odhcpd 'odhcpd'

	option maindhcp '0'

	option leasefile '/tmp/hosts/odhcpd'

	option leasefile '/tmp/odhcpd.leases'

	option leasetrigger '/usr/sbin/odhcpd-update'

	option loglevel '4'

	option piodir '/tmp/odhcpd-piodir'

	option hostsdir '/tmp/hosts'



package dhcp-opkg



config dnsmasq

	option domainneeded '1'

	option boguspriv '1'

	option filterwin2k '0'

	option localise_queries '1'

	option rebind_protection '1'

	option rebind_localhost '1'

	option local '/lan/'

	option domain 'lan'

	option expandhosts '1'

	option nonegcache '0'

	option cachesize '1000'

	option authoritative '1'

	option readethers '1'

	option leasefile '/tmp/dhcp.leases'

	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'

	option nonwildcard '1'

	option localservice '1'

	option ednspacket_max '1232'

	option filter_aaaa '0'

	option filter_a '0'



config dhcp 'lan'

	option interface 'lan'

	option start '100'

	option limit '150'

	option leasetime '12h'



config dhcp 'wan'

	option interface 'wan'

	option ignore '1'



package dropbear
@@ -70,6 +119,128 @@ config rule 
	option dest_port '22'

	option target 'ACCEPT'



package firewall-opkg



config defaults

	option syn_flood '1'

	option input 'REJECT'

	option output 'ACCEPT'

	option forward 'REJECT'



config zone

	option name 'lan'

	list network 'lan'

	option input 'ACCEPT'

	option output 'ACCEPT'

	option forward 'ACCEPT'



config zone

	option name 'wan'

	list network 'wan'

	list network 'wan6'

	option input 'REJECT'

	option output 'ACCEPT'

	option forward 'REJECT'

	option masq '1'

	option mtu_fix '1'



config forwarding

	option src 'lan'

	option dest 'wan'



config rule

	option name 'Allow-DHCP-Renew'

	option src 'wan'

	option proto 'udp'

	option dest_port '68'

	option target 'ACCEPT'

	option family 'ipv4'



config rule

	option name 'Allow-Ping'

	option src 'wan'

	option proto 'icmp'

	option icmp_type 'echo-request'

	option family 'ipv4'

	option target 'ACCEPT'



config rule

	option name 'Allow-IGMP'

	option src 'wan'

	option proto 'igmp'

	option family 'ipv4'

	option target 'ACCEPT'



config rule

	option name 'Allow-DHCPv6'

	option src 'wan'

	option proto 'udp'

	option dest_port '546'

	option family 'ipv6'

	option target 'ACCEPT'



config rule

	option name 'Allow-MLD'

	option src 'wan'

	option proto 'icmp'

	option src_ip 'fe80::/10'

	list icmp_type '130/0'

	list icmp_type '131/0'

	list icmp_type '132/0'

	list icmp_type '143/0'

	option family 'ipv6'

	option target 'ACCEPT'



config rule

	option name 'Allow-ICMPv6-Input'

	option src 'wan'

	option proto 'icmp'

	list icmp_type 'echo-request'

	list icmp_type 'echo-reply'

	list icmp_type 'destination-unreachable'

	list icmp_type 'packet-too-big'

	list icmp_type 'time-exceeded'

	list icmp_type 'bad-header'

	list icmp_type 'unknown-header-type'

	list icmp_type 'router-solicitation'

	list icmp_type 'neighbour-solicitation'

	list icmp_type 'router-advertisement'

	list icmp_type 'neighbour-advertisement'

	option limit '1000/sec'

	option family 'ipv6'

	option target 'ACCEPT'



config rule

	option name 'Allow-ICMPv6-Forward'

	option src 'wan'

	option dest '*'

	option proto 'icmp'

	list icmp_type 'echo-request'

	list icmp_type 'echo-reply'

	list icmp_type 'destination-unreachable'

	list icmp_type 'packet-too-big'

	list icmp_type 'time-exceeded'

	list icmp_type 'bad-header'

	list icmp_type 'unknown-header-type'

	option limit '1000/sec'

	option family 'ipv6'

	option target 'ACCEPT'



config rule

	option name 'Allow-IPSec-ESP'

	option src 'wan'

	option dest 'lan'

	option proto 'esp'

	option target 'ACCEPT'



config rule

	option name 'Allow-ISAKMP'

	option src 'wan'

	option dest 'lan'

	option dest_port '500'

	option proto 'udp'

	option target 'ACCEPT'



package luci



config core 'main'
@@ -112,6 +283,40 @@ config internal 'diag' 
	option ping 'openwrt.org'

	option route 'openwrt.org'



package luci-opkg



config core 'main'

	option lang 'auto'

	option mediaurlbase '/luci-static/bootstrap'

	option resourcebase '/luci-static/resources'

	option ubuspath '/ubus/'



config extern 'flash_keep'

	option uci '/etc/config/'

	option dropbear '/etc/dropbear/'

	option openvpn '/etc/openvpn/'

	option passwd '/etc/passwd'

	option opkg '/etc/opkg.conf'

	option firewall '/etc/firewall.user'

	option uploads '/lib/uci/upload/'



config internal 'languages'



config internal 'sauth'

	option sessionpath '/tmp/luci-sessions'

	option sessiontime '3600'



config internal 'ccache'

	option enable '1'



config internal 'themes'



config internal 'apply'

	option rollback '90'

	option holdoff '4'

	option timeout '5'

	option display '1.5'



package network



config interface 'loopback'
@@ -122,6 +327,7 @@ config interface 'loopback' 


config globals 'globals'

	option ula_prefix 'fdc9:d14b:495c::/48'

	option dhcp_default_duid '000429036885a7af4a4b8c2ceedc3945fbfb' # pragma: allowlist secret



config device

	option name 'br-lan'
@@ -188,6 +394,12 @@ config timeserver 'ntp' 
	list server '2.openwrt.pool.ntp.org'

	list server '3.openwrt.pool.ntp.org'



package ubihealthd



config ubi-device 'ubi0'

	option device '/dev/ubi0'

	option enable '1'



package ubootenv



config ubootenv
@@ -275,6 +487,38 @@ config uhttpd 'main' 
	option http_keepalive '20'

	option tcp_keepalive '1'

	option ubus_prefix '/ubus'

	list ucode_prefix '/cgi-bin/luci=/usr/share/ucode/luci/uhttpd.uc'



config cert 'defaults'

	option days '730'

	option key_type 'ec'

	option bits '2048'

	option ec_curve 'P-256'

	option country 'ZZ'

	option state 'Somewhere'

	option location 'Unknown'

	option commonname 'OpenWrt'



package uhttpd-opkg



config uhttpd 'main'

	list listen_http '0.0.0.0:80'

	list listen_http '[::]:80'

	list listen_https '0.0.0.0:443'

	list listen_https '[::]:443'

	option redirect_https '0'

	option home '/www'

	option rfc1918_filter '1'

	option max_requests '3'

	option max_connections '100'

	option cert '/etc/uhttpd.crt'

	option key '/etc/uhttpd.key'

	option cgi_prefix '/cgi-bin'

	list lua_prefix '/cgi-bin/luci=/usr/lib/lua/luci/sgi/uhttpd.lua'

	option script_timeout '60'

	option network_timeout '30'

	option http_keepalive '20'

	option tcp_keepalive '1'



config cert 'defaults'

	option days '730'
@@ -290,7 +534,7 @@ package wireless 


config wifi-device 'radio0'

	option type 'mac80211'

	option path 'soc/40000000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'

	option path 'soc/40000000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'

	option channel 'auto'

	option band '5g'

	option htmode 'VHT80'