Skip to content

Commit 1a85ec3

Browse files
DonGiovanni83DonGiovanni83
authored
Add opnsense config role (#155)
* Init opnsense_configure role * Init system settings tasks in opnsense_config * Add system setting logging to opnsense_config role * Add firewall_aliases to role * Add firewall rules to config role * Simplify role * Add firewall rules var to default vars of role * Add user config to configure role * Add interfaces assignments to role * Refactor role variable structure * Add system HA to config role * Add conditionals to configurations in role * Cleanup role * Document config rule * Add changelog fragment for new role * Lint role meta.yml * Fix changelog fragment file name typo * Use clearer variable wording in role README
1 parent 5eef6d6 commit 1a85ec3

File tree

8 files changed

+431
-0
lines changed

8 files changed

+431
-0
lines changed

‎changelogs/fragments/155-add-opnsense-config-role.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
minor_changes:
3+
- puzzle.opnsense.opnsense_configure - Addition of an ansible role to the collection

‎molecule/opnsense_config/converge.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
- name: converge
3+
hosts: all
4+
become: true
5+
vars:
6+
system:
7+
access:
8+
users:
9+
- username: simple_user
10+
password: pass1234
11+
high_availability:
12+
synchronize_interface: LAN
13+
synchronize_config_to_ip: 224.0.0.240
14+
synchronize_peer_ip: 224.0.0.241
15+
disable_preempt: true
16+
disconnect_dialup_interfaces: true
17+
synchronize_states: true
18+
remote_system_username: opnsense
19+
remote_system_password: v3rys3cure
20+
services_to_synchronize:
21+
- aliases
22+
- rules
23+
- ipsec
24+
settings:
25+
general:
26+
hostname: "firewall01"
27+
domain: "test.local"
28+
timezone: "Europe/Zurich"
29+
logging:
30+
preserve_logs: 10
31+
interfaces:
32+
assignments:
33+
- device: em0
34+
identifier: opt2
35+
description: VAGRANT
36+
- device: em1
37+
identifier: lan
38+
description: LAN
39+
- device: em2
40+
identifier: wan
41+
description: WAN
42+
- device: em3
43+
identifier: opt1
44+
description: DMZ
45+
firewall:
46+
aliases:
47+
- name: TestAliasTypeHost
48+
type: host
49+
statistics: false
50+
description: Test Alias with type Host
51+
content: 10.0.0.1
52+
- name: TestAliasTypeNetwork
53+
type: network
54+
statistics: false
55+
description: Test Alias with type Network
56+
content: 10.0.0.0/24
57+
rules:
58+
- interface: lan
59+
description: Block SSH on LAN
60+
destination:
61+
port: 22
62+
action: block
63+
roles:
64+
- role: puzzle.opnsense.opnsense_configure

‎molecule/opnsense_config/molecule.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
---
2+
scenario:
3+
name: opnsense_config
4+
test_sequence:
5+
# - dependency not relevant unless we have requirements
6+
- destroy
7+
- syntax
8+
- create
9+
- converge
10+
- idempotence
11+
- verify
12+
- destroy
13+
14+
driver:
15+
name: vagrant
16+
parallel: true
17+
18+
platforms:
19+
- name: "22.7"
20+
hostname: false
21+
box: puzzle/opnsense
22+
box_version: "22.7"
23+
memory: 1024
24+
cpus: 2
25+
instance_raw_config_args:
26+
- 'vm.guest = :freebsd'
27+
- 'ssh.sudo_command = "%c"'
28+
- 'ssh.shell = "/bin/sh"'
29+
- name: "23.1"
30+
box: puzzle/opnsense
31+
hostname: false
32+
box_version: "23.1"
33+
memory: 1024
34+
cpus: 2
35+
instance_raw_config_args:
36+
- 'vm.guest = :freebsd'
37+
- 'ssh.sudo_command = "%c"'
38+
- 'ssh.shell = "/bin/sh"'
39+
- name: "23.7"
40+
box: puzzle/opnsense
41+
hostname: false
42+
box_version: "23.7"
43+
memory: 1024
44+
cpus: 2
45+
instance_raw_config_args:
46+
- 'vm.guest = :freebsd'
47+
- 'ssh.sudo_command = "%c"'
48+
- 'ssh.shell = "/bin/sh"'
49+
- name: "24.1"
50+
box: puzzle/opnsense
51+
hostname: false
52+
box_version: "24.1"
53+
memory: 1024
54+
cpus: 2
55+
instance_raw_config_args:
56+
- 'vm.guest = :freebsd'
57+
- 'ssh.sudo_command = "%c"'
58+
- 'ssh.shell = "/bin/sh"'
59+
- name: "24.7"
60+
box: puzzle/opnsense
61+
hostname: false
62+
box_version: "24.7"
63+
memory: 1024
64+
cpus: 2
65+
instance_raw_config_args:
66+
- 'vm.guest = :freebsd'
67+
- 'ssh.sudo_command = "%c"'
68+
- 'ssh.shell = "/bin/sh"'
69+
70+
provisioner:
71+
name: ansible
72+
env:
73+
ANSIBLE_VERBOSITY: 3
74+
verifier:
75+
name: ansible
76+
options:
77+
become: true

‎molecule/opnsense_config/verify.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
- name: Verify connectivity to server
3+
hosts: all
4+
tasks:
5+
- name: Ping the server
6+
ansible.builtin.ping:

‎roles/opnsense_configure/README.md

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
opnsense_configure - OPNsense configuration role
2+
=========
3+
4+
This role provides a generic approach to configure OPNsense instances by populating host variables
5+
according to this roles defaults specification.
6+
7+
Role Variables
8+
--------------
9+
10+
The variables must be structured in a way that each puzzle.opnsense module has its own variable section . Each module related variable section
11+
is then structured just like the corresponding module parameters as documented in the modules themselves.
12+
The top level structure must be structured as follows:
13+
```yaml
14+
---
15+
system:
16+
access:
17+
users: [] # list of users, where the users follows the system_access_users module parameter structure
18+
high_availability:
19+
# system_high_availability_settings module parameters
20+
settings:
21+
general:
22+
# system_settings_general module parameters
23+
logging:
24+
# system_settings_logging module parameters
25+
26+
interfaces:
27+
assignments: [] # list of interface assignments, where the users follows the interfaces_assignments module parameter structure
28+
29+
firewall:
30+
aliases: [] # list of aliases, where the users follows the firewall_alias module parameter structure
31+
rules: [] # list of rules, where the users follows the firewall_rules module parameter structure
32+
```
33+
34+
35+
Example Playbook
36+
----------------
37+
38+
The usage of the role is straight forward, however the main thought should go into the building of the
39+
host variables. An example execution could look like this:
40+
41+
```yaml
42+
---
43+
- name: converge
44+
hosts: all
45+
become: true
46+
vars:
47+
system:
48+
access:
49+
users:
50+
- username: simple_user
51+
password: pass1234
52+
high_availability:
53+
synchronize_interface: LAN
54+
synchronize_config_to_ip: 224.0.0.240
55+
synchronize_peer_ip: 224.0.0.241
56+
disable_preempt: true
57+
disconnect_dialup_interfaces: true
58+
synchronize_states: true
59+
remote_system_username: opnsense
60+
remote_system_password: v3rys3cure
61+
services_to_synchronize:
62+
- aliases
63+
- rules
64+
- ipsec
65+
settings:
66+
general:
67+
hostname: "firewall01"
68+
domain: "test.local"
69+
timezone: "Europe/Zurich"
70+
logging:
71+
preserve_logs: 10
72+
interfaces:
73+
assignments:
74+
- device: em0
75+
identifier: opt2
76+
description: VAGRANT
77+
- device: em1
78+
identifier: lan
79+
description: LAN
80+
- device: em2
81+
identifier: wan
82+
description: WAN
83+
- device: em3
84+
identifier: opt1
85+
description: DMZ
86+
firewall:
87+
aliases:
88+
- name: TestAliasTypeHost
89+
type: host
90+
statistics: false
91+
description: Test Alias with type Host
92+
content: 10.0.0.1
93+
- name: TestAliasTypeNetwork
94+
type: network
95+
statistics: false
96+
description: Test Alias with type Network
97+
content: 10.0.0.0/24
98+
rules:
99+
- interface: lan
100+
description: Block SSH on LAN
101+
destination:
102+
port: 22
103+
action: block
104+
roles:
105+
- role: puzzle.opnsense.opnsense_configure
106+
107+
```
108+
109+
License
110+
-------
111+
112+
GPLv3
113+
114+
Author Information
115+
------------------
116+
- Fabio Bertagna (github.com/dongiovanni83)

‎roles/opnsense_configure/defaults/main.yml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
# defaults file for opnsense_configure
3+
4+
#
5+
# System variables should be provided in this structure
6+
#
7+
# system:
8+
# access:
9+
# users: [] # see system_access_users task args for user entry structure
10+
# high_availability:
11+
# disable_preempt:
12+
# disconnect_dialup_interfaces:
13+
# synchronize_states:
14+
# synchronize_interface:
15+
# sync_compatibility:
16+
# synchronize_peer_ip:
17+
# synchronize_config_to_ip:
18+
# remote_system_username:
19+
# remote_system_password:
20+
# services_to_synchronize:
21+
# settings:
22+
# general:
23+
# hostname:
24+
# domain:
25+
# timezone:
26+
# logging:
27+
# max_log_file_size_mb:
28+
# preserve_logs:
29+
30+
system:
31+
settings:
32+
access:
33+
# Interface related variables:
34+
#
35+
# interfaces:
36+
# assignments: []
37+
interfaces:
38+
39+
#
40+
# Firewall related variables should be provided in this structure
41+
#
42+
# firewall:
43+
# aliases: []
44+
# rules: []
45+
firewall:

‎roles/opnsense_configure/meta/main.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
galaxy_info:
2+
author: Fabio Bertagna <bertagna@puzzle.ch>
3+
company: Puzzle ITC
4+
license: GPL-3.0-only
5+
min_ansible_version: 2.1
6+
galaxy_tags:
7+
- opnsense
8+
9+
dependencies: [ ]

0 commit comments

Comments
 (0)