From cc9cc6d34f945c86687f9a6dda0458936477409c Mon Sep 17 00:00:00 2001
From: Ruakij <ruakij@ruekov.eu>
Date: Sat, 7 Nov 2026 19:23:51 +0000
Subject: [PATCH] common: valid hex IPv6 stable-secret written before
 addr_gen_mode, sysctl reload only of the role files

---
 common/handlers/main.yml    |  9 ++++++++-
 common/tasks/networking.yml | 13 +++++--------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/common/handlers/main.yml b/common/handlers/main.yml
index e77d0ef..10fd150 100644
--- a/common/handlers/main.yml
+++ b/common/handlers/main.yml
@@ -1,5 +1,12 @@
+# Only the files of this role that exist: in a container the distribution files hold keys that
+# are not writable there, and sysctl --system fails on them.
 - name: reload_sysctl
-  command: sysctl --system
+  shell: >-
+    cd /etc/sysctl.d && sysctl -p $(ls
+    ip-forwarding.conf
+    ipv6-slaac-address-generation.conf
+    ipv6-slaac-override.conf
+    tcp-bbr.conf 2>/dev/null)
 
 - name: restart_journald
   systemd:
diff --git a/common/tasks/networking.yml b/common/tasks/networking.yml
index 80ccdbe..14f1651 100644
--- a/common/tasks/networking.yml
+++ b/common/tasks/networking.yml
@@ -23,19 +23,16 @@
 
     - name: Generate random IPv6 stable-secret
       set_fact:
-        ipv6_stable_secret: "{{ 'fd' + (lookup('password', '/dev/null length=30 chars=hex')).split('.')[0][:7] + '::' + (lookup('password', '/dev/null length=4 chars=hex')) }}"
+        ipv6_stable_secret: "{{ lookup('password', '/dev/null length=32 chars=hexdigits') | lower | regex_replace('(.{4})(?!$)', '\\1:') }}"
 
+    # The secret goes first: addr_gen_mode 2 is rejected while the interface has no secret.
     - name: Set sysctl settings for ipv6-address-generation
       copy:
         dest: "/etc/sysctl.d/ipv6-slaac-address-generation.conf"
         content: |
-          {% if ansible_facts.default_ipv6.interface is defined %}
-          net.ipv6.conf.{{ ansible_facts.default_ipv6.interface }}.addr_gen_mode = 2
-          net.ipv6.conf.{{ ansible_facts.default_ipv6.interface }}.stable_secret = {{ ipv6_stable_secret }}
-          {% else %}
-          net.ipv6.conf.{{ ansible_facts.default_ipv4.interface }}.addr_gen_mode = 2
-          net.ipv6.conf.{{ ansible_facts.default_ipv4.interface }}.stable_secret = {{ ipv6_stable_secret }}
-          {% endif %}
+          {% set iface = ansible_facts.default_ipv6.interface | default(ansible_facts.default_ipv4.interface) %}
+          net.ipv6.conf.{{ iface }}.stable_secret = {{ ipv6_stable_secret }}
+          net.ipv6.conf.{{ iface }}.addr_gen_mode = 2
       notify: reload_sysctl
   when: 
     - ansible_facts.default_ipv6 is defined