Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

common: valid hex IPv6 stable-secret written before addr_gen_mode, sysctl reload only of the role files

Browse Source
This commit is contained in:
Ruakij
2026-11-07 19:23:51 +00:00
parent 975beccf50
commit cc9cc6d34f
2 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/tasks/networking.yml
+5 -8
View File
@@ -23,19 +23,16 @@
- name: Generate random IPv6 stable-secret
set_fact:
ipv6_stable_secret: "{{ 'fd' + (lookup('password', '/dev/null length=30 chars=hex')).split('.')[0][:7] + '::' + (lookup('password', '/dev/null length=4 chars=hex')) }}"
ipv6_stable_secret: "{{ lookup('password', '/dev/null length=32 chars=hexdigits') | lower | regex_replace('(.{4})(?!$)', '\\1:') }}"
# The secret goes first: addr_gen_mode 2 is rejected while the interface has no secret.
- name: Set sysctl settings for ipv6-address-generation
copy:
dest: "/etc/sysctl.d/ipv6-slaac-address-generation.conf"
content: |
{% if ansible_facts.default_ipv6.interface is defined %}
net.ipv6.conf.{{ ansible_facts.default_ipv6.interface }}.addr_gen_mode = 2
net.ipv6.conf.{{ ansible_facts.default_ipv6.interface }}.stable_secret = {{ ipv6_stable_secret }}
{% else %}
net.ipv6.conf.{{ ansible_facts.default_ipv4.interface }}.addr_gen_mode = 2
net.ipv6.conf.{{ ansible_facts.default_ipv4.interface }}.stable_secret = {{ ipv6_stable_secret }}
{% endif %}
{% set iface = ansible_facts.default_ipv6.interface | default(ansible_facts.default_ipv4.interface) %}
net.ipv6.conf.{{ iface }}.stable_secret = {{ ipv6_stable_secret }}
net.ipv6.conf.{{ iface }}.addr_gen_mode = 2
notify: reload_sysctl
when:
- ansible_facts.default_ipv6 is defined