common: valid hex IPv6 stable-secret written before addr_gen_mode, sysctl reload only of the role files

common/handlers/main.yml

@@ -1,5 +1,12 @@
+# Only the files of this role that exist: in a container the distribution files hold keys that
+# are not writable there, and sysctl --system fails on them.
 - name: reload_sysctl
-  command: sysctl --system
+  shell: >-
+    cd /etc/sysctl.d && sysctl -p $(ls
+    ip-forwarding.conf
+    ipv6-slaac-address-generation.conf
+    ipv6-slaac-override.conf
+    tcp-bbr.conf 2>/dev/null)
 
 - name: restart_journald
   systemd:

common/tasks/networking.yml

@@ -23,19 +23,16 @@
 
     - name: Generate random IPv6 stable-secret
       set_fact:
-        ipv6_stable_secret: "{{ 'fd' + (lookup('password', '/dev/null length=30 chars=hex')).split('.')[0][:7] + '::' + (lookup('password', '/dev/null length=4 chars=hex')) }}"
+        ipv6_stable_secret: "{{ lookup('password', '/dev/null length=32 chars=hexdigits') | lower | regex_replace('(.{4})(?!$)', '\\1:') }}"
 
+    # The secret goes first: addr_gen_mode 2 is rejected while the interface has no secret.
     - name: Set sysctl settings for ipv6-address-generation
       copy:
         dest: "/etc/sysctl.d/ipv6-slaac-address-generation.conf"
         content: |
-          {% if ansible_facts.default_ipv6.interface is defined %}
+          {% set iface = ansible_facts.default_ipv6.interface | default(ansible_facts.default_ipv4.interface) %}
-          net.ipv6.conf.{{ ansible_facts.default_ipv6.interface }}.addr_gen_mode = 2
+          net.ipv6.conf.{{ iface }}.stable_secret = {{ ipv6_stable_secret }}
-          net.ipv6.conf.{{ ansible_facts.default_ipv6.interface }}.stable_secret = {{ ipv6_stable_secret }}
+          net.ipv6.conf.{{ iface }}.addr_gen_mode = 2
-          {% else %}
-          net.ipv6.conf.{{ ansible_facts.default_ipv4.interface }}.addr_gen_mode = 2
-          net.ipv6.conf.{{ ansible_facts.default_ipv4.interface }}.stable_secret = {{ ipv6_stable_secret }}
-          {% endif %}
       notify: reload_sysctl
   when: 
     - ansible_facts.default_ipv6 is defined