Fix networkd templating integration and access permissions

roles/server/tasks/networkd.yaml

@@ -1,99 +1,97 @@
 ---
-- name: Install systemd-networkd on Rocky
+- name: Configure network settings
   become: true
-  ansible.builtin.dnf:
-    name: systemd-networkd
-    state: present
+  block:
+    - name: Install systemd-networkd on Rocky
+      ansible.builtin.dnf:
+        name: systemd-networkd
+        state: present
 
-- name: Ensure network config directory exists
-  ansible.builtin.file:
-    path: /etc/systemd/network
-    state: directory
-    owner: root
-    group: root
-    mode: 0644
+    - name: Ensure network config directory exists
+      ansible.builtin.file:
+        path: /etc/systemd/network
+        state: directory
+        owner: root
+        group: root
+        mode: 0755
 
-- name: Create network files
-  become: true
-  ansible.builtin.template:
-    src: network.j2
-    dest: /etc/systemd/network/{{ item.key }}.network
-    mode: 0644
-    owner: root
-    group: "{{ ansible_user }}"
-  loop: "{{ skylab_networking.interfaces | dict2items }}"
+    - name: Create network files
+      ansible.builtin.template:
+        src: network.j2
+        dest: /etc/systemd/network/{{ item.key }}.network
+        mode: 0644
+        owner: root
+        group: "{{ ansible_user }}"
+      loop: "{{ skylab_networking.interfaces | dict2items }}"
+      loop_control:
+        label: "{{ item.key }}"
 
-- name: Create netdev files
-  become: true
-  when: item.kind is defined
-  ansible.builtin.template:
-    src: netdev.j2
-    dest: /etc/systemd/network/{{ item.key }}.netdev
-    mode: 0644
-    owner: root
-    group: "{{ ansible_user }}"
-  loop: "{{ skylab_networking.interfaces | dict2items }}"
+    - name: Create netdev files
+      when: item.value.type is defined
+      ansible.builtin.template:
+        src: netdev.j2
+        dest: /etc/systemd/network/{{ item.key }}.netdev
+        mode: 0644
+        owner: root
+        group: "{{ ansible_user }}"
+      loop: "{{ skylab_networking.interfaces | dict2items }}"
+      loop_control:
+        label: "{{ item.key }}"
 
-- name: Fetch existing network config directory contents
-  become: true
-  changed_when: false
-  ansible.builtin.command:
-    cmd: /usr/bin/ls /etc/systemd/network
-  register: _network_config_dir_raw
+    - name: Fetch existing network config directory contents
+      changed_when: false
+      ansible.builtin.command:
+        cmd: /usr/bin/ls /etc/systemd/network
+      register: _network_config_dir_raw
 
-- name: Remove legacy network config files
-  become: true
-  when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking.interfaces
-  ansible.builtin.file:
-    path: /etc/systemd/network/{{ item }}
-    state: absent
-  loop: "{{ _network_config_dir_raw.stdout.split(' ') }}"
+    - name: Remove legacy network config files
+      when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking.interfaces
+      ansible.builtin.file:
+        path: /etc/systemd/network/{{ item }}
+        state: absent
+      loop: "{{ _network_config_dir_raw.stdout_lines }}"
+      loop_control:
+        label: "{{ item.strip() }}"
 
-- name: Configure fallback DNS
-  become: true
-  ansible.builtin.lineinfile:
-    path: /etc/systemd/resolved.conf
-    create: false
-    line: FallbackDNS=
+    - name: Configure fallback DNS
+      ansible.builtin.lineinfile:
+        path: /etc/systemd/resolved.conf
+        create: false
+        line: FallbackDNS=
 
-- name: Enable systemd-networkd
-  become: true
-  ansible.builtin.systemd:
-    name: "{{ item }}"
-    enabled: true
-  loop:
-    - systemd-networkd
-    - systemd-networkd-wait-online
-    - systemd-resolved
+    - name: Enable systemd-networkd
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        enabled: true
+      loop:
+        - systemd-networkd
+        - systemd-networkd-wait-online
+        - systemd-resolved
 
-- name: Disable NetworkManager
-  become: true
-  ansible.builtin.systemd:
-    name: "{{ item }}"
-    enabled: false
-  loop:
-    - NetworkManager
-    - NetworkManager-wait-online
+    - name: Disable NetworkManager
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        enabled: false
+      loop:
+        - NetworkManager
+        - NetworkManager-wait-online
 
-- name: Start systemd-resolved to enable symlink creation
-  become: true
-  ansible.builtin.systemd:
-    name: systemd-resolved
-    state: started
+    - name: Start systemd-resolved to enable symlink creation
+      ansible.builtin.systemd:
+        name: systemd-resolved
+        state: started
 
-- name: Link system resolv.conf to systemd-resolved
-  become: true
-  ansible.builtin.file:
-    dest: /etc/resolv.conf
-    src: /run/systemd/resolve/resolv.conf
-    state: link
-    force: true
-    setype: net_conf_t
+    - name: Link system resolv.conf to systemd-resolved
+      ansible.builtin.file:
+        dest: /etc/resolv.conf
+        src: /run/systemd/resolve/resolv.conf
+        state: link
+        force: true
+        setype: net_conf_t
 
-- name: Link systemd-resolved to multi-user target
-  become: true
-  ansible.builtin.file:
-    dest: /etc/systemd/system/multi-user.target.wants/systemd-resolved.service
-    src: /usr/lib/systemd/system/systemd-resolved.service
-    state: link
-    force: true
+    - name: Link systemd-resolved to multi-user target
+      ansible.builtin.file:
+        dest: /etc/systemd/system/multi-user.target.wants/systemd-resolved.service
+        src: /usr/lib/systemd/system/systemd-resolved.service
+        state: link
+        force: true

roles/server/templates/network.j2

@@ -14,17 +14,15 @@ DNS={{ server }}
 {% if item.value.bond is defined %}
 Bond={{ item.value.bond }}
 {% endif %}
-
 {% if item.value.dhcp | default(false) %}
+
 Gateway={{ item.value.gateway | ansible.netcommon.ipaddr('address') }}
 {% for address in item.value.addresses %}
 Address={{ address | ansible.netcommon.ipaddr('host/prefix') }}
 {% endfor %}
 {% endif %}
-
-
 {% for interface in skylab_networking.interfaces.keys() %}
-{% if interface.startswith(item.key) and interface.partition('.')[2] | number %}
+{% if interface.startswith(item.key) and interface.partition('.')[2] | regex_search('^[0-9]{1,4}$') and interface != item.key %}
 VLAN={{ interface }}
 {% endif %}
 {% endfor %}