.

2026-03-26 08:57:55 +01:00
parent 2b1ca2d5be
commit bb55664283
19 changed files with 2671 additions and 0 deletions
@@ -0,0 +1,209 @@
+---
+- hosts: opnsense
+  gather_facts: false
+  roles:
+    - role: opnsense
+      vars:
+        opnsense_dhcp_interfaces:
+          - lan
+          - opt2
+          - opt3
+
+        opnsense_self_address: 10.61.0.240   # OPNsense LAN IP
+        opnsense_lan_interface: lan
+        opnsense_dmz_interface: opt1
+        opnsense_guest_interface: opt2
+        opnsense_iot_interface: opt3
+
+        opnsense_iot_internet_allowed:
+          - 192.168.20.10   # smart TV
+          - 192.168.20.11   # printer
+
+        # --- VLANs ---
+        opnsense_vlans:
+          - interface: vtnet0
+            tag: 1
+            description: LAN
+          - interface: vtnet0
+            tag: 10
+            description: DMZ
+          - interface: vtnet0
+            tag: 11
+            description: GUEST
+          - interface: vtnet0
+            tag: 20
+            description: IoT
+
+        # --- Unbound ---
+        opnsense_unbound_hosts:
+          - hostname: airq-livingroom
+            domain: homelan
+            description: AirQ Luftsensor
+            records:
+              - value: 10.63.1.177
+            aliases:
+              - alias: api
+              - domain: homelan.matzman.net
+
+          - hostname: ha
+            domain: homelan
+            description: Home Assistant
+            records:
+              - value: 10.61.1.75
+              - type: AAAA
+                value: "fd30:882:6101:1::75"
+            aliases:
+              - domain: homelan.matzman.net
+              - alias: mqtt
+              - alias: mqtt
+                domain: homelan.matzman.net
+
+          - hostname: ha
+            domain: iot.homelan
+            description: Home Assistant IoT VLAN
+            records:
+              - value: 10.63.1.75
+              - type: AAAA
+                value: "fd30:882:6120:1::75"
+            aliases:
+              - domain: iot.homelan.matzman.net
+              - alias: mqtt
+              - alias: mqtt
+                domain: iot.homelan.matzman.net
+
+          - hostname: helios4
+            domain: iot.homelan
+            description: Home Assistant IoT VLAN
+            records:
+              - value: 10.61.1.190
+              - type: AAAA
+                value: "fd30:882:6101:1::190"
+            aliases:
+              - domain: iot.homelan.matzman.net
+              - alias: mqtt
+              - alias: mqtt
+                domain: iot.homelan.matzman.net
+
+          - hostname: octopi
+            domain: homelan
+            description: OctoPi Raspi
+            records:
+              - value: 10.63.1.70
+              - type: AAAA
+                value: "fd30:882:6120:1::70"
+            aliases:
+              - alias: octoprint
+
+          - hostname: opnsense
+            domain: homelan
+            description: OPNsense Router
+            records:
+              - value: 10.61.0.250
+              - type: AAAA
+                value: "fd30:0882:6101::250"
+            aliases:
+              - alias: pfsense
+              - alias: ntp
+
+          - hostname: opnsense
+            domain: iot.homelan
+            description: OPNsense Router IoT VLAN
+            records:
+              - value: 10.63.0.250
+              - type: AAAA
+                value: "fd30:0882:6120::250"
+            aliases:
+              - alias: pfsense
+              - alias: ntp
+
+          - hostname: prusa-core-one
+            domain: homelan
+            description: Prusa Core One 3D-Printer
+            records:
+              - value: 10.63.1.84
+
+          - hostname: vhost0
+            domain: homelan
+            description: vhost0 Server
+            records:
+              - value: 10.61.0.100
+              - type: AAAA
+                value: "fd30:0882:6101::100"
+            aliases:
+              - alias: vhost0
+                domain: homelan.matzman.net
+              - alias: nas3
+
+          - hostname: vhost1
+            domain: homelan
+            description: vhost1 Server
+            records:
+              - value: 10.61.0.110
+              - type: AAAA
+                value: "fd30:0882:6101::110"
+            aliases:
+              - alias: vhost1
+                domain: homelan.matzman.net
+              - alias: comic-utils
+              - alias: homepage
+              - alias: komf
+              - alias: komga
+              - alias: uptime
+              - alias: traefik
+              - alias: jdownloader
+              - alias: transmission
+              - alias: lanraragi
+              - alias: influxdb
+              - alias: influxdb
+                domain: homelan.matzman.net
+              - alias: nas0
+
+          - hostname: vhost1
+            domain: iot.homelan
+            description: vhost1 Server IoT VLAN
+            records:
+              - value: 10.63.0.110
+              - type: AAAA
+                value: "fd30:0882:6120::110"
+            aliases:
+              - alias: vhost1
+                domain: iot.homelan.matzman.net
+              - alias: influxdb
+              - alias: influxdb
+                domain: iot.homelan.matzman.net
+
+          - hostname: vserver0
+            domain: wg0.homelan
+            description: vserver0 wg0 interface
+            records:
+              - value: 10.71.1.4
+
+        opnsense_dhcp_subnets:
+          - subnet: "192.168.1.0/24"
+            pools:
+              - "192.168.1.100 - 192.168.1.200"
+            gateway: [192.168.1.1]
+            dns: [192.168.1.1]
+            domain: homelan
+            description: LAN
+
+        # --- WireGuard ---
+        opnsense_wireguard_enabled: false
+
+        opnsense_wireguard_servers:
+          - name: wg0
+            private_key: "MGChy8PrvKTHWC7nzvLwuHQP/uxhNA5FUhLm5NTgfE8="
+            port: 51820
+            allowed_ips:
+              - 10.0.0.1/24
+            peers: []
+            enabled: true
+
+        opnsense_wireguard_peers:
+          - name: client1
+            public_key: "NjmYVK0BWDhQzaODqqoWHNgdtPQyNMJwhCJyEingln8="
+            allowed_ips:
+              - 10.0.0.2/32
+            servers: [wg0]
+            keepalive: 25
+            enabled: true