.

2026-03-26 08:57:55 +01:00
parent 2b1ca2d5be
commit bb55664283
19 changed files with 2671 additions and 0 deletions
@@ -0,0 +1,166 @@
+#SPDX-License-Identifier: MIT-0
+---
+# --- Connection ---
+# opnsense_firewall defaults to ansible_host from inventory
+opnsense_firewall: "{{ ansible_host }}"
+opnsense_api_key: ""       # set in Ansible Vault
+opnsense_api_secret: ""    # set in Ansible Vault
+opnsense_ssl_verify: true
+opnsense_api_port: 443
+
+# --- System settings ---
+opnsense_hostname: opnsense
+opnsense_domain: homelan
+opnsense_timezone: Europe/Vienna
+opnsense_dns_servers:
+  - 1.1.1.1
+  - 8.8.8.8
+
+# --- Gateways ---
+# opnsense_gateways:
+#   - name: WAN_GW
+#     interface: wan
+#     gateway: 192.168.1.1
+#     ip_protocol: inet
+#     default_gw: true
+opnsense_gateways: []
+
+# --- VLANs ---
+# opnsense_vlans:
+#   - interface: vtnet0
+#     tag: 10
+#     description: LAN
+opnsense_vlans: []
+
+# --- Network topology ---
+# OPNsense interface names as assigned in WebUI (Interfaces → Assignments)
+opnsense_lan_interface: lan
+opnsense_dmz_interface: opt1
+opnsense_guest_interface: opt2
+opnsense_iot_interface: opt3
+
+# OPNsense's own IP address — used as DNS target in firewall rules
+# Set this to OPNsense's LAN IP (e.g. 192.168.1.1)
+opnsense_self_address: ""
+
+# IoT hosts allowed internet access — list of IPs for iot_internet_allowed alias
+opnsense_iot_internet_allowed: []
+
+# --- Firewall aliases ---
+# opnsense_aliases:
+#   - name: rfc1918
+#     type: network
+#     content:
+#       - 10.0.0.0/8
+#       - 172.16.0.0/12
+#       - 192.168.0.0/16
+#     description: Private networks
+opnsense_aliases: []
+
+# --- Firewall rules ---
+# opnsense_rules:
+#   - description: Allow LAN to internet
+#     interface: [lan]
+#     direction: in
+#     action: pass
+#     source_net: lan
+#     destination_net: any
+#     protocol: any
+#     enabled: true
+opnsense_rules: []
+
+# --- NAT (outbound / masquerade) ---
+# opnsense_nat_source_rules:
+#   - description: Masquerade LAN to WAN
+#     interface: wan
+#     source_net: 192.168.0.0/24
+#     target: interface
+#     enabled: true
+opnsense_nat_source_rules: []
+
+# --- DHCP server ---
+opnsense_dhcp_enabled: false
+opnsense_dhcp_interfaces: []
+opnsense_dhcp_fw_rules: false
+
+# opnsense_dhcp_subnets:
+#   - subnet: 192.168.1.0/24
+#     pools:
+#       - 192.168.1.100 - 192.168.1.200
+#     gateway: [192.168.1.1]
+#     dns: [192.168.1.1]
+#     domain: homelan
+#     description: LAN
+opnsense_dhcp_subnets: []
+
+# opnsense_dhcp_reservations:
+#   - ip: 192.168.1.10
+#     mac: "aa:bb:cc:dd:ee:ff"
+#     hostname: myhost
+#     subnet: 192.168.1.0/24
+#     description: My host
+opnsense_dhcp_reservations: []
+
+# --- Unbound DNS resolver ---
+opnsense_unbound_enabled: true
+opnsense_unbound_port: 53
+opnsense_unbound_dnssec: true
+opnsense_unbound_register_dhcp_leases: false
+opnsense_unbound_register_dhcp_static_mappings: false
+opnsense_unbound_register_system_records: true
+
+# Host overrides — aliases are sub-properties of each host entry.
+# alias.domain defaults to the parent host's domain if not set.
+# alias.target is auto-set to hostname.domain of the parent host.
+# opnsense_unbound_hosts:
+#   - hostname: vhost0
+#     domain: homelan
+#     records:
+#       - value: 10.61.0.100          # type defaults to A
+#       - type: AAAA
+#         value: "fd30:882:6101:1::1"
+#     aliases:
+#       - alias: web
+#       - alias: api
+#   - hostname: vhost1
+#     domain: homelan
+#     records:
+#       - value: 10.61.0.110
+opnsense_unbound_hosts: []
+
+# Selective forwards — leave empty to resolve everything from root servers
+# opnsense_unbound_forwards:
+#   - domain: homelan
+#     target: 10.61.0.1
+#     description: Local domain
+#   - domain: internal.example.com
+#     target: 192.168.1.53
+#     description: Internal DNS
+opnsense_unbound_forwards: []
+
+# --- OpenVPN clients ---
+opnsense_openvpn_static_keys: []
+opnsense_openvpn_clients: []
+
+# --- WireGuard ---
+opnsense_wireguard_enabled: true
+
+# opnsense_wireguard_servers:
+#   - name: wg0
+#     private_key: "{{ vault_wg_private_key }}"
+#     port: 51820
+#     allowed_ips:
+#       - 10.0.0.1/24
+#     peers: []
+#     enabled: true
+opnsense_wireguard_servers: []
+
+# opnsense_wireguard_peers:
+#   - name: client1
+#     public_key: "CLIENT_PUBLIC_KEY"
+#     allowed_ips:
+#       - 10.0.0.2/32
+#     servers: [wg0]
+#     keepalive: 25
+#     enabled: true
+opnsense_wireguard_peers: []