working ig

ansible/group_vars/vpnhub.example.yml

@@ -34,6 +34,11 @@ radius_secret: ""
 # console (this var must still match for the init job's API login).
 technitium_admin_password: ""
 
+# DNS zone where VPN clients get registered as <username>.<zone> with a
+# matching PTR (Technitium primary zone, created by the init job). Set to
+# "" to disable registration.
+vpn_dns_zone: roam.atlashorizon.net
+
 # ── Optional ──
 # Pin for deterministic Duo updates (e.g. "6.5.1"); bumping it forces a
 # refetch of the tarball on the next rebuild.

ansible/site.yml

@@ -23,6 +23,7 @@
     vpnhub_base_dir: /opt
     vpnhub_stack_dir: "{{ vpnhub_base_dir }}/vpnhub"
     vpnhub_force_rebuild: false
+    vpnhub_host_dns: [1.1.1.1, 9.9.9.9]
     public_iface: "{{ ansible_default_ipv4.interface }}"
     wg_peers_configured: >-
       {{ (troch_wg_public_key | default('')) != ''
@@ -30,9 +31,9 @@
 
   handlers:
     - name: reload firewall
+      # the reload flushes the Docker-managed chains, so restart docker after
       ansible.builtin.shell: |
         netfilter-persistent reload
-        # the reload flushes Docker's chains — put them back
         if systemctl is-active --quiet docker; then systemctl restart docker; fi
 
     - name: restart wireguard
@@ -50,17 +51,18 @@
         chdir: "{{ vpnhub_stack_dir }}"
 
     - name: recreate duo-authproxy
-      ansible.builtin.command: docker compose up -d --force-recreate duo-authproxy
+      # --build: entrypoint/cfg-template changes are baked into the image
+      ansible.builtin.command: docker compose up -d --build --force-recreate duo-authproxy
       args:
         chdir: "{{ vpnhub_stack_dir }}"
 
     - name: recreate openvpn
-      ansible.builtin.command: docker compose up -d --force-recreate openvpn
+      ansible.builtin.command: docker compose up -d --build --force-recreate openvpn
       args:
         chdir: "{{ vpnhub_stack_dir }}"
 
     - name: recreate stack
-      ansible.builtin.command: docker compose up -d --force-recreate
+      ansible.builtin.command: docker compose up -d --build --force-recreate
       args:
         chdir: "{{ vpnhub_stack_dir }}"
 
@@ -76,9 +78,12 @@
             update_cache: true
             cache_valid_time: 3600
 
+        # Distro-agnostic: ansible_distribution is Ubuntu or Debian, and
+        # Docker publishes separate repos per distro (a Debian codename
+        # like trixie does not exist under linux/ubuntu and vice versa).
         - name: Docker apt signing key
           ansible.builtin.get_url:
-            url: https://download.docker.com/linux/ubuntu/gpg
+            url: "https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg"
             dest: /etc/apt/keyrings/docker.asc
             mode: "0644"
 
@@ -87,7 +92,7 @@
             repo: >-
               deb [arch={{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}
               signed-by=/etc/apt/keyrings/docker.asc]
-              https://download.docker.com/linux/ubuntu
+              https://download.docker.com/linux/{{ ansible_distribution | lower }}
               {{ ansible_distribution_release }} stable
             filename: docker
 
@@ -124,10 +129,19 @@
         sysctl_file: /etc/sysctl.d/99-vpnhub.conf
         reload: true
 
-    # Technitium binds 0.0.0.0:53 — systemd-resolved's stub listener on
-    # 127.0.0.53:53 would collide with it.
+    # Technitium binds 0.0.0.0:53 — free the port while keeping host DNS
+    # working. Ubuntu runs systemd-resolved (stub on 127.0.0.53:53 must be
+    # disabled); plain Debian has no resolved and just needs a sane static
+    # /etc/resolv.conf.
+    - name: Check whether systemd-resolved is in use
+      tags: host
+      ansible.builtin.stat:
+        path: /run/systemd/resolve/resolv.conf
+      register: resolved_upstream
+
     - name: resolved drop-in directory
       tags: host
+      when: resolved_upstream.stat.exists
       ansible.builtin.file:
         path: /etc/systemd/resolved.conf.d
         state: directory
@@ -135,6 +149,7 @@
 
     - name: Disable systemd-resolved stub listener (frees :53 for Technitium)
       tags: host
+      when: resolved_upstream.stat.exists
       ansible.builtin.copy:
         dest: /etc/systemd/resolved.conf.d/99-vpnhub.conf
         mode: "0644"
@@ -143,14 +158,29 @@
           DNSStubListener=no
       notify: restart systemd-resolved
 
-    - name: Point /etc/resolv.conf at resolved's upstream file (not the dead stub)
+    - name: Point /etc/resolv.conf at resolved upstream file (not the dead stub)
       tags: host
+      when: resolved_upstream.stat.exists
       ansible.builtin.file:
         src: /run/systemd/resolve/resolv.conf
         dest: /etc/resolv.conf
         state: link
         force: true
 
+    - name: Static resolv.conf (no systemd-resolved on this host)
+      tags: host
+      when: not resolved_upstream.stat.exists
+      ansible.builtin.copy:
+        dest: /etc/resolv.conf
+        follow: false     # replace a dangling symlink rather than write through it
+        mode: "0644"
+        content: |
+          # Managed by Ansible (vpnhub). Public resolvers on purpose: the
+          # host must resolve registries/repos even when the stack is down.
+          {% for ns in vpnhub_host_dns %}
+          nameserver {{ ns }}
+          {% endfor %}
+
     - name: Firewall rules (rendered from host/rules.v4/v6.template)
       tags: [host, firewall]
       ansible.builtin.copy:

ansible/templates/env.j2

@@ -18,6 +18,8 @@ RADIUS_SECRET={{ radius_secret }}
 
 TECHNITIUM_ADMIN_PASSWORD={{ technitium_admin_password }}
 
+VPN_DNS_ZONE={{ vpn_dns_zone | default('roam.atlashorizon.net') }}
+
 DUO_AUTHPROXY_VERSION={{ duo_authproxy_version | default('latest') }}
 
 # /opt layout — consumed by compose ${*_DIR} interpolation