Merge pull request #58 from svc-design/vpn-overlay

Vpn overlay

.github/workflows/app-pipeline-renew-node-ssl-certs.yml

@@ -2,7 +2,6 @@ name: Renew node ssl cert
 
 on:
   pull_request:
-  push:
     paths:
       - '.github/workflows/app-pipeline-renew-node-ssl-certs.yml'
   workflow_dispatch:

ansible/playbooks/roles/vhosts/common/tasks/main.yml

@@ -13,8 +13,8 @@
 - name: Run secure_ssh.sh script
   script: files/secure_ssh.sh
 
-- name: Disable systemd-resolved and set static DNS
-  include_tasks: disable-systemd-resolved.yml
+- name: Set systemd-resolved and set static DNS
+  include_tasks: setup-systemd-resolved.yml
 
 - name: Install packages
   script: files/install-packages.sh

ansible/playbooks/roles/vhosts/common/tasks/setup-systemd-resolved.yml

@@ -0,0 +1,36 @@
+# playbooks/setup-systemd-resolved.yml
+- name: Ensure systemd-resolved is installed
+  package:
+    name: systemd-resolved
+    state: present
+
+- name: Enable and start systemd-resolved
+  systemd:
+    name: systemd-resolved
+    enabled: yes
+    state: started
+
+- name: Configure /etc/systemd/resolved.conf
+  ini_file:
+    path: /etc/systemd/resolved.conf
+    section: "Resolve"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    mode: '0644'
+  loop:
+    - { option: "DNSStubListener", value: "no" }
+    - { option: "DNS", value: "" }
+    - { option: "FallbackDNS", value: "" }
+
+- name: Restart systemd-resolved
+  systemd:
+    name: systemd-resolved
+    state: restarted
+    daemon_reload: yes
+
+- name: Ensure /etc/resolv.conf points to /run/systemd/resolve/resolv.conf
+  file:
+    src: /run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true