pi-isp/main.yml

---
- name: Set up a Pi ISP.
  hosts: all
  become: false
  gather_facts: true

  vars_files:
    - config.yml

  roles:
    - geerlingguy.security

  handlers:
    - name: restart mgetty
      ansible.builtin.service:
        name: mgetty
        state: restarted

    - name: restart macproxy
      ansible.builtin.service:
        name: macproxy
        state: restarted

  tasks:
    - name: Ensure dialup server software is installed.
      ansible.builtin.package:
        name:
          - ppp
          - mgetty
          - iptables-persistent
        state: present
      become: true

    - name: Deploy mgetty configuration.
      ansible.builtin.template:
        src: "{{ item.src }}"
        dest: "{{ item.dest }}"
        owner: root
        group: root
        mode: '0644'
      notify: restart mgetty
      loop:
        - src: mgetty.service.j2
          dest: /etc/systemd/system/mgetty.service
        - src: mgetty.config.j2
          dest: /etc/mgetty/mgetty.config
      register: mgetty_template
      become: true

    - name: Reload systemd daemon.
      ansible.builtin.systemd_service:
        daemon_reload: true
      when: mgetty_template is changed
      become: true

    - name: Ensure mgetty is running and enabled at boot.
      ansible.builtin.service:
        name: mgetty
        state: started
        enabled: true
      become: true

    - name: Template PPP configuration files
      ansible.builtin.template:
        src: "{{ item.src }}"
        dest: "{{ item.dest }}"
        owner: root
        group: root
        mode: '0600'
      loop:
        - src: ppp-options.j2
          dest: /etc/ppp/options
        - src: "ppp-options.usb-device.j2"
          dest: "/etc/ppp/options.{{ usb_modem_device }}"
      notify: restart mgetty
      become: true

    - name: Create the dial user.
      ansible.builtin.user:
        name: dial
        group: users
        groups: dialout,dip,users
        append: true
        home: /home/dial
        create_home: true
        shell: /usr/sbin/pppd
        password: "{{ dial_user_password }}"
        update_password: on_create
      become: true

    - name: Add dial user to pap-secrets.
      ansible.builtin.lineinfile:
        path: /etc/ppp/pap-secrets
        regexp: '^dial\s+'
        line: 'dial * "" *'
        owner: root
        group: root
        mode: '0600'
        create: true
      become: true

    - name: Enable IPv4 forwarding in sysctl.
      ansible.posix.sysctl:
        name: net.ipv4.ip_forward
        value: '1'
        sysctl_set: true
        state: present
        reload: true
      become: true

    - name: Configure NAT masquerade for the 192.168.32.0/24 subnet
      ansible.builtin.iptables:
        table: nat
        chain: POSTROUTING
        source: 192.168.32.0/24
        out_interface: eth0
        jump: MASQUERADE
      register: iptables_change
      become: true

    - name: Save iptables rules if they changed
      ansible.builtin.command: netfilter-persistent save
      when: iptables_change.changed
      become: true

    - name: Include Macproxy Classic setup tasks.
      ansible.builtin.import_tasks: tasks/macproxy_classic.yml