initial ipv6 deployment

roles/arrstack/templates/custom-init/setup-wg.sh.j2

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
-
+set -x
-apk add --no-cache wireguard-tools-wg
 
 local_gateway=$(ip route | grep default | awk '{print $3}')
 # This used as the gateway address for NAT-PMP to work properly
@@ -19,5 +18,9 @@ ip route add default via "$wg_gateway"
 # Note that the DNS isn't changed, so there's actually a leak there
 # That's on purpose, just in case I want to access local jackett from qbit
 
+# Still need to figure out how to make this work with IPv6
+# Prevent IPv6 leaks
+# ip -6 route del default
+
 # Finally, optionally allow access to the home network
 # ip route add "\{\{ home_network }}" via "$local_gateway"

roles/arrstack/templates/docker-compose.yml.j2

@@ -1,9 +1,11 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"
 
 networks:
-  default:
+{#  {{ helpers.default_network(249) | indent(2) }}#}
+  # TODO: Figure out IPv6 leaks
+  ipv4_only:
   traefik_traefik:
     external: true
 
@@ -14,10 +16,13 @@ services:
     cap_add:
       - NET_ADMIN
     labels:
-      - {{ traefik_labels("qbit", port="8080", auth=true) | indent(6) }}
+      - {{ helpers.traefik_labels('qbit', port='8080', auth=true) | indent(6) }}
     restart: unless-stopped
+    environment:
+      - DOCKER_MODS=linuxserver/mods:universal-package-install
+      - INSTALL_PACKAGES=wireguard-tools-wg
     networks:
-      - default
+      - ipv4_only
       - traefik_traefik
     volumes:
       - ./wireguard:/etc/wireguard:ro
@@ -31,12 +36,12 @@ services:
     image: linuxserver/prowlarr:latest
     container_name: prowlarr
     labels:
-      - {{ traefik_labels("prowlarr", port="9696", auth=true) | indent(6) }}
+      - {{ helpers.traefik_labels('prowlarr', port='9696', auth=true) | indent(6) }}
     restart: unless-stopped
     depends_on:
       - qbittorrent
     networks:
-      - default
+      - ipv4_only
       - traefik_traefik
     volumes:
       - {{ base_volume_path }}/arrstack/config/prowlarr:/config
@@ -45,12 +50,12 @@ services:
     image: linuxserver/sonarr:latest
     container_name: sonarr
     labels:
-      - {{ traefik_labels("sonarr", port="8989", auth=true) | indent(6) }}
+      - {{ helpers.traefik_labels('sonarr', port='8989', auth=true) | indent(6) }}
     restart: unless-stopped
     depends_on:
       - qbittorrent
     networks:
-      - default
+      - ipv4_only
       - traefik_traefik
     volumes:
       - {{ base_volume_path }}/arrstack/config/sonarr:/config
@@ -61,12 +66,12 @@ services:
     image: linuxserver/radarr:latest
     container_name: radarr
     labels:
-      - {{ traefik_labels("radarr", port="7878", auth=true) | indent(6) }}
+      - {{ helpers.traefik_labels('radarr', port='7878', auth=true) | indent(6) }}
     restart: unless-stopped
     depends_on:
       - qbittorrent
     networks:
-      - default
+      - ipv4_only
       - traefik_traefik
     volumes:
       - {{ base_volume_path }}/arrstack/config/radarr:/config

roles/arrstack/templates/wireguard/wg0.conf.j2

@@ -7,5 +7,5 @@ PrivateKey = {{ wg_privkey }}
 
 [Peer]
 PublicKey = {{ wg_peer_pubkey }}
-AllowedIPs = 0.0.0.0/0
+AllowedIPs = 0.0.0.0/0,::0/0
 Endpoint = {{ wg_peer_endpoint }}

roles/authentik/templates/docker-compose.yml.j2

@@ -1,9 +1,9 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"
 
 networks:
-  default:
+  {{ helpers.default_network(253) | indent(2) }}
   traefik_traefik:
     external: true
 
@@ -12,11 +12,14 @@ services:
     image: ghcr.io/goauthentik/server:${AUTHENTIK_VERSION}
     container_name: authentik_server
     labels:
-      - {{ traefik_labels("auth", port="9000") | indent(6) }}
+      - {{ helpers.traefik_labels('auth', port='9000') | indent(6) }}
-      - traefik.http.middlewares.authentik.forwardauth.address=http://authentik_server:9000/outpost.goauthentik.io/auth/traefik
+      - traefik.http.middlewares.authentik.forwardauth.address=http://localhost:9000/outpost.goauthentik.io/auth/traefik
       - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
       - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
     restart: unless-stopped
+    # Port forward is needed because traefik can't resolve the container name from the host network
+    ports:
+      - "9000:9000"
     command: server
     env_file:
       - .env.authentik
@@ -61,3 +64,5 @@ services:
       interval: 30s
       retries: 5
       timeout: 3s
+    volumes:
+      - {{ base_volume_path }}/authentik/redis:/data

roles/common/tasks/main.yml

@@ -4,7 +4,7 @@
     name:
      - docker-ce
      - docker-compose-plugin
-     - ufw
+     - firewalld
     state: latest
 
 - name: Upgrade Debian packages
@@ -19,23 +19,41 @@
 
 - name: Allow SSH
   become: yes
-  ufw:
+  firewalld:
-    rule: allow
+    service: ssh
-    name: OpenSSH
+    permanent: yes
+    state: enabled
+    immediate: yes
 
 - name: Allow Web
   become: yes
-  ufw:
+  firewalld:
-    rule: allow
+    service: http
-    name: WWW Full
+    permanent: yes
+    state: disabled
+    immediate: yes
+
+- name: Allow Web Secure
+  become: yes
+  firewalld:
+    service: https
+    permanent: yes
+    state: enabled
+    immediate: yes
+
+- name: Allow 443 udp for http3
+  become: yes
+  firewalld:
+    port: 443/udp
+    permanent: yes
+    state: enabled
+    immediate: yes
 
 - name: Enable Firewall
   become: yes
-  ufw:
+  firewalld:
     state: enabled
-    policy: reject
+    immediate: yes
-    direction: incoming
-    logging: on
 
 - name: Reboot if needed
   become: yes

roles/docker_host/tasks/main.yml

@@ -25,9 +25,19 @@
     mode: "0644"
   register: docker_daemon_config
 
+- name: Remove docker0 from firewalld trusted zone
+  become: yes
+  firewalld:
+    zone: trusted
+    interface: docker0
+    permanent: yes
+    immediate: yes
+    state: disabled
+  register: docker0_firewalld
+
 - name: Restart Docker daemon
   become: yes
   service:
     name: docker
     state: restarted
-  when: docker_daemon_config.changed
+  when: docker_daemon_config.changed or docker0_firewalld.changed

roles/gitea/templates/docker-compose.yml.j2

@@ -1,9 +1,9 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"
 
 networks:
-  default:
+  {{ helpers.default_network(252) | indent(2) }}
   traefik_traefik:
     external: true
 
@@ -12,7 +12,7 @@ services:
     image: gitea/gitea:1.18
     container_name: gitea_server
     labels:
-      - {{ traefik_labels("gitea", port="3000") | indent(6) }}
+      - {{ helpers.traefik_labels('gitea', port='3000') | indent(6) }}
     restart: unless-stopped
     env_file:
       - .env.gitea

roles/jellyfin/templates/docker-compose.yml.j2

@@ -1,9 +1,9 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"
 
 networks:
-  default:
+  {{ helpers.default_network(250) | indent(2) }}
   traefik_traefik:
     external: true
 
@@ -12,7 +12,7 @@ services:
     image: jellyfin/jellyfin:10.8.6
     container_name: jellyfin_jellyfin
     labels:
-      - {{ traefik_labels("jellyfin", port="8096") | indent(6) }}
+      - {{ helpers.traefik_labels('jellyfin', port='8096') | indent(6) }}
     restart: unless-stopped
     env_file:
       - .env.jellyfin

roles/nextcloud/templates/docker-compose.yml.j2

@@ -1,9 +1,9 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"
 
 networks:
-  default:
+  {{ helpers.default_network(251) | indent(2) }}
   traefik_traefik:
     external: true
 
@@ -83,7 +83,7 @@ services:
     image: nginx:1.23-alpine
     container_name: nextcloud_web
     labels:
-      - {{ traefik_labels("nc") | indent(6) }}
+      - {{ helpers.traefik_labels('nc') | indent(6) }}
     restart: unless-stopped
     links:
       - app

roles/traefik/templates/traefik.yml.j2

@@ -8,12 +8,16 @@ accessLog:
   filePath: /logs/access.log
   bufferingSize: 100
 
+experimental:
+  http3: true
+
 entryPoints:
   web:
     address: ":80"
-
   websecure:
     address: ":443"
+    http3:
+      advertisedPort: 443
 
 certificatesResolvers:
   letsencrypt:

services.yml

@@ -3,9 +3,9 @@
     - docker_host
     - traefik
     - authentik
+    - gitea
     - nextcloud
     - jellyfin
-    - gitea
     - arrstack
   post_tasks:
     - name: Docker prune objects