refactor: restructure inventory, split roles and add new services

roles/zerotier-one/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: reload nftables
+  ansible.builtin.command: nft -f /etc/nftables.conf
+
+- name: restart zerotier-one systemd service unit
+  ansible.builtin.systemd_service:
+    name: zerotier-one
+    daemon_reload: true
+    state: restarted
+    enabled: true

roles/zerotier-one/tasks/configure.yml

@@ -0,0 +1,31 @@
+---
+- name: create networks.d directory
+  ansible.builtin.file:
+    path: /var/lib/zerotier-one/networks.d
+    state: directory
+    mode: 0700
+    owner: zerotier-one
+    group: zerotier-one
+
+- name: check if zerotier-one network config exists
+  ansible.builtin.stat:
+    path: "/var/lib/zerotier-one/networks.d/{{ zerotier_network_id }}.conf"
+  register: zerotier_network_stat
+
+- name: create zerotier-one network config
+  ansible.builtin.file:
+    path: "/var/lib/zerotier-one/networks.d/{{ zerotier_network_id }}.conf"
+    state: touch
+    mode: "0600"
+    owner: zerotier-one
+    group: zerotier-one
+  when: not zerotier_network_stat.stat.exists
+  register: zerotier_network
+
+- name: restart zerotier-one systemd service unit
+  ansible.builtin.systemd_service:
+    name: zerotier-one
+    daemon_reload: true
+    state: restarted
+    enabled: true
+  when: zerotier_network.changed

roles/zerotier-one/tasks/install.yml

@@ -0,0 +1,16 @@
+---
+- name: add zerotier repository
+  ansible.builtin.deb822_repository:
+    name: zerotier
+    types: deb
+    uris: "http://download.zerotier.com/debian/trixie"
+    suites: "trixie"
+    components: main
+    signed_by: "https://download.zerotier.com/contact%40zerotier.com.gpg"
+    state: present
+
+- name: install zerotier-one
+  ansible.builtin.apt:
+    name: zerotier-one
+    state: latest
+    update_cache: true

roles/zerotier-one/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: include install
+  ansible.builtin.include_tasks: install.yml
+
+- name: include configure
+  ansible.builtin.include_tasks: configure.yml

roles/zerotier-one/templates/wg0.conf.j2

@@ -0,0 +1,17 @@
+[Interface]
+PrivateKey = {{ wg_private_key }}
+Address = {{ wg_address }}
+Table = off
+PostUp = ip route add 10.250.250.0/24 dev wg0 2>/dev/null || true
+PostUp = ip rule add fwmark 0xc7 lookup 199 2>/dev/null || true
+PostUp = ip route add default dev wg0 table 199 2>/dev/null || true
+PreDown = ip route del default dev wg0 table 199 2>/dev/null || true
+PreDown = ip rule del fwmark 0xc7 lookup 199 2>/dev/null || true
+PreDown = ip route del 10.250.250.0/24 dev wg0 2>/dev/null || true
+
+[Peer]
+PublicKey = {{ wg_public_key }}
+PresharedKey = {{ wg_presharedkey }}
+Endpoint = {{ wg_endpoint_address }}:{{ wg_endpoint_port }}
+PersistentKeepalive = 25
+AllowedIPs = 0.0.0.0/0