Fix networkd templating integration and access permissions

roles/server/tasks/networkd.yaml

@@ -1,20 +1,21 @@
 ---
-- name: Install systemd-networkd on Rocky
+- name: Configure network settings
   become: true
+  block:
+    - name: Install systemd-networkd on Rocky
       ansible.builtin.dnf:
         name: systemd-networkd
         state: present
 
-- name: Ensure network config directory exists
+    - name: Ensure network config directory exists
       ansible.builtin.file:
         path: /etc/systemd/network
         state: directory
         owner: root
         group: root
-    mode: 0644
+        mode: 0755
 
-- name: Create network files
+    - name: Create network files
-  become: true
       ansible.builtin.template:
         src: network.j2
         dest: /etc/systemd/network/{{ item.key }}.network
@@ -22,10 +23,11 @@
         owner: root
         group: "{{ ansible_user }}"
       loop: "{{ skylab_networking.interfaces | dict2items }}"
+      loop_control:
+        label: "{{ item.key }}"
 
-- name: Create netdev files
+    - name: Create netdev files
-  become: true
+      when: item.value.type is defined
-  when: item.kind is defined
       ansible.builtin.template:
         src: netdev.j2
         dest: /etc/systemd/network/{{ item.key }}.netdev
@@ -33,31 +35,31 @@
         owner: root
         group: "{{ ansible_user }}"
       loop: "{{ skylab_networking.interfaces | dict2items }}"
+      loop_control:
+        label: "{{ item.key }}"
 
-- name: Fetch existing network config directory contents
+    - name: Fetch existing network config directory contents
-  become: true
       changed_when: false
       ansible.builtin.command:
         cmd: /usr/bin/ls /etc/systemd/network
       register: _network_config_dir_raw
 
-- name: Remove legacy network config files
+    - name: Remove legacy network config files
-  become: true
       when: item.strip().replace('.netdev', '').replace('.network', '') not in skylab_networking.interfaces
       ansible.builtin.file:
         path: /etc/systemd/network/{{ item }}
         state: absent
-  loop: "{{ _network_config_dir_raw.stdout.split(' ') }}"
+      loop: "{{ _network_config_dir_raw.stdout_lines }}"
+      loop_control:
+        label: "{{ item.strip() }}"
 
-- name: Configure fallback DNS
+    - name: Configure fallback DNS
-  become: true
       ansible.builtin.lineinfile:
         path: /etc/systemd/resolved.conf
         create: false
         line: FallbackDNS=
 
-- name: Enable systemd-networkd
+    - name: Enable systemd-networkd
-  become: true
       ansible.builtin.systemd:
         name: "{{ item }}"
         enabled: true
@@ -66,8 +68,7 @@
         - systemd-networkd-wait-online
         - systemd-resolved
 
-- name: Disable NetworkManager
+    - name: Disable NetworkManager
-  become: true
       ansible.builtin.systemd:
         name: "{{ item }}"
         enabled: false
@@ -75,14 +76,12 @@
         - NetworkManager
         - NetworkManager-wait-online
 
-- name: Start systemd-resolved to enable symlink creation
+    - name: Start systemd-resolved to enable symlink creation
-  become: true
       ansible.builtin.systemd:
         name: systemd-resolved
         state: started
 
-- name: Link system resolv.conf to systemd-resolved
+    - name: Link system resolv.conf to systemd-resolved
-  become: true
       ansible.builtin.file:
         dest: /etc/resolv.conf
         src: /run/systemd/resolve/resolv.conf
@@ -90,8 +89,7 @@
         force: true
         setype: net_conf_t
 
-- name: Link systemd-resolved to multi-user target
+    - name: Link systemd-resolved to multi-user target
-  become: true
       ansible.builtin.file:
         dest: /etc/systemd/system/multi-user.target.wants/systemd-resolved.service
         src: /usr/lib/systemd/system/systemd-resolved.service

roles/server/templates/network.j2

@@ -14,17 +14,15 @@ DNS={{ server }}
 {% if item.value.bond is defined %}
 Bond={{ item.value.bond }}
 {% endif %}
-
 {% if item.value.dhcp | default(false) %}
+
 Gateway={{ item.value.gateway | ansible.netcommon.ipaddr('address') }}
 {% for address in item.value.addresses %}
 Address={{ address | ansible.netcommon.ipaddr('host/prefix') }}
 {% endfor %}
 {% endif %}
-
-
 {% for interface in skylab_networking.interfaces.keys() %}
-{% if interface.startswith(item.key) and interface.partition('.')[2] | number %}
+{% if interface.startswith(item.key) and interface.partition('.')[2] | regex_search('^[0-9]{1,4}$') and interface != item.key %}
 VLAN={{ interface }}
 {% endif %}
 {% endfor %}