update..

README.bond

@@ -0,0 +1,43 @@
+# ----------------------------------
+# Example Configurations bond device
+# ----------------------------------
+
+In /etc/network/interfaces, the following stanza will configure bond0, in
+802.3ad mode (mode 4), with eth0 and eth1 as slaves.
+
+-----8<----------8<----------8<----------8<----------8<-----
+
+auto bond0
+iface bond0 inet dhcp
+ bond-slaves eth0 eth1
+ bond-mode 4
+ bond-miimon 100
+ bond-primary eth0 eth1
+
+-----8<----------8<----------8<----------8<----------8<-----
+
+If the above configuration doesn't work, you might have a system using
+upstart for system startup. This is most notably true for recent
+Ubuntu versions. The following stanza in /etc/network/interfaces will
+produce the same result on those systems.
+
+-----8<----------8<----------8<----------8<----------8<-----
+
+auto bond0
+iface bond0 inet dhcp
+ bond-slaves none
+ bond-mode 4
+ bond-miimon 100
+
+auto eth0
+iface eth0 inet manual
+ bond-master bond0
+ bond-primary eth0 eth1
+
+auto eth1
+iface eth1 inet manual
+ bond-master bond0
+ bond-primary eth0 eth1
+
+-----8<----------8<----------8<----------8<----------8<-----
+

group_vars/all/vars_network-setup.yml.sample

@@ -78,8 +78,8 @@ network_interfaces:
     #      - 91.239.100.100   # anycast.censurfridns.dk
     #    search: warenform.de
     #
-    nameservers: {}
+    nameservers: []
-    search: {}
+    search:
 
     # optional additional subnets/ips subnets: []
     # subnets: 
@@ -97,15 +97,15 @@ network_interfaces:
 
     #  optional bonding parameters bond: {}
     #  bond:
-    #    master
+    #    master:
-    #    primary
+    #    primary:
-    #    slave
+    #    slave:
     #    mode:
     #    miimon:
     #    lacp-rate:
-    #    ad-select-rate:
+    #    ad-select:
-    #    master:
+    #    downdelay:
-    #    slaves:
+    #    updelay:
     bond: {}
 
     # optional vlan settings | vlan: {}

host_vars/ga-al-gw.oopen.de.yml

@@ -44,7 +44,7 @@ network_interfaces:
     netmask: 24
     post-up:
       # - VLAN 221 (Ubiquiti UniFi Accesspoints)
-      - vconfig add eth2 221
+      - /sbin/ip link add link eth2 name eth2.221 type vlan id 221
 
   - device: eth2:ns
     headline: eth2:ns - Alias on eth2 (Nameserver)
@@ -297,16 +297,6 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
 
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFkl+5aVg4l40bxmf6k2dpopV8oAXyLhGGmKfzspW3GTfD29WjhuGS/mefrqr3tZRYrybPA5GDQ1QdwwRL16+6xfjAt/B62p3dMXnjsHalk74DTcQCZDlsj0UxTV1+gfOYzcB/CAqRd2wtB+vqGWRP+oGP3E7AIgoBlE44MaEDDuMP0Vvm8hNQ5N+/3zcrE626yDHAa4qmOd5d+J/HWrHLeJ4915g9VcCYCNGCgepb//4RdCpzEqUJiBGwihb/iJk3RoHcAv3L+tht8vmBF7Wz0iJ9BtLRTsJGFCkET0i50E18mU3bfaa7ov/PY/+UcE8FZSWZcoZ6AtmoBy0Zg2mp6/F9serfe67qtILNAbWD+qNRC7GjW3c5UvF5GJM6WvG8OZRvwarovZOU8uw1NLL3unY8O1bdihXmCXatXz+MvHCOvmZekUolKMBu7mziH5wificprUY9YeGX1FHVh4/hsL04zZdu/Q8Rr/BxM8+mJCCPsrkEoNnZNJfxCSwynd3jjqkhBpzZkEW9EGDBG5qnx4f6QPtcf/sv7eoNjzhEUs5k9GstbgW0ZD6381Ws/EpIdRbZUl52wFXalE8N/Z9hU6vfBC1xk0DIardUkZk+6lTsS8orBZkmPDNhX5hT8nmwNszQI0WgHPs+xDAdFskMcB/j20G5NupZm+2QgNXoww== jonas@meurer.it'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCzd5rFYvV5/V2NZE4jxL09qZ4TTsgmhbfSHpsj9wX89+j7ZrfTAkAkAFxyrWs8FR3CQ11DGkrXW059a0ppRQ7R8bUW9CniXS/RaRAvqX9AMM9Xo/lmL4pXNM0sV4nHJWphi5Bc+zTIM2I4PSbHYw+5dDnj8ZIQ8ucBff+k29Zd90JRuKx72tk0pQNf7sQbWVKNCT/B4g4MJV84NvnO+ExCWvGM95Cy5NCTnQfO94/OSkN72R//tIR7Nd/aK7hEj69MoVJZrFy4qzE9KskLhKeUYCqoz86XOQ6Dfag/B2adTeG3r9DEacG3ao/ACZKQChj0X12LEV/PZUHLORqYpWIwMuIx54vhbxarSwlKhoOCv1XQJwo9BTavMhFNsMtZpAJYdvAakRCbf18bDrHyqYYqjAyYOp+L+G+wlSh3tz0qQL8aAnaV3RPN0fDd7Zu1dpMGAM2gMnBEMJ+k82V7EtACp1jf37LW11Lbv2o+dRUJEgsrU9TNGxaGSTWqGc65TuP9PUfDXq1ZNOPQWSK/KseqB0WUx6ePfZzkgkr7kGXT/d9hUSCq2+iprhfwQpYLcXE9XtCdo1aivIKQ8zCuR44q11HePyNtEMaJfq33p4uDTVOy7UOtuACzSbk6vs7h6h8CUGPwU9aw+PRiWY4Jdm0caJ8trFfH1R8XaIe3SaUEw== t@NB-003258-RLS'
-
   - name: back
     user_id: 1060
     group_id: 1060
@@ -319,7 +309,7 @@ default_user:
 sudo_users:
   - chris
   - sysadm
-  - localadmin
+  - wadmin
 
 
 # ---

host_vars/ga-al-kvm2.ga.netz.yml

@@ -32,6 +32,52 @@
 # vars used by roles/common/tasks/webadmin-user.yml
 # ---
 
+default_user:
+
+  - name: chris
+    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - wadmin
+
 
 # ---
 # vars used by roles/common/tasks/sshd.yml

host_vars/ga-al-kvm3.ga.netz.yml

@@ -32,6 +32,52 @@
 # vars used by roles/common/tasks/webadmin-user.yml
 # ---
 
+default_user:
+
+  - name: chris
+    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - wadmin
+
 
 # ---
 # vars used by roles/common/tasks/sshd.yml

host_vars/ga-nh-gw.oopen.de.yml

@@ -151,16 +151,6 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
 
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFkl+5aVg4l40bxmf6k2dpopV8oAXyLhGGmKfzspW3GTfD29WjhuGS/mefrqr3tZRYrybPA5GDQ1QdwwRL16+6xfjAt/B62p3dMXnjsHalk74DTcQCZDlsj0UxTV1+gfOYzcB/CAqRd2wtB+vqGWRP+oGP3E7AIgoBlE44MaEDDuMP0Vvm8hNQ5N+/3zcrE626yDHAa4qmOd5d+J/HWrHLeJ4915g9VcCYCNGCgepb//4RdCpzEqUJiBGwihb/iJk3RoHcAv3L+tht8vmBF7Wz0iJ9BtLRTsJGFCkET0i50E18mU3bfaa7ov/PY/+UcE8FZSWZcoZ6AtmoBy0Zg2mp6/F9serfe67qtILNAbWD+qNRC7GjW3c5UvF5GJM6WvG8OZRvwarovZOU8uw1NLL3unY8O1bdihXmCXatXz+MvHCOvmZekUolKMBu7mziH5wificprUY9YeGX1FHVh4/hsL04zZdu/Q8Rr/BxM8+mJCCPsrkEoNnZNJfxCSwynd3jjqkhBpzZkEW9EGDBG5qnx4f6QPtcf/sv7eoNjzhEUs5k9GstbgW0ZD6381Ws/EpIdRbZUl52wFXalE8N/Z9hU6vfBC1xk0DIardUkZk+6lTsS8orBZkmPDNhX5hT8nmwNszQI0WgHPs+xDAdFskMcB/j20G5NupZm+2QgNXoww== jonas@meurer.it'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCzd5rFYvV5/V2NZE4jxL09qZ4TTsgmhbfSHpsj9wX89+j7ZrfTAkAkAFxyrWs8FR3CQ11DGkrXW059a0ppRQ7R8bUW9CniXS/RaRAvqX9AMM9Xo/lmL4pXNM0sV4nHJWphi5Bc+zTIM2I4PSbHYw+5dDnj8ZIQ8ucBff+k29Zd90JRuKx72tk0pQNf7sQbWVKNCT/B4g4MJV84NvnO+ExCWvGM95Cy5NCTnQfO94/OSkN72R//tIR7Nd/aK7hEj69MoVJZrFy4qzE9KskLhKeUYCqoz86XOQ6Dfag/B2adTeG3r9DEacG3ao/ACZKQChj0X12LEV/PZUHLORqYpWIwMuIx54vhbxarSwlKhoOCv1XQJwo9BTavMhFNsMtZpAJYdvAakRCbf18bDrHyqYYqjAyYOp+L+G+wlSh3tz0qQL8aAnaV3RPN0fDd7Zu1dpMGAM2gMnBEMJ+k82V7EtACp1jf37LW11Lbv2o+dRUJEgsrU9TNGxaGSTWqGc65TuP9PUfDXq1ZNOPQWSK/KseqB0WUx6ePfZzkgkr7kGXT/d9hUSCq2+iprhfwQpYLcXE9XtCdo1aivIKQ8zCuR44q11HePyNtEMaJfq33p4uDTVOy7UOtuACzSbk6vs7h6h8CUGPwU9aw+PRiWY4Jdm0caJ8trFfH1R8XaIe3SaUEw== t@NB-003258-RLS'
-
   - name: back
     user_id: 1060
     group_id: 1060
@@ -173,7 +163,7 @@ default_user:
 sudo_users:
   - chris
   - sysadm
-  - localadmin
+  - wadmin
 
 
 # ---

host_vars/ga-st-gw-ersatz.ga.netz.yml

@@ -0,0 +1,173 @@
+---
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+  - resolvconf
+
+network_interfaces:
+
+  - device: eth6
+    headline: eth2 - LAN
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.19
+    netmask: 24
+    gateway: 192.168.11.254
+    nameserver:
+      - 192.168.11.1
+      - 192.168.10.3
+    search: ga.netz ga.intra
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_ssh_keypair_backup_server: false
+ssh_keypair_backup_server:
+  - name: backup
+    backup_user: back
+    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
+    priv_key_dest: /root/.ssh/id_rsa
+    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
+    pub_key_dest: /root/.ssh/id_rsa.pub
+
+insert_keypair_backup_client: true
+ssh_keypair_backup_client:
+  - name: backup
+    priv_key_src: root/.ssh/id_ed25519.oopen-server
+    priv_key_dest: /root/.ssh/id_ed25519
+    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
+    pub_key_dest: /root/.ssh/id_ed25519.pub
+    target: backup.oopen.de
+
+default_user:
+
+  - name: chris
+    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-gateway
+  repo: https://git.oopen.de/firewall/ipt-gateway
+  dest: /usr/local/src/ipt-gateway
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/ga-st-gw.oopen.de.yml

@@ -0,0 +1,408 @@
+---
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+  - resolvconf
+
+network_interfaces:
+
+  - device: eth2
+    headline: eth2 - Uplink static line (radio) to Altenschlirf
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.111.254
+    netmask: 24
+    up:
+      # - For management Antennas
+      - /sbin/ip link add link eth2 name eth2.111 type vlan id 111
+    post-up:
+      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
+      # -
+      # - Telefon Altenshlirf
+      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
+      # User Network Altenshlirf
+      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
+      # Management Network Altenschlirf
+      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
+      # WLan Router (Accesspoints) Altenshlirf
+      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
+      # # WLan Networks Altenshlirf
+      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
+      # DSL via Fritzbox Altenschlirf
+      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
+      # - WLAN Gemeinschaft Altenschlirf (Unifi routet Network)
+      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
+      # VPN home Network Altenschlirf
+      #
+      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
+      # private networks 'ckubu'
+      #
+      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
+      # so we route them back to that gateway..
+      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
+      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
+
+
+  - device: eth2.111
+    headline: eth2.111 - network 10.10.111.0 (management antennas)
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.111.254
+    netmask: 24
+
+
+  - device: eth8 
+    headline: eth8 - holds VLAN 211 device for Network Telefons Stockhausen
+    auto: false
+    family: inet
+    method: manual
+    up:
+      - /sbin/ip link add link eth8 name eth8.211 type vlan id 211
+
+
+  - device: eth8.211
+    headline: eth8.211 - Network Telefons Stockhausen
+    auto: true
+    family: inet
+    method: static
+    # Note:
+    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
+    #       This LANCom Router IS NOT pngable                                 !!
+    address: 172.16.211.1
+    netmask: 24
+    pre-up:
+      - /sbin/ifconfig eth8 up
+
+
+  - device: eth9
+    headline: eth9 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.11.1
+    netmask: 24
+    gateway: 172.16.11.254
+
+
+  - device: eth10
+    headline: eth10 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.13.1
+    netmask: 24
+    gateway: 172.16.13.254
+
+
+  - device: eth11
+    headline: eth11 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.12.1
+    netmask: 24
+    gateway: 172.16.12.254
+
+
+    # ----------
+    # Note: Install the 'ifenslave' package, necessary to enable bonding:
+    # 
+    #    apt-get install ifenslave
+    # ----------
+  - device: bond0
+    headline: bond0 - LAG (Link Aggregation) on devices eth0 and eth4
+    auto: true
+    family: inet
+    method: static
+    address: 10.1.9.254
+    netmask: 24
+    bond:
+      slaves: eth0 eth4
+      # Mode 4 (802.3ad)
+      #
+      #    also possible here:
+      #       - Mode 5: balance-tlb
+      #       - Mode 6: balance-alb
+      mode: 4
+      miimon: 100
+      lacp-rate: 1
+      ad-select: count
+      downdelay: 200
+      updelay: 200
+    post-up:
+      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
+      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
+      # VLAN 78 for network Georgshaus 192.168.78.0/24
+      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
+
+
+  - device: bond0.11
+    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.11.254
+    netmask: 24
+
+
+  - device: bond0.78
+    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.78.254
+    netmask: 24
+
+
+    # ----------
+    # Note: Install the 'ifenslave' package, necessary to enable bonding:
+    # 
+    #    apt-get install ifenslave
+    # ----------
+  - device: bond1
+    headline: bond1 - LAG (Link Aggregation) on devices eth1 and eth5 - Main Network Stockhausen
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.254
+    netmask: 24
+    nameservers:
+      - 192.168.11.1
+      - 192.168.10.3
+    search: ga.netz ga.intra
+    bond:
+      slaves: eth1 eth5
+      # Mode 4 (802.3ad)
+      #
+      #    also possible here:
+      #       - Mode 5: balance-tlb
+      #       - Mode 6: balance-alb
+      mode: 4
+      miimon: 100
+      lacp-rate: 1
+      ad-select: count
+      downdelay: 200
+      updelay: 200
+    post-up:
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints)
+      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
+      # Route ???
+      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
+
+
+  - device: bond1.121
+    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints
+    auto: true
+    family: inet
+    method: static
+    address: 10.121.15.254
+    netmask: 20
+
+
+  - device: bond1:ns
+    headline: bond1:ns - Alias IP on bond1 device for Nameservice
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.1
+    netmask: 32
+
+
+  - device: bond1:1
+    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.9.254
+    netmask: 24
+
+
+  - device: bond1:ap
+    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
+    auto: true
+    family: inet
+    method: static
+    address: 10.112.1.254
+    netmask: 24
+    post-up:
+      # - Wireless Networks routed through appropriate Accesspoints
+      # -
+      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
+      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
+      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
+      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
+      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
+      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
+      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
+      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
+      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
+      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
+      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
+      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
+      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
+      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
+      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
+
+
+  - device: bond1:ipmi
+    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
+    auto: true
+    family: inet
+    method: static
+    address: 10.11.11.254
+    netmask: 24
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_ssh_keypair_backup_server: false
+ssh_keypair_backup_server:
+  - name: backup
+    backup_user: back
+    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
+    priv_key_dest: /root/.ssh/id_rsa
+    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
+    pub_key_dest: /root/.ssh/id_rsa.pub
+
+insert_keypair_backup_client: true
+ssh_keypair_backup_client:
+  - name: backup
+    priv_key_src: root/.ssh/id_ed25519.oopen-server
+    priv_key_dest: /root/.ssh/id_ed25519
+    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
+    pub_key_dest: /root/.ssh/id_ed25519.pub
+    target: backup.oopen.de
+
+default_user:
+
+  - name: chris
+    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-gateway
+  repo: https://git.oopen.de/firewall/ipt-gateway
+  dest: /usr/local/src/ipt-gateway
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/ga-st-kvm1.ga.netz.yml

@@ -32,6 +32,52 @@
 # vars used by roles/common/tasks/webadmin-user.yml
 # ---
 
+default_user:
+
+  - name: chris
+    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - wadmin
+
 
 # ---
 # vars used by roles/common/tasks/sshd.yml

host_vars/ga-st-kvm5.ga.netz.yml

@@ -31,13 +31,14 @@ network_interfaces:
     pre-up:
       - ifconfig $IFACE up
       - vconfig add eno2 11
+      - /sbin/ip link add link eno2 name eno2.11 type vlan id 11
     post-down:
       - ifconfig $IFACE down
 
 
   - device: eno2.11
     # use only once per device (for the first device entry)
-    headline: eno2.11
+    headline: eno2.11 - Main ip Address LXC Host
 
     # auto & allow are only used for the first device entry
     allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -94,6 +95,52 @@ network_interfaces:
 # vars used by roles/common/tasks/users.yml
 # ---
 
+default_user:
+
+  - name: chris
+    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - wadmin
+
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/ga-st-lxc1.ga.netz.yml

@@ -31,13 +31,6 @@ network_interfaces:
 
     family: inet
     method: manual
-    hwaddress: ac:1f:6b:d1:20:f2
-    description: Bridge Interface IPv4 for LXC
-    #address:
-    #netmask:
-    #network:
-    #broadcast:
-    #gateway:
 
     # optional dns settings nameservers: []
     # nameservers:
@@ -63,20 +56,6 @@ network_interfaces:
       hello: 2
       maxage: 12
 
-    #  optional bonding parameters bond: {}
-    #  bond:
-    #    method:
-    #    miimon:
-    #    master:
-    #    slaves:
-    #    lacp-rate:
-    bond: {}
-
-    # optional vlan settings | vlan: {}
-    # vlan: {}
-    #   raw-device: 'eth0'
-    vlan: {}
-
     # inline hook scripts
     pre-up: [] # pre-up script lines
     up: [] # up script lines
@@ -88,58 +67,13 @@ network_interfaces:
   - device: eno2
     # use only once per device (for the first device entry)
     headline: eno2 - LAN Interface VLAN definition 
-
-    # auto & allow are only used for the first device entry
-    allow: [] # array of allow-[stanzas] eg. allow-hotplug
     auto: true
-
     family: inet
     method: manual
     description: LAN Interface only VLAN definition
-
-    # optional dns settings nameservers: []
-    # nameservers:
-    #  - "194.150.168.168"  # dns.as250.net
-    #  - "91.239.100.100"   # anycast.censurfridns.dk
-
-    # optional additional subnets/ips subnets: []
-    # subnets: 
-    #   - '192.168.123.0/24'
-    #   - '192.168.124.11/32'
-
-    # optional bridge parameters bridge: {}
-    # bridge:
-    #   ports:
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
-    bridge: {}
-
-    #  optional bonding parameters bond: {}
-    #  bond:
-    #    method:
-    #    miimon:
-    #    master:
-    #    slaves:
-    #    lacp-rate:
-    bond: {}
-
-    # optional vlan settings | vlan: {}
-    # vlan: {}
-    #   raw-device: 'eth0'
-    vlan: {}
-
-    # inline hook scripts
     pre-up: # pre-up script lines
-      - ip link set $IFACE up
+      - /sbin/ip link set $IFACE up
-      - ip link add link eno2 name eno2.11 type vlan id 11
+      - /sbin/ip link add link eno2 name eno2.11 type vlan id 11
-    up: [] # up script lines
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: # pre-down script lines (alias for down)
-      - ip link set $IFACE down
-    down: [] # down script lines
-    post-down: [] # post-down script lines
 
   - device: eno2.11
     # use only once per device (for the first device entry)
@@ -160,42 +94,139 @@ network_interfaces:
     # nameservers:
     #  - "194.150.168.168"  # dns.as250.net
     #  - "91.239.100.100"   # anycast.censurfridns.dk
+    nameservers:
+      - 192.168.11.1
+      - 192.168.10.3
+    search: ga.netz ga.intra
 
-    # optional additional subnets/ips subnets: []
-    # subnets: 
-    #   - '192.168.123.0/24'
-    #   - '192.168.124.11/32'
 
-    # optional bridge parameters bridge: {}
+# ---
-    # bridge:
+# vars used by roles/ansible_dependencies
-    #   ports:
+# ---
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
 
-    #  optional bonding parameters bond: {}
-    #  bond:
-    #    master
-    #    primary
-    #    slave
-    #    method:
-    #    miimon:
-    #    lacp-rate:
-    #    ad-select-rate:
-    #    master:
-    #    slaves:
-    bond: {}
 
-    # optional vlan settings | vlan: {}
+# ---
-    # vlan: {}
+# vars used by roles/ansible_user
-    #   raw-device: 'eth0'
+# ---
-    vlan: {}
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_ssh_keypair_backup_server: false
+ssh_keypair_backup_server:
+  - name: backup
+    backup_user: back
+    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
+    priv_key_dest: /root/.ssh/id_rsa
+    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
+    pub_key_dest: /root/.ssh/id_rsa.pub
+
+insert_keypair_backup_client: true
+ssh_keypair_backup_client:
+  - name: backup
+    priv_key_src: root/.ssh/id_ed25519.oopen-server
+    priv_key_dest: /root/.ssh/id_ed25519
+    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
+    pub_key_dest: /root/.ssh/id_ed25519.pub
+    target: backup.oopen.de
+
+default_user:
+
+  - name: chris
+    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user: {}
 
-    # inline hook scripts
-    pre-up: [] # pre-up script lines
-    up: [] # up script lines
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: [] # pre-down script lines (alias for down)
-    down: [] # down script lines
-    post-down: [] # post-down script lines

roles/network_interfaces/templates/etc/network/interfaces.d/device.j2

@@ -61,24 +61,6 @@ iface {{ config.device }} {{ config.family | default('inet', true) }} {{ config.
 {%     endfor -%}
 {%   endif %}
 
-{# #}
-{# nameservers #}
-{%-  if (config.nameservers is defined and config.nameservers) or (config.search is defined and config.search) %}
-   # dns-* options are implemented by the resolvconf package, if installed
-   # sets entries in /etc/resolv.conf
-   #
-{% endif -%}
-{%  if config.search is defined and config.search %}
-   dns-search {{ config.search }}
-{%   endif -%}
-{%-  if (config.nameservers is defined) and config.nameservers %}
-{%     for _ip in config.nameservers %}
-   dns-nameserver {{ _ip }}
-{%     endfor %}
-{%   endif %}
-{%-  if (config.nameservers is defined and config.nameservers) or (config.search is defined and config.search) %}
-
-{%   endif -%}
 {# #}
 {# subnets #}
 {%-  if (config.subnets is defined) and (0 < config.subnets | length) %}
@@ -98,25 +80,46 @@ iface {{ config.device }} {{ config.family | default('inet', true) }} {{ config.
 {%   endfor %}
 
 {% endif -%}
+
 {# #}
 {# bond parameters #}
 {%   set bond_keys = ['master', 'primary', 'slaves', 'mode', 'miimon', 'lacp-rate', 'ad-select', 'downdelay', 'updelay'] %}
-{%-  if (config.bond is defined) and (bond_keys | intersect(config.bond.keys())) -%}
+{%-  if (config.bond is defined) and (bond_keys | intersect(config.bond.keys())) %}
    # bond parameters
 {%     for key in bond_keys %}
-{%       if key in config.bond -%}
+{%       if key in config.bond %}
    bond-{{ key }} {{ config.bond[key] }}
 {%       endif %}
 {%     endfor %}
 
-{# #}
 {%   endif -%}
+
+{# #}
+{# nameservers #}
+{%-  if (config.nameservers is defined and config.nameservers) or (config.search is defined and config.search) %}
+   # dns-* options are implemented by the resolvconf package, if installed
+   # sets entries in /etc/resolv.conf
+   #
+{% endif -%}
+{%  if config.search is defined and config.search %}
+   dns-search {{ config.search }}
+{%   endif -%}
+{%-  if (config.nameservers is defined) and config.nameservers %}
+{%     for _ip in config.nameservers %}
+   dns-nameservers {{ _ip }}
+{%     endfor %}
+{%   endif %}
+{%-  if (config.nameservers is defined and config.nameservers) or (config.search is defined and config.search) %}
+
+{%   endif -%}
+
+{# #}
 {# vlan #}
 {%   set vlan_keys = ['raw-device'] %}
 {%-  if (config.vlan is defined) and (vlan_keys | intersect(config.vlan.keys())) -%}
    # vlan
 {%     for key in vlan_keys %}
-{%       if key in config.vlan -%}
+{%       if key in config.vlan %}
    vlan-{{ key }} {{ config.vlan[key] }}
 {%       endif %}