Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/roles/openvpn_gateway/defaults/main.yml

@@ -7,6 +7,9 @@ openvpn_config_dir: /etc/openvpn/homelab
 openvpn_config_path: /etc/openvpn/homelab/homelab.conf
 openvpn_static_key_path: /etc/openvpn/homelab/static.key
 openvpn_service_name: homelab-openvpn
+openvpn_public_interface: "{{ ansible_facts['default_ipv4']['interface'] }}"
+openvpn_lan_interface: eth0
+openvpn_forwarded_services: []
 openvpn_home_routes:
   - network: 192.168.1.5
     netmask: 255.255.255.255

ansible/roles/openvpn_gateway/tasks/main.yml

@@ -41,13 +41,13 @@
   no_log: true
   notify: restart openvpn
 
-- name: Enable IPv4 forwarding on gateway
+- name: Enable IPv4 forwarding for routed traffic
   ansible.posix.sysctl:
     name: net.ipv4.ip_forward
     value: "1"
     state: present
     reload: true
-  when: openvpn_role == 'gateway'
+  when: openvpn_role == 'gateway' or openvpn_forwarded_services | length > 0
 
 - name: Allow OpenVPN TCP in UFW on server
   ansible.builtin.command: "ufw allow {{ openvpn_listen_port }}/tcp"
@@ -65,7 +65,7 @@
     mode: "0600"
   notify: restart openvpn
 
-- name: Render OpenVPN gateway up script
+- name: Render OpenVPN up script
   ansible.builtin.template:
     src: up.sh.j2
     dest: "{{ openvpn_config_dir }}/up.sh"
@@ -73,9 +73,9 @@
     group: root
     mode: "0700"
   notify: restart openvpn
-  when: openvpn_role == 'gateway'
+  when: openvpn_role == 'gateway' or openvpn_forwarded_services | length > 0
 
-- name: Render OpenVPN gateway down script
+- name: Render OpenVPN down script
   ansible.builtin.template:
     src: down.sh.j2
     dest: "{{ openvpn_config_dir }}/down.sh"
@@ -83,7 +83,7 @@
     group: root
     mode: "0700"
   notify: restart openvpn
-  when: openvpn_role == 'gateway'
+  when: openvpn_role == 'gateway' or openvpn_forwarded_services | length > 0
 
 - name: Render OpenVPN systemd service
   ansible.builtin.template:

ansible/roles/openvpn_gateway/templates/down.sh.j2

@@ -1,2 +1,15 @@
 #!/bin/sh
-iptables -t nat -D POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE 2>/dev/null || true
+{% if openvpn_role == 'gateway' %}
+iptables -t nat -D POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ openvpn_lan_interface }} -j MASQUERADE 2>/dev/null || true
+{% for service in openvpn_forwarded_services %}
+iptables -D FORWARD -i {{ openvpn_interface }} -o {{ openvpn_lan_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT 2>/dev/null || true
+iptables -D FORWARD -i {{ openvpn_lan_interface }} -o {{ openvpn_interface }} -p {{ service.protocol }} -s {{ service.target_host }} --sport {{ service.target_port }} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
+{% endfor %}
+{% else %}
+{% for service in openvpn_forwarded_services %}
+iptables -t nat -D PREROUTING -i {{ openvpn_public_interface }} -p {{ service.protocol }} --dport {{ service.public_port }} -j DNAT --to-destination {{ service.target_host }}:{{ service.target_port }} 2>/dev/null || true
+iptables -t nat -D POSTROUTING -o {{ openvpn_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -j SNAT --to-source {{ openvpn_local_ip }} 2>/dev/null || true
+iptables -D FORWARD -i {{ openvpn_public_interface }} -o {{ openvpn_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT 2>/dev/null || true
+iptables -D FORWARD -i {{ openvpn_interface }} -o {{ openvpn_public_interface }} -p {{ service.protocol }} -s {{ service.target_host }} --sport {{ service.target_port }} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
+{% endfor %}
+{% endif %}

ansible/roles/openvpn_gateway/templates/homelab.conf.j2

@@ -13,6 +13,14 @@ port {{ openvpn_listen_port }}
 {% for route in openvpn_home_routes %}
 route {{ route.network }} {{ route.netmask }}
 {% endfor %}
+{% for service in openvpn_forwarded_services %}
+route {{ service.target_host }} 255.255.255.255
+{% endfor %}
+{% if openvpn_forwarded_services | length > 0 %}
+script-security 2
+up /etc/openvpn/homelab/up.sh
+down /etc/openvpn/homelab/down.sh
+{% endif %}
 {% endif %}
 {% if openvpn_role == 'gateway' %}
 proto {{ openvpn_proto_client }}

ansible/roles/openvpn_gateway/templates/up.sh.j2

@@ -1,3 +1,23 @@
 #!/bin/sh
-iptables -t nat -C POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE 2>/dev/null || \
-  iptables -t nat -A POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE
+sysctl -w net.ipv4.ip_forward=1 >/dev/null
+{% if openvpn_role == 'gateway' %}
+iptables -t nat -C POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ openvpn_lan_interface }} -j MASQUERADE 2>/dev/null || \
+  iptables -t nat -A POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ openvpn_lan_interface }} -j MASQUERADE
+{% for service in openvpn_forwarded_services %}
+iptables -C FORWARD -i {{ openvpn_interface }} -o {{ openvpn_lan_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT 2>/dev/null || \
+  iptables -I FORWARD 1 -i {{ openvpn_interface }} -o {{ openvpn_lan_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
+iptables -C FORWARD -i {{ openvpn_lan_interface }} -o {{ openvpn_interface }} -p {{ service.protocol }} -s {{ service.target_host }} --sport {{ service.target_port }} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || \
+  iptables -I FORWARD 1 -i {{ openvpn_lan_interface }} -o {{ openvpn_interface }} -p {{ service.protocol }} -s {{ service.target_host }} --sport {{ service.target_port }} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+{% endfor %}
+{% else %}
+{% for service in openvpn_forwarded_services %}
+iptables -t nat -C PREROUTING -i {{ openvpn_public_interface }} -p {{ service.protocol }} --dport {{ service.public_port }} -j DNAT --to-destination {{ service.target_host }}:{{ service.target_port }} 2>/dev/null || \
+  iptables -t nat -A PREROUTING -i {{ openvpn_public_interface }} -p {{ service.protocol }} --dport {{ service.public_port }} -j DNAT --to-destination {{ service.target_host }}:{{ service.target_port }}
+iptables -t nat -C POSTROUTING -o {{ openvpn_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -j SNAT --to-source {{ openvpn_local_ip }} 2>/dev/null || \
+  iptables -t nat -A POSTROUTING -o {{ openvpn_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -j SNAT --to-source {{ openvpn_local_ip }}
+iptables -C FORWARD -i {{ openvpn_public_interface }} -o {{ openvpn_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT 2>/dev/null || \
+  iptables -I FORWARD 1 -i {{ openvpn_public_interface }} -o {{ openvpn_interface }} -p {{ service.protocol }} -d {{ service.target_host }} --dport {{ service.target_port }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
+iptables -C FORWARD -i {{ openvpn_interface }} -o {{ openvpn_public_interface }} -p {{ service.protocol }} -s {{ service.target_host }} --sport {{ service.target_port }} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || \
+  iptables -I FORWARD 1 -i {{ openvpn_interface }} -o {{ openvpn_public_interface }} -p {{ service.protocol }} -s {{ service.target_host }} --sport {{ service.target_port }} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+{% endfor %}
+{% endif %}