sshd setup

ansible/inventory/host_vars/hv00.balsillie.house/ansible_connection.yaml

@@ -1,16 +1,7 @@
-$ANSIBLE_VAULT;1.1;AES256
+ 
-30653030376238643536303332376530306565363333613230303263653935626332383862646539
+ansible_connection: ssh
-3739623265323837613333343363343461353837643637650a616637656563313265636366616134
+ansible_host: 192.168.1.250
-61636335613330393239656262663735316365613435303766643964353964666537353338646666
+ansible_fqdn: hv00.balsillie.house
-3536363034316632390a363234343466363937613631316130333566313037306636386130303137
+ansible_port: 22
-33366462303461393866633233643033356231343232313832636335336232383234626163623533
+ansible_become_method: sudo
-64656339346264306265353839373362373034306261316238346365373639326566313866363263
+static_fqdn: hv00.balsillie.house
-62613639313566373233303734666331633038383638316361353838313634383163626563333137
-62393835663963646431353431396238663062363031613735623937373835383630653165373634
-32356365363162333661323765333236363934636461366664666431333338326362656439366339
-62313265616666386164343336623032386536343134336232613164363236656236646332356335
-36643362613832656666376233363436313030626566356134306533643862333536336662653630
-32663936333434346530343639383330633538306536346432333136393765316366356362353735
-30636536333436346166616232643238373964306139313265623934616636663234336162306338
-34343934613136623837353436353462303036643837656636386533333266663265643538633333
-373133383866666465383332373336343739

ansible/inventory/host_vars/hv00.balsillie.house/credentials.yaml

@@ -0,0 +1,13 @@
+$ANSIBLE_VAULT;1.1;AES256
+65303065306531633065386131316639323033623166636331386435393231623763356336646337
+3430333966353561336334333332343130643065323663610a393664353431623037363731373837
+61653866666536383365393434613933393437343135346430643136396236313138613762316438
+3439303064366639380a316563666330306636613734666136633066656234363936623536383130
+65363364393937343231346133343435383336366464666661663432663663316337356637643165
+34303238653334663764633534393237643639636435633436353862663533346634396339343935
+34396363306461623564623566356139613564633136313965386337373138316365383732663139
+34396438636436376566323435316430376261323835303231663735373465326666666161616330
+33663132613733663337393636643736313863643566343366633032396134303462656162376432
+62666563376663323537396638306233346238306434643434366131656438303035666265613336
+37336135373061393036326633333137356531303038613061373638306435396135383365323265
+33623061633139626431

ansible/inventory/host_vars/hv00.balsillie.house/hypervisor.yaml

@@ -1,6 +1,5 @@
 hypervisor:
   storage: dir
-  device: /dev/sda
 
 qemu_bridges:
   - br0

ansible/inventory/host_vars/hv00.balsillie.house/sshd_setup.yaml

@@ -0,0 +1,16 @@
+sshd:
+  config_path: home
+  auth:
+    pubkey: 'yes'
+    password: 'no'
+    empty: 'no'
+  listen:
+    port: '22'
+    family: inet
+    ipv4:
+      - '192.168.1.250'
+      - '10.192.110.100'
+  forwarding:
+    agent: 'no'
+    x11: 'no'
+  nickname: vault

ansible/inventory/host_vars/hv00.balsillie.house/systemd_networkd.yaml

@@ -8,7 +8,7 @@ systemd_networkd_configs:
   - name: 00-eth2.link
     src: ethernet.link.j2
     mac_address: 64-62-66-21-e9-c5
-  - name: 00-eth3.link
+  - name: 00-wan.link
     src: ethernet.link.j2
     mac_address: 64-62-66-21-e9-c6
   - name: 01-eth0.network
@@ -47,10 +47,10 @@ systemd_networkd_configs:
         - 210
         - 220
         - 230
-  - name: 01-eth3.network
+  - name: 01-wan.network
     src: ethernet.network.j2
     mac_address: 64-62-66-21-e9-c6
-    arp: false
+    arp: true
     lldp: false
     dhcp: true
   - name: 10-br0.netdev
@@ -63,7 +63,7 @@ systemd_networkd_configs:
     dhcp: false
     lldp: true
     vlans:
-      - vlan110
+      - 110
   - name: 20-vlan110.netdev
     src: vlan.netdev.j2
     vlan_id: 110
@@ -74,7 +74,7 @@ systemd_networkd_configs:
     dhcp: false
     address:
       ipv4:
-        - 10.192.110.1/24
+        - 10.192.110.100/24
     gateway:
       ipv4: 10.192.110.254
     nameserver:

ansible/inventory/host_vars/localhost/vault.yaml

@@ -1,13 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-32663239363537353936346439323334373561303531343365356338626336626237386562376335
-3637303166393236323236623637613632313831373065620a646639336130613534666633643633
-33393032356261393764646166643465366164356236666464333439333039633934643732616666
-6537396433663666650a316266393334656534323135643939336662626563646461363131336437
-32383963366163323065376230633366383830626539396563323661643266643139316334616237
-35633264626637346635613262383236396530313335346139653239316433646338613339303638
-65326134306438333265636337376538313337356164663865653036343666353335663336376463
-61616465333461656461313464623635336533363132626534373230633139373064636634613136
-33633134313538326662323534386533363833326337383837393036653637663561323837373162
-32613733353637313862323837653663343134323761363339333032383239643633666632663563
-39366362663334316634346339663337386439386162636639393137306138303163333538616664
-64333366663134356435

ansible/playbooks/vp2420.yaml

@@ -4,22 +4,38 @@
 
 # Systemd networking
 
-- name: Setup systemd-networkd
+# - name: Setup systemd-networkd
-  hosts: hv00.balsillie.house
+#   hosts: hv00.balsillie.house
-  become: true
+#   become: true
-  roles:
+#   roles:
-    - name: systemd_networkd
+#     - name: systemd_networkd
-      vars:
+#       vars:
-        ansible_host: 192.168.1.106
+#         ansible_host: 192.168.1.106
 
 # Serial console
 
 # - name: Setup serial console
-#   hosts: hv00_balsillie_house
+#   hosts: hv00.balsillie.house
 #   become: true
 #   roles:
 #     - name: serial_console
 
 # Hypervisor setup
 
+# - name: Configure hypervisor
+#   hosts: hv00.balsillie.house
+#   gather_facts: true
+#   become: true
+#   roles:
+#     - name: hypervisor
+
+# SSHd setup
+
+- name: Configure sshd
+  hosts: hv00.balsillie.house
+  gather_facts: true
+  become: true
+  roles:
+    - name: sshd_setup
+
 # VM setup

ansible/roles/archinstall/tasks/main.yml

@@ -39,7 +39,7 @@
 
 # pacstrap
 # pacstrap -K /mnt/root base linux-lts linux-firmware nano openssh bind bash efibootmgr reflector screen pv pinentry sudo man-db man-pages texinfo ufw nftables intel-ucode e2fsprogs dosfstools curl cryptsetup
-# sbctl fwupd fwupd-efi dmidecode udisks2 
+# sbctl sbsigntools fwupd fwupd-efi dmidecode udisks2 usbutils inetutils
 
 # gen fstab
 # genfstab -L /mnt/root >> /mnt/root/etc/fstab
@@ -51,6 +51,11 @@
   # set hostname
   # echo hv00 > /etc/hostname
 
+  # TODO add entries to /etc/hosts
+  # 127.0.0.1 localhost
+  # ::1 localhost
+  # 127.0.1.1 static_fqdn
+
   # link timezone
   # ln -sf /usr/share/zoneinfo/Australia/Brisbane /etc/localtime
 
@@ -65,6 +70,8 @@
   # locale-gen
   # echo LANG=en_US.UTF-8 > /etc/locale.conf
 
+  
+
   # uncomment wheel group in /etc/sudoers
   # sed -i 's/# %wheel ALL=(ALL:ALL) ALL/%wheel ALL=(ALL:ALL) ALL/g' /etc/sudoers
 
@@ -79,8 +86,39 @@
   # echo 'cryptdevice=dbbb9fb2-5509-4701-a2bb-5660934a5378:root root=/dev/mapper/root rw' > /etc/kernel/cmdline
   # echo 'rd.luks.name=dbbb9fb2-5509-4701-a2bb-5660934a5378=root root=/dev/mapper/root rw' > /etc/kernel/cmdline
 
+  # create a default systemd-networkd config
+  # enable systemd-networkd
+  # enable sshd
+  # enable ufw service
+  # enable ufw firewall
+  # create ufw config to allow ssh port 22
 
   # modify mkinitcpio for encryption
   # old HOOKS=(base udev autodetect modconf kms keyboard keymap consolefont block filesystems fsck)
   # new HOOKS=(base systemd keyboard autodetect modconf kms block sd-encrypt filesystems fsck)
   # sed -i 's/^HOOKS=(base udev autodetect modconf block filesystems keyboard fsck)/HOOKS=(base udev autodetect modconf block encrypt filesystems keyboard fsck)/g' /etc/mkinitcpio.conf
+
+  # geneate sb keys with sbctl
+  # keys go to /usr/share/secureboot/keys/db/db.pem
+  # enroll sbctl keys
+
+  # add console= option to cmdline file
+
+  # create initcpio post hook /etc/initcpio/post/uki-sbsign
+  # make /etc/initcpio/post/uki-sbsign executable
+  # chmod +x /etc/initcpio/post/uki-sbsign
+  # make initcpio
+  # mkinitcpio -p linux-lts
+
+  # vfio and iommu
+  # add 'intel_iommu=on iommu=pt' to kernel cmdline
+
+  # add vfio binding
+  # vp2420 iGPU = 8086:4555
+  # add vfio-pci ids to /etc/kernel/cmdline
+  # vfio-pci.ids=8086:4555
+
+  # add vfio modules to mkinitcpio.conf
+  # MODULES=(vfio_pci vfio vfio_iommu_type1)
+  # ensure modconf hook is in mkinitcpio.conf
+  # HOOKS=(base systemd keyboard autodetect modconf kms block sd-encrypt filesystems fsck)

ansible/roles/hypervisor/defaults/main.yaml

@@ -1,16 +1,20 @@
 libvirt_packages:
-  arch:
+  Archlinux:
-    qemu-base
+    - qemu-base
-    openbsd-netcat
+    - openbsd-netcat
-    swtpm
+    - swtpm
-    gettext
+    - gettext
-    libvirt
+    - libvirt
-    libvirt-python
+    - libvirt-python
+    - python-lxml
 
 hypervisor:
   storage: dir
-  device: /dev/sda
+  device: /dev/sdb
-  datasets:
+
-    - name: tank/vhds
+# hypervisor:
-      compression: lz4
+#   storage: zfs
-      encryption: 'off'
+#   datasets:
+#     - name: tank/vhds
+#       compression: lz4
+#       encryption: 'off'      

ansible/roles/hypervisor/tasks/libvirt_dir.yaml

@@ -1,12 +1,5 @@
 ---
 
-- name: Format and mount the libvirt disk if it is not root
-  when:
-    - hypervisor.device not in (ansible_mounts | json_query('[?mount == `/`].device'))
-    - hypervisor.device not in (ansible_mounts | json_query('[?mount == `/var/lib/libvirt`].device'))
-  ansible.builtin.include_tasks:
-    file: libvirt_dir_mount.yaml
-
 - name: Create the libvirt storage directories
   ansible.builtin.file:
     path: "{{ item }}"

ansible/roles/hypervisor/tasks/libvirt_drive_mount.yaml

@@ -12,6 +12,8 @@
     part_start: 0%
     state: present
 
+# TODO disk encryption
+
 - name: Format filesystem
   community.general.filesystem:
     device: "{{ hypervisor.device }}1"
@@ -19,12 +21,24 @@
     resizefs: true
     state: present
 
-- name: Stop the libvirt service
+- name: Get list of services
+  ansible.builtin.service_facts:
+
+- name: Stop the libvirt services
+  when: item in ansible_facts.services
   ansible.builtin.service:
-    name: libvirtd
+    name: "{{ item }}"
     state: stopped
+  loop:
+    - libvirtd.service
+
+- name: Check if libvirt storage directory exists
+  ansible.builtin.stat:
+    path: /var/lib/libvirt/
+  register: libvirt_storage
 
 - name: Temp mount and copy block
+  when: libvirt_storage.stat.exists
   block:
 
     - name: Temporarily mount hypervisor storage
@@ -42,13 +56,6 @@
         remote_src: true
         mode: preserve
 
-  always:
-
-    - name: Unmount from temporary mount point
-      ansible.posix.mount:
-        path: /mnt/libvirt_temp/
-        state: absent
-
     - name: Remove existing libvirt storage
       ansible.builtin.file:
         path: /var/lib/libvirt/
@@ -60,6 +67,13 @@
         - absent
         - directory
 
+  always:
+
+    - name: Unmount from temporary mount point
+      ansible.posix.mount:
+        path: /mnt/libvirt_temp/
+        state: absent
+
 - name: Mount hypervisor storage
   ansible.posix.mount:
     path: /var/lib/libvirt/
@@ -69,6 +83,9 @@
     boot: true
 
 - name: Start the libvirt service
+  when: item in ansible_facts.services
   ansible.builtin.service:
-    name: libvirtd
+    name: "{{ item }}"
     state: started
+  loop:
+    - libvirtd.service

ansible/roles/hypervisor/tasks/main.yaml

@@ -1,18 +1,32 @@
 ---
 
-- name: Install libvirt packages (Arch)
+- name: Format and mount the libvirt disk if it is not root
-  when: ansible_os_distribution == 'Archlinux'
+  when:
+    - hypervisor.device is defined
+    - hypervisor.device not in (ansible_mounts | json_query('[?mount == `/var/lib/libvirt`].device'))
+  ansible.builtin.include_tasks:
+    file: libvirt_drive_mount.yaml
+
+- name: Install libvirt packages (Archlinux)
+  when: ansible_distribution == 'Archlinux'
   community.general.pacman:
-    name: "{{ libvirt_packages['Arch'] }}"
+    name: "{{ libvirt_packages['Archlinux'] }}"
     state: present
     update_cache: true
 
 - name: Add user to libvirt group
   ansible.builtin.user:
     name: "{{ ansible_user }}"
-    groups: libvirt
+    groups:
+      - libvirt
+      - libvirt-qemu
     append: true
 
+- name: Load br_netfilter kernel module so sysctl flags can be set
+  community.general.modprobe:
+    name: br_netfilter
+    state: present
+
 - name: Set required sysctl flags for bridging
   ansible.posix.sysctl:
     name: "{{ item.name }}"
@@ -20,7 +34,7 @@
     state: present
     sysctl_file: /etc/sysctl.d/bridge.conf
     sysctl_set: true
-    value: "{{ item.value }}}}"
+    value: "{{ item.value }}"
   loop:
     - name: net.ipv4.ip_forward
       value: 1
@@ -77,11 +91,11 @@
   community.libvirt.virt_pool:
     command: facts
 
-- name: Define the standard libvirt storage pools
+- name: Define the standard libvirt storage pools # TODO add when condition against existing pools
   community.libvirt.virt_pool:
     name: "{{ item.name }}"
     command: define
-    xml: "{{ lookup('template', 'dir_pool.xml.j2') }}"
+    xml: "{{ lookup('template', 'dir_libvirt_pool.xml.j2') }}"
   loop:
     - name: isos
       path: /var/lib/libvirt/isos/

ansible/roles/sshd/defaults/main.yml

@@ -1,6 +0,0 @@
----
-openssh_packages:
-  - openssh
-openssh_service: sshd.service
-openssh_configuration_file: /etc/ssh/sshd_config
-openssh_configuration_mode: 0644

ansible/roles/sshd/files/lab_authorized_keys

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHDSByUetRCOrrCRpyc0HMPVX8mKeJfXUcYH8+6NL2Md ladmin@lab.balsillie.net

ansible/roles/sshd/handlers/main.yml

@@ -1,6 +0,0 @@
----
-
-- name: restart openssh
-  ansible.builtin.service:
-    name: "{{ openssh_service }}"
-    state: restarted

ansible/roles/sshd/tasks/main.yml

@@ -1,39 +0,0 @@
----
-- name: install openssh arch
-  become: true
-  community.general.pacman:
-    name: "{{ openssh_packages }}"
-    state: latest
-    update_cache: true
-    reason: explicit
-  when:
-    - ansible_os_family == 'Arch'
-
-- name: add authorized keys
-  ansible.builtin.copy:
-    dest: "/home/{{ ansible_user }}/.ssh/authorized_keys"
-    src: "{{ authorized_keys_file }}"
-    mode: 0600
-    owner: "{{ ansible_user }}"
-    group: "{{ ansible_user }}"
-
-- name: configure openssh
-  become: true
-  ansible.builtin.copy:
-    dest: "{{ openssh_configuration_file }}"
-    src: "{{ openssh_configuration_src }}"
-    mode: "{{ openssh_configuration_mode }}"
-    owner: root
-    group: root
-  notify:
-    - restart openssh
-
-- name: start and enable openssh
-  become: true
-  ansible.builtin.service:
-    name: "{{ openssh_service }}"
-    state: started
-    enabled: yes
-
-- name: flush handlers
-  ansible.builtin.meta: flush_handlers

ansible/roles/sshd_setup/defaults/main.yaml

@@ -0,0 +1,16 @@
+sshd:
+  config_path: default
+  auth:
+    pubkey: 'yes'
+    password: 'no'
+    empty: 'no'
+  listen:
+    port: '22'
+    family: any # 'any', 'inet' or 'inet6'
+    ipv4:
+      - '0.0.0.0'
+    ipv6:
+      - '::'
+  forwarding:
+    agent: 'no'
+    x11: 'no'

ansible/roles/sshd_setup/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+
+- name: Restart sshd
+  ansible.builtin.service:
+    name: sshd.service
+    state: restarted

ansible/roles/sshd_setup/tasks/main.yaml

@@ -0,0 +1,76 @@
+---
+
+# - name: Debug ansible facts
+#   ansible.builtin.debug:
+#     msg: "{{ ansible_facts }}"
+
+# - name: Debug host vars
+#   ansible.builtin.debug:
+#     msg: "{{ hostvars[inventory_hostname]['ansible_fqdn'] }}"
+
+- name: Ensure ssh config dir exists
+  delegate_to: localhost
+  become: false
+  ansible.builtin.file:
+    path: "{{ lookup('env', 'HOME') }}/.ssh/conf.d/{{ sshd.config_path }}"
+    state: directory
+    owner: "{{ lookup('env', 'USER') }}"
+    group: "{{ lookup('env', 'USER') }}"
+    mode: '0700'
+
+- name: Generate local SSH key pair
+  delegate_to: localhost
+  become: false
+  community.crypto.openssh_keypair:
+    backend: opensshbin
+    comment: "{{ ansible_user }}@{{ static_fqdn }}"
+    mode: '0600'
+    passphrase: "{{ ssh_keygen_passphrase }}"
+    path: "{{ lookup('env', 'HOME') }}/.ssh/conf.d/{{ sshd.config_path }}/{{ static_fqdn }}"
+    regenerate: full_idempotence
+    size: 521
+    state: present
+    type: ecdsa
+  register: ssh_keygen
+
+- name: Copy SSH pubkey to target
+  ansible.posix.authorized_key:
+    key: "{{ ssh_keygen.public_key }}"
+    user: "{{ ansible_user }}"
+    state: present
+
+- name: Template out sshd_config
+  ansible.builtin.template:
+    src: sshd_config.j2
+    dest: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: '0644'
+  notify:
+    - Restart sshd
+
+- name: Flush handlers for immediate shhd restart
+  ansible.builtin.meta: flush_handlers
+
+- name: Add local ssh client config
+  delegate_to: localhost
+  become: false
+  community.general.ssh_config:
+    host: "{{ sshd.nickname | default(omit) }} {{ static_fqdn }}"
+    hostname: "{{ static_fqdn }}"
+    identity_file: "{{ ssh_keygen.filename }}"
+    port: "{{ sshd.listen.port | default('22') }}"
+    remote_user: "{{ ansible_user }}"
+    ssh_config_file: "{{ lookup('env', 'HOME') }}/.ssh/conf.d/{{ sshd.config_path }}/{{ static_fqdn }}.conf"
+    state: present
+
+- name: Include generated ssh config in default config file
+  delegate_to: localhost
+  become: false
+  ansible.builtin.lineinfile:
+    path: "{{ lookup('env', 'HOME') }}/.ssh/config"
+    line: "Include {{ lookup('env', 'HOME') }}/.ssh/conf.d/{{ sshd.config_path }}/{{ static_fqdn }}.conf"
+    mode: '0600'
+    state: present
+    create: true
+    insertafter: ^Include\s.*$

ansible/roles/sshd_setup/templates/sshd_config.j2

@@ -1,19 +1,23 @@
-#       $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
+Port {{ sshd.listen.port | default('22') }}
-
+AddressFamily {{ sshd.listen.family | default('any') }}
-# This is the sshd server system-wide configuration file.  See
+{% if (sshd.listen.family is defined and sshd.listen.family == 'inet') or (sshd.listen.family is defined and sshd.listen.family == 'any') -%}
-# sshd_config(5) for more information.
+{% if sshd.listen.ipv4 is defined -%}
-
+{% for address in sshd.listen.ipv4 -%}
-# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/bin
+ListenAddress {{ address }}
-
+{% endfor -%}
-# The strategy used for options in the default sshd_config shipped with
+{% else -%}
-# OpenSSH is to specify options with their default value where
+ListenAddress 0.0.0.0
-# possible, but leave them commented.  Uncommented options override the
+{% endif -%}
-# default value.
+{% endif -%}
-
+{% if (sshd.listen.family is defined and sshd.listen.family == 'inet6') or (sshd.listen.family is defined and sshd.listen.family == 'any') -%}
-#Port 22
+{% if sshd.listen.ipv6 is defined -%}
-#AddressFamily any
+{% for address in sshd.listen.ipv6 -%}
-#ListenAddress 0.0.0.0
+ListenAddress {{ address }}
-#ListenAddress ::
+{% endfor -%}
+{% else -%}
+ListenAddress ::
+{% endif -%}
+{% endif -%}
 
 #HostKey /etc/ssh/ssh_host_rsa_key
 #HostKey /etc/ssh/ssh_host_ecdsa_key
@@ -34,7 +38,7 @@
 #MaxAuthTries 6
 #MaxSessions 10
 
-PubkeyAuthentication yes
+PubkeyAuthentication {{ sshd.auth.pubkey | default('yes') }}
 
 # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
 # but this is overridden so installations will only check .ssh/authorized_keys
@@ -54,8 +58,8 @@ AuthorizedKeysFile      .ssh/authorized_keys
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-PasswordAuthentication no
+PasswordAuthentication {{ sshd.auth.password | default('yes') }}
-#PermitEmptyPasswords no
+PermitEmptyPasswords {{ sshd.auth.empty | default('no') }}
 
 # Change to no to disable s/key passwords
 KbdInteractiveAuthentication no
@@ -81,10 +85,10 @@ KbdInteractiveAuthentication no
 # and KbdInteractiveAuthentication to 'no'.
 UsePAM yes
 
-#AllowAgentForwarding yes
+AllowAgentForwarding {{ sshd.forwarding.agent | default('no') }}
 #AllowTcpForwarding yes
 #GatewayPorts no
-#X11Forwarding no
+X11Forwarding {{ sshd.forwarding.x11 | default('no') }}
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
@@ -103,7 +107,7 @@ PrintMotd no # pam does that
 #VersionAddendum none
 
 # no default banner path
-#Banner none
+# Banner Connected to {{ ansible_fqdn | default('host.') }}
 
 # override default of no subsystems
 Subsystem       sftp    /usr/lib/ssh/sftp-server

ansible/roles/systemd_networkd/tasks/main.yaml

@@ -14,7 +14,7 @@
 - name: Create systemd-networkd config files
   ansible.builtin.template:
     src: "{{ item.src }}"
-    dest: /etc/systemd/network/"{{ item.name }}"
+    dest: /etc/systemd/network/{{ item.name }}
     owner: root
     group: root
     mode: '0644'

ansible/roles/systemd_networkd/templates/bridge.network.j2

@@ -10,6 +10,11 @@ LinkLocalAddressing=False
 LLDP={{ item.lldp | default(true) }}
 {% if item.vlans is defined -%}
 {% for vlan in item.vlans -%}
+VLAN=vlan{{ vlan }}
+{% endfor -%}
+
+[BridgeVLAN]
+{% for vlan in item.vlans -%}
 VLAN={{ vlan }}
 {% endfor -%}
 {% endif -%}

ansible/roles/systemd_networkd/templates/ethernet.link.j2

@@ -3,6 +3,5 @@ PermanentMACAddress={{ item.mac_address }}
 
 [Link]
 Name={{ item.name | regex_replace('^[0-9]*-', '') |  regex_replace('\.link', '') }}
-MACAddressPolicy=permanent
+MACAddressPolicy=persistent
-MACAddress={{ item.mac_address }}
 

ansible/roles/systemd_networkd/templates/ethernet.network.j2

@@ -1,5 +1,5 @@
 [Match]
-MACAddress={{ item.mac_address }}
+Name={{ item.name | regex_replace('^[0-9]*-', '') |  regex_replace('\.network', '') }}
 
 [Link]
 ARP={{ item.arp | default(true) }}
@@ -62,7 +62,7 @@ Type=unicast
 {% endif -%}
 
 {% if item.bridge is defined and item.bridge.vlans is defined %}
-[BridgeVLANs]
+[BridgeVLAN]
 {% for vlan in item.bridge.vlans -%}
 VLAN={{ vlan }}
 {% endfor -%}