# extravars: target_ip, ports
#
# Превращает сервер в прозрачный прокси: tcp-порты ports уходят на те же порты target_ip.
- name: Redirect traffic to target
  hosts: target
  gather_facts: false
  tasks:
    - ansible.builtin.import_tasks: tasks/firewall.yml
      vars:
        firewall_tcp_ports: [ "{{ ansible_port }}" ]
        firewall_forward: true

    # sysctl при загрузке применяется раньше nftables: без модулей ключи conntrack и bbr не выставятся
    - name: Load forwarding kernel modules on boot
      ansible.builtin.copy:
        dest: /etc/modules-load.d/serverus-forward.conf
        mode: "0644"
        content: |
          nf_conntrack
          tcp_bbr

    - name: Load forwarding kernel modules
      ansible.builtin.command: modprobe -a nf_conntrack tcp_bbr
      changed_when: false

    - name: Enable ip forwarding
      ansible.builtin.copy:
        dest: /etc/sysctl.d/90-serverus-forward.conf
        mode: "0644"
        content: |
          net.ipv4.ip_forward = 1
          net.core.default_qdisc = fq
          net.ipv4.tcp_congestion_control = bbr
          net.netfilter.nf_conntrack_max = 2000000
          net.core.netdev_max_backlog = 250000
          net.core.rmem_max = 16777216
          net.core.wmem_max = 16777216
          net.ipv4.tcp_rmem = 4096 87380 16777216
          net.ipv4.tcp_wmem = 4096 65536 16777216
          net.ipv4.tcp_mtu_probing = 1
          net.ipv4.tcp_slow_start_after_idle = 0

    - name: Apply sysctl
      ansible.builtin.command: sysctl --system
      changed_when: false

    - name: Install redirect script
      ansible.builtin.copy:
        src: files/redirect.sh
        dest: /usr/local/sbin/serverus-redirect
        mode: "0755"

    - name: Redirect traffic
      ansible.builtin.command:
        argv: [ /usr/local/sbin/serverus-redirect, "{{ target_ip }}", "{{ ports | join(',') }}" ]
      environment:
        SSH_PORT: "{{ ansible_port }}"