7 files changed, 118 insertions, 0 deletions

diff --git a/roles/gre_tunnel/defaults/main.yml b/roles/gre_tunnel/defaults/main.yml
new file mode 100644
index 0000000..2bb0e43
--- /dev/null
+++ b/roles/gre_tunnel/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+gre_tunnel_interfaces: []
diff --git a/roles/gre_tunnel/meta/argument_specs.yml b/roles/gre_tunnel/meta/argument_specs.yml
new file mode 100644
index 0000000..7916ceb
--- /dev/null
+++ b/roles/gre_tunnel/meta/argument_specs.yml
@@ -0,0 +1,37 @@
+---
+argument_specs:
+  main:
+    short_description: Tunnel interfaces (GRE and other encapsulations)
+    description:
+      - Creates C(interfaces tunnel) entries with their encapsulation,
+        endpoints, MTU and TCP MSS clamping, and addresses them.
+      - Building block used by "Site-to-Site IPSec VPN to Cisco using FlexVPN"
+        (GRE protected by IPsec); also usable for plain GRE.
+      - The tunnel itself is created with vyos.vyos.vyos_config in one commit,
+        because vyos_interfaces cannot set encapsulation or endpoints;
+        addresses use vyos_l3_interfaces.
+    options:
+      gre_tunnel_interfaces:
+        type: list
+        elements: dict
+        required: true
+        description: Tunnel interfaces.
+        options:
+          name: {type: str, required: true, description: "Interface name, e.g. C(tun1)."}
+          encapsulation: {type: str, default: gre, description: "Encapsulation, e.g. C(gre), C(gretap), C(ipip)."}
+          source_address: {type: str, description: Local endpoint address.}
+          source_interface: {type: str, description: Local endpoint interface (instead of C(source_address)).}
+          remote: {type: str, description: Remote endpoint address.}
+          mtu: {type: int, description: Interface MTU.}
+          adjust_mss: {type: str, description: "TCP MSS clamping value, e.g. C(1336) or C(clamp-mss-to-pmtu)."}
+          description: {type: str, description: Interface description.}
+          addresses: {type: list, elements: str, default: [], description: IPv4 addresses in CIDR notation.}
+      vyos_blueprints_render_only:
+        type: bool
+        default: false
+        description: Collect commands into C(vyos_blueprints_rendered) instead of configuring.
+  verify:
+    short_description: Post-deployment checks for the gre_tunnel role
+    description: Run with C(tasks_from=verify). Checks every tunnel interface is up.
+    options:
+      gre_tunnel_interfaces: {type: list, elements: dict, required: true, description: Same value as for C(main).}
diff --git a/roles/gre_tunnel/meta/main.yml b/roles/gre_tunnel/meta/main.yml
new file mode 100644
index 0000000..e4408b4
--- /dev/null
+++ b/roles/gre_tunnel/meta/main.yml
@@ -0,0 +1,11 @@
+---
+galaxy_info:
+  author: VyOS maintainers and contributors
+  description: GRE (and other) tunnel interfaces
+  license: GPL-3.0-or-later
+  min_ansible_version: "2.16"
+  platforms:
+    - name: GenericLinux
+      versions: [all]
+  galaxy_tags: [vyos, networking, gre, tunnel]
+dependencies: []
diff --git a/roles/gre_tunnel/tasks/main.yml b/roles/gre_tunnel/tasks/main.yml
new file mode 100644
index 0000000..5f8a90a
--- /dev/null
+++ b/roles/gre_tunnel/tasks/main.yml
@@ -0,0 +1,20 @@
+---
+- name: Create the tunnel interfaces
+  # vyos_interfaces cannot set encapsulation or endpoints, and a tunnel must
+  # be created with them in one commit, so this goes through vyos_config.
+  vyos.vyos.vyos_config:
+    lines: "{{ _gre_tunnel_cli_lines }}"
+  register: _gre_tunnel_r_cli
+  when: not (vyos_blueprints_render_only | default(false) | bool)
+
+- name: Address the tunnel interfaces
+  vyos.vyos.vyos_l3_interfaces:
+    config: "{{ _gre_tunnel_l3 }}"
+    state: "{{ _gre_tunnel_state }}"
+  register: _gre_tunnel_r_l3
+  when: _gre_tunnel_l3 | length > 0
+
+- name: Collect rendered commands  # noqa: var-naming[no-role-prefix] - shared across roles by design
+  ansible.builtin.set_fact:
+    vyos_blueprints_rendered: "{{ vyos_blueprints_rendered | default([]) + _gre_tunnel_cli_lines + (_gre_tunnel_r_l3.rendered | default([])) }}"
+  when: vyos_blueprints_render_only | default(false) | bool
diff --git a/roles/gre_tunnel/tasks/verify.yml b/roles/gre_tunnel/tasks/verify.yml
new file mode 100644
index 0000000..52cb45f
--- /dev/null
+++ b/roles/gre_tunnel/tasks/verify.yml
@@ -0,0 +1,15 @@
+---
+- name: Read interfaces
+  vyos.vyos.vyos_command:
+    commands:
+      - show interfaces
+  register: _gre_tunnel_v
+
+- name: Every tunnel interface is up
+  ansible.builtin.assert:
+    that: _gre_tunnel_v.stdout[0] is search('(?m)^' ~ (item.name | regex_escape) ~ '\s.*\bu/u\b')
+    fail_msg: "tunnel {{ item.name }} is not up"
+    quiet: true
+  loop: "{{ gre_tunnel_interfaces }}"
+  loop_control:
+    label: "{{ item.name }}"
diff --git a/roles/gre_tunnel/templates/tunnels.j2 b/roles/gre_tunnel/templates/tunnels.j2
new file mode 100644
index 0000000..fb23487
--- /dev/null
+++ b/roles/gre_tunnel/templates/tunnels.j2
@@ -0,0 +1,22 @@
+{% for t in gre_tunnel_interfaces %}
+{%   set b = 'set interfaces tunnel ' ~ t.name %}
+{{ b }} encapsulation '{{ t.encapsulation | default('gre') }}'
+{%   if t.description is defined %}
+{{ b }} description '{{ t.description }}'
+{%   endif %}
+{%   if t.adjust_mss is defined %}
+{{ b }} ip adjust-mss '{{ t.adjust_mss }}'
+{%   endif %}
+{%   if t.mtu is defined %}
+{{ b }} mtu '{{ t.mtu }}'
+{%   endif %}
+{%   if t.remote is defined %}
+{{ b }} remote '{{ t.remote }}'
+{%   endif %}
+{%   if t.source_address is defined %}
+{{ b }} source-address '{{ t.source_address }}'
+{%   endif %}
+{%   if t.source_interface is defined %}
+{{ b }} source-interface '{{ t.source_interface }}'
+{%   endif %}
+{% endfor %}
diff --git a/roles/gre_tunnel/vars/main.yml b/roles/gre_tunnel/vars/main.yml
new file mode 100644
index 0000000..87be41e
--- /dev/null
+++ b/roles/gre_tunnel/vars/main.yml
@@ -0,0 +1,11 @@
+---
+_gre_tunnel_state: "{{ 'rendered' if (vyos_blueprints_render_only | default(false) | bool) else 'merged' }}"
+_gre_tunnel_cli_lines: "{{ (lookup('ansible.builtin.template', 'tunnels.j2') or '').splitlines() | select | list }}"
+_gre_tunnel_l3: >-
+  {%- set out = [] -%}
+  {%- for t in gre_tunnel_interfaces if t.addresses | default([]) -%}
+  {%-   set addrs = [] -%}
+  {%-   for a in t.addresses -%}{%- set _ = addrs.append({'address': a}) -%}{%- endfor -%}
+  {%-   set _ = out.append({'name': t.name, 'ipv4': addrs}) -%}
+  {%- endfor -%}
+  {{ out }}