From f0252a8b9417905b0ddfe4122c6c6603e0b930bd Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 26 Jun 2026 13:49:45 +0200 Subject: [PATCH] woodpecker-agent: enable IPv6 in the Docker daemon MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI steps run inside Docker containers on the wp-agents, and Docker gives containers no IPv6 by default — so deploys to IPv6-only hosts fail with "Network unreachable" even when the agent host itself has v6 (confirmed: the deploy-netbird-proxy pipeline can't SSH the v6-only proxy-1). Write /etc/docker/daemon.json with ipv6 + a ULA fixed-cidr-v6 + ip6tables (IPv6 NAT), so step containers get NAT'd v6 egress through the host. Caveats: - Requires Docker 27+ (ip6tables stable) and the agent HOSTS to have v6 egress themselves (the .srv VLAN must route v6). - Applying notifies a docker restart, which interrupts running pipelines (including the one applying it, if run via a pipeline on the agents). Apply deliberately — out-of-band, or expect the triggering run to die on the restart and re-run it. Unblocks the deploy-netbird-proxy pipeline (PR #47) reaching proxy-1. Co-Authored-By: Claude Opus 4.8 (1M context) --- ansible/roles/woodpecker-agent/defaults/main.yml | 7 +++++++ ansible/roles/woodpecker-agent/handlers/main.yml | 5 +++++ ansible/roles/woodpecker-agent/tasks/main.yml | 8 ++++++++ ansible/roles/woodpecker-agent/templates/daemon.json.j2 | 5 +++++ 4 files changed, 25 insertions(+) create mode 100644 ansible/roles/woodpecker-agent/templates/daemon.json.j2 diff --git a/ansible/roles/woodpecker-agent/defaults/main.yml b/ansible/roles/woodpecker-agent/defaults/main.yml index 8cd569b4..6c676758 100644 --- a/ansible/roles/woodpecker-agent/defaults/main.yml +++ b/ansible/roles/woodpecker-agent/defaults/main.yml @@ -12,3 +12,10 @@ woodpecker_max_workflows: 2 # Docker Compose project directory woodpecker_agent_compose_dir: "/opt/woodpecker-agent" + +# Enable IPv6 in the agent's Docker daemon so CI step containers can reach +# IPv6-only destinations (e.g. deploying to v6-only hosts). ULA + ip6tables +# gives the containers NAT'd IPv6 egress through the host's own v6. +# Requires Docker 27+ (ip6tables stable) and the host to have v6 egress. +woodpecker_agent_docker_ipv6: true +woodpecker_agent_docker_v6_cidr: "fd00:dead:beef::/64" diff --git a/ansible/roles/woodpecker-agent/handlers/main.yml b/ansible/roles/woodpecker-agent/handlers/main.yml index 23e65e32..8d8f3494 100644 --- a/ansible/roles/woodpecker-agent/handlers/main.yml +++ b/ansible/roles/woodpecker-agent/handlers/main.yml @@ -1,4 +1,9 @@ --- +- name: Restart docker + ansible.builtin.systemd: + name: docker + state: restarted + - name: Restart woodpecker-agent systemd: name: woodpecker-agent diff --git a/ansible/roles/woodpecker-agent/tasks/main.yml b/ansible/roles/woodpecker-agent/tasks/main.yml index 2e577568..aacca355 100644 --- a/ansible/roles/woodpecker-agent/tasks/main.yml +++ b/ansible/roles/woodpecker-agent/tasks/main.yml @@ -1,4 +1,12 @@ --- +- name: Enable IPv6 in the Docker daemon (so CI containers can reach v6 hosts) + ansible.builtin.template: + src: daemon.json.j2 + dest: /etc/docker/daemon.json + mode: "0644" + when: woodpecker_agent_docker_ipv6 | bool + notify: Restart docker + - name: Create Woodpecker agent directory file: path: "{{ woodpecker_agent_compose_dir }}" diff --git a/ansible/roles/woodpecker-agent/templates/daemon.json.j2 b/ansible/roles/woodpecker-agent/templates/daemon.json.j2 new file mode 100644 index 00000000..084e547e --- /dev/null +++ b/ansible/roles/woodpecker-agent/templates/daemon.json.j2 @@ -0,0 +1,5 @@ +{ + "ipv6": true, + "fixed-cidr-v6": "{{ woodpecker_agent_docker_v6_cidr }}", + "ip6tables": true +} -- 2.54.0