From 5ef452cd7c07a5e1cfe7528a348d5e415d80c426 Mon Sep 17 00:00:00 2001
From: Pig Monkey <pm@pig-monkey.com>
Date: Wed, 13 May 2026 11:58:38 -0700
Subject: [PATCH] add additional network privacy options

Closes #131
---
 roles/networkmanager/tasks/main.yml           |  6 +++++
 .../networkmanager/templates/privacy.conf.j2  | 23 +++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 roles/networkmanager/templates/privacy.conf.j2

diff --git a/roles/networkmanager/tasks/main.yml b/roles/networkmanager/tasks/main.yml
index 52c9675..f6687ed 100644
--- a/roles/networkmanager/tasks/main.yml
+++ b/roles/networkmanager/tasks/main.yml
@@ -21,6 +21,12 @@
     dest: /etc/NetworkManager/conf.d/20-random_mac.conf
     mode: "0644"
 
+- name: Push privacy config
+  ansible.builtin.template:
+    src: privacy.conf.j2
+    dest: /etc/NetworkManager/conf.d/40-privacy.conf
+    mode: "0644"
+
 - name: Push WiFi/Wired Exclusive dispatcher
   ansible.builtin.copy:
     src: wifi-wired-exclusive.sh
diff --git a/roles/networkmanager/templates/privacy.conf.j2 b/roles/networkmanager/templates/privacy.conf.j2
new file mode 100644
index 0000000..8c1a324
--- /dev/null
+++ b/roles/networkmanager/templates/privacy.conf.j2
@@ -0,0 +1,23 @@
+# {{ ansible_managed }}
+[connection]
+# Prevent leaking the machine hostname to DHCP servers, which may log it or
+# use it to populate local DNS.
+ipv4.dhcp-send-hostname=0
+ipv6.dhcp-send-hostname=0
+
+# Use a per-connection client identifier derived from the connection's
+# stable-id rather than the MAC address, avoiding hardware identity exposure
+# in DHCPv4 requests.
+ipv4.dhcp-client-id=stable
+
+# Use a per-connection DUID derived from the connection's stable-id rather
+# than the global machine-id, preventing cross-network tracking via DHCPv6.
+ipv6.dhcp-duid=stable-uuid
+
+# Enable IPv6 Privacy Extensions (RFC 4941). Generates a temporary address in
+# addition to the stable one and prefers it for outgoing connections, making
+# cross-session tracking harder.
+ipv6.ip6-privacy=2
+{% for setting in network.privacy_settings | default([]) %}
+{{ setting }}
+{% endfor %}