coregonus

12 files changed, 154 insertions, 1 deletions

diff --git a/tnet/files/coregonus/bird-tnet-pre.conf b/tnet/files/coregonus/bird-tnet-pre.conf
new file mode 100644
index 0000000..d60e8df
--- /dev/null
+++ b/tnet/files/coregonus/bird-tnet-pre.conf
@@ -0,0 +1,20 @@
+define tnet = fdb1:4242:3538:2000::/52;
+
+function is_tnet() -> bool
+{
+  return net ~ tnet;
+}
+
+roa6 table dn42_roa;
+
+protocol static {
+    roa6 { table dn42_roa; };
+    include "/etc/bird/dn42_roa_bird2_6.conf";
+};
+
+function dn42_is_valid_network() -> bool
+{
+  return net ~ [
+    fd00::/8{44,64} # ULA address space as per RFC 4193
+  ];
+}
diff --git a/tnet/files/coregonus/bird-tnet.conf b/tnet/files/coregonus/bird-tnet.conf
new file mode 100644
index 0000000..95ede41
--- /dev/null
+++ b/tnet/files/coregonus/bird-tnet.conf
@@ -0,0 +1,43 @@
+# Set to true if this peer is directly connected to a dn42 peer
+define is_dn42_peer = true;
+# If we are connected directly to dn42, we don't want the dn42 routes from others
+define import_dn42 = !is_dn42_peer;
+define export_dn42 = is_dn42_peer;
+
+template bgp tnet_tpl {
+  local    as 4242423538;
+  neighbor internal;
+
+  direct;
+
+  password "trygvis";
+
+  ipv6 {
+    next hop self;
+    import filter {
+      if is_tnet() then {
+        accept proto, ": (tnet) import accept, net=", net, ", from=", from, ", gw=", gw;
+      } else if import_dn42 && dn42_is_valid_network() then {
+        accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw;
+      } else {
+        reject proto, ": import reject, reason=not tnet";
+      }
+    };
+    # newer bird's only
+    # import keep filtered;
+    export filter {
+      if is_tnet() then {
+        accept proto, ": (tnet) export accept, net=", net, ", from=", from, ", gw=", gw;
+      } else if export_dn42 && dn42_is_valid_network() then {
+        accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw;
+      } else {
+        reject proto, ": export reject, reason=not tnet";
+      }
+    };
+  };
+}
+
+protocol bgp tnet_knot from tnet_tpl {
+  neighbor fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2;
+  interface "tnet-knot";
+}
diff --git a/tnet/files/knot/bird-tnet.conf b/tnet/files/knot/bird-tnet.conf
index fd5332a..e774e31 100644
--- a/tnet/files/knot/bird-tnet.conf
+++ b/tnet/files/knot/bird-tnet.conf
@@ -44,6 +44,13 @@ protocol bgp tnet_conflatorio from tnet_tpl {
   rr client;
 }
 
+protocol bgp tnet_coregonus from tnet_tpl {
+  neighbor fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d3;
+  interface "tnet-coregonus";
+
+  rr client;
+}
+
 protocol bgp tnet_hash from tnet_tpl {
   neighbor fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7d;
   interface "tnet-hash";
@@ -51,6 +58,13 @@ protocol bgp tnet_hash from tnet_tpl {
   rr client;
 }
 
+protocol bgp tnet_kv24ix from tnet_tpl {
+  neighbor fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf;
+  interface "tnet-kv24ix";
+
+  rr client;
+}
+
 protocol bgp tnet_lhn2pi from tnet_tpl {
   neighbor fdb1:4242:3538:ffff:374e:2c7d:319e:e527;
   interface "tnet-lhn2pi";
diff --git a/tnet/host_vars/coregonus/bird.yml b/tnet/host_vars/coregonus/bird.yml
new file mode 100644
index 0000000..816b95a
--- /dev/null
+++ b/tnet/host_vars/coregonus/bird.yml
@@ -0,0 +1,4 @@
+tnet_bird_peers:
+  knot:
+
+birdv: 2015
diff --git a/tnet/host_vars/coregonus/wg.yml b/tnet/host_vars/coregonus/wg.yml
new file mode 100644
index 0000000..0d80a18
--- /dev/null
+++ b/tnet/host_vars/coregonus/wg.yml
@@ -0,0 +1,5 @@
+tnet_wg:
+  knot:
+    endpoint: knot.inamo.no:51011
+    address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d3
+
diff --git a/tnet/host_vars/knot/bird.yml b/tnet/host_vars/knot/bird.yml
index a9175e8..94c610a 100644
--- a/tnet/host_vars/knot/bird.yml
+++ b/tnet/host_vars/knot/bird.yml
@@ -2,8 +2,12 @@ tnet_bird_peers:
   conflatorio:
     rr_client: true
     interface: tnet-confltrio
+  coregonus:
+    rr_client: true
   hash:
     rr_client: true
+  kv24ix:
+    rr_client: true
   node1:
     rr_client: true
   node2:
diff --git a/tnet/host_vars/knot/wg.yml b/tnet/host_vars/knot/wg.yml
index b382831..243c9f2 100644
--- a/tnet/host_vars/knot/wg.yml
+++ b/tnet/host_vars/knot/wg.yml
@@ -9,7 +9,7 @@ tnet_wg:
     address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9a
   kv24ix:
     port: 51003
-    address: fdb1:4242:3538:ffff:ea4:11cb:863:5252
+    address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7ce
   akili:
     port: 51004
     address: fdb1:4242:3538:ffff:59d7:cf77:8b5d:761a
@@ -34,3 +34,7 @@ tnet_wg:
     if_name: confltrio
     port: 51010
     address: fe80:47fc:0660:b91f:1063:a6ae:46bb:7589
+  coregonus:
+    if_name: coregonus
+    port: 51011
+    address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2
diff --git a/tnet/host_vars/kv24ix/wg.yml b/tnet/host_vars/kv24ix/wg.yml
index 9cfdc5d..99c54b6 100644
--- a/tnet/host_vars/kv24ix/wg.yml
+++ b/tnet/host_vars/kv24ix/wg.yml
@@ -1,2 +1,3 @@
 tnet_wg:
   knot:
+    address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf
diff --git a/tnet/keys/wg-coregonus-knot.pub b/tnet/keys/wg-coregonus-knot.pub
new file mode 100644
index 0000000..181fd56
--- /dev/null
+++ b/tnet/keys/wg-coregonus-knot.pub
@@ -0,0 +1 @@
+uOqXlYKRgwBXVKPAaPn2fx4YtMHCH5M2qQ3hs/tZwms=
diff --git a/tnet/keys/wg-coregonus-knot.sops.key b/tnet/keys/wg-coregonus-knot.sops.key
new file mode 100644
index 0000000..b3c6239
--- /dev/null
+++ b/tnet/keys/wg-coregonus-knot.sops.key
@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:aPPYaRDzczKgMZxWKJXE5X7JC0pQxs9W0d3UZjY8QYLhxmxk8L+RpX6zWscR,iv:CE+JgwUMdkbFDrkk53ow77ehm3GEmeJFnVM5jbWXZIY=,tag:mlnV5SNhIOnU/+TnOWiU0g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMWml3V0dCRStJY0RsUEN5\nSVhya1dXYW5GQ0R1a1h3NVJMV09LbVV1eXhNCmFMS2JYVzVPbS95TmwxWG04emtO\nd3B5QUtxWGVaWTlpUDN4ZVErZ1BqcEEKLS0tIE9iTjJaN0RaZjJQeG5Zd1Z5Ylp1\nYkwxS0JqVzNLNHBkSjM0b2owcURZN1UKj5i3uMAwhcqM/vB6faF2vq3ndEYGEOAn\nH1m4LdRj0b03BOtz5vz5oeF+nW3e8rGwhq84N7UFdI4W+9w3ZCI2AQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMVGdPaERQRWNodnpmOUFM\nWG1QSGhJUmoyamplMFFsK3krNzd4ZHVvdlY0Cit3UHNzNUVIVWlZakNsTUFNVlA1\neE9rNTliWmZ0a295UVJZUXo3dk9WTkkKLS0tIDE2SjE1bXFVdno5NkwwQk15UGZY\nczBPTTUwdTBJT0laWWJsWmJmNDFuUG8KRlCmMio144qdPuPXuxc2AEHhdUxbJT8W\nDp7Atk0G57V57tX/zk1RaXjp+ORStvwpgDAdCwmikt1PW78Y6x77tQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpYWlHRUVTV1RreFExcDBj\nYmI3OTBpRnEwd0FBTDdPTHI1OVhRYmlZMGdFCjlHTWJPY0lSRVhPSTQyNEgxYkMy\nY3ljMnhKeURSL2JwcDd3dmlubW15bFEKLS0tIEZHUG9NUmNnUlh2NjlTd1RsYytR\nVDI0OVhZeGhyWFVFcU9URE1NRXpnR00KUO2W8ab2RehPhEAjFlOXWrr2rn55gBR5\neSvOtAPEEV1lWO+O0r3jOFpnUI/ahgPeBhMoLFOdionm3GPrYzf8aQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-08-20T22:51:59Z",
+		"mac": "ENC[AES256_GCM,data:4haVcOm18uCW8LK06wURyf32qr9ZXnjc6feJHf4T85C0COrmZ7AmxUZKt5Mi9YoPO7dTMpjcvnxhEVEP4x6/wBc3SB5RpRSWU25GZ4/ofnqR/xBH0R1edirQtuhsDJeR3rYnTYeMjRltf9zpZknED907GRmmddaO15xsWtU8/t8=,iv:wXMIQRj4mV7SNnUqC3XVM/8mEhbPMwL1Z4/LrIBqpcs=,tag:i6CSlmj2449GgMqosa8e0A==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}
\ No newline at end of file
diff --git a/tnet/keys/wg-knot-coregonus.pub b/tnet/keys/wg-knot-coregonus.pub
new file mode 100644
index 0000000..7fc1905
--- /dev/null
+++ b/tnet/keys/wg-knot-coregonus.pub
@@ -0,0 +1 @@
+lTuzdN+En+Jc8v9+cTx2U455mw6v+fl/QsWWxO7ZYgI=
diff --git a/tnet/keys/wg-knot-coregonus.sops.key b/tnet/keys/wg-knot-coregonus.sops.key
new file mode 100644
index 0000000..6acb9ef
--- /dev/null
+++ b/tnet/keys/wg-knot-coregonus.sops.key
@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:NhASCvnUd1DDdo8qQ8MNY+KXMa9fACx7DNEwNwwLgjuwSu+bV42z/OYTY6Ck,iv:z0mGt+HuBwuS+WnbuomGwqReCXqEfIC+qPOuz+JciSw=,tag:sCUW0nXWJWgxYEAbkp+7JQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTWY3a0xxbzJnVm1GRHdU\nZU1IcnhKQkdEVjBtNFRIb0swWHlqdldFSUR3Ckg4dGlERkV4Ly93YVRwSjBJdzB0\nS1hmSkNQY2ROdDBZVTVmODRUR2Z4bmMKLS0tIFh0ZDJ1d2ViMFVwNlRkY3d6eU5E\nbHVhSXVCRWI2b2NKVVI1cGVjL3RGaVEKgFzmd42NmzH4GH4Vuklcd1jkCJnngloO\nN4Q5/NdHij8fXWnhkuV/8xX7KnBXEGX5uHo9pYd1aYzyZTUD40rDyw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TmJ4UjZBN2pFU2dBZXdG\naDNtQUhGdkFnYkh5OXVlYTZ6c1N0YWpaTnpNCnZMWFgrWFpNd0tqVGpyN2NIZnlo\ncTRlQ1Q4UGJySm16TThwS0V1dW1nTlUKLS0tIGgzWjQvZ0hETW15TTV4S0Q1K1V5\naDFMODFVcVB4cmxnYXR5RTRnanQ0bVkKPZ/caVVhPQ/0I5X3A70czYnMNgw/l39W\nrf75d5RK5x5FcgZenz23l00g+AUt8uNfct+3YHc15OjL+vOrtm1NCQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjalBWcXg5NVlFS3Bjb0Vt\nUXlhNVNxMmtIMVhEdC8rb2h5UEJxUVpUckI0Ci9BaUM3YWJSczI1RVNQWGtIZllI\nQmhuK2dyMUwvRlpORUZDK2thWldUdFkKLS0tIDA2UVBzbTQ3aDEwcXNHcjRoMkNW\nRXhmZ3hmUlhVR0xzaWU1MDZBUW1zcTAKkkyLoqodk7FWwZV07wlkttEs115/v9ZI\nOVfi+VzkI++jLW2KzL1S1i1N+/BHnfXDnzNDaIqUTRrFi5jhd1kk0A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-08-20T23:20:12Z",
+		"mac": "ENC[AES256_GCM,data:l4s7OdTHRqBXVGHpCQMo/k6nwwPEcWK8J47n1b8pQSDuO4DFcB/ApI8rNKgFAujXLUwB10YeRwp0bcLdlGREt7PhcHhddNB5yRYx/8djqYpm0w3rSAN9p4IW5CNB5LmfdxQk2dI0Ow8wxw8UzTVO08T7cDNeYRZdQTJLd+VUhCo=,iv:Ffv/pz30FwLaho3Y2HlMO11jKIl71GUpKMe1cSMNOwo=,tag:Qo3ZSTnJa26jYdwJtGvmyQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}
\ No newline at end of file