diff options
24 files changed, 770 insertions, 63 deletions
diff --git a/ansible/group_vars/all/ipam.yml b/ansible/group_vars/all/ipam.yml index 5621385..f0ce96c 100644 --- a/ansible/group_vars/all/ipam.yml +++ b/ansible/group_vars/all/ipam.yml @@ -25,12 +25,6 @@ ipam6: range: "fdb1:4242:3538:2004::/64" hosts: knot: "fdb1:4242:3538:2004::ffff" - coregonus_dn42: - range: "fdb1:4242:3538:2005::/64" - hosts: - kjell: "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c/64" - coregonus_docker: - range: "fdb1:4242:3538:2005:df01:676a:ec28:0a00/120" kv24_pub: range: "2a01:799:111d:1801::/64" kv24_dn42: @@ -40,7 +34,7 @@ ipam6: garasjepi: "fdb1:4242:3538:2006:e9f7:418f:49fd:8d2e" ha-kv24: "fdb1:4242:3538:2006:18a:90f:4264:8ca0/64" netbox: "fdb1:4242:3538:2006:be24:11ff:febb:5c7f/64" - coregonus: "fdb1:4242:3538:2006:2e0:4cff:fe98:1bb5/64" + kjell: "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c/64" hash_dn42: range: "fdb1:4242:3538:2007::/64" hosts: @@ -50,12 +44,17 @@ ipam6: lhn2_dn42: range: "fdb1:4242:3538:2008::/64" hosts: + lhn2ix: "fdb1:4242:3538:2008::1" lhn2pi: "fdb1:4242:3538:2008::ffff" lhn2-z2m: "fdb1:4242:3538:2008:9aed:e460:1711:07dd" ha-lhn2: "fdb1:4242:3538:2008:9c59:926f:1dc9:89db" conflatorio: "fdb1:4242:3538:2008:8042:32ff:fe0c:7161" danneri: "fdb1:4242:3538:2008:9422:d355:95b7:f170" unifi: "fdb1:4242:3538:2008:5054:ff:fe4d:96c" + lhn2_service: + range: "fdb1:4242:3538:2009::/64" + hosts: + coregonus: "fdb1:4242:3538:2009::4/64" # k8s: # range: "fdb1:4242:3538:3000::/52" diff --git a/ansible/host_vars/kjell-ct-102/traefik-server.yml b/ansible/host_vars/kjell-ct-102/traefik-server.yml new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/ansible/host_vars/kjell-ct-102/traefik-server.yml diff --git a/ansible/host_vars/kjell-ct-102/users.yml b/ansible/host_vars/kjell-ct-102/users.yml new file mode 100644 index 0000000..d0d4852 --- /dev/null +++ b/ansible/host_vars/kjell-ct-102/users.yml @@ -0,0 +1,5 @@ +lusers: + - trygvis + +superusers: + - trygvis diff --git a/ansible/plays/kjell-ct-102.yml b/ansible/plays/kjell-ct-102.yml new file mode 100644 index 0000000..87b9459 --- /dev/null +++ b/ansible/plays/kjell-ct-102.yml @@ -0,0 +1,49 @@ +- hosts: + - kjell-ct-102 + vars: + traefik_version: 3.4.1 + traefik_checksum: md5:f299230ea9f247a672b187a79f2e76e6719ccbee + traefik_template: traefik-proxy.toml.j2 + tasks: + - become: yes + apt: + name: + - etckeeper + - sudo + tags: packages,never + + - import_role: + name: timezone + tags: timezone,never + + - name: Load values from sops.yml + community.sops.load_vars: + name: env + file: ../../sops.yml + tags: traefik-server,never + + - import_role: + name: traefik-server + vars: + traefik_environment: + LINODE_TOKEN: "{{ env.linode_token }}" + tags: traefik-server,never + + - name: /etc/systemd/services/traefik.service + become: true + template: + src: "{{ traefik_template }}" + dest: /etc/traefik/traefik.toml + owner: root + group: root + mode: 0644 + register: template + + - name: systemctl restart traefik + become: true + systemd: + daemon_reload: true + unit: traefik + enabled: true + state: restarted + when: template.changed diff --git a/ansible/plays/templates/traefik-proxy.toml.j2 b/ansible/plays/templates/traefik-proxy.toml.j2 new file mode 100644 index 0000000..d538664 --- /dev/null +++ b/ansible/plays/templates/traefik-proxy.toml.j2 @@ -0,0 +1,126 @@ +[global] + checkNewVersion = true + sendAnonymousUsage = false + +################################################################ +# Entrypoints configuration +################################################################ + +[entryPoints] +# [entryPoints.web] +# address = ":80" + + [entryPoints.websecure] + address = ":443" + + [entryPoints.websecure.http.tls] + certResolver = "linode" + +[log] + + # Log level + # + # Optional + # Default: "ERROR" + # + level = "DEBUG" + + # Sets the filepath for the traefik log. If not specified, stdout will be used. + # Intermediate directories are created if necessary. + # + # Optional + # Default: os.Stdout + # + # filePath = "log/traefik.log" + + # Format is either "json" or "common". + # + # Optional + # Default: "common" + # + # format = "json" + +################################################################ +# Access logs configuration +################################################################ + +# Enable access logs +# By default it will write to stdout and produce logs in the textual +# Common Log Format (CLF), extended with additional fields. +# +# Optional +# +# [accessLog] + + # Sets the file path for the access log. If not specified, stdout will be used. + # Intermediate directories are created if necessary. + # + # Optional + # Default: os.Stdout + # + # filePath = "/path/to/log/log.txt" + + # Format is either "json" or "common". + # + # Optional + # Default: "common" + # + # format = "json" + +################################################################ +# API and dashboard configuration +################################################################ + +# Enable API and dashboard +[api] + + # Enable the API in insecure mode + # + # Optional + # Default: false + # + # insecure = true + + # Enabled Dashboard + # + # Optional + # Default: true + # + # dashboard = false + +################################################################ +# Ping configuration +################################################################ + +# Enable ping +[ping] + + # Name of the related entry point + # + # Optional + # Default: "traefik" + # + # entryPoint = "traefik" + + +[certificatesResolvers.linode.acme] + email = "root@trygvis.io" + storage = "acme.json" + [certificatesResolvers.linode.acme.dnsChallenge] + provider = "linode" + delayBeforeCheck = 1 + +[http] +[http.routers] + [http.routers.junk] + rule = "Host(`junk.dn42.trygvis.io`)" + service = "netbox" + + [http.routers.junk.tls] + certResolver = "linode" + + [http.services] + # Define how to reach an existing service on our infrastructure + [http.services.netbox.loadBalancer] + [[http.services.netbox.loadBalancer.servers]] + url = "http://[fdb1:4242:3538:2005:be24:11ff:febb:5c7f]:8080" diff --git a/ansible/roles/traefik-server/handlers/main.yml b/ansible/roles/traefik-server/handlers/main.yml new file mode 100644 index 0000000..6e34db4 --- /dev/null +++ b/ansible/roles/traefik-server/handlers/main.yml @@ -0,0 +1,5 @@ +- name: systemctl restart traefik + systemd: + daemon_reload: true + unit: traefik + state: restarted diff --git a/ansible/roles/traefik-server/tasks/main.yml b/ansible/roles/traefik-server/tasks/main.yml new file mode 100644 index 0000000..98d45e5 --- /dev/null +++ b/ansible/roles/traefik-server/tasks/main.yml @@ -0,0 +1,56 @@ +- name: Download traefik + become: true + ansible.builtin.get_url: + url: https://github.com/traefik/traefik/releases/download/v{{ traefik_version }}/traefik_v{{ traefik_version }}_linux_amd64.tar.gz + dest: /tmp/traefik-{{ traefik_version }}.tar.gz + checksum: "{{ traefik_download|default('') }}" + register: download + +- name: Download checksum + debug: + msg: download.checksum_src={{ download.checksum_src }} + when: download.status_code == 200 + +- name: mkdir /tmp/traefik-x.y.z + become: true + file: + path: /tmp/traefik-{{ traefik_version }} + state: directory + +- name: Extract traefik + become: true + unarchive: + remote_src: true + src: /tmp/traefik-{{ traefik_version }}.tar.gz + dest: /tmp/traefik-{{ traefik_version }} + +- name: Install traefik + become: true + copy: + remote_src: true + src: /tmp/traefik-{{ traefik_version }}/traefik + dest: /usr/local/bin/traefik + owner: root + group: root + mode: 0750 + +- name: /etc/systemd/services/traefik.service + become: true + template: + src: traefik.service.j2 + dest: /etc/systemd/system/traefik.service + owner: root + group: root + mode: 0644 + +- name: mkdir /etc/traefik + become: true + file: + path: /etc/traefik + state: directory + +- name: mkdir /etc/traefik/acme + become: true + file: + path: /etc/traefik/acme + state: directory diff --git a/ansible/roles/traefik-server/templates/traefik.service.j2 b/ansible/roles/traefik-server/templates/traefik.service.j2 new file mode 100644 index 0000000..14bc403 --- /dev/null +++ b/ansible/roles/traefik-server/templates/traefik.service.j2 @@ -0,0 +1,52 @@ +[Unit] +Description=traefik proxy +After=network-online.target +Wants=network-online.target systemd-networkd-wait-online.service + +AssertFileIsExecutable=/usr/local/bin/traefik +AssertPathExists=/etc/traefik/traefik.toml + +[Service] +Restart=on-abnormal + +#User=traefik +#Group=traefik + +; Always set "-root" to something safe in case it gets forgotten in the traefikfile. +ExecStart=/usr/local/bin/traefik --configfile=/etc/traefik/traefik.toml + +; Limit the number of file descriptors; see `man systemd.exec` for more limit settings. +LimitNOFILE=1048576 + +; Use private /tmp and /var/tmp, which are discarded after traefik stops. +PrivateTmp=true + +; Use a minimal /dev (May bring additional security if switched to 'true') +PrivateDevices=true + +; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys. +ProtectHome=true + +; Make /usr, /boot, /etc and possibly some more folders read-only. +ProtectSystem=full + +; ... except /etc/ssl/traefik, because we want Letsencrypt-certificates there. +; This merely retains r/w access rights, it does not add any new. Must still be writable on the host! +#ReadWriteDirectories=/etc/traefik/acme + +; The following additional security directives only work with systemd v229 or later. +; They further restrict privileges that can be gained by traefik. Uncomment if you like. +; Note that you may have to add capabilities required by any plugins in use. +CapabilityBoundingSet=CAP_NET_BIND_SERVICE +AmbientCapabilities=CAP_NET_BIND_SERVICE +NoNewPrivileges=true +{% set env=traefik_environment.items()|default({}) %} +{% if env %} + +{% for k, v in env %} +Environment="{{ k }}={{ v }}" +{% endfor %} +{% endif %} + +[Install] +WantedBy=multi-user.target diff --git a/ansible/wg0/group_vars/all/wireguard_wg0.yml b/ansible/wg0/group_vars/all/wireguard_wg0.yml index 109de3d..cfaec64 100644 --- a/ansible/wg0/group_vars/all/wireguard_wg0.yml +++ b/ansible/wg0/group_vars/all/wireguard_wg0.yml @@ -56,8 +56,6 @@ wireguard_wg0: lhn2ix: state: present ipv6: fdf3:aad9:a885:0b3a::15 - allowed_ips: - - fdf3:aad9:a885:77dd::/64 kv24ix: state: present ipv6: fdf3:aad9:a885:0b3a::16 diff --git a/config/backup-lhn2ix b/config/backup-lhn2ix new file mode 100755 index 0000000..6755232 --- /dev/null +++ b/config/backup-lhn2ix @@ -0,0 +1,13 @@ +#!/bin/bash + +set -euo pipefail + +basedir="${0%/*}" + +cd "$basedir" + +ssh ubnt@lhn2ix.dn42.trygvis.io \ + /opt/vyatta/bin/vyatta-op-cmd-wrapper show configuration commands \ + > .tmp + +mv .tmp "${0##*backup-}".txt diff --git a/config/kv24ix.txt b/config/kv24ix.txt index a29716b..2c04479 100644 --- a/config/kv24ix.txt +++ b/config/kv24ix.txt @@ -2,7 +2,6 @@ set firewall all-ping enable set firewall broadcast-ping disable set firewall ipv6-name WANv6_IN default-action drop set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN' -set firewall ipv6-name WANv6_IN enable-default-log set firewall ipv6-name WANv6_IN rule 10 action accept set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions' set firewall ipv6-name WANv6_IN rule 10 state established enable @@ -87,6 +86,7 @@ set interfaces ethernet eth4 poe output off set interfaces ethernet eth4 speed auto set interfaces loopback lo set interfaces switch switch0 address 192.168.10.1/24 +set interfaces switch switch0 address 'fdb1:4242:3538:2006::ffff/64' set interfaces switch switch0 description Local set interfaces switch switch0 firewall in set interfaces switch switch0 ipv6 address @@ -104,7 +104,7 @@ set interfaces wireguard wg0 peer cuUgTdFH1UEXpUH6V1nashdH7K/L+pl6dmJCpBWN+Xw= e set interfaces wireguard wg0 peer cuUgTdFH1UEXpUH6V1nashdH7K/L+pl6dmJCpBWN+Xw= persistent-keepalive 60 set interfaces wireguard wg0 private-key /config/auth/wg0.key set interfaces wireguard wg0 route-allowed-ips false -set interfaces wireguard wg1 address 'fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf/64' +set interfaces wireguard wg1 address 'fdb1:4242:3538:2f01::b/64' set interfaces wireguard wg1 description tnet-knot set interfaces wireguard wg1 mtu 1420 set interfaces wireguard wg1 peer eF8DIAyneOlhEzyriFB528IUsnYqy/b5398i0SW06g4= allowed-ips '::/0' @@ -112,27 +112,32 @@ set interfaces wireguard wg1 peer eF8DIAyneOlhEzyriFB528IUsnYqy/b5398i0SW06g4= e set interfaces wireguard wg1 peer eF8DIAyneOlhEzyriFB528IUsnYqy/b5398i0SW06g4= persistent-keepalive 60 set interfaces wireguard wg1 private-key /config/auth/knot.key set interfaces wireguard wg1 route-allowed-ips false +set interfaces wireguard wg2 address '2a11:6c7:f04:fd::2/64' set interfaces wireguard wg2 description route64.org set interfaces wireguard wg2 mtu 1420 +set interfaces wireguard wg2 peer ztZNKsJH/CKQjYz9kUOtcIyKakqaNoNuVPZL8nlDxgM= allowed-ips '::/0' set interfaces wireguard wg2 peer ztZNKsJH/CKQjYz9kUOtcIyKakqaNoNuVPZL8nlDxgM= endpoint '118.91.187.67:46010' set interfaces wireguard wg2 peer ztZNKsJH/CKQjYz9kUOtcIyKakqaNoNuVPZL8nlDxgM= persistent-keepalive 30 set interfaces wireguard wg2 private-key /config/auth/route64.key set interfaces wireguard wg2 route-allowed-ips false set policy prefix-list6 bitraf-dn42 rule 1 action permit +set policy prefix-list6 bitraf-dn42 rule 1 description 'tnet subnetworks' set policy prefix-list6 bitraf-dn42 rule 1 le 128 -set policy prefix-list6 bitraf-dn42 rule 1 prefix 'fdb1:4242:3538::/48' -set policy route-map knot rule 1 action permit -set policy route-map knot rule 1 match ipv6 address prefix-list bitraf-dn42 -set policy route-map knot rule 1 set ipv6-next-hop global 'fe80:fef1:78a:5b64:efd3:ae7b:d286:d7ce' -set policy route-map knot rule 1 set ipv6-next-hop local 'fe80:fef1:78a:5b64:efd3:ae7b:d286:d7ce' -set protocols bgp 4242423538 address-family ipv6-unicast network 'fdb1:4242:3538:2006::/64' route-map knot -set protocols bgp 4242423538 neighbor 'fe80:fef1:78a:5b64:efd3:ae7b:d286:d7ce' address-family ipv6-unicast capability graceful-restart -set protocols bgp 4242423538 neighbor 'fe80:fef1:78a:5b64:efd3:ae7b:d286:d7ce' address-family ipv6-unicast route-map export knot -set protocols bgp 4242423538 neighbor 'fe80:fef1:78a:5b64:efd3:ae7b:d286:d7ce' address-family ipv6-unicast soft-reconfiguration inbound -set protocols bgp 4242423538 neighbor 'fe80:fef1:78a:5b64:efd3:ae7b:d286:d7ce' nexthop-self -set protocols bgp 4242423538 neighbor 'fe80:fef1:78a:5b64:efd3:ae7b:d286:d7ce' password trygvis -set protocols bgp 4242423538 neighbor 'fe80:fef1:78a:5b64:efd3:ae7b:d286:d7ce' remote-as 4242423538 -set protocols bgp 4242423538 parameters +set policy prefix-list6 bitraf-dn42 rule 1 prefix 'fdb1:4242:3538:2000::/60' +set policy route-map bitraf-dn42 rule 1 action permit +set policy route-map bitraf-dn42 rule 1 match ipv6 address prefix-list bitraf-dn42 +set protocols bgp 4242423538 address-family ipv6-unicast redistribute connected route-map bitraf-dn42 +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' address-family ipv6-unicast capability graceful-restart +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' address-family ipv6-unicast nexthop-self +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' address-family ipv6-unicast route-reflector-client +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' address-family ipv6-unicast soft-reconfiguration inbound +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' capability dynamic +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' capability graceful-restart +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' password trygvis +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' remote-as 4242423538 +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' soft-reconfiguration inbound +set protocols bgp 4242423538 parameters graceful-restart +set protocols static route6 'fdb1:4242:3538:2006::/64' blackhole set service dhcp-server disabled false set service dhcp-server hostfile-update disable set service dhcp-server shared-network-name LAN authoritative enable @@ -161,8 +166,9 @@ set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-ma set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping swoppe mac-address 'b4:fb:e4:8a:24:a6' set service dhcp-server static-arp disable set service dhcp-server use-dnsmasq disable -set service dns forwarding cache-size 150 +set service dns forwarding cache-size 1000 set service dns forwarding listen-on switch0 +set service dns forwarding options 'server=/dn42/fd42:d42:d42:54::1' set service gui http-port 80 set service gui https-port 443 set service gui older-ciphers enable diff --git a/config/lhn2ix.txt b/config/lhn2ix.txt new file mode 100644 index 0000000..b05d5d9 --- /dev/null +++ b/config/lhn2ix.txt @@ -0,0 +1,229 @@ +set firewall all-ping enable +set firewall broadcast-ping disable +set firewall ipv6-name DN42v6_IN default-action drop +set firewall ipv6-name DN42v6_IN description 'DN42 traffic through the router' +set firewall ipv6-name DN42v6_IN enable-default-log +set firewall ipv6-name DN42v6_IN rule 10 action accept +set firewall ipv6-name DN42v6_IN rule 10 description 'Allow established/related sessions' +set firewall ipv6-name DN42v6_IN rule 10 state established enable +set firewall ipv6-name DN42v6_IN rule 10 state related enable +set firewall ipv6-name DN42v6_IN rule 20 action drop +set firewall ipv6-name DN42v6_IN rule 20 description 'Drop invalid state' +set firewall ipv6-name DN42v6_IN rule 20 state invalid enable +set firewall ipv6-name DN42v6_IN rule 30 action accept +set firewall ipv6-name DN42v6_IN rule 30 description 'Allow IPv6 icmp' +set firewall ipv6-name DN42v6_IN rule 30 protocol ipv6-icmp +set firewall ipv6-name DN42v6_IN rule 100 action accept +set firewall ipv6-name DN42v6_IN rule 100 description 'Allow anything from tnet (tcp)' +set firewall ipv6-name DN42v6_IN rule 100 protocol tcp +set firewall ipv6-name DN42v6_IN rule 100 source address 'fdb1:4242:3538:2000::/52' +set firewall ipv6-name DN42v6_IN rule 101 action accept +set firewall ipv6-name DN42v6_IN rule 101 description 'Allow anything from tnet (udp)' +set firewall ipv6-name DN42v6_IN rule 101 protocol udp +set firewall ipv6-name DN42v6_IN rule 101 source address 'fdb1:4242:3538:2000::/52' +set firewall ipv6-name DN42v6_IN rule 200 action accept +set firewall ipv6-name DN42v6_IN rule 200 description 'Allow SSH' +set firewall ipv6-name DN42v6_IN rule 200 destination port 22 +set firewall ipv6-name DN42v6_IN rule 200 protocol tcp +set firewall ipv6-name DN42v6_IN rule 201 action accept +set firewall ipv6-name DN42v6_IN rule 201 description 'Allow HTTP' +set firewall ipv6-name DN42v6_IN rule 201 destination port 80 +set firewall ipv6-name DN42v6_IN rule 201 protocol tcp +set firewall ipv6-name DN42v6_IN rule 202 action accept +set firewall ipv6-name DN42v6_IN rule 202 description 'Allow HTTPS' +set firewall ipv6-name DN42v6_IN rule 202 destination port https +set firewall ipv6-name DN42v6_IN rule 202 protocol tcp +set firewall ipv6-name DN42v6_LOCAL default-action drop +set firewall ipv6-name DN42v6_LOCAL description 'DN42 inbound traffic to the router' +set firewall ipv6-name DN42v6_LOCAL enable-default-log +set firewall ipv6-name DN42v6_LOCAL rule 10 action accept +set firewall ipv6-name DN42v6_LOCAL rule 10 description 'Allow established/related sessions' +set firewall ipv6-name DN42v6_LOCAL rule 10 state established enable +set firewall ipv6-name DN42v6_LOCAL rule 10 state related enable +set firewall ipv6-name DN42v6_LOCAL rule 20 action drop +set firewall ipv6-name DN42v6_LOCAL rule 20 description 'Drop invalid state' +set firewall ipv6-name DN42v6_LOCAL rule 20 state invalid enable +set firewall ipv6-name DN42v6_LOCAL rule 30 action accept +set firewall ipv6-name DN42v6_LOCAL rule 30 description 'Allow IPv6 icmp' +set firewall ipv6-name DN42v6_LOCAL rule 30 protocol ipv6-icmp +set firewall ipv6-name DN42v6_LOCAL rule 40 action accept +set firewall ipv6-name DN42v6_LOCAL rule 40 description 'Allow SSH' +set firewall ipv6-name DN42v6_LOCAL rule 40 destination port 22 +set firewall ipv6-name DN42v6_LOCAL rule 40 protocol tcp +set firewall ipv6-name DN42v6_LOCAL rule 50 action accept +set firewall ipv6-name DN42v6_LOCAL rule 50 description 'Allow BGP' +set firewall ipv6-name DN42v6_LOCAL rule 50 destination port 179 +set firewall ipv6-name DN42v6_LOCAL rule 50 protocol tcp +set firewall ipv6-name WANv6_IN default-action drop +set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN' +set firewall ipv6-name WANv6_IN rule 10 action accept +set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions' +set firewall ipv6-name WANv6_IN rule 10 state established enable +set firewall ipv6-name WANv6_IN rule 10 state related enable +set firewall ipv6-name WANv6_IN rule 20 action drop +set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state' +set firewall ipv6-name WANv6_IN rule 20 state invalid enable +set firewall ipv6-name WANv6_LOCAL default-action drop +set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router' +set firewall ipv6-name WANv6_LOCAL enable-default-log +set firewall ipv6-name WANv6_LOCAL rule 10 action accept +set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions' +set firewall ipv6-name WANv6_LOCAL rule 10 state established enable +set firewall ipv6-name WANv6_LOCAL rule 10 state related enable +set firewall ipv6-name WANv6_LOCAL rule 20 action drop +set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state' +set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable +set firewall ipv6-name WANv6_LOCAL rule 30 action accept +set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp' +set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp +set firewall ipv6-name WANv6_LOCAL rule 40 action accept +set firewall ipv6-name WANv6_LOCAL rule 40 description 'Allow DHCPv6' +set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546 +set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp +set firewall ipv6-name WANv6_LOCAL rule 40 source port 547 +set firewall ipv6-name WANv6_LOCAL rule 50 action accept +set firewall ipv6-name WANv6_LOCAL rule 50 description 'Allow SSH' +set firewall ipv6-name WANv6_LOCAL rule 50 destination port 22 +set firewall ipv6-name WANv6_LOCAL rule 50 protocol tcp +set firewall ipv6-receive-redirects disable +set firewall ipv6-src-route disable +set firewall ip-src-route disable +set firewall log-martians enable +set firewall receive-redirects disable +set firewall send-redirects enable +set firewall source-validation disable +set firewall syn-cookies enable +set interfaces ethernet eth0 address dhcp +set interfaces ethernet eth0 description Internet +set interfaces ethernet eth0 dhcpv6-pd pd 0 interface switch0 host-address '::1' +set interfaces ethernet eth0 dhcpv6-pd pd 0 interface switch0 prefix-id ':0' +set interfaces ethernet eth0 dhcpv6-pd pd 0 interface switch0 service slaac +set interfaces ethernet eth0 dhcpv6-pd pd 0 prefix-length 56 +set interfaces ethernet eth0 dhcpv6-pd rapid-commit enable +set interfaces ethernet eth0 duplex auto +set interfaces ethernet eth0 firewall in ipv6-name WANv6_IN +set interfaces ethernet eth0 firewall local ipv6-name WANv6_LOCAL +set interfaces ethernet eth0 ipv6 address +set interfaces ethernet eth0 ipv6 dup-addr-detect-transmits 1 +set interfaces ethernet eth0 poe output off +set interfaces ethernet eth0 speed auto +set interfaces ethernet eth1 description conflatorio +set interfaces ethernet eth1 duplex auto +set interfaces ethernet eth1 poe output off +set interfaces ethernet eth1 speed auto +set interfaces ethernet eth2 description Local +set interfaces ethernet eth2 duplex auto +set interfaces ethernet eth2 poe output off +set interfaces ethernet eth2 speed auto +set interfaces ethernet eth3 description Local +set interfaces ethernet eth3 duplex auto +set interfaces ethernet eth3 poe output off +set interfaces ethernet eth3 speed auto +set interfaces ethernet eth4 description Wifi +set interfaces ethernet eth4 duplex auto +set interfaces ethernet eth4 poe output 24v +set interfaces ethernet eth4 speed auto +set interfaces ethernet eth5 duplex auto +set interfaces ethernet eth5 mac '48:FD:8E:B5:98:49' +set interfaces ethernet eth5 speed auto +set interfaces loopback lo +set interfaces switch switch0 address 'fdb1:4242:3538:2008::1/64' +set interfaces switch switch0 address 192.168.11.1/24 +set interfaces switch switch0 address 'fdb1:4242:3538:2009::1/64' +set interfaces switch switch0 description Local +set interfaces switch switch0 ipv6 dup-addr-detect-transmits 1 +set interfaces switch switch0 ipv6 router-advert cur-hop-limit 64 +set interfaces switch switch0 ipv6 router-advert link-mtu 0 +set interfaces switch switch0 ipv6 router-advert managed-flag true +set interfaces switch switch0 ipv6 router-advert max-interval 600 +set interfaces switch switch0 ipv6 router-advert other-config-flag false +set interfaces switch switch0 ipv6 router-advert prefix '2a06:2240:f002:9900::0/64' autonomous-flag true +set interfaces switch switch0 ipv6 router-advert prefix '2a06:2240:f002:9900::0/64' on-link-flag true +set interfaces switch switch0 ipv6 router-advert prefix '2a06:2240:f002:9900::0/64' valid-lifetime 2592000 +set interfaces switch switch0 ipv6 router-advert prefix 'fdb1:4242:3538:2008::0/64' autonomous-flag true +set interfaces switch switch0 ipv6 router-advert prefix 'fdb1:4242:3538:2008::0/64' on-link-flag true +set interfaces switch switch0 ipv6 router-advert prefix 'fdb1:4242:3538:2008::0/64' valid-lifetime 2592000 +set interfaces switch switch0 ipv6 router-advert reachable-time 0 +set interfaces switch switch0 ipv6 router-advert retrans-timer 0 +set interfaces switch switch0 ipv6 router-advert send-advert true +set interfaces switch switch0 mtu 1500 +set interfaces switch switch0 switch-port interface eth1 +set interfaces switch switch0 switch-port interface eth2 +set interfaces switch switch0 switch-port interface eth3 +set interfaces switch switch0 switch-port interface eth4 +set interfaces switch switch0 switch-port vlan-aware disable +set interfaces wireguard wg1 address 'fdb1:4242:3538:2f02::b/64' +set interfaces wireguard wg1 description tnet-knot +set interfaces wireguard wg1 firewall in ipv6-name DN42v6_IN +set interfaces wireguard wg1 firewall local ipv6-name DN42v6_LOCAL +set interfaces wireguard wg1 mtu 1420 +set interfaces wireguard wg1 peer Up8+DhBlMp+/fpaxyGDQBnH/4tZnHojcAKZWCr5sSAk= allowed-ips '::0/0' +set interfaces wireguard wg1 peer Up8+DhBlMp+/fpaxyGDQBnH/4tZnHojcAKZWCr5sSAk= endpoint 'knot.inamo.no:51002' +set interfaces wireguard wg1 peer Up8+DhBlMp+/fpaxyGDQBnH/4tZnHojcAKZWCr5sSAk= persistent-keepalive 60 +set interfaces wireguard wg1 private-key 4IhYSjPBx5K2TuEYs2bl3rjaKSLdx3HNgbjn2BpJimg= +set interfaces wireguard wg1 route-allowed-ips false +set policy prefix-list6 bitraf-dn42 rule 1 action permit +set policy prefix-list6 bitraf-dn42 rule 1 description 'tnet subnetworks' +set policy prefix-list6 bitraf-dn42 rule 1 le 128 +set policy prefix-list6 bitraf-dn42 rule 1 prefix 'fdb1:4242:3538:2000::/60' +set policy route-map bitraf-dn42 rule 1 action permit +set policy route-map bitraf-dn42 rule 1 match ipv6 address prefix-list bitraf-dn42 +set protocols bgp 4242423538 address-family ipv6-unicast redistribute connected route-map bitraf-dn42 +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' address-family ipv6-unicast capability graceful-restart +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' address-family ipv6-unicast nexthop-self +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' address-family ipv6-unicast route-reflector-client +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' address-family ipv6-unicast soft-reconfiguration inbound +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' description knot +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' password trygvis +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' remote-as 4242423538 +set protocols bgp 4242423538 parameters graceful-restart +set protocols static route6 'fdb1:4242:3538:2008::/64' blackhole +set service dhcp-server disabled false +set service dhcp-server hostfile-update disable +set service dhcp-server shared-network-name LAN authoritative enable +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 default-router 192.168.11.1 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 dns-server 192.168.11.1 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 dns-server 8.8.8.8 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 lease 86400 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 start 192.168.11.100 stop 192.168.11.199 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping conflatorio ip-address 192.168.11.3 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping conflatorio mac-address '82:42:32:0c:71:61' +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping coregonus ip-address 192.168.11.4 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping coregonus mac-address '00:E0:4C:98:1B:B5' +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping teknisk ip-address 192.168.11.2 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping teknisk mac-address 'f4:e2:c6:1c:f9:e3' +set service dhcp-server static-arp disable +set service dhcp-server use-dnsmasq disable +set service dns forwarding cache-size 1000 +set service dns forwarding listen-on switch0 +set service gui http-port 80 +set service gui https-port 443 +set service gui older-ciphers enable +set service nat rule 5010 description 'masquerade for WAN' +set service nat rule 5010 outbound-interface eth0 +set service nat rule 5010 type masquerade +set service snmp community public authorization ro +set service snmp location lhn2ix +set service ssh port 22 +set service ssh protocol-version v2 +set service unms disable +set system analytics-handler send-analytics-report false +set system config-management commit-revisions 10 +set system crash-handler send-crash-report false +set system domain-name trygvis.io +set system host-name lhn2ix +set system login user ubnt authentication encrypted-password '$5$Wu8xmYAo9yxLxQbq$HgzV.0uev3uJmtEfp7/GJnaw2ZIxICAlRr1Y8YbU/pB' +set system login user ubnt authentication plaintext-password '' +set system login user ubnt authentication public-keys trygvis@biwia key AAAAC3NzaC1lZDI1NTE5AAAAIK3NIIYprtLQFNut7GGf0va7YYFeSXKSgWDQi4qbf5Ph +set system login user ubnt authentication public-keys trygvis@biwia type ssh-ed25519 +set system login user ubnt full-name '' +set system login user ubnt level admin +set system name-server 8.8.8.8 +set system ntp server 0.ubnt.pool.ntp.org +set system ntp server 1.ubnt.pool.ntp.org +set system ntp server 2.ubnt.pool.ntp.org +set system ntp server 3.ubnt.pool.ntp.org +set system syslog console facility all level debug +set system syslog global facility all level notice +set system syslog global facility protocols level debug +set system time-zone Europe/Oslo diff --git a/docs/2025-05 - tnet.drawio b/docs/2025-05 - tnet.drawio new file mode 100644 index 0000000..dd34e80 --- /dev/null +++ b/docs/2025-05 - tnet.drawio @@ -0,0 +1,122 @@ +<mxfile host="Electron" modified="2025-05-15T20:07:23.594Z" agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/22.0.2 Chrome/114.0.5735.289 Electron/25.8.4 Safari/537.36" etag="dOQjW2HOEjVxAzMLv_4_" version="22.0.2" type="device"> + <diagram name="Page-1" id="3tc4ToPB8LTOAe-fqp2l"> + <mxGraphModel dx="1185" dy="685" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1169" pageHeight="827" math="0" shadow="0"> + <root> + <mxCell id="0" /> + <mxCell id="1" parent="0" /> + <mxCell id="sc4hc9jCg4AFeJkXXveA-4" value="tnet-coregonus::ffff/64" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;labelPosition=center;verticalLabelPosition=middle;align=center;verticalAlign=middle;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-5"> + <mxGeometry x="-0.4562" y="-3" relative="1" as="geometry"> + <mxPoint x="565" y="140" as="targetPoint" /> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-10" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;entryX=0.764;entryY=0.179;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-8"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-1" value="coregonus" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="460" y="200" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-5" value="fdb1:4242:3538:2005::/64" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="130" y="60" width="220" height="80" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-9" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-6" target="sc4hc9jCg4AFeJkXXveA-8"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-6" value="akili" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="70" y="474" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-7" value="" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;labelPosition=left;verticalLabelPosition=top;align=right;verticalAlign=bottom;endArrow=none;endFill=0;exitX=0.168;exitY=-0.003;exitDx=0;exitDy=0;exitPerimeter=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-6" target="sc4hc9jCg4AFeJkXXveA-5"> + <mxGeometry x="-1" relative="1" as="geometry"> + <mxPoint x="489" y="210" as="sourcePoint" /> + <mxPoint x="389" y="136" as="targetPoint" /> + <Array as="points"> + <mxPoint x="90" y="190" /> + </Array> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-8" value="kv24-isp::/64" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="290" y="474" width="220" height="80" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-11" value="" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="930" y="300" width="220" height="80" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-13" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-14"> + <mxGeometry relative="1" as="geometry"> + <mxPoint x="251" y="270" as="sourcePoint" /> + <mxPoint x="338" y="398" as="targetPoint" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-14" value="hash" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="770" y="30" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-15" value="knot" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="790" y="130" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-16" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-15"> + <mxGeometry relative="1" as="geometry"> + <mxPoint x="590" y="225" as="sourcePoint" /> + <mxPoint x="710" y="195" as="targetPoint" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-17" value="tunnelbroker/he" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="830" y="414" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-19" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-17"> + <mxGeometry relative="1" as="geometry"> + <mxPoint x="590" y="245" as="sourcePoint" /> + <mxPoint x="710" y="255" as="targetPoint" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-20" value="2001:470:27:791::2/64%he" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelPosition=center;verticalLabelPosition=middle;" vertex="1" connectable="0" parent="sc4hc9jCg4AFeJkXXveA-19"> + <mxGeometry x="-0.8905" relative="1" as="geometry"> + <mxPoint x="14" y="6" as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-21" value="2001:470:27:791::1/64" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelPosition=center;verticalLabelPosition=middle;" vertex="1" connectable="0" parent="sc4hc9jCg4AFeJkXXveA-19"> + <mxGeometry x="0.9128" relative="1" as="geometry"> + <mxPoint x="-16" y="-7" as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-22" value="tunnelbroker #958887<br>2001:470:28:791::/64" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="130" y="280" width="220" height="80" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-23" value="wg0" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-15"> + <mxGeometry relative="1" as="geometry"> + <mxPoint x="670" y="240" as="sourcePoint" /> + <mxPoint x="800" y="183" as="targetPoint" /> + <Array as="points"> + <mxPoint x="690" y="230" /> + </Array> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-24" value="2001:470:28:791::aaaa%br0" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;labelPosition=center;verticalLabelPosition=middle;align=center;verticalAlign=middle;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-6" target="sc4hc9jCg4AFeJkXXveA-22"> + <mxGeometry x="-0.4852" y="-20" relative="1" as="geometry"> + <mxPoint x="159" y="210" as="sourcePoint" /> + <mxPoint x="284" y="134" as="targetPoint" /> + <Array as="points" /> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-25" value="2001:470:28:791::ffff%enp2s0" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;labelPosition=center;verticalLabelPosition=middle;align=center;verticalAlign=middle;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-22" target="sc4hc9jCg4AFeJkXXveA-1"> + <mxGeometry x="0.1216" y="-1" relative="1" as="geometry"> + <mxPoint x="141" y="350" as="sourcePoint" /> + <mxPoint x="225" y="262" as="targetPoint" /> + <Array as="points" /> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-30" value="" style="endArrow=none;html=1;rounded=0;edgeStyle=orthogonalEdgeStyle;curved=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;exitX=0.322;exitY=-0.011;exitDx=0;exitDy=0;exitPerimeter=0;" edge="1" parent="1"> + <mxGeometry width="50" height="50" relative="1" as="geometry"> + <mxPoint x="108.63999999999987" y="473.99999999999994" as="sourcePoint" /> + <mxPoint x="460" y="230.66" as="targetPoint" /> + <Array as="points"> + <mxPoint x="110" y="474" /> + <mxPoint x="110" y="231" /> + </Array> + </mxGeometry> + </mxCell> + </root> + </mxGraphModel> + </diagram> +</mxfile> diff --git a/terraform/dns/dn42.tf b/terraform/dns/dn42.tf index c7aab96..e23af28 100644 --- a/terraform/dns/dn42.tf +++ b/terraform/dns/dn42.tf @@ -11,7 +11,7 @@ resource "linode_domain_record" "dn42-coregonus" { domain_id = linode_domain.root.id name = "coregonus.dn42" record_type = "AAAA" - target = "fdb1:4242:3538:2006:2e0:4cff:fe98:1bb5" + target = "fdb1:4242:3538:2009::4" } resource "linode_domain_record" "dn42-danneri" { @@ -77,6 +77,13 @@ resource "linode_domain_record" "dn42-lhn2-z2m" { target = "fdb1:4242:3538:2008:9aed:e460:1711:7dd" } +resource "linode_domain_record" "dn42-lhn2ix" { + domain_id = linode_domain.root.id + name = "lhn2ix.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2008::1" +} + resource "linode_domain_record" "dn42-lhn2pi" { domain_id = linode_domain.root.id name = "lhn2pi.dn42" diff --git a/terraform/dns/trygvis.tf b/terraform/dns/trygvis.tf index 5dfc8cb..a19efcf 100644 --- a/terraform/dns/trygvis.tf +++ b/terraform/dns/trygvis.tf @@ -176,7 +176,7 @@ resource "linode_domain_record" "kv24ix" { domain_id = linode_domain.root.id name = "kv24ix" record_type = "A" - target = "81.166.205.176" + target = "81.166.17.37" } resource "linode_domain_record" "lhn2" { diff --git a/terraform/garasjepi-zigbee2mqtt/main.tf b/terraform/garasjepi-zigbee2mqtt/main.tf index 1321115..df23aea 100644 --- a/terraform/garasjepi-zigbee2mqtt/main.tf +++ b/terraform/garasjepi-zigbee2mqtt/main.tf @@ -12,9 +12,9 @@ provider "docker" { } locals { - host = "garasjepi.dn42.trygvis.io" - version = "2.3.0" - public_ip = module.ipam.hosts.garasjepi.address + host = "garasjepi.dn42.trygvis.io" + version = "2.6.0" + public_ip = module.ipam.hosts.garasjepi.address } module "ipam" { diff --git a/terraform/ipam6/ipam6.tf b/terraform/ipam6/ipam6.tf index 08ad9a0..84c7a87 100644 --- a/terraform/ipam6/ipam6.tf +++ b/terraform/ipam6/ipam6.tf @@ -54,24 +54,6 @@ output "networks" { } } } - coregonus_dn42 = { - range = "fdb1:4242:3538:2005::/64" - address = "fdb1:4242:3538:2005::" - prefix = "64" - hosts = { - kjell = { - address : "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c" - prefix : "64" - } - } - } - coregonus_docker = { - range = "fdb1:4242:3538:2005:df01:676a:ec28:0a00/120" - address = "fdb1:4242:3538:2005:df01:676a:ec28:a00" - prefix = "120" - hosts = { - } - } kv24_pub = { range = "2a01:799:111d:1801::/64" address = "2a01:799:111d:1801::" @@ -100,8 +82,8 @@ output "networks" { address : "fdb1:4242:3538:2006:be24:11ff:febb:5c7f" prefix : "64" } - coregonus = { - address : "fdb1:4242:3538:2006:2e0:4cff:fe98:1bb5" + kjell = { + address : "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c" prefix : "64" } } @@ -129,6 +111,10 @@ output "networks" { address = "fdb1:4242:3538:2008::" prefix = "64" hosts = { + lhn2ix = { + address : "fdb1:4242:3538:2008::1" + prefix : "128" + } lhn2pi = { address : "fdb1:4242:3538:2008::ffff" prefix : "128" @@ -155,6 +141,17 @@ output "networks" { } } } + lhn2_service = { + range = "fdb1:4242:3538:2009::/64" + address = "fdb1:4242:3538:2009::" + prefix = "64" + hosts = { + coregonus = { + address : "fdb1:4242:3538:2009::4" + prefix : "64" + } + } + } danneri_cluster = { range = "fdb1:4242:3538:2008:aaaa:aaaa:aaaa::/112" address = "fdb1:4242:3538:2008:aaaa:aaaa:aaaa:0" @@ -193,10 +190,6 @@ output "hosts" { address : "fdb1:4242:3538:2004::ffff" prefix : "128" } - kjell = { - address : "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c" - prefix : "64" - } kv24ix = { address : "fdb1:4242:3538:2006::ffff" prefix : "128" @@ -213,14 +206,18 @@ output "hosts" { address : "fdb1:4242:3538:2006:be24:11ff:febb:5c7f" prefix : "64" } - coregonus = { - address : "fdb1:4242:3538:2006:2e0:4cff:fe98:1bb5" + kjell = { + address : "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c" prefix : "64" } hash = { address : "fdb1:4242:3538:2007::ffff" prefix : "128" } + lhn2ix = { + address : "fdb1:4242:3538:2008::1" + prefix : "128" + } lhn2pi = { address : "fdb1:4242:3538:2008::ffff" prefix : "128" @@ -245,5 +242,9 @@ output "hosts" { address : "fdb1:4242:3538:2008:5054:ff:fe4d:96c" prefix : "128" } + coregonus = { + address : "fdb1:4242:3538:2009::4" + prefix : "64" + } } } diff --git a/terraform/lhn2pi-zigbee2mqtt/main.tf b/terraform/lhn2pi-zigbee2mqtt/main.tf index 2857b99..f9a6adf 100644 --- a/terraform/lhn2pi-zigbee2mqtt/main.tf +++ b/terraform/lhn2pi-zigbee2mqtt/main.tf @@ -12,8 +12,8 @@ provider "docker" { } locals { - host = "lhn2pi.dn42.trygvis.io" - docker_image = "koenkk/zigbee2mqtt:1.42.0" + host = "lhn2pi.dn42.trygvis.io" + version = "2.3.0" public_ip = module.ipam.hosts.lhn2pi.address } @@ -24,6 +24,7 @@ module "ipam" { module "zigbee2mqtt" { source = "../modules/zigbee2mqtt" - public_ip = local.public_ip - serial_port = "/dev/serial/by-id/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2688076-if00" + docker_version = local.version + public_ip = local.public_ip + serial_port = "/dev/serial/by-id/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2688076-if00" } diff --git a/tnet/host_vars/knot/wg.yml b/tnet/host_vars/knot/wg.yml index 9ad867e..e64a4a6 100644 --- a/tnet/host_vars/knot/wg.yml +++ b/tnet/host_vars/knot/wg.yml @@ -6,10 +6,11 @@ tnet_wg: address: fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7c lhn2ix: port: 51002 - address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9a +# address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9a + address: fdb1:4242:3538:2f02::a kv24ix: port: 51003 - address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7ce + address: fdb1:4242:3538:2f01::a akili: port: 51004 address: fdb1:4242:3538:ffff:59d7:cf77:8b5d:761a @@ -37,3 +38,8 @@ tnet_wg: if_name: coregonus port: 51011 address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2 + kioubit_de2: + if_name: kioubit_d2 + endpoint: de2.g-load.eu:23538 + port: 51012 + address: fe80::ade1 diff --git a/tnet/host_vars/kv24ix/wg.yml b/tnet/host_vars/kv24ix/wg.yml index 99c54b6..4a4c833 100644 --- a/tnet/host_vars/kv24ix/wg.yml +++ b/tnet/host_vars/kv24ix/wg.yml @@ -1,3 +1,4 @@ tnet_wg: knot: - address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf +# address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9b + address: fdb1:4242:3538:2f02::b/64 diff --git a/tnet/keys/wg-kioubit_de2-knot.pub b/tnet/keys/wg-kioubit_de2-knot.pub new file mode 100644 index 0000000..aed317e --- /dev/null +++ b/tnet/keys/wg-kioubit_de2-knot.pub @@ -0,0 +1 @@ +B1xSG/XTJRLd+GrWDsB06BqnIq8Xud93YVh/LYYYtUY= diff --git a/tnet/keys/wg-knot-kioubit_de2.pub b/tnet/keys/wg-knot-kioubit_de2.pub new file mode 100644 index 0000000..a8d0922 --- /dev/null +++ b/tnet/keys/wg-knot-kioubit_de2.pub @@ -0,0 +1 @@ +7QJdCBlpvYWHyg33ifsifWmV/bV6RgUct4lh0ykCK1g= diff --git a/tnet/keys/wg-knot-kioubit_de2.sops.key b/tnet/keys/wg-knot-kioubit_de2.sops.key new file mode 100644 index 0000000..6f699b0 --- /dev/null +++ b/tnet/keys/wg-knot-kioubit_de2.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:pj1LPjdqo+M/GlgWA63LNH/lM7F5rOYeMF1a0qNuBm6/luo5PvRYBj2jyLxa,iv:qlIvXCBXd9dyC6tj9WH0mq3jomzSUc4maPg9zPIvDbM=,tag:cSHZFa18BISZ9owjkHVkVw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MTdPUUFNU0FXcTZWckZJ\nSXV2a3ZQVmE0T3BNTVByMGp0L3ZvZERyNEFjCmFjcmRpeXU5S2tlTnp3NXBPKzl4\nZ1doRVZ0TTYwZkkvSU5RNitySUJoTWsKLS0tIGlsNzJHL0FydVRXT3puT0RuR0R2\nZGZSaXFOWFB2YkoyMi8rZ0tBL2xxbjAKDPy+8yB95EZZq542FtuI3vo4NmcDrVO5\njOvYGmatpxqSZJ9Oy4HpMzKSWvSuKVkZwTcG7Zzrhi6qrhm/TKIRvQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0dGlteEludXNpampzd0lD\nTGtQYjIwV3dEbVlEYUJOTlRXZDJYTGNpM1dzCncxMWg4R0J4aVQxQWlvQXY2ZmFH\nWjlxckFWZ2IzMnNENDZHeGFPUlJtVXMKLS0tIHJET2RLL1dBVURwdHhMZGpiMHlW\nblFaQTlDRDE4TmN6SDBnbTVpa3d1eEkKReWQml+gnXRCFbQtF5tFm8vUrALnY+QB\n/dki/g35K2I4tzyPg7qPgKEdGGUYcPTfg1Fyf2m7Q7xXJ7Xg7T1flA==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNTltblFtRGVLM2xSTGp1\nVjFNMzBaNHJ2WmZTeUlON25GZE5hSUF5QVdFCmFQb28xK2dDVFdzcS9hSTZGRnRv\nSDBDNWNGb3lWVFVmNk9VR1N5TTRkd1kKLS0tIHBhZVp3d3U4UzlDK0ZkaWRxdTA5\nelBrVFVId1IydVpOcXl2R2x3SDZlNlkKNB7tdDL9QdglbbN/za18BBbWDEEvgZcr\nIHEiz1UJZZYdKEsfk1w0LRE9IKhh7LdL11hCtfO/2uTVY/4ghDFHcA==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2025-06-30T17:13:23Z", + "mac": "ENC[AES256_GCM,data:zY63cqqaceaSuyIBi06jQcwuUaR/bD8h1EL0B+2M8SLTdPQAQ88cDzWze8NjpN2WqPYsxGNo2RYZe0YPXg3ymEJ9YeOvOBzALUZvf7geF7KOoNAqzzieWmIjt7K6Xmq8w1LmsEN3oM8oUU/vNiNoXLHpcD+/Yamu2d0CGr32TZU=,iv:Aj7Hop2etAvJrfsFrvoag0bvKlaMrJySdea3t4cK9c8=,tag:kN4Tn6kiKEwFy0RW6i/HDA==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.9.1" + } +}
\ No newline at end of file diff --git a/tnet/wg-links.yml b/tnet/wg-links.yml index a050547..6613614 100644 --- a/tnet/wg-links.yml +++ b/tnet/wg-links.yml @@ -6,6 +6,7 @@ handlers: # Has to be restart for now, hash doesn't support reloading networkd - name: systemctl restart systemd-networkd + #when: false become: yes systemd: name: systemd-networkd |