diff options
32 files changed, 1535 insertions, 67 deletions
diff --git a/ansible/group_vars/all/ipam.yml b/ansible/group_vars/all/ipam.yml index 0d49b1b..f0ce96c 100644 --- a/ansible/group_vars/all/ipam.yml +++ b/ansible/group_vars/all/ipam.yml @@ -25,21 +25,16 @@ ipam6: range: "fdb1:4242:3538:2004::/64" hosts: knot: "fdb1:4242:3538:2004::ffff" - coregonus_dn42: - range: "fdb1:4242:3538:2005::/64" - hosts: - coregonus: "fdb1:4242:3538:2005::ffff" - coregonus_docker: - range: "fdb1:4242:3538:2005:df01:676a:ec28:0a00/120" kv24_pub: range: "2a01:799:111d:1801::/64" - hosts: - ha-kv24: "fdb1:4242:3538:2005:c534:9d54:8212:1ced/64" kv24_dn42: range: "fdb1:4242:3538:2006::/64" hosts: kv24ix: "fdb1:4242:3538:2006::ffff" - garasjepi: "fdb1:4242:3538:2005:37df:fafe:392:f991" + garasjepi: "fdb1:4242:3538:2006:e9f7:418f:49fd:8d2e" + ha-kv24: "fdb1:4242:3538:2006:18a:90f:4264:8ca0/64" + netbox: "fdb1:4242:3538:2006:be24:11ff:febb:5c7f/64" + kjell: "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c/64" hash_dn42: range: "fdb1:4242:3538:2007::/64" hosts: @@ -49,12 +44,17 @@ ipam6: lhn2_dn42: range: "fdb1:4242:3538:2008::/64" hosts: + lhn2ix: "fdb1:4242:3538:2008::1" lhn2pi: "fdb1:4242:3538:2008::ffff" lhn2-z2m: "fdb1:4242:3538:2008:9aed:e460:1711:07dd" ha-lhn2: "fdb1:4242:3538:2008:9c59:926f:1dc9:89db" conflatorio: "fdb1:4242:3538:2008:8042:32ff:fe0c:7161" danneri: "fdb1:4242:3538:2008:9422:d355:95b7:f170" unifi: "fdb1:4242:3538:2008:5054:ff:fe4d:96c" + lhn2_service: + range: "fdb1:4242:3538:2009::/64" + hosts: + coregonus: "fdb1:4242:3538:2009::4/64" # k8s: # range: "fdb1:4242:3538:3000::/52" diff --git a/ansible/host_vars/kjell-ct-102/traefik-server.yml b/ansible/host_vars/kjell-ct-102/traefik-server.yml new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/ansible/host_vars/kjell-ct-102/traefik-server.yml diff --git a/ansible/host_vars/kjell-ct-102/users.yml b/ansible/host_vars/kjell-ct-102/users.yml new file mode 100644 index 0000000..d0d4852 --- /dev/null +++ b/ansible/host_vars/kjell-ct-102/users.yml @@ -0,0 +1,5 @@ +lusers: + - trygvis + +superusers: + - trygvis diff --git a/ansible/inventory b/ansible/inventory index 1684d93..912b922 100644 --- a/ansible/inventory +++ b/ansible/inventory @@ -59,6 +59,10 @@ all: zh2569.rsync.net: ansible_user: zh2569 + # Kjell + kjell-ct-102: + ansible_host: fdb1:4242:3538:2005:be24:11ff:fe34:b52c + children: workstation: children: diff --git a/ansible/netbox/pyproject.toml b/ansible/netbox/pyproject.toml new file mode 100644 index 0000000..84c0d6d --- /dev/null +++ b/ansible/netbox/pyproject.toml @@ -0,0 +1,10 @@ +[project] +name = "netbox" +version = "0.1.0" +description = "Add your description here" +readme = "README.md" +requires-python = ">=3.12" +dependencies = [ + "unifi-controller-api", + "pynetbox", +] diff --git a/ansible/netbox/sync-unifi.py b/ansible/netbox/sync-unifi.py new file mode 100644 index 0000000..4427b20 --- /dev/null +++ b/ansible/netbox/sync-unifi.py @@ -0,0 +1,363 @@ +import os +import sys +from unifi_controller_api import UnifiController, UnifiDevice +from unifi_controller_api.exceptions import UnifiAuthenticationError, UnifiAPIError +from pprint import pprint + +import pynetbox +from pynetbox.core.response import Record + +class Db(): + def __init__(self): + self.devices = [] + self.interfaces = [] + self.ips = [] + self.macs = [] + self.cables = [] + +class NotFoundException(Exception): + def __init__(self, msg): + super().__init__(msg) + +class Query(): + def __init__(self, args, query, projection=lambda x: x.id): + self.args = args + self.query = query + self.projection = projection + + def run(self, nb): + try: + ret = self.query() + except Exception as e: + print("Query failed: ") + print(f"Arguments: {value.args}") + print(e) + raise e + + if ret is None: + raise NotFoundException(f"resource not found, args={self.args}") + +# if len(ret) != 1: +# raise NotFoundException(f"multiple resources found, args={self.args}, result={ret}") + + return self.projection(ret) + +def find_device(nb, name: str): + return Query({}, lambda: nb.dcim.devices.get(name=name)) + +def find_interface_by_mac(nb, mac_address: str): + args = locals() + del args["nb"] + return Query(args, lambda: nb.dcim.interfaces.get(mac_address=mac_address)) + +def find_interface(nb, device: str, name: str): + args = locals() + del args["nb"] + return Query(args, lambda: nb.dcim.interfaces.get(device=device, name=name)) + +class NetboxCache(): + def __init__(self, nb): + self.nb = nb + self.device_roles = {} + self.device_types = {} + self.ip_addresses = {} + + def get_device_role(self, slug): + dt = self.device_roles.get(slug) + + if dt is not None: + return dt + + dt = self.nb.dcim.device_roles.get(slug=slug) + if dt is None: + raise Exception(f"No such device type: {slug}") + + self.device_roles[slug] = dt + return dt + + def get_device_type(self, slug): + dt = self.device_types.get(slug) + + if dt is not None: + return dt + + dt = self.nb.dcim.device_types.get(slug=slug) + if dt is None: + raise Exception(f"No such device type: {slug}") + + self.device_types[slug] = dt + return dt + + def get_or_create_ip_address(self, addr: str, vrf: Record | None, data): + vrf_id = vrf.id if vrf is not None else None + key = (addr, vrf_id) + ip = self.ip_addresses.get(key) + if ip is not None: + return ip + + ip = self.nb.ipam.ip_addresses.get(address=addr, vrf_id=vrf_id) + if ip is not None: + print(f"Found IP address {ip.id} address={ip.address}, vrf={ip.vrf}") + ip.update(data) + ip = self.nb.ipam.ip_addresses.get(address=addr, vrf_id=vrf_id) + self.ip_addresses[key] = ip + return ip + + ip = self.nb.ipam.ip_addresses.create(address=addr, vrf=vrf_id, status="active") + self.ip_addresses[key] = ip + return ip + +def create_or_update_device(nb, d): + device = nb.dcim.devices.get(name = d["name"]) + if device is None: + device = nb.dcim.devices.create(d) + print(f"Created device id={device.id}, name={device.name}") + + return device + + print(f"Updating device id={device.id}, name={device.name}") + device.update(d) + + return nb.dcim.devices.get(id=device.id) + +def create_or_update_interface(nb, i): + iface = nb.dcim.interfaces.get(device_id=i["device"], name=i["name"]) + if iface is None: + iface = nb.dcim.interfaces.create(i) + print(f"Created interface id={iface.id}, name={iface.name}") + + return iface + + print(f"Updating interface id={iface.id}, name={iface.name}") + iface.update(i) + return nb.dcim.interfaces.get(id=iface.id) + +def create_or_update_mac_address(nb, data): + ma = nb.dcim.mac_addresses.get(mac_address=data["mac_address"]) + if ma is None: + ma = nb.dcim.mac_addresses.create(data) + print(f"Created MAC address id={ma.id}, address={ma.mac_address}") + + return ma + + print(f"Updating MAC address id={ma.id}, address={ma.mac_address}") + ma.update(data) + return nb.dcim.mac_addresses.get(id=ma.id) + +def create_or_update_ip_address(nb, data): + ip = nb.ipam.ip_addresses.get(address=data["address"]) + if ip is None: + ip = nb.ipam.ip_addresses.create(data) + print(f"Created IP address id={ip.id}, ip={ip.address}") + + return ip + + print(f"Updating IP address id={ip.id}, ip={ip.address}") + ip.update(data) + return nb.ipam.ip_addresses.get(id=ip.id) + +def create_or_update_cable(nb, data): + if len(data["a_terminations"]) == 1: + a = data["a_terminations"][0] + else: + raise Exception("only single termination is supported") + + if len(data["b_terminations"]) == 1: + b = data["b_terminations"][0] + else: + raise Exception("only single termination is supported") + + cable = nb.dcim.cables.get( + termination_a_type=a["object_type"], + termination_a_id=a["object_id"], + termination_b_type=b["object_type"], + termination_b_id=b["object_id"], + ) + if cable is None: + cable = nb.dcim.cables.create(data) + print(f"Created Cable address id={ip.id}") + + return cable + + print(f"Updating cable id={ip.id}") + cable.update(data) + return nb.dcim.cables.get(id=cable.id) + +def process_switch(d: UnifiDevice, db: Db, nb: NetboxCache, site, vrf): +# db.devices.append({ +# "name": d.name, +# "device_type": nb.get_device_type("ubiquiti-us-8-150w").id, +# "role": nb.get_device_role("switch").id, +# "serial": d.serial, +# "site_name": site, +# }) +# +# db.interfaces.append({ +# "device": find_device(nb.nb, name=d.name), +# "name": "switch0", +# "type": "virtual", +# }) +# +# db.ips.append({ +# "address": f"{d.ip}/32", +# "is_primary": "true", +# "vrf": vrf.id, +# "assigned_object_id": find_interface(nb.nb, device=d.name, name="switch0"), +# "assigned_object_type": "dcim.interface", +## "is_primary": "true" TODO: does not work +# }) +# +# db.macs.append({ +# "mac_address": d.mac, +# "assigned_object_id": find_interface(nb.nb, device=d.name, name="switch0"), +# "assigned_object_type": "dcim.interface", +## "is_primary": "true" TODO: does not work +# }) + + pprint(d.lldp_info) + + for e in d.lldp_info: + a = [ + { + "object_type": "dcim.interface", + "object_id": find_interface(nb.nb, device=d.name, name=f"Port {e.local_port_idx} (PoE)"), + } + ] + b = [ + { + "object_type": "dcim.interface", + "object_id": find_interface_by_mac(nb.nb, e.chassis_id), + } + ] + + if e.chassis_id > d.mac: + a, b = b, a + + db.cables.append({ + "a_terminations": a, + "b_terminations": b, + "status": "connected", + }) + +def sync_db(db: Db, nb): + def resolve_query(value): + if value is None or isinstance(value, str) or isinstance(value, int): + return value + elif isinstance(value, Query): + return value.run(nb) + elif isinstance(value, dict): + for k, v in value.items(): + value[k] = resolve_query(v) + elif isinstance(value, list): + for i, item in enumerate(value): + value[i] = resolve_query(item) + else: + raise Exception(f"unsupported type: {value}") + return value + + for device in db.devices: + device = resolve_query(device) + create_or_update_device(nb, device) + + for iface in db.interfaces: + iface = resolve_query(iface) + create_or_update_interface(nb, iface) + + for mac in db.macs: + mac = resolve_query(mac) + create_or_update_mac_address(nb, mac) + + for ip in db.ips: + ip = resolve_query(ip) + create_or_update_ip_address(nb, ip) + + for cable in db.cables: + try: + cable = resolve_query(cable) + pprint(cable) + create_or_update_cable(nb, cable) + except NotFoundException: + print("Cable failed, could not find endpoint") + continue + +def main(): + unifi_url=os.getenv("UNIFI_URL") + unifi_username=os.getenv("UNIFI_USERNAME") + unifi_password=os.getenv("UNIFI_PASSWORD") + unifi_site=os.getenv("UNIFI_SITE") + + netbox_url=os.getenv("NETBOX_URL") + netbox_token=os.getenv("NETBOX_TOKEN") + netbox_vrf_name=os.getenv("NETBOX_VRF") + netbox_site_name=os.getenv("NETBOX_SITE") + + controller = controller_login(unifi_url, unifi_username, unifi_password) + + (nb, netbox_site, netbox_vrf) = netbox_login(netbox_url, netbox_token, netbox_site_name, netbox_vrf_name) + status = nb.status() + print(f"NetBox status: {status}") + + devices = collect_devices(controller, unifi_site) + + nb_cache = NetboxCache(nb) + db = Db() + for d in devices: +# pprint(d) + if d.model == "US8P150": + process_switch(d, db, nb_cache, netbox_site, netbox_vrf) + + sync_db(db, nb) + +def controller_login(url, username, password) -> UnifiController: +# try: + controller = UnifiController( + controller_url=url, + username=username, + password=password, + is_udm_pro=False, + verify_ssl=True, + ) + + # Just to check that there is a valid authentication + controller.get_unifi_site(include_health=False, raw=False) + + return controller +# except UnifiAuthenticationError: +# print("Authentication failed - please check your UniFi Controller credentials and URL.") +# except UnifiAPIError as e: +# print(f"UniFi API error: {e}") +# except Exception as e: +# print(f"An unexpected error occurred: {e}") + +def collect_devices(controller: UnifiController, site_name: str) -> list[UnifiDevice]: + try: + return controller.get_unifi_site_device(site_name=site_name, detailed=True, raw=False) + except UnifiAPIError as e: + print(f"Error fetching device information: {e}") + except Exception as e: + print(f"An unexpected error occurred: {e}") + +def netbox_login(url: str, token: str, site_name: str, vrf_name: str) -> pynetbox.core.api.Api: + nb = pynetbox.api(url, token=token) + + site = nb.dcim.sites.get(name=site_name) + if site is None: + site = nb.dcim.sites.get(slug=site_name) + if site is None: + print(f"Could not look up site by name or slug: {site_name}") + exit(1) + print(f"NetBox site {site.name}") + + vrf = None + vrf_id = None + if vrf_name is not None: + vrf = nb.ipam.vrfs.get(site=site, name=vrf_name) + if vrf is None: + print(f"Could not look up VRF by slug: {vrf_name}") + exit(1) + vrf_id = vrf.id + + return nb, site, vrf + +if __name__ == "__main__": + main() diff --git a/ansible/netbox/uv.lock b/ansible/netbox/uv.lock new file mode 100644 index 0000000..96a71dd --- /dev/null +++ b/ansible/netbox/uv.lock @@ -0,0 +1,129 @@ +version = 1 +revision = 2 +requires-python = ">=3.12" + +[[package]] +name = "certifi" +version = "2025.4.26" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload-time = "2025-04-26T02:12:29.51Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload-time = "2025-04-26T02:12:27.662Z" }, +] + +[[package]] +name = "charset-normalizer" +version = "3.4.2" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/e4/33/89c2ced2b67d1c2a61c19c6751aa8902d46ce3dacb23600a283619f5a12d/charset_normalizer-3.4.2.tar.gz", hash = "sha256:5baececa9ecba31eff645232d59845c07aa030f0c81ee70184a90d35099a0e63", size = 126367, upload-time = "2025-05-02T08:34:42.01Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/d7/a4/37f4d6035c89cac7930395a35cc0f1b872e652eaafb76a6075943754f095/charset_normalizer-3.4.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0c29de6a1a95f24b9a1aa7aefd27d2487263f00dfd55a77719b530788f75cff7", size = 199936, upload-time = "2025-05-02T08:32:33.712Z" }, + { url = "https://files.pythonhosted.org/packages/ee/8a/1a5e33b73e0d9287274f899d967907cd0bf9c343e651755d9307e0dbf2b3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cddf7bd982eaa998934a91f69d182aec997c6c468898efe6679af88283b498d3", size = 143790, upload-time = "2025-05-02T08:32:35.768Z" }, + { url = "https://files.pythonhosted.org/packages/66/52/59521f1d8e6ab1482164fa21409c5ef44da3e9f653c13ba71becdd98dec3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a", size = 153924, upload-time = "2025-05-02T08:32:37.284Z" }, + { url = "https://files.pythonhosted.org/packages/86/2d/fb55fdf41964ec782febbf33cb64be480a6b8f16ded2dbe8db27a405c09f/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d41c4d287cfc69060fa91cae9683eacffad989f1a10811995fa309df656ec214", size = 146626, upload-time = "2025-05-02T08:32:38.803Z" }, + { url = "https://files.pythonhosted.org/packages/8c/73/6ede2ec59bce19b3edf4209d70004253ec5f4e319f9a2e3f2f15601ed5f7/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4e594135de17ab3866138f496755f302b72157d115086d100c3f19370839dd3a", size = 148567, upload-time = "2025-05-02T08:32:40.251Z" }, + { url = "https://files.pythonhosted.org/packages/09/14/957d03c6dc343c04904530b6bef4e5efae5ec7d7990a7cbb868e4595ee30/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cf713fe9a71ef6fd5adf7a79670135081cd4431c2943864757f0fa3a65b1fafd", size = 150957, upload-time = "2025-05-02T08:32:41.705Z" }, + { url = "https://files.pythonhosted.org/packages/0d/c8/8174d0e5c10ccebdcb1b53cc959591c4c722a3ad92461a273e86b9f5a302/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a370b3e078e418187da8c3674eddb9d983ec09445c99a3a263c2011993522981", size = 145408, upload-time = "2025-05-02T08:32:43.709Z" }, + { url = "https://files.pythonhosted.org/packages/58/aa/8904b84bc8084ac19dc52feb4f5952c6df03ffb460a887b42615ee1382e8/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:a955b438e62efdf7e0b7b52a64dc5c3396e2634baa62471768a64bc2adb73d5c", size = 153399, upload-time = "2025-05-02T08:32:46.197Z" }, + { url = "https://files.pythonhosted.org/packages/c2/26/89ee1f0e264d201cb65cf054aca6038c03b1a0c6b4ae998070392a3ce605/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:7222ffd5e4de8e57e03ce2cef95a4c43c98fcb72ad86909abdfc2c17d227fc1b", size = 156815, upload-time = "2025-05-02T08:32:48.105Z" }, + { url = "https://files.pythonhosted.org/packages/fd/07/68e95b4b345bad3dbbd3a8681737b4338ff2c9df29856a6d6d23ac4c73cb/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:bee093bf902e1d8fc0ac143c88902c3dfc8941f7ea1d6a8dd2bcb786d33db03d", size = 154537, upload-time = "2025-05-02T08:32:49.719Z" }, + { url = "https://files.pythonhosted.org/packages/77/1a/5eefc0ce04affb98af07bc05f3bac9094513c0e23b0562d64af46a06aae4/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:dedb8adb91d11846ee08bec4c8236c8549ac721c245678282dcb06b221aab59f", size = 149565, upload-time = "2025-05-02T08:32:51.404Z" }, + { url = "https://files.pythonhosted.org/packages/37/a0/2410e5e6032a174c95e0806b1a6585eb21e12f445ebe239fac441995226a/charset_normalizer-3.4.2-cp312-cp312-win32.whl", hash = "sha256:db4c7bf0e07fc3b7d89ac2a5880a6a8062056801b83ff56d8464b70f65482b6c", size = 98357, upload-time = "2025-05-02T08:32:53.079Z" }, + { url = "https://files.pythonhosted.org/packages/6c/4f/c02d5c493967af3eda9c771ad4d2bbc8df6f99ddbeb37ceea6e8716a32bc/charset_normalizer-3.4.2-cp312-cp312-win_amd64.whl", hash = "sha256:5a9979887252a82fefd3d3ed2a8e3b937a7a809f65dcb1e068b090e165bbe99e", size = 105776, upload-time = "2025-05-02T08:32:54.573Z" }, + { url = "https://files.pythonhosted.org/packages/ea/12/a93df3366ed32db1d907d7593a94f1fe6293903e3e92967bebd6950ed12c/charset_normalizer-3.4.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:926ca93accd5d36ccdabd803392ddc3e03e6d4cd1cf17deff3b989ab8e9dbcf0", size = 199622, upload-time = "2025-05-02T08:32:56.363Z" }, + { url = "https://files.pythonhosted.org/packages/04/93/bf204e6f344c39d9937d3c13c8cd5bbfc266472e51fc8c07cb7f64fcd2de/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:eba9904b0f38a143592d9fc0e19e2df0fa2e41c3c3745554761c5f6447eedabf", size = 143435, upload-time = "2025-05-02T08:32:58.551Z" }, + { url = "https://files.pythonhosted.org/packages/22/2a/ea8a2095b0bafa6c5b5a55ffdc2f924455233ee7b91c69b7edfcc9e02284/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3fddb7e2c84ac87ac3a947cb4e66d143ca5863ef48e4a5ecb83bd48619e4634e", size = 153653, upload-time = "2025-05-02T08:33:00.342Z" }, + { url = "https://files.pythonhosted.org/packages/b6/57/1b090ff183d13cef485dfbe272e2fe57622a76694061353c59da52c9a659/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98f862da73774290f251b9df8d11161b6cf25b599a66baf087c1ffe340e9bfd1", size = 146231, upload-time = "2025-05-02T08:33:02.081Z" }, + { url = "https://files.pythonhosted.org/packages/e2/28/ffc026b26f441fc67bd21ab7f03b313ab3fe46714a14b516f931abe1a2d8/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6c9379d65defcab82d07b2a9dfbfc2e95bc8fe0ebb1b176a3190230a3ef0e07c", size = 148243, upload-time = "2025-05-02T08:33:04.063Z" }, + { url = "https://files.pythonhosted.org/packages/c0/0f/9abe9bd191629c33e69e47c6ef45ef99773320e9ad8e9cb08b8ab4a8d4cb/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e635b87f01ebc977342e2697d05b56632f5f879a4f15955dfe8cef2448b51691", size = 150442, upload-time = "2025-05-02T08:33:06.418Z" }, + { url = "https://files.pythonhosted.org/packages/67/7c/a123bbcedca91d5916c056407f89a7f5e8fdfce12ba825d7d6b9954a1a3c/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1c95a1e2902a8b722868587c0e1184ad5c55631de5afc0eb96bc4b0d738092c0", size = 145147, upload-time = "2025-05-02T08:33:08.183Z" }, + { url = "https://files.pythonhosted.org/packages/ec/fe/1ac556fa4899d967b83e9893788e86b6af4d83e4726511eaaad035e36595/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ef8de666d6179b009dce7bcb2ad4c4a779f113f12caf8dc77f0162c29d20490b", size = 153057, upload-time = "2025-05-02T08:33:09.986Z" }, + { url = "https://files.pythonhosted.org/packages/2b/ff/acfc0b0a70b19e3e54febdd5301a98b72fa07635e56f24f60502e954c461/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:32fc0341d72e0f73f80acb0a2c94216bd704f4f0bce10aedea38f30502b271ff", size = 156454, upload-time = "2025-05-02T08:33:11.814Z" }, + { url = "https://files.pythonhosted.org/packages/92/08/95b458ce9c740d0645feb0e96cea1f5ec946ea9c580a94adfe0b617f3573/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:289200a18fa698949d2b39c671c2cc7a24d44096784e76614899a7ccf2574b7b", size = 154174, upload-time = "2025-05-02T08:33:13.707Z" }, + { url = "https://files.pythonhosted.org/packages/78/be/8392efc43487ac051eee6c36d5fbd63032d78f7728cb37aebcc98191f1ff/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4a476b06fbcf359ad25d34a057b7219281286ae2477cc5ff5e3f70a246971148", size = 149166, upload-time = "2025-05-02T08:33:15.458Z" }, + { url = "https://files.pythonhosted.org/packages/44/96/392abd49b094d30b91d9fbda6a69519e95802250b777841cf3bda8fe136c/charset_normalizer-3.4.2-cp313-cp313-win32.whl", hash = "sha256:aaeeb6a479c7667fbe1099af9617c83aaca22182d6cf8c53966491a0f1b7ffb7", size = 98064, upload-time = "2025-05-02T08:33:17.06Z" }, + { url = "https://files.pythonhosted.org/packages/e9/b0/0200da600134e001d91851ddc797809e2fe0ea72de90e09bec5a2fbdaccb/charset_normalizer-3.4.2-cp313-cp313-win_amd64.whl", hash = "sha256:aa6af9e7d59f9c12b33ae4e9450619cf2488e2bbe9b44030905877f0b2324980", size = 105641, upload-time = "2025-05-02T08:33:18.753Z" }, + { url = "https://files.pythonhosted.org/packages/20/94/c5790835a017658cbfabd07f3bfb549140c3ac458cfc196323996b10095a/charset_normalizer-3.4.2-py3-none-any.whl", hash = "sha256:7f56930ab0abd1c45cd15be65cc741c28b1c9a34876ce8c17a2fa107810c0af0", size = 52626, upload-time = "2025-05-02T08:34:40.053Z" }, +] + +[[package]] +name = "idna" +version = "3.10" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" }, +] + +[[package]] +name = "netbox" +version = "0.1.0" +source = { virtual = "." } +dependencies = [ + { name = "pynetbox" }, + { name = "unifi-controller-api" }, +] + +[package.metadata] +requires-dist = [ + { name = "pynetbox" }, + { name = "unifi-controller-api" }, +] + +[[package]] +name = "packaging" +version = "25.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/a1/d4/1fc4078c65507b51b96ca8f8c3ba19e6a61c8253c72794544580a7b6c24d/packaging-25.0.tar.gz", hash = "sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f", size = 165727, upload-time = "2025-04-19T11:48:59.673Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/20/12/38679034af332785aac8774540895e234f4d07f7545804097de4b666afd8/packaging-25.0-py3-none-any.whl", hash = "sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484", size = 66469, upload-time = "2025-04-19T11:48:57.875Z" }, +] + +[[package]] +name = "pynetbox" +version = "7.5.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "packaging" }, + { name = "requests" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/d3/0b/695021a23c373991d07c1e4cb510287a521318cfc4b29f68ebbecb19fcd2/pynetbox-7.5.0.tar.gz", hash = "sha256:780064c800fb8c079c9828df472203146442ed3dd0b522a28a501204eb00c066", size = 73850, upload-time = "2025-05-20T16:03:03.831Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/44/b7/a24bc58f0e27f0cd847bf14ffbe9722604f5abe3ec9c12dd8f89cb965be8/pynetbox-7.5.0-py3-none-any.whl", hash = "sha256:ab755a0020c0abb09b4d24c8f8ba89df26f04fa56c35de73302e29a39352f031", size = 35808, upload-time = "2025-05-20T16:03:02.445Z" }, +] + +[[package]] +name = "requests" +version = "2.32.3" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "certifi" }, + { name = "charset-normalizer" }, + { name = "idna" }, + { name = "urllib3" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/63/70/2bf7780ad2d390a8d301ad0b550f1581eadbd9a20f896afe06353c2a2913/requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760", size = 131218, upload-time = "2024-05-29T15:37:49.536Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/f9/9b/335f9764261e915ed497fcdeb11df5dfd6f7bf257d4a6a2a686d80da4d54/requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6", size = 64928, upload-time = "2024-05-29T15:37:47.027Z" }, +] + +[[package]] +name = "unifi-controller-api" +version = "0.3.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "requests" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/a6/62/0e12da83245655872fed6fdfea66fa05b36b76dd31994a8dc17fafe164c8/unifi_controller_api-0.3.0.tar.gz", hash = "sha256:a5ebaf0e739b825921ed3b94c80b0113cad6e295539397653571ad2286c81287", size = 54194, upload-time = "2025-04-14T18:57:24.028Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/33/32/38c5483b2a8dc57d3d76c3dcffbe3a47b1dfc671753ee2b62bfb529683a6/unifi_controller_api-0.3.0-py3-none-any.whl", hash = "sha256:b312aab9b460ee5d5189d704b7855d03452bfe0649cc569d8ce20c4417c75d71", size = 59134, upload-time = "2025-04-14T18:57:22.674Z" }, +] + +[[package]] +name = "urllib3" +version = "2.4.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/8a/78/16493d9c386d8e60e442a35feac5e00f0913c0f4b7c217c11e8ec2ff53e0/urllib3-2.4.0.tar.gz", hash = "sha256:414bc6535b787febd7567804cc015fee39daab8ad86268f1310a9250697de466", size = 390672, upload-time = "2025-04-10T15:23:39.232Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/6b/11/cc635220681e93a0183390e26485430ca2c7b5f9d33b15c74c2861cb8091/urllib3-2.4.0-py3-none-any.whl", hash = "sha256:4e16665048960a0900c702d4a66415956a584919c03361cac9f1df5c5dd7e813", size = 128680, upload-time = "2025-04-10T15:23:37.377Z" }, +] diff --git a/ansible/plays/kjell-ct-102.yml b/ansible/plays/kjell-ct-102.yml new file mode 100644 index 0000000..87b9459 --- /dev/null +++ b/ansible/plays/kjell-ct-102.yml @@ -0,0 +1,49 @@ +- hosts: + - kjell-ct-102 + vars: + traefik_version: 3.4.1 + traefik_checksum: md5:f299230ea9f247a672b187a79f2e76e6719ccbee + traefik_template: traefik-proxy.toml.j2 + tasks: + - become: yes + apt: + name: + - etckeeper + - sudo + tags: packages,never + + - import_role: + name: timezone + tags: timezone,never + + - name: Load values from sops.yml + community.sops.load_vars: + name: env + file: ../../sops.yml + tags: traefik-server,never + + - import_role: + name: traefik-server + vars: + traefik_environment: + LINODE_TOKEN: "{{ env.linode_token }}" + tags: traefik-server,never + + - name: /etc/systemd/services/traefik.service + become: true + template: + src: "{{ traefik_template }}" + dest: /etc/traefik/traefik.toml + owner: root + group: root + mode: 0644 + register: template + + - name: systemctl restart traefik + become: true + systemd: + daemon_reload: true + unit: traefik + enabled: true + state: restarted + when: template.changed diff --git a/ansible/plays/templates/traefik-proxy.toml.j2 b/ansible/plays/templates/traefik-proxy.toml.j2 new file mode 100644 index 0000000..d538664 --- /dev/null +++ b/ansible/plays/templates/traefik-proxy.toml.j2 @@ -0,0 +1,126 @@ +[global] + checkNewVersion = true + sendAnonymousUsage = false + +################################################################ +# Entrypoints configuration +################################################################ + +[entryPoints] +# [entryPoints.web] +# address = ":80" + + [entryPoints.websecure] + address = ":443" + + [entryPoints.websecure.http.tls] + certResolver = "linode" + +[log] + + # Log level + # + # Optional + # Default: "ERROR" + # + level = "DEBUG" + + # Sets the filepath for the traefik log. If not specified, stdout will be used. + # Intermediate directories are created if necessary. + # + # Optional + # Default: os.Stdout + # + # filePath = "log/traefik.log" + + # Format is either "json" or "common". + # + # Optional + # Default: "common" + # + # format = "json" + +################################################################ +# Access logs configuration +################################################################ + +# Enable access logs +# By default it will write to stdout and produce logs in the textual +# Common Log Format (CLF), extended with additional fields. +# +# Optional +# +# [accessLog] + + # Sets the file path for the access log. If not specified, stdout will be used. + # Intermediate directories are created if necessary. + # + # Optional + # Default: os.Stdout + # + # filePath = "/path/to/log/log.txt" + + # Format is either "json" or "common". + # + # Optional + # Default: "common" + # + # format = "json" + +################################################################ +# API and dashboard configuration +################################################################ + +# Enable API and dashboard +[api] + + # Enable the API in insecure mode + # + # Optional + # Default: false + # + # insecure = true + + # Enabled Dashboard + # + # Optional + # Default: true + # + # dashboard = false + +################################################################ +# Ping configuration +################################################################ + +# Enable ping +[ping] + + # Name of the related entry point + # + # Optional + # Default: "traefik" + # + # entryPoint = "traefik" + + +[certificatesResolvers.linode.acme] + email = "root@trygvis.io" + storage = "acme.json" + [certificatesResolvers.linode.acme.dnsChallenge] + provider = "linode" + delayBeforeCheck = 1 + +[http] +[http.routers] + [http.routers.junk] + rule = "Host(`junk.dn42.trygvis.io`)" + service = "netbox" + + [http.routers.junk.tls] + certResolver = "linode" + + [http.services] + # Define how to reach an existing service on our infrastructure + [http.services.netbox.loadBalancer] + [[http.services.netbox.loadBalancer.servers]] + url = "http://[fdb1:4242:3538:2005:be24:11ff:febb:5c7f]:8080" diff --git a/ansible/roles/traefik-server/handlers/main.yml b/ansible/roles/traefik-server/handlers/main.yml new file mode 100644 index 0000000..6e34db4 --- /dev/null +++ b/ansible/roles/traefik-server/handlers/main.yml @@ -0,0 +1,5 @@ +- name: systemctl restart traefik + systemd: + daemon_reload: true + unit: traefik + state: restarted diff --git a/ansible/roles/traefik-server/tasks/main.yml b/ansible/roles/traefik-server/tasks/main.yml new file mode 100644 index 0000000..98d45e5 --- /dev/null +++ b/ansible/roles/traefik-server/tasks/main.yml @@ -0,0 +1,56 @@ +- name: Download traefik + become: true + ansible.builtin.get_url: + url: https://github.com/traefik/traefik/releases/download/v{{ traefik_version }}/traefik_v{{ traefik_version }}_linux_amd64.tar.gz + dest: /tmp/traefik-{{ traefik_version }}.tar.gz + checksum: "{{ traefik_download|default('') }}" + register: download + +- name: Download checksum + debug: + msg: download.checksum_src={{ download.checksum_src }} + when: download.status_code == 200 + +- name: mkdir /tmp/traefik-x.y.z + become: true + file: + path: /tmp/traefik-{{ traefik_version }} + state: directory + +- name: Extract traefik + become: true + unarchive: + remote_src: true + src: /tmp/traefik-{{ traefik_version }}.tar.gz + dest: /tmp/traefik-{{ traefik_version }} + +- name: Install traefik + become: true + copy: + remote_src: true + src: /tmp/traefik-{{ traefik_version }}/traefik + dest: /usr/local/bin/traefik + owner: root + group: root + mode: 0750 + +- name: /etc/systemd/services/traefik.service + become: true + template: + src: traefik.service.j2 + dest: /etc/systemd/system/traefik.service + owner: root + group: root + mode: 0644 + +- name: mkdir /etc/traefik + become: true + file: + path: /etc/traefik + state: directory + +- name: mkdir /etc/traefik/acme + become: true + file: + path: /etc/traefik/acme + state: directory diff --git a/ansible/roles/traefik-server/templates/traefik.service.j2 b/ansible/roles/traefik-server/templates/traefik.service.j2 new file mode 100644 index 0000000..14bc403 --- /dev/null +++ b/ansible/roles/traefik-server/templates/traefik.service.j2 @@ -0,0 +1,52 @@ +[Unit] +Description=traefik proxy +After=network-online.target +Wants=network-online.target systemd-networkd-wait-online.service + +AssertFileIsExecutable=/usr/local/bin/traefik +AssertPathExists=/etc/traefik/traefik.toml + +[Service] +Restart=on-abnormal + +#User=traefik +#Group=traefik + +; Always set "-root" to something safe in case it gets forgotten in the traefikfile. +ExecStart=/usr/local/bin/traefik --configfile=/etc/traefik/traefik.toml + +; Limit the number of file descriptors; see `man systemd.exec` for more limit settings. +LimitNOFILE=1048576 + +; Use private /tmp and /var/tmp, which are discarded after traefik stops. +PrivateTmp=true + +; Use a minimal /dev (May bring additional security if switched to 'true') +PrivateDevices=true + +; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys. +ProtectHome=true + +; Make /usr, /boot, /etc and possibly some more folders read-only. +ProtectSystem=full + +; ... except /etc/ssl/traefik, because we want Letsencrypt-certificates there. +; This merely retains r/w access rights, it does not add any new. Must still be writable on the host! +#ReadWriteDirectories=/etc/traefik/acme + +; The following additional security directives only work with systemd v229 or later. +; They further restrict privileges that can be gained by traefik. Uncomment if you like. +; Note that you may have to add capabilities required by any plugins in use. +CapabilityBoundingSet=CAP_NET_BIND_SERVICE +AmbientCapabilities=CAP_NET_BIND_SERVICE +NoNewPrivileges=true +{% set env=traefik_environment.items()|default({}) %} +{% if env %} + +{% for k, v in env %} +Environment="{{ k }}={{ v }}" +{% endfor %} +{% endif %} + +[Install] +WantedBy=multi-user.target diff --git a/ansible/wg0/group_vars/all/wireguard_wg0.yml b/ansible/wg0/group_vars/all/wireguard_wg0.yml index 109de3d..cfaec64 100644 --- a/ansible/wg0/group_vars/all/wireguard_wg0.yml +++ b/ansible/wg0/group_vars/all/wireguard_wg0.yml @@ -56,8 +56,6 @@ wireguard_wg0: lhn2ix: state: present ipv6: fdf3:aad9:a885:0b3a::15 - allowed_ips: - - fdf3:aad9:a885:77dd::/64 kv24ix: state: present ipv6: fdf3:aad9:a885:0b3a::16 diff --git a/config/backup-kv24ix b/config/backup-kv24ix new file mode 100755 index 0000000..1abcc44 --- /dev/null +++ b/config/backup-kv24ix @@ -0,0 +1,13 @@ +#!/bin/bash + +set -euo pipefail + +basedir="${0%/*}" + +cd "$basedir" + +ssh ubnt@kv24ix.trygvis.io \ + /opt/vyatta/bin/vyatta-op-cmd-wrapper show configuration commands \ + > kv24ix.txt.new + +mv kv24ix.txt.new kv24ix.txt diff --git a/config/backup-lhn2ix b/config/backup-lhn2ix new file mode 100755 index 0000000..6755232 --- /dev/null +++ b/config/backup-lhn2ix @@ -0,0 +1,13 @@ +#!/bin/bash + +set -euo pipefail + +basedir="${0%/*}" + +cd "$basedir" + +ssh ubnt@lhn2ix.dn42.trygvis.io \ + /opt/vyatta/bin/vyatta-op-cmd-wrapper show configuration commands \ + > .tmp + +mv .tmp "${0##*backup-}".txt diff --git a/config/kv24ix.txt b/config/kv24ix.txt new file mode 100644 index 0000000..2c04479 --- /dev/null +++ b/config/kv24ix.txt @@ -0,0 +1,199 @@ +set firewall all-ping enable +set firewall broadcast-ping disable +set firewall ipv6-name WANv6_IN default-action drop +set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN' +set firewall ipv6-name WANv6_IN rule 10 action accept +set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions' +set firewall ipv6-name WANv6_IN rule 10 state established enable +set firewall ipv6-name WANv6_IN rule 10 state related enable +set firewall ipv6-name WANv6_IN rule 20 action drop +set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state' +set firewall ipv6-name WANv6_IN rule 20 state invalid enable +set firewall ipv6-name WANv6_LOCAL default-action drop +set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router' +set firewall ipv6-name WANv6_LOCAL enable-default-log +set firewall ipv6-name WANv6_LOCAL rule 10 action accept +set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions' +set firewall ipv6-name WANv6_LOCAL rule 10 state established enable +set firewall ipv6-name WANv6_LOCAL rule 10 state related enable +set firewall ipv6-name WANv6_LOCAL rule 20 action drop +set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state' +set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable +set firewall ipv6-name WANv6_LOCAL rule 30 action accept +set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp' +set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp +set firewall ipv6-name WANv6_LOCAL rule 40 action accept +set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6' +set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546 +set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp +set firewall ipv6-name WANv6_LOCAL rule 40 source port 547 +set firewall ipv6-receive-redirects disable +set firewall ipv6-src-route disable +set firewall ip-src-route disable +set firewall log-martians enable +set firewall name WAN_IN default-action drop +set firewall name WAN_IN description 'WAN to internal' +set firewall name WAN_IN rule 10 action accept +set firewall name WAN_IN rule 10 description 'Allow established/related' +set firewall name WAN_IN rule 10 state established enable +set firewall name WAN_IN rule 10 state related enable +set firewall name WAN_IN rule 20 action drop +set firewall name WAN_IN rule 20 description 'Drop invalid state' +set firewall name WAN_IN rule 20 state invalid enable +set firewall name WAN_LOCAL default-action drop +set firewall name WAN_LOCAL description 'WAN to router' +set firewall name WAN_LOCAL rule 10 action accept +set firewall name WAN_LOCAL rule 10 description 'Allow established/related' +set firewall name WAN_LOCAL rule 10 state established enable +set firewall name WAN_LOCAL rule 10 state related enable +set firewall name WAN_LOCAL rule 20 action drop +set firewall name WAN_LOCAL rule 20 description 'Drop invalid state' +set firewall name WAN_LOCAL rule 20 state invalid enable +set firewall name WAN_LOCAL rule 30 action accept +set firewall name WAN_LOCAL rule 30 description 'Allow ICMP' +set firewall name WAN_LOCAL rule 30 log disable +set firewall name WAN_LOCAL rule 30 protocol icmp +set firewall receive-redirects disable +set firewall send-redirects enable +set firewall source-validation disable +set firewall syn-cookies enable +set interfaces ethernet eth0 address dhcp +set interfaces ethernet eth0 description Internet +set interfaces ethernet eth0 dhcpv6-pd pd 1 interface switch0 host-address '::1' +set interfaces ethernet eth0 dhcpv6-pd pd 1 interface switch0 prefix-id ':1' +set interfaces ethernet eth0 dhcpv6-pd pd 1 interface switch0 service slaac +set interfaces ethernet eth0 dhcpv6-pd pd 1 prefix-length /56 +set interfaces ethernet eth0 dhcpv6-pd rapid-commit enable +set interfaces ethernet eth0 duplex auto +set interfaces ethernet eth0 firewall in ipv6-name WANv6_IN +set interfaces ethernet eth0 firewall in name WAN_IN +set interfaces ethernet eth0 firewall local ipv6-name WANv6_LOCAL +set interfaces ethernet eth0 firewall local name WAN_LOCAL +set interfaces ethernet eth0 speed auto +set interfaces ethernet eth1 description Local +set interfaces ethernet eth1 duplex auto +set interfaces ethernet eth1 speed auto +set interfaces ethernet eth2 description Local +set interfaces ethernet eth2 duplex auto +set interfaces ethernet eth2 speed auto +set interfaces ethernet eth3 description Local +set interfaces ethernet eth3 duplex auto +set interfaces ethernet eth3 speed auto +set interfaces ethernet eth4 description Local +set interfaces ethernet eth4 duplex auto +set interfaces ethernet eth4 mtu 1500 +set interfaces ethernet eth4 poe output off +set interfaces ethernet eth4 speed auto +set interfaces loopback lo +set interfaces switch switch0 address 192.168.10.1/24 +set interfaces switch switch0 address 'fdb1:4242:3538:2006::ffff/64' +set interfaces switch switch0 description Local +set interfaces switch switch0 firewall in +set interfaces switch switch0 ipv6 address +set interfaces switch switch0 ipv6 dup-addr-detect-transmits 1 +set interfaces switch switch0 mtu 1500 +set interfaces switch switch0 switch-port interface eth1 +set interfaces switch switch0 switch-port interface eth2 +set interfaces switch switch0 switch-port interface eth3 +set interfaces switch switch0 switch-port interface eth4 +set interfaces switch switch0 switch-port vlan-aware disable +set interfaces wireguard wg0 address 'fdf3:aad9:a885:0b3a::16/64' +set interfaces wireguard wg0 mtu 1420 +set interfaces wireguard wg0 peer cuUgTdFH1UEXpUH6V1nashdH7K/L+pl6dmJCpBWN+Xw= allowed-ips '::0/0' +set interfaces wireguard wg0 peer cuUgTdFH1UEXpUH6V1nashdH7K/L+pl6dmJCpBWN+Xw= endpoint 'trygvis.io:51821' +set interfaces wireguard wg0 peer cuUgTdFH1UEXpUH6V1nashdH7K/L+pl6dmJCpBWN+Xw= persistent-keepalive 60 +set interfaces wireguard wg0 private-key /config/auth/wg0.key +set interfaces wireguard wg0 route-allowed-ips false +set interfaces wireguard wg1 address 'fdb1:4242:3538:2f01::b/64' +set interfaces wireguard wg1 description tnet-knot +set interfaces wireguard wg1 mtu 1420 +set interfaces wireguard wg1 peer eF8DIAyneOlhEzyriFB528IUsnYqy/b5398i0SW06g4= allowed-ips '::/0' +set interfaces wireguard wg1 peer eF8DIAyneOlhEzyriFB528IUsnYqy/b5398i0SW06g4= endpoint 'knot.inamo.no:51003' +set interfaces wireguard wg1 peer eF8DIAyneOlhEzyriFB528IUsnYqy/b5398i0SW06g4= persistent-keepalive 60 +set interfaces wireguard wg1 private-key /config/auth/knot.key +set interfaces wireguard wg1 route-allowed-ips false +set interfaces wireguard wg2 address '2a11:6c7:f04:fd::2/64' +set interfaces wireguard wg2 description route64.org +set interfaces wireguard wg2 mtu 1420 +set interfaces wireguard wg2 peer ztZNKsJH/CKQjYz9kUOtcIyKakqaNoNuVPZL8nlDxgM= allowed-ips '::/0' +set interfaces wireguard wg2 peer ztZNKsJH/CKQjYz9kUOtcIyKakqaNoNuVPZL8nlDxgM= endpoint '118.91.187.67:46010' +set interfaces wireguard wg2 peer ztZNKsJH/CKQjYz9kUOtcIyKakqaNoNuVPZL8nlDxgM= persistent-keepalive 30 +set interfaces wireguard wg2 private-key /config/auth/route64.key +set interfaces wireguard wg2 route-allowed-ips false +set policy prefix-list6 bitraf-dn42 rule 1 action permit +set policy prefix-list6 bitraf-dn42 rule 1 description 'tnet subnetworks' +set policy prefix-list6 bitraf-dn42 rule 1 le 128 +set policy prefix-list6 bitraf-dn42 rule 1 prefix 'fdb1:4242:3538:2000::/60' +set policy route-map bitraf-dn42 rule 1 action permit +set policy route-map bitraf-dn42 rule 1 match ipv6 address prefix-list bitraf-dn42 +set protocols bgp 4242423538 address-family ipv6-unicast redistribute connected route-map bitraf-dn42 +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' address-family ipv6-unicast capability graceful-restart +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' address-family ipv6-unicast nexthop-self +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' address-family ipv6-unicast route-reflector-client +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' address-family ipv6-unicast soft-reconfiguration inbound +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' capability dynamic +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' capability graceful-restart +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' password trygvis +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' remote-as 4242423538 +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f01::a' soft-reconfiguration inbound +set protocols bgp 4242423538 parameters graceful-restart +set protocols static route6 'fdb1:4242:3538:2006::/64' blackhole +set service dhcp-server disabled false +set service dhcp-server hostfile-update disable +set service dhcp-server shared-network-name LAN authoritative enable +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 default-router 192.168.10.1 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 dns-server 192.168.10.1 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 dns-server 8.8.8.8 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 lease 86400 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 start 192.168.10.100 stop 192.168.10.199 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping garasje ip-address 192.168.10.23 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping garasje mac-address 'b4:fb:e4:76:3c:58' +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping kjokken ip-address 192.168.10.21 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping kjokken mac-address 'b4:fb:e4:76:3b:2b' +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping kontor ip-address 192.168.10.22 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping kontor mac-address 'b4:fb:e4:76:3b:1c' +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping laboratorium ip-address 192.168.10.26 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping laboratorium mac-address 'd8:b3:70:b3:35:19' +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping nede ip-address 192.168.10.25 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping nede mac-address 'b4:fb:e4:76:3b:1b' +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping stue ip-address 192.168.10.20 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping stue mac-address 'b4:fb:e4:76:3b:08' +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping swcloud ip-address 192.168.10.12 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping swcloud mac-address '18:e8:29:43:73:02' +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping swnede ip-address 192.168.10.11 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping swnede mac-address '18:e8:29:bf:9d:da' +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping swoppe ip-address 192.168.10.10 +set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 static-mapping swoppe mac-address 'b4:fb:e4:8a:24:a6' +set service dhcp-server static-arp disable +set service dhcp-server use-dnsmasq disable +set service dns forwarding cache-size 1000 +set service dns forwarding listen-on switch0 +set service dns forwarding options 'server=/dn42/fd42:d42:d42:54::1' +set service gui http-port 80 +set service gui https-port 443 +set service gui older-ciphers enable +set service lldp interface switch0 +set service nat rule 5010 description 'masquerade for WAN' +set service nat rule 5010 outbound-interface eth0 +set service nat rule 5010 type masquerade +set service snmp community public authorization ro +set service snmp location kv24ix +set service ssh port 22 +set service ssh protocol-version v2 +set service unms disable +set system analytics-handler send-analytics-report false +set system config-management commit-revisions 10 +set system crash-handler send-crash-report false +set system host-name kv24ix +set system login user ubnt authentication encrypted-password '$5$YmwMYrjdnUz2i//n$.dj42FJRGmiS6l/YLkrAG6GW3l3/hX6ARCWpsvG7WC4' +set system login user ubnt authentication plaintext-password '' +set system login user ubnt authentication public-keys trygvis@biwia key AAAAC3NzaC1lZDI1NTE5AAAAIK3NIIYprtLQFNut7GGf0va7YYFeSXKSgWDQi4qbf5Ph +set system login user ubnt authentication public-keys trygvis@biwia type ssh-ed25519 +set system login user ubnt level admin +set system ntp server 0.ubnt.pool.ntp.org +set system ntp server 1.ubnt.pool.ntp.org +set system ntp server 2.ubnt.pool.ntp.org +set system ntp server 3.ubnt.pool.ntp.org +set system syslog global facility all level notice +set system syslog global facility protocols level debug +set system time-zone Europe/Oslo diff --git a/config/lhn2ix.txt b/config/lhn2ix.txt new file mode 100644 index 0000000..b05d5d9 --- /dev/null +++ b/config/lhn2ix.txt @@ -0,0 +1,229 @@ +set firewall all-ping enable +set firewall broadcast-ping disable +set firewall ipv6-name DN42v6_IN default-action drop +set firewall ipv6-name DN42v6_IN description 'DN42 traffic through the router' +set firewall ipv6-name DN42v6_IN enable-default-log +set firewall ipv6-name DN42v6_IN rule 10 action accept +set firewall ipv6-name DN42v6_IN rule 10 description 'Allow established/related sessions' +set firewall ipv6-name DN42v6_IN rule 10 state established enable +set firewall ipv6-name DN42v6_IN rule 10 state related enable +set firewall ipv6-name DN42v6_IN rule 20 action drop +set firewall ipv6-name DN42v6_IN rule 20 description 'Drop invalid state' +set firewall ipv6-name DN42v6_IN rule 20 state invalid enable +set firewall ipv6-name DN42v6_IN rule 30 action accept +set firewall ipv6-name DN42v6_IN rule 30 description 'Allow IPv6 icmp' +set firewall ipv6-name DN42v6_IN rule 30 protocol ipv6-icmp +set firewall ipv6-name DN42v6_IN rule 100 action accept +set firewall ipv6-name DN42v6_IN rule 100 description 'Allow anything from tnet (tcp)' +set firewall ipv6-name DN42v6_IN rule 100 protocol tcp +set firewall ipv6-name DN42v6_IN rule 100 source address 'fdb1:4242:3538:2000::/52' +set firewall ipv6-name DN42v6_IN rule 101 action accept +set firewall ipv6-name DN42v6_IN rule 101 description 'Allow anything from tnet (udp)' +set firewall ipv6-name DN42v6_IN rule 101 protocol udp +set firewall ipv6-name DN42v6_IN rule 101 source address 'fdb1:4242:3538:2000::/52' +set firewall ipv6-name DN42v6_IN rule 200 action accept +set firewall ipv6-name DN42v6_IN rule 200 description 'Allow SSH' +set firewall ipv6-name DN42v6_IN rule 200 destination port 22 +set firewall ipv6-name DN42v6_IN rule 200 protocol tcp +set firewall ipv6-name DN42v6_IN rule 201 action accept +set firewall ipv6-name DN42v6_IN rule 201 description 'Allow HTTP' +set firewall ipv6-name DN42v6_IN rule 201 destination port 80 +set firewall ipv6-name DN42v6_IN rule 201 protocol tcp +set firewall ipv6-name DN42v6_IN rule 202 action accept +set firewall ipv6-name DN42v6_IN rule 202 description 'Allow HTTPS' +set firewall ipv6-name DN42v6_IN rule 202 destination port https +set firewall ipv6-name DN42v6_IN rule 202 protocol tcp +set firewall ipv6-name DN42v6_LOCAL default-action drop +set firewall ipv6-name DN42v6_LOCAL description 'DN42 inbound traffic to the router' +set firewall ipv6-name DN42v6_LOCAL enable-default-log +set firewall ipv6-name DN42v6_LOCAL rule 10 action accept +set firewall ipv6-name DN42v6_LOCAL rule 10 description 'Allow established/related sessions' +set firewall ipv6-name DN42v6_LOCAL rule 10 state established enable +set firewall ipv6-name DN42v6_LOCAL rule 10 state related enable +set firewall ipv6-name DN42v6_LOCAL rule 20 action drop +set firewall ipv6-name DN42v6_LOCAL rule 20 description 'Drop invalid state' +set firewall ipv6-name DN42v6_LOCAL rule 20 state invalid enable +set firewall ipv6-name DN42v6_LOCAL rule 30 action accept +set firewall ipv6-name DN42v6_LOCAL rule 30 description 'Allow IPv6 icmp' +set firewall ipv6-name DN42v6_LOCAL rule 30 protocol ipv6-icmp +set firewall ipv6-name DN42v6_LOCAL rule 40 action accept +set firewall ipv6-name DN42v6_LOCAL rule 40 description 'Allow SSH' +set firewall ipv6-name DN42v6_LOCAL rule 40 destination port 22 +set firewall ipv6-name DN42v6_LOCAL rule 40 protocol tcp +set firewall ipv6-name DN42v6_LOCAL rule 50 action accept +set firewall ipv6-name DN42v6_LOCAL rule 50 description 'Allow BGP' +set firewall ipv6-name DN42v6_LOCAL rule 50 destination port 179 +set firewall ipv6-name DN42v6_LOCAL rule 50 protocol tcp +set firewall ipv6-name WANv6_IN default-action drop +set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN' +set firewall ipv6-name WANv6_IN rule 10 action accept +set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions' +set firewall ipv6-name WANv6_IN rule 10 state established enable +set firewall ipv6-name WANv6_IN rule 10 state related enable +set firewall ipv6-name WANv6_IN rule 20 action drop +set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state' +set firewall ipv6-name WANv6_IN rule 20 state invalid enable +set firewall ipv6-name WANv6_LOCAL default-action drop +set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router' +set firewall ipv6-name WANv6_LOCAL enable-default-log +set firewall ipv6-name WANv6_LOCAL rule 10 action accept +set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions' +set firewall ipv6-name WANv6_LOCAL rule 10 state established enable +set firewall ipv6-name WANv6_LOCAL rule 10 state related enable +set firewall ipv6-name WANv6_LOCAL rule 20 action drop +set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state' +set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable +set firewall ipv6-name WANv6_LOCAL rule 30 action accept +set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp' +set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp +set firewall ipv6-name WANv6_LOCAL rule 40 action accept +set firewall ipv6-name WANv6_LOCAL rule 40 description 'Allow DHCPv6' +set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546 +set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp +set firewall ipv6-name WANv6_LOCAL rule 40 source port 547 +set firewall ipv6-name WANv6_LOCAL rule 50 action accept +set firewall ipv6-name WANv6_LOCAL rule 50 description 'Allow SSH' +set firewall ipv6-name WANv6_LOCAL rule 50 destination port 22 +set firewall ipv6-name WANv6_LOCAL rule 50 protocol tcp +set firewall ipv6-receive-redirects disable +set firewall ipv6-src-route disable +set firewall ip-src-route disable +set firewall log-martians enable +set firewall receive-redirects disable +set firewall send-redirects enable +set firewall source-validation disable +set firewall syn-cookies enable +set interfaces ethernet eth0 address dhcp +set interfaces ethernet eth0 description Internet +set interfaces ethernet eth0 dhcpv6-pd pd 0 interface switch0 host-address '::1' +set interfaces ethernet eth0 dhcpv6-pd pd 0 interface switch0 prefix-id ':0' +set interfaces ethernet eth0 dhcpv6-pd pd 0 interface switch0 service slaac +set interfaces ethernet eth0 dhcpv6-pd pd 0 prefix-length 56 +set interfaces ethernet eth0 dhcpv6-pd rapid-commit enable +set interfaces ethernet eth0 duplex auto +set interfaces ethernet eth0 firewall in ipv6-name WANv6_IN +set interfaces ethernet eth0 firewall local ipv6-name WANv6_LOCAL +set interfaces ethernet eth0 ipv6 address +set interfaces ethernet eth0 ipv6 dup-addr-detect-transmits 1 +set interfaces ethernet eth0 poe output off +set interfaces ethernet eth0 speed auto +set interfaces ethernet eth1 description conflatorio +set interfaces ethernet eth1 duplex auto +set interfaces ethernet eth1 poe output off +set interfaces ethernet eth1 speed auto +set interfaces ethernet eth2 description Local +set interfaces ethernet eth2 duplex auto +set interfaces ethernet eth2 poe output off +set interfaces ethernet eth2 speed auto +set interfaces ethernet eth3 description Local +set interfaces ethernet eth3 duplex auto +set interfaces ethernet eth3 poe output off +set interfaces ethernet eth3 speed auto +set interfaces ethernet eth4 description Wifi +set interfaces ethernet eth4 duplex auto +set interfaces ethernet eth4 poe output 24v +set interfaces ethernet eth4 speed auto +set interfaces ethernet eth5 duplex auto +set interfaces ethernet eth5 mac '48:FD:8E:B5:98:49' +set interfaces ethernet eth5 speed auto +set interfaces loopback lo +set interfaces switch switch0 address 'fdb1:4242:3538:2008::1/64' +set interfaces switch switch0 address 192.168.11.1/24 +set interfaces switch switch0 address 'fdb1:4242:3538:2009::1/64' +set interfaces switch switch0 description Local +set interfaces switch switch0 ipv6 dup-addr-detect-transmits 1 +set interfaces switch switch0 ipv6 router-advert cur-hop-limit 64 +set interfaces switch switch0 ipv6 router-advert link-mtu 0 +set interfaces switch switch0 ipv6 router-advert managed-flag true +set interfaces switch switch0 ipv6 router-advert max-interval 600 +set interfaces switch switch0 ipv6 router-advert other-config-flag false +set interfaces switch switch0 ipv6 router-advert prefix '2a06:2240:f002:9900::0/64' autonomous-flag true +set interfaces switch switch0 ipv6 router-advert prefix '2a06:2240:f002:9900::0/64' on-link-flag true +set interfaces switch switch0 ipv6 router-advert prefix '2a06:2240:f002:9900::0/64' valid-lifetime 2592000 +set interfaces switch switch0 ipv6 router-advert prefix 'fdb1:4242:3538:2008::0/64' autonomous-flag true +set interfaces switch switch0 ipv6 router-advert prefix 'fdb1:4242:3538:2008::0/64' on-link-flag true +set interfaces switch switch0 ipv6 router-advert prefix 'fdb1:4242:3538:2008::0/64' valid-lifetime 2592000 +set interfaces switch switch0 ipv6 router-advert reachable-time 0 +set interfaces switch switch0 ipv6 router-advert retrans-timer 0 +set interfaces switch switch0 ipv6 router-advert send-advert true +set interfaces switch switch0 mtu 1500 +set interfaces switch switch0 switch-port interface eth1 +set interfaces switch switch0 switch-port interface eth2 +set interfaces switch switch0 switch-port interface eth3 +set interfaces switch switch0 switch-port interface eth4 +set interfaces switch switch0 switch-port vlan-aware disable +set interfaces wireguard wg1 address 'fdb1:4242:3538:2f02::b/64' +set interfaces wireguard wg1 description tnet-knot +set interfaces wireguard wg1 firewall in ipv6-name DN42v6_IN +set interfaces wireguard wg1 firewall local ipv6-name DN42v6_LOCAL +set interfaces wireguard wg1 mtu 1420 +set interfaces wireguard wg1 peer Up8+DhBlMp+/fpaxyGDQBnH/4tZnHojcAKZWCr5sSAk= allowed-ips '::0/0' +set interfaces wireguard wg1 peer Up8+DhBlMp+/fpaxyGDQBnH/4tZnHojcAKZWCr5sSAk= endpoint 'knot.inamo.no:51002' +set interfaces wireguard wg1 peer Up8+DhBlMp+/fpaxyGDQBnH/4tZnHojcAKZWCr5sSAk= persistent-keepalive 60 +set interfaces wireguard wg1 private-key 4IhYSjPBx5K2TuEYs2bl3rjaKSLdx3HNgbjn2BpJimg= +set interfaces wireguard wg1 route-allowed-ips false +set policy prefix-list6 bitraf-dn42 rule 1 action permit +set policy prefix-list6 bitraf-dn42 rule 1 description 'tnet subnetworks' +set policy prefix-list6 bitraf-dn42 rule 1 le 128 +set policy prefix-list6 bitraf-dn42 rule 1 prefix 'fdb1:4242:3538:2000::/60' +set policy route-map bitraf-dn42 rule 1 action permit +set policy route-map bitraf-dn42 rule 1 match ipv6 address prefix-list bitraf-dn42 +set protocols bgp 4242423538 address-family ipv6-unicast redistribute connected route-map bitraf-dn42 +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' address-family ipv6-unicast capability graceful-restart +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' address-family ipv6-unicast nexthop-self +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' address-family ipv6-unicast route-reflector-client +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' address-family ipv6-unicast soft-reconfiguration inbound +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' description knot +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' password trygvis +set protocols bgp 4242423538 neighbor 'fdb1:4242:3538:2f02::a' remote-as 4242423538 +set protocols bgp 4242423538 parameters graceful-restart +set protocols static route6 'fdb1:4242:3538:2008::/64' blackhole +set service dhcp-server disabled false +set service dhcp-server hostfile-update disable +set service dhcp-server shared-network-name LAN authoritative enable +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 default-router 192.168.11.1 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 dns-server 192.168.11.1 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 dns-server 8.8.8.8 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 lease 86400 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 start 192.168.11.100 stop 192.168.11.199 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping conflatorio ip-address 192.168.11.3 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping conflatorio mac-address '82:42:32:0c:71:61' +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping coregonus ip-address 192.168.11.4 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping coregonus mac-address '00:E0:4C:98:1B:B5' +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping teknisk ip-address 192.168.11.2 +set service dhcp-server shared-network-name LAN subnet 192.168.11.0/24 static-mapping teknisk mac-address 'f4:e2:c6:1c:f9:e3' +set service dhcp-server static-arp disable +set service dhcp-server use-dnsmasq disable +set service dns forwarding cache-size 1000 +set service dns forwarding listen-on switch0 +set service gui http-port 80 +set service gui https-port 443 +set service gui older-ciphers enable +set service nat rule 5010 description 'masquerade for WAN' +set service nat rule 5010 outbound-interface eth0 +set service nat rule 5010 type masquerade +set service snmp community public authorization ro +set service snmp location lhn2ix +set service ssh port 22 +set service ssh protocol-version v2 +set service unms disable +set system analytics-handler send-analytics-report false +set system config-management commit-revisions 10 +set system crash-handler send-crash-report false +set system domain-name trygvis.io +set system host-name lhn2ix +set system login user ubnt authentication encrypted-password '$5$Wu8xmYAo9yxLxQbq$HgzV.0uev3uJmtEfp7/GJnaw2ZIxICAlRr1Y8YbU/pB' +set system login user ubnt authentication plaintext-password '' +set system login user ubnt authentication public-keys trygvis@biwia key AAAAC3NzaC1lZDI1NTE5AAAAIK3NIIYprtLQFNut7GGf0va7YYFeSXKSgWDQi4qbf5Ph +set system login user ubnt authentication public-keys trygvis@biwia type ssh-ed25519 +set system login user ubnt full-name '' +set system login user ubnt level admin +set system name-server 8.8.8.8 +set system ntp server 0.ubnt.pool.ntp.org +set system ntp server 1.ubnt.pool.ntp.org +set system ntp server 2.ubnt.pool.ntp.org +set system ntp server 3.ubnt.pool.ntp.org +set system syslog console facility all level debug +set system syslog global facility all level notice +set system syslog global facility protocols level debug +set system time-zone Europe/Oslo diff --git a/docs/2025-05 - tnet.drawio b/docs/2025-05 - tnet.drawio new file mode 100644 index 0000000..dd34e80 --- /dev/null +++ b/docs/2025-05 - tnet.drawio @@ -0,0 +1,122 @@ +<mxfile host="Electron" modified="2025-05-15T20:07:23.594Z" agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/22.0.2 Chrome/114.0.5735.289 Electron/25.8.4 Safari/537.36" etag="dOQjW2HOEjVxAzMLv_4_" version="22.0.2" type="device"> + <diagram name="Page-1" id="3tc4ToPB8LTOAe-fqp2l"> + <mxGraphModel dx="1185" dy="685" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1169" pageHeight="827" math="0" shadow="0"> + <root> + <mxCell id="0" /> + <mxCell id="1" parent="0" /> + <mxCell id="sc4hc9jCg4AFeJkXXveA-4" value="tnet-coregonus::ffff/64" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;labelPosition=center;verticalLabelPosition=middle;align=center;verticalAlign=middle;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-5"> + <mxGeometry x="-0.4562" y="-3" relative="1" as="geometry"> + <mxPoint x="565" y="140" as="targetPoint" /> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-10" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;entryX=0.764;entryY=0.179;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-8"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-1" value="coregonus" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="460" y="200" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-5" value="fdb1:4242:3538:2005::/64" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="130" y="60" width="220" height="80" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-9" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-6" target="sc4hc9jCg4AFeJkXXveA-8"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-6" value="akili" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="70" y="474" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-7" value="" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;labelPosition=left;verticalLabelPosition=top;align=right;verticalAlign=bottom;endArrow=none;endFill=0;exitX=0.168;exitY=-0.003;exitDx=0;exitDy=0;exitPerimeter=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-6" target="sc4hc9jCg4AFeJkXXveA-5"> + <mxGeometry x="-1" relative="1" as="geometry"> + <mxPoint x="489" y="210" as="sourcePoint" /> + <mxPoint x="389" y="136" as="targetPoint" /> + <Array as="points"> + <mxPoint x="90" y="190" /> + </Array> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-8" value="kv24-isp::/64" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="290" y="474" width="220" height="80" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-11" value="" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="930" y="300" width="220" height="80" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-13" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-14"> + <mxGeometry relative="1" as="geometry"> + <mxPoint x="251" y="270" as="sourcePoint" /> + <mxPoint x="338" y="398" as="targetPoint" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-14" value="hash" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="770" y="30" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-15" value="knot" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="790" y="130" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-16" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-15"> + <mxGeometry relative="1" as="geometry"> + <mxPoint x="590" y="225" as="sourcePoint" /> + <mxPoint x="710" y="195" as="targetPoint" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-17" value="tunnelbroker/he" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="830" y="414" width="120" height="60" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-19" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-17"> + <mxGeometry relative="1" as="geometry"> + <mxPoint x="590" y="245" as="sourcePoint" /> + <mxPoint x="710" y="255" as="targetPoint" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-20" value="2001:470:27:791::2/64%he" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelPosition=center;verticalLabelPosition=middle;" vertex="1" connectable="0" parent="sc4hc9jCg4AFeJkXXveA-19"> + <mxGeometry x="-0.8905" relative="1" as="geometry"> + <mxPoint x="14" y="6" as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-21" value="2001:470:27:791::1/64" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelPosition=center;verticalLabelPosition=middle;" vertex="1" connectable="0" parent="sc4hc9jCg4AFeJkXXveA-19"> + <mxGeometry x="0.9128" relative="1" as="geometry"> + <mxPoint x="-16" y="-7" as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-22" value="tunnelbroker #958887<br>2001:470:28:791::/64" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" vertex="1" parent="1"> + <mxGeometry x="130" y="280" width="220" height="80" as="geometry" /> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-23" value="wg0" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-1" target="sc4hc9jCg4AFeJkXXveA-15"> + <mxGeometry relative="1" as="geometry"> + <mxPoint x="670" y="240" as="sourcePoint" /> + <mxPoint x="800" y="183" as="targetPoint" /> + <Array as="points"> + <mxPoint x="690" y="230" /> + </Array> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-24" value="2001:470:28:791::aaaa%br0" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;labelPosition=center;verticalLabelPosition=middle;align=center;verticalAlign=middle;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-6" target="sc4hc9jCg4AFeJkXXveA-22"> + <mxGeometry x="-0.4852" y="-20" relative="1" as="geometry"> + <mxPoint x="159" y="210" as="sourcePoint" /> + <mxPoint x="284" y="134" as="targetPoint" /> + <Array as="points" /> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-25" value="2001:470:28:791::ffff%enp2s0" style="rounded=0;orthogonalLoop=1;jettySize=auto;html=1;labelPosition=center;verticalLabelPosition=middle;align=center;verticalAlign=middle;endArrow=none;endFill=0;" edge="1" parent="1" source="sc4hc9jCg4AFeJkXXveA-22" target="sc4hc9jCg4AFeJkXXveA-1"> + <mxGeometry x="0.1216" y="-1" relative="1" as="geometry"> + <mxPoint x="141" y="350" as="sourcePoint" /> + <mxPoint x="225" y="262" as="targetPoint" /> + <Array as="points" /> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="sc4hc9jCg4AFeJkXXveA-30" value="" style="endArrow=none;html=1;rounded=0;edgeStyle=orthogonalEdgeStyle;curved=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;exitX=0.322;exitY=-0.011;exitDx=0;exitDy=0;exitPerimeter=0;" edge="1" parent="1"> + <mxGeometry width="50" height="50" relative="1" as="geometry"> + <mxPoint x="108.63999999999987" y="473.99999999999994" as="sourcePoint" /> + <mxPoint x="460" y="230.66" as="targetPoint" /> + <Array as="points"> + <mxPoint x="110" y="474" /> + <mxPoint x="110" y="231" /> + </Array> + </mxGeometry> + </mxCell> + </root> + </mxGraphModel> + </diagram> +</mxfile> @@ -1,5 +1,7 @@ #ENC[AES256_GCM,data:VXrX0NUIHcFjmxHLuYzz9ekkR7N2IW/CF6a9U0dk/cvgtwoNLA==,iv:NIpefl6uO7c7ESxgCHXe3Y2x4cf9nLPjwDJo28xt5SY=,tag:U59KOg8Ny+O33Lf63Zjo1w==,type:comment] -linode_token: ENC[AES256_GCM,data:PeLIxcZ5mQMnp1LZy4saSUWIpCxrGm+3/6PssmIE9yO81x2HcGrgxO0CNl1feOtPrI1PVcAfFnFlpSetELLZlg==,iv:ETBKZgmFdIHoUROHVUzhxRoLS2uIuGR0SXZ96C9FhDk=,tag:pzuS8RLQf1A5ctmrOanVgA==,type:str] +#ENC[AES256_GCM,data:tGaEE5lsc+NutVre1el9hBL2U7CZ8LNFQZ5Q/AOZp5I=,iv:aF3gXP20Q74Y8shSNP9l17AgtVX83rEL1BvPXpAg+54=,tag:h87MkG5nokS2HLId+QFRQQ==,type:comment] +#ENC[AES256_GCM,data:/jkbA/Kv2BydOycNYyW13yncVDIEJ62bWQZuY6cjrXFt0ywZOQ01BvyyoiHF75VjSZrZPr3IFTuG21Q+g8yMPRopTpvSvtw0v7Tb6O6P,iv:cFeKYcDoyAsimh19yFa6AL0yX4NqUpq4ehTOYnW65iI=,tag:DV0gZdImGG4cOWVR3WnZzA==,type:comment] +linode_token: ENC[AES256_GCM,data:a9Uzjh+DzY1TRLaJ9r7tNYPY2rw+FMj2ldSsL3Dl0SbUCO3HOXN2lvgDHfG/0gqRqrqBd8ZCq60B//3SVqhA8w==,iv:klS15g5pRHImsd1bM2Tc/DjiqaQQVQ/xF5msrqsABU4=,tag:l6Y3u+xhIcm2WEtalka2cQ==,type:str] knot_pdb_terraform_password: ENC[AES256_GCM,data:cu5aUZAVrmtzgBB2hGfBkd+TU4vB0cWnBNluTHptyV0YvZuq,iv:HT4Cmr9huuylVt2vwFcrWUlBmDE6V3n0bXq/telJNBM=,tag:2RSvWnAAM5seHv12HyDprA==,type:str] sops: kms: [] @@ -34,8 +36,8 @@ sops: a1E2c3VEaWR0K3U4dnpqdm5RU0VCZUkKiOtFMhim7qAe4kDU2gijcCChesM0qAGk Z2xNVfBy4HH58cgWrtCQ6PRvULwAQ6Bgq59iZ7H/C2IFVqVfliajmw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-08-21T18:05:07Z" - mac: ENC[AES256_GCM,data:Kxa9SCKy0pLCgqGd7f+xFbQz3Cpf9EfDYP1fwPiIweHhw8iFEeaI7WZCb9zXjsky1tuQ0nbJMHfVQaPSqLC+ACyrBioXIBjgITAfEg3xtpRYiSQRFVBtGA7HpEAKWeFquzTvBR/EAoDuEvFTkrup3JSE8sM3bWKVb2dy1uRyBIc=,iv:O5LO1TFJLlFdCOGWWk5xJlQtVF1+sZTCH2DUKQdvQGo=,tag:0USQg2+EYUVG3+FsjilssQ==,type:str] + lastmodified: "2025-03-30T18:19:37Z" + mac: ENC[AES256_GCM,data:Oyv/4fPW3+u7xsAPCM/JIZEFggmJfUMvk0ofLBjvH0steVJZ53KVzhQrb9D9JIOk4YE9xhhGxH2bHVnx6bm7oX4DtiaGf919NawepoBi0mu8pnbYsvEeFUY4nN5ZA++cGEQYMQDObGeXz6fwncIU6ZPzpcBKGf3hSPdswXNRC8M=,iv:AFT0+ibBnejgbDzZ96Rjz/ngDkC0UTqbkRia+WD4JcU=,tag:VFoXXi7WRRLvULs3EFojIA==,type:str] pgp: [] unencrypted_suffix: _unencrypted - version: 3.7.3 + version: 3.9.1 diff --git a/terraform/dns/dn42.tf b/terraform/dns/dn42.tf index 45fb19d..e23af28 100644 --- a/terraform/dns/dn42.tf +++ b/terraform/dns/dn42.tf @@ -11,7 +11,7 @@ resource "linode_domain_record" "dn42-coregonus" { domain_id = linode_domain.root.id name = "coregonus.dn42" record_type = "AAAA" - target = "fdb1:4242:3538:2005::ffff" + target = "fdb1:4242:3538:2009::4" } resource "linode_domain_record" "dn42-danneri" { @@ -25,14 +25,14 @@ resource "linode_domain_record" "dn42-garasjepi" { domain_id = linode_domain.root.id name = "garasjepi.dn42" record_type = "AAAA" - target = "fdb1:4242:3538:2005:37df:fafe:392:f991" + target = "fdb1:4242:3538:2006:e9f7:418f:49fd:8d2e" } resource "linode_domain_record" "dn42-ha-kv24" { domain_id = linode_domain.root.id name = "ha-kv24.dn42" record_type = "AAAA" - target = "fdb1:4242:3538:2005:c534:9d54:8212:1ced" + target = "fdb1:4242:3538:2006:18a:90f:4264:8ca0" } resource "linode_domain_record" "dn42-ha-lhn2" { @@ -49,6 +49,13 @@ resource "linode_domain_record" "dn42-hash" { target = "fdb1:4242:3538:2007::ffff" } +resource "linode_domain_record" "dn42-kjell" { + domain_id = linode_domain.root.id + name = "kjell.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c" +} + resource "linode_domain_record" "dn42-knot" { domain_id = linode_domain.root.id name = "knot.dn42" @@ -70,6 +77,13 @@ resource "linode_domain_record" "dn42-lhn2-z2m" { target = "fdb1:4242:3538:2008:9aed:e460:1711:7dd" } +resource "linode_domain_record" "dn42-lhn2ix" { + domain_id = linode_domain.root.id + name = "lhn2ix.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2008::1" +} + resource "linode_domain_record" "dn42-lhn2pi" { domain_id = linode_domain.root.id name = "lhn2pi.dn42" @@ -77,6 +91,13 @@ resource "linode_domain_record" "dn42-lhn2pi" { target = "fdb1:4242:3538:2008::ffff" } +resource "linode_domain_record" "dn42-netbox" { + domain_id = linode_domain.root.id + name = "netbox.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2006:be24:11ff:febb:5c7f" +} + resource "linode_domain_record" "dn42-node1" { domain_id = linode_domain.root.id name = "node1.dn42" diff --git a/terraform/dns/trygvis.tf b/terraform/dns/trygvis.tf index 667ba83..a19efcf 100644 --- a/terraform/dns/trygvis.tf +++ b/terraform/dns/trygvis.tf @@ -17,6 +17,13 @@ resource "linode_domain_record" "root-a" { target = "176.58.112.84" } +resource "linode_domain_record" "root-aaaa" { + domain_id = linode_domain.root.id + name = "" + record_type = "AAAA" + target = "2a01:7e00::f03c:91ff:feae:93a3" +} + resource "linode_domain_record" "root-mx" { domain_id = linode_domain.root.id name = "" @@ -165,6 +172,13 @@ resource "linode_domain_record" "kv24" { target = "trygvis.io" } +resource "linode_domain_record" "kv24ix" { + domain_id = linode_domain.root.id + name = "kv24ix" + record_type = "A" + target = "81.166.17.37" +} + resource "linode_domain_record" "lhn2" { domain_id = linode_domain.root.id name = "lhn2" diff --git a/terraform/garasjepi-zigbee2mqtt/main.tf b/terraform/garasjepi-zigbee2mqtt/main.tf index 4d5bb25..df23aea 100644 --- a/terraform/garasjepi-zigbee2mqtt/main.tf +++ b/terraform/garasjepi-zigbee2mqtt/main.tf @@ -12,9 +12,9 @@ provider "docker" { } locals { - host = "garasjepi.dn42.trygvis.io" - docker_image = "koenkk/zigbee2mqtt:1.42.0" - public_ip = module.ipam.hosts.garasjepi.address + host = "garasjepi.dn42.trygvis.io" + version = "2.6.0" + public_ip = module.ipam.hosts.garasjepi.address } module "ipam" { @@ -24,7 +24,7 @@ module "ipam" { module "zigbee2mqtt" { source = "../modules/zigbee2mqtt" - docker_version = "2.1" - public_ip = local.public_ip - serial_port = "/dev/serial/by-id/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2698168-if00" + docker_version = local.version + public_ip = local.public_ip + serial_port = "/dev/serial/by-id/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2698168-if00" } diff --git a/terraform/hash-docker/traefik.tf b/terraform/hash-docker/traefik.tf index 3708024..96f50ec 100644 --- a/terraform/hash-docker/traefik.tf +++ b/terraform/hash-docker/traefik.tf @@ -3,7 +3,7 @@ resource "docker_network" "traefik" { } resource "docker_image" "traefik" { - name = "traefik:2.9.8" + name = "traefik:3.3.4" } resource "docker_container" "traefik" { @@ -31,7 +31,9 @@ resource "docker_container" "traefik" { } command = [ - "--log.level=DEBUG", + "--log.level=INFO", + "--log.format=common", + "--log.noColor=true", "--api=true", "--api.dashboard=true", "--api.debug=true", diff --git a/terraform/ipam6/ipam6.tf b/terraform/ipam6/ipam6.tf index 79a350a..84c7a87 100644 --- a/terraform/ipam6/ipam6.tf +++ b/terraform/ipam6/ipam6.tf @@ -54,33 +54,11 @@ output "networks" { } } } - coregonus_dn42 = { - range = "fdb1:4242:3538:2005::/64" - address = "fdb1:4242:3538:2005::" - prefix = "64" - hosts = { - coregonus = { - address : "fdb1:4242:3538:2005::ffff" - prefix : "128" - } - } - } - coregonus_docker = { - range = "fdb1:4242:3538:2005:df01:676a:ec28:0a00/120" - address = "fdb1:4242:3538:2005:df01:676a:ec28:a00" - prefix = "120" - hosts = { - } - } kv24_pub = { range = "2a01:799:111d:1801::/64" address = "2a01:799:111d:1801::" prefix = "64" hosts = { - ha-kv24 = { - address : "fdb1:4242:3538:2005:c534:9d54:8212:1ced" - prefix : "64" - } } } kv24_dn42 = { @@ -93,9 +71,21 @@ output "networks" { prefix : "128" } garasjepi = { - address : "fdb1:4242:3538:2005:37df:fafe:392:f991" + address : "fdb1:4242:3538:2006:e9f7:418f:49fd:8d2e" prefix : "128" } + ha-kv24 = { + address : "fdb1:4242:3538:2006:18a:90f:4264:8ca0" + prefix : "64" + } + netbox = { + address : "fdb1:4242:3538:2006:be24:11ff:febb:5c7f" + prefix : "64" + } + kjell = { + address : "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c" + prefix : "64" + } } } hash_dn42 = { @@ -121,6 +111,10 @@ output "networks" { address = "fdb1:4242:3538:2008::" prefix = "64" hosts = { + lhn2ix = { + address : "fdb1:4242:3538:2008::1" + prefix : "128" + } lhn2pi = { address : "fdb1:4242:3538:2008::ffff" prefix : "128" @@ -147,6 +141,17 @@ output "networks" { } } } + lhn2_service = { + range = "fdb1:4242:3538:2009::/64" + address = "fdb1:4242:3538:2009::" + prefix = "64" + hosts = { + coregonus = { + address : "fdb1:4242:3538:2009::4" + prefix : "64" + } + } + } danneri_cluster = { range = "fdb1:4242:3538:2008:aaaa:aaaa:aaaa::/112" address = "fdb1:4242:3538:2008:aaaa:aaaa:aaaa:0" @@ -185,26 +190,34 @@ output "hosts" { address : "fdb1:4242:3538:2004::ffff" prefix : "128" } - coregonus = { - address : "fdb1:4242:3538:2005::ffff" - prefix : "128" - } - ha-kv24 = { - address : "fdb1:4242:3538:2005:c534:9d54:8212:1ced" - prefix : "64" - } kv24ix = { address : "fdb1:4242:3538:2006::ffff" prefix : "128" } garasjepi = { - address : "fdb1:4242:3538:2005:37df:fafe:392:f991" + address : "fdb1:4242:3538:2006:e9f7:418f:49fd:8d2e" prefix : "128" } + ha-kv24 = { + address : "fdb1:4242:3538:2006:18a:90f:4264:8ca0" + prefix : "64" + } + netbox = { + address : "fdb1:4242:3538:2006:be24:11ff:febb:5c7f" + prefix : "64" + } + kjell = { + address : "fdb1:4242:3538:2006:2f0:cbff:fefe:d98c" + prefix : "64" + } hash = { address : "fdb1:4242:3538:2007::ffff" prefix : "128" } + lhn2ix = { + address : "fdb1:4242:3538:2008::1" + prefix : "128" + } lhn2pi = { address : "fdb1:4242:3538:2008::ffff" prefix : "128" @@ -229,5 +242,9 @@ output "hosts" { address : "fdb1:4242:3538:2008:5054:ff:fe4d:96c" prefix : "128" } + coregonus = { + address : "fdb1:4242:3538:2009::4" + prefix : "64" + } } } diff --git a/terraform/lhn2pi-zigbee2mqtt/main.tf b/terraform/lhn2pi-zigbee2mqtt/main.tf index 2857b99..f9a6adf 100644 --- a/terraform/lhn2pi-zigbee2mqtt/main.tf +++ b/terraform/lhn2pi-zigbee2mqtt/main.tf @@ -12,8 +12,8 @@ provider "docker" { } locals { - host = "lhn2pi.dn42.trygvis.io" - docker_image = "koenkk/zigbee2mqtt:1.42.0" + host = "lhn2pi.dn42.trygvis.io" + version = "2.3.0" public_ip = module.ipam.hosts.lhn2pi.address } @@ -24,6 +24,7 @@ module "ipam" { module "zigbee2mqtt" { source = "../modules/zigbee2mqtt" - public_ip = local.public_ip - serial_port = "/dev/serial/by-id/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2688076-if00" + docker_version = local.version + public_ip = local.public_ip + serial_port = "/dev/serial/by-id/usb-dresden_elektronik_ingenieurtechnik_GmbH_ConBee_II_DE2688076-if00" } diff --git a/terraform/modules/zigbee2mqtt/zigbee2mqtt.tf b/terraform/modules/zigbee2mqtt/zigbee2mqtt.tf index 467c5e1..8723a38 100644 --- a/terraform/modules/zigbee2mqtt/zigbee2mqtt.tf +++ b/terraform/modules/zigbee2mqtt/zigbee2mqtt.tf @@ -16,7 +16,7 @@ resource "docker_container" "zigbee2mqtt" { name = "zigbee2mqtt" hostname = "zigbee2mqtt" # privileged = true - must_run = true + restart = "unless-stopped" network_mode = "host" @@ -40,6 +40,6 @@ resource "docker_container" "zigbee2mqtt" { devices { host_path = var.serial_port container_path = "/dev/ttyACM0" -# permissions = "rwm" + permissions = "rwm" } } diff --git a/tnet/host_vars/knot/wg.yml b/tnet/host_vars/knot/wg.yml index 9ad867e..e64a4a6 100644 --- a/tnet/host_vars/knot/wg.yml +++ b/tnet/host_vars/knot/wg.yml @@ -6,10 +6,11 @@ tnet_wg: address: fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7c lhn2ix: port: 51002 - address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9a +# address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9a + address: fdb1:4242:3538:2f02::a kv24ix: port: 51003 - address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7ce + address: fdb1:4242:3538:2f01::a akili: port: 51004 address: fdb1:4242:3538:ffff:59d7:cf77:8b5d:761a @@ -37,3 +38,8 @@ tnet_wg: if_name: coregonus port: 51011 address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2 + kioubit_de2: + if_name: kioubit_d2 + endpoint: de2.g-load.eu:23538 + port: 51012 + address: fe80::ade1 diff --git a/tnet/host_vars/kv24ix/wg.yml b/tnet/host_vars/kv24ix/wg.yml index 99c54b6..4a4c833 100644 --- a/tnet/host_vars/kv24ix/wg.yml +++ b/tnet/host_vars/kv24ix/wg.yml @@ -1,3 +1,4 @@ tnet_wg: knot: - address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf +# address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9b + address: fdb1:4242:3538:2f02::b/64 diff --git a/tnet/keys/wg-kioubit_de2-knot.pub b/tnet/keys/wg-kioubit_de2-knot.pub new file mode 100644 index 0000000..aed317e --- /dev/null +++ b/tnet/keys/wg-kioubit_de2-knot.pub @@ -0,0 +1 @@ +B1xSG/XTJRLd+GrWDsB06BqnIq8Xud93YVh/LYYYtUY= diff --git a/tnet/keys/wg-knot-kioubit_de2.pub b/tnet/keys/wg-knot-kioubit_de2.pub new file mode 100644 index 0000000..a8d0922 --- /dev/null +++ b/tnet/keys/wg-knot-kioubit_de2.pub @@ -0,0 +1 @@ +7QJdCBlpvYWHyg33ifsifWmV/bV6RgUct4lh0ykCK1g= diff --git a/tnet/keys/wg-knot-kioubit_de2.sops.key b/tnet/keys/wg-knot-kioubit_de2.sops.key new file mode 100644 index 0000000..6f699b0 --- /dev/null +++ b/tnet/keys/wg-knot-kioubit_de2.sops.key @@ -0,0 +1,28 @@ +{ + "data": "ENC[AES256_GCM,data:pj1LPjdqo+M/GlgWA63LNH/lM7F5rOYeMF1a0qNuBm6/luo5PvRYBj2jyLxa,iv:qlIvXCBXd9dyC6tj9WH0mq3jomzSUc4maPg9zPIvDbM=,tag:cSHZFa18BISZ9owjkHVkVw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MTdPUUFNU0FXcTZWckZJ\nSXV2a3ZQVmE0T3BNTVByMGp0L3ZvZERyNEFjCmFjcmRpeXU5S2tlTnp3NXBPKzl4\nZ1doRVZ0TTYwZkkvSU5RNitySUJoTWsKLS0tIGlsNzJHL0FydVRXT3puT0RuR0R2\nZGZSaXFOWFB2YkoyMi8rZ0tBL2xxbjAKDPy+8yB95EZZq542FtuI3vo4NmcDrVO5\njOvYGmatpxqSZJ9Oy4HpMzKSWvSuKVkZwTcG7Zzrhi6qrhm/TKIRvQ==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0dGlteEludXNpampzd0lD\nTGtQYjIwV3dEbVlEYUJOTlRXZDJYTGNpM1dzCncxMWg4R0J4aVQxQWlvQXY2ZmFH\nWjlxckFWZ2IzMnNENDZHeGFPUlJtVXMKLS0tIHJET2RLL1dBVURwdHhMZGpiMHlW\nblFaQTlDRDE4TmN6SDBnbTVpa3d1eEkKReWQml+gnXRCFbQtF5tFm8vUrALnY+QB\n/dki/g35K2I4tzyPg7qPgKEdGGUYcPTfg1Fyf2m7Q7xXJ7Xg7T1flA==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNTltblFtRGVLM2xSTGp1\nVjFNMzBaNHJ2WmZTeUlON25GZE5hSUF5QVdFCmFQb28xK2dDVFdzcS9hSTZGRnRv\nSDBDNWNGb3lWVFVmNk9VR1N5TTRkd1kKLS0tIHBhZVp3d3U4UzlDK0ZkaWRxdTA5\nelBrVFVId1IydVpOcXl2R2x3SDZlNlkKNB7tdDL9QdglbbN/za18BBbWDEEvgZcr\nIHEiz1UJZZYdKEsfk1w0LRE9IKhh7LdL11hCtfO/2uTVY/4ghDFHcA==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2025-06-30T17:13:23Z", + "mac": "ENC[AES256_GCM,data:zY63cqqaceaSuyIBi06jQcwuUaR/bD8h1EL0B+2M8SLTdPQAQ88cDzWze8NjpN2WqPYsxGNo2RYZe0YPXg3ymEJ9YeOvOBzALUZvf7geF7KOoNAqzzieWmIjt7K6Xmq8w1LmsEN3oM8oUU/vNiNoXLHpcD+/Yamu2d0CGr32TZU=,iv:Aj7Hop2etAvJrfsFrvoag0bvKlaMrJySdea3t4cK9c8=,tag:kN4Tn6kiKEwFy0RW6i/HDA==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.9.1" + } +}
\ No newline at end of file diff --git a/tnet/wg-links.yml b/tnet/wg-links.yml index a050547..6613614 100644 --- a/tnet/wg-links.yml +++ b/tnet/wg-links.yml @@ -6,6 +6,7 @@ handlers: # Has to be restart for now, hash doesn't support reloading networkd - name: systemctl restart systemd-networkd + #when: false become: yes systemd: name: systemd-networkd |