aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ansible/group_vars/all/ipam.yml16
-rw-r--r--ansible/inventory2
-rw-r--r--tnet/files/coregonus/bird-tnet-pre.conf20
-rw-r--r--tnet/files/coregonus/bird-tnet.conf43
-rw-r--r--tnet/files/knot/bird-tnet.conf14
-rw-r--r--tnet/host_vars/coregonus/bird.yml4
-rw-r--r--tnet/host_vars/coregonus/wg.yml5
-rw-r--r--tnet/host_vars/knot/bird.yml4
-rw-r--r--tnet/host_vars/knot/wg.yml6
-rw-r--r--tnet/host_vars/kv24ix/wg.yml1
-rw-r--r--tnet/keys/wg-coregonus-knot.pub1
-rw-r--r--tnet/keys/wg-coregonus-knot.sops.key28
-rw-r--r--tnet/keys/wg-knot-coregonus.pub1
-rw-r--r--tnet/keys/wg-knot-coregonus.sops.key28
14 files changed, 171 insertions, 2 deletions
diff --git a/ansible/group_vars/all/ipam.yml b/ansible/group_vars/all/ipam.yml
index 82f1e62..4d4017b 100644
--- a/ansible/group_vars/all/ipam.yml
+++ b/ansible/group_vars/all/ipam.yml
@@ -14,8 +14,22 @@ ipam6:
description: Internal network on host
range: "fdb1:4242:3538:2001::/64"
hosts:
- - conflatorio-ix: "fdb1:4242:3538:2001::ffff"
+ - conflatorio-ix: "fdb1:4242:3538:2001::ffff/64"
node1_dn42:
range: "fdb1:4242:3538:2002::/64"
node2_dn42:
range: "fdb1:4242:3538:2003::/64"
+ knot_dn42:
+ range: "fdb1:4242:3538:2004::/64"
+ hosts:
+ - knot: "fdb1:4242:3538:2004::ffff/64"
+ coregonus_dn42:
+ range: "fdb1:4242:3538:2005::/64"
+ hosts:
+ - coregonus-ix: "fdb1:4242:3538:2005::ffff/64"
+ coregonus_docker:
+ range: "fdb1:4242:3538:2005:df01:676a:ec28:0a00/120"
+ kv24_dn42:
+ range: "fdb1:4242:3538:2006::/64"
+ hosts:
+ - kv24ix: "fdb1:4242:3538:2006::ffff/64"
diff --git a/ansible/inventory b/ansible/inventory
index 9b89ace..a21cbc9 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -178,6 +178,7 @@ all:
akili:
astyanax:
conflatorio:
+ coregonus:
hash:
knot:
kv24ix:
@@ -191,6 +192,7 @@ all:
akili:
astyanax:
conflatorio:
+ coregonus:
hash:
knot:
lhn2pi:
diff --git a/tnet/files/coregonus/bird-tnet-pre.conf b/tnet/files/coregonus/bird-tnet-pre.conf
new file mode 100644
index 0000000..d60e8df
--- /dev/null
+++ b/tnet/files/coregonus/bird-tnet-pre.conf
@@ -0,0 +1,20 @@
+define tnet = fdb1:4242:3538:2000::/52;
+
+function is_tnet() -> bool
+{
+ return net ~ tnet;
+}
+
+roa6 table dn42_roa;
+
+protocol static {
+ roa6 { table dn42_roa; };
+ include "/etc/bird/dn42_roa_bird2_6.conf";
+};
+
+function dn42_is_valid_network() -> bool
+{
+ return net ~ [
+ fd00::/8{44,64} # ULA address space as per RFC 4193
+ ];
+}
diff --git a/tnet/files/coregonus/bird-tnet.conf b/tnet/files/coregonus/bird-tnet.conf
new file mode 100644
index 0000000..95ede41
--- /dev/null
+++ b/tnet/files/coregonus/bird-tnet.conf
@@ -0,0 +1,43 @@
+# Set to true if this peer is directly connected to a dn42 peer
+define is_dn42_peer = true;
+# If we are connected directly to dn42, we don't want the dn42 routes from others
+define import_dn42 = !is_dn42_peer;
+define export_dn42 = is_dn42_peer;
+
+template bgp tnet_tpl {
+ local as 4242423538;
+ neighbor internal;
+
+ direct;
+
+ password "trygvis";
+
+ ipv6 {
+ next hop self;
+ import filter {
+ if is_tnet() then {
+ accept proto, ": (tnet) import accept, net=", net, ", from=", from, ", gw=", gw;
+ } else if import_dn42 && dn42_is_valid_network() then {
+ accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw;
+ } else {
+ reject proto, ": import reject, reason=not tnet";
+ }
+ };
+ # newer bird's only
+ # import keep filtered;
+ export filter {
+ if is_tnet() then {
+ accept proto, ": (tnet) export accept, net=", net, ", from=", from, ", gw=", gw;
+ } else if export_dn42 && dn42_is_valid_network() then {
+ accept proto, ": (dn42) import accept, net=", net, ", from=", from, ", gw=", gw;
+ } else {
+ reject proto, ": export reject, reason=not tnet";
+ }
+ };
+ };
+}
+
+protocol bgp tnet_knot from tnet_tpl {
+ neighbor fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2;
+ interface "tnet-knot";
+}
diff --git a/tnet/files/knot/bird-tnet.conf b/tnet/files/knot/bird-tnet.conf
index fd5332a..e774e31 100644
--- a/tnet/files/knot/bird-tnet.conf
+++ b/tnet/files/knot/bird-tnet.conf
@@ -44,6 +44,13 @@ protocol bgp tnet_conflatorio from tnet_tpl {
rr client;
}
+protocol bgp tnet_coregonus from tnet_tpl {
+ neighbor fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d3;
+ interface "tnet-coregonus";
+
+ rr client;
+}
+
protocol bgp tnet_hash from tnet_tpl {
neighbor fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7d;
interface "tnet-hash";
@@ -51,6 +58,13 @@ protocol bgp tnet_hash from tnet_tpl {
rr client;
}
+protocol bgp tnet_kv24ix from tnet_tpl {
+ neighbor fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf;
+ interface "tnet-kv24ix";
+
+ rr client;
+}
+
protocol bgp tnet_lhn2pi from tnet_tpl {
neighbor fdb1:4242:3538:ffff:374e:2c7d:319e:e527;
interface "tnet-lhn2pi";
diff --git a/tnet/host_vars/coregonus/bird.yml b/tnet/host_vars/coregonus/bird.yml
new file mode 100644
index 0000000..816b95a
--- /dev/null
+++ b/tnet/host_vars/coregonus/bird.yml
@@ -0,0 +1,4 @@
+tnet_bird_peers:
+ knot:
+
+birdv: 2015
diff --git a/tnet/host_vars/coregonus/wg.yml b/tnet/host_vars/coregonus/wg.yml
new file mode 100644
index 0000000..0d80a18
--- /dev/null
+++ b/tnet/host_vars/coregonus/wg.yml
@@ -0,0 +1,5 @@
+tnet_wg:
+ knot:
+ endpoint: knot.inamo.no:51011
+ address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d3
+
diff --git a/tnet/host_vars/knot/bird.yml b/tnet/host_vars/knot/bird.yml
index a9175e8..94c610a 100644
--- a/tnet/host_vars/knot/bird.yml
+++ b/tnet/host_vars/knot/bird.yml
@@ -2,8 +2,12 @@ tnet_bird_peers:
conflatorio:
rr_client: true
interface: tnet-confltrio
+ coregonus:
+ rr_client: true
hash:
rr_client: true
+ kv24ix:
+ rr_client: true
node1:
rr_client: true
node2:
diff --git a/tnet/host_vars/knot/wg.yml b/tnet/host_vars/knot/wg.yml
index b382831..243c9f2 100644
--- a/tnet/host_vars/knot/wg.yml
+++ b/tnet/host_vars/knot/wg.yml
@@ -9,7 +9,7 @@ tnet_wg:
address: fdb1:4242:3538:ffff:18b7:d3ec:5608:db9a
kv24ix:
port: 51003
- address: fdb1:4242:3538:ffff:ea4:11cb:863:5252
+ address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7ce
akili:
port: 51004
address: fdb1:4242:3538:ffff:59d7:cf77:8b5d:761a
@@ -34,3 +34,7 @@ tnet_wg:
if_name: confltrio
port: 51010
address: fe80:47fc:0660:b91f:1063:a6ae:46bb:7589
+ coregonus:
+ if_name: coregonus
+ port: 51011
+ address: fe80:ba82:77f0:f96d:7a85:a7fa:ef6f:37d2
diff --git a/tnet/host_vars/kv24ix/wg.yml b/tnet/host_vars/kv24ix/wg.yml
index 9cfdc5d..99c54b6 100644
--- a/tnet/host_vars/kv24ix/wg.yml
+++ b/tnet/host_vars/kv24ix/wg.yml
@@ -1,2 +1,3 @@
tnet_wg:
knot:
+ address: fe80:fef1:078a:5b64:efd3:ae7b:d286:d7cf
diff --git a/tnet/keys/wg-coregonus-knot.pub b/tnet/keys/wg-coregonus-knot.pub
new file mode 100644
index 0000000..181fd56
--- /dev/null
+++ b/tnet/keys/wg-coregonus-knot.pub
@@ -0,0 +1 @@
+uOqXlYKRgwBXVKPAaPn2fx4YtMHCH5M2qQ3hs/tZwms=
diff --git a/tnet/keys/wg-coregonus-knot.sops.key b/tnet/keys/wg-coregonus-knot.sops.key
new file mode 100644
index 0000000..b3c6239
--- /dev/null
+++ b/tnet/keys/wg-coregonus-knot.sops.key
@@ -0,0 +1,28 @@
+{
+ "data": "ENC[AES256_GCM,data:aPPYaRDzczKgMZxWKJXE5X7JC0pQxs9W0d3UZjY8QYLhxmxk8L+RpX6zWscR,iv:CE+JgwUMdkbFDrkk53ow77ehm3GEmeJFnVM5jbWXZIY=,tag:mlnV5SNhIOnU/+TnOWiU0g==,type:str]",
+ "sops": {
+ "kms": null,
+ "gcp_kms": null,
+ "azure_kv": null,
+ "hc_vault": null,
+ "age": [
+ {
+ "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3",
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMWml3V0dCRStJY0RsUEN5\nSVhya1dXYW5GQ0R1a1h3NVJMV09LbVV1eXhNCmFMS2JYVzVPbS95TmwxWG04emtO\nd3B5QUtxWGVaWTlpUDN4ZVErZ1BqcEEKLS0tIE9iTjJaN0RaZjJQeG5Zd1Z5Ylp1\nYkwxS0JqVzNLNHBkSjM0b2owcURZN1UKj5i3uMAwhcqM/vB6faF2vq3ndEYGEOAn\nH1m4LdRj0b03BOtz5vz5oeF+nW3e8rGwhq84N7UFdI4W+9w3ZCI2AQ==\n-----END AGE ENCRYPTED FILE-----\n"
+ },
+ {
+ "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw",
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMVGdPaERQRWNodnpmOUFM\nWG1QSGhJUmoyamplMFFsK3krNzd4ZHVvdlY0Cit3UHNzNUVIVWlZakNsTUFNVlA1\neE9rNTliWmZ0a295UVJZUXo3dk9WTkkKLS0tIDE2SjE1bXFVdno5NkwwQk15UGZY\nczBPTTUwdTBJT0laWWJsWmJmNDFuUG8KRlCmMio144qdPuPXuxc2AEHhdUxbJT8W\nDp7Atk0G57V57tX/zk1RaXjp+ORStvwpgDAdCwmikt1PW78Y6x77tQ==\n-----END AGE ENCRYPTED FILE-----\n"
+ },
+ {
+ "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5",
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpYWlHRUVTV1RreFExcDBj\nYmI3OTBpRnEwd0FBTDdPTHI1OVhRYmlZMGdFCjlHTWJPY0lSRVhPSTQyNEgxYkMy\nY3ljMnhKeURSL2JwcDd3dmlubW15bFEKLS0tIEZHUG9NUmNnUlh2NjlTd1RsYytR\nVDI0OVhZeGhyWFVFcU9URE1NRXpnR00KUO2W8ab2RehPhEAjFlOXWrr2rn55gBR5\neSvOtAPEEV1lWO+O0r3jOFpnUI/ahgPeBhMoLFOdionm3GPrYzf8aQ==\n-----END AGE ENCRYPTED FILE-----\n"
+ }
+ ],
+ "lastmodified": "2024-08-20T22:51:59Z",
+ "mac": "ENC[AES256_GCM,data:4haVcOm18uCW8LK06wURyf32qr9ZXnjc6feJHf4T85C0COrmZ7AmxUZKt5Mi9YoPO7dTMpjcvnxhEVEP4x6/wBc3SB5RpRSWU25GZ4/ofnqR/xBH0R1edirQtuhsDJeR3rYnTYeMjRltf9zpZknED907GRmmddaO15xsWtU8/t8=,iv:wXMIQRj4mV7SNnUqC3XVM/8mEhbPMwL1Z4/LrIBqpcs=,tag:i6CSlmj2449GgMqosa8e0A==,type:str]",
+ "pgp": null,
+ "unencrypted_suffix": "_unencrypted",
+ "version": "3.7.3"
+ }
+} \ No newline at end of file
diff --git a/tnet/keys/wg-knot-coregonus.pub b/tnet/keys/wg-knot-coregonus.pub
new file mode 100644
index 0000000..7fc1905
--- /dev/null
+++ b/tnet/keys/wg-knot-coregonus.pub
@@ -0,0 +1 @@
+lTuzdN+En+Jc8v9+cTx2U455mw6v+fl/QsWWxO7ZYgI=
diff --git a/tnet/keys/wg-knot-coregonus.sops.key b/tnet/keys/wg-knot-coregonus.sops.key
new file mode 100644
index 0000000..6acb9ef
--- /dev/null
+++ b/tnet/keys/wg-knot-coregonus.sops.key
@@ -0,0 +1,28 @@
+{
+ "data": "ENC[AES256_GCM,data:NhASCvnUd1DDdo8qQ8MNY+KXMa9fACx7DNEwNwwLgjuwSu+bV42z/OYTY6Ck,iv:z0mGt+HuBwuS+WnbuomGwqReCXqEfIC+qPOuz+JciSw=,tag:sCUW0nXWJWgxYEAbkp+7JQ==,type:str]",
+ "sops": {
+ "kms": null,
+ "gcp_kms": null,
+ "azure_kv": null,
+ "hc_vault": null,
+ "age": [
+ {
+ "recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3",
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTWY3a0xxbzJnVm1GRHdU\nZU1IcnhKQkdEVjBtNFRIb0swWHlqdldFSUR3Ckg4dGlERkV4Ly93YVRwSjBJdzB0\nS1hmSkNQY2ROdDBZVTVmODRUR2Z4bmMKLS0tIFh0ZDJ1d2ViMFVwNlRkY3d6eU5E\nbHVhSXVCRWI2b2NKVVI1cGVjL3RGaVEKgFzmd42NmzH4GH4Vuklcd1jkCJnngloO\nN4Q5/NdHij8fXWnhkuV/8xX7KnBXEGX5uHo9pYd1aYzyZTUD40rDyw==\n-----END AGE ENCRYPTED FILE-----\n"
+ },
+ {
+ "recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw",
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TmJ4UjZBN2pFU2dBZXdG\naDNtQUhGdkFnYkh5OXVlYTZ6c1N0YWpaTnpNCnZMWFgrWFpNd0tqVGpyN2NIZnlo\ncTRlQ1Q4UGJySm16TThwS0V1dW1nTlUKLS0tIGgzWjQvZ0hETW15TTV4S0Q1K1V5\naDFMODFVcVB4cmxnYXR5RTRnanQ0bVkKPZ/caVVhPQ/0I5X3A70czYnMNgw/l39W\nrf75d5RK5x5FcgZenz23l00g+AUt8uNfct+3YHc15OjL+vOrtm1NCQ==\n-----END AGE ENCRYPTED FILE-----\n"
+ },
+ {
+ "recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5",
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjalBWcXg5NVlFS3Bjb0Vt\nUXlhNVNxMmtIMVhEdC8rb2h5UEJxUVpUckI0Ci9BaUM3YWJSczI1RVNQWGtIZllI\nQmhuK2dyMUwvRlpORUZDK2thWldUdFkKLS0tIDA2UVBzbTQ3aDEwcXNHcjRoMkNW\nRXhmZ3hmUlhVR0xzaWU1MDZBUW1zcTAKkkyLoqodk7FWwZV07wlkttEs115/v9ZI\nOVfi+VzkI++jLW2KzL1S1i1N+/BHnfXDnzNDaIqUTRrFi5jhd1kk0A==\n-----END AGE ENCRYPTED FILE-----\n"
+ }
+ ],
+ "lastmodified": "2024-08-20T23:20:12Z",
+ "mac": "ENC[AES256_GCM,data:l4s7OdTHRqBXVGHpCQMo/k6nwwPEcWK8J47n1b8pQSDuO4DFcB/ApI8rNKgFAujXLUwB10YeRwp0bcLdlGREt7PhcHhddNB5yRYx/8djqYpm0w3rSAN9p4IW5CNB5LmfdxQk2dI0Ow8wxw8UzTVO08T7cDNeYRZdQTJLd+VUhCo=,iv:Ffv/pz30FwLaho3Y2HlMO11jKIl71GUpKMe1cSMNOwo=,tag:Qo3ZSTnJa26jYdwJtGvmyQ==,type:str]",
+ "pgp": null,
+ "unencrypted_suffix": "_unencrypted",
+ "version": "3.7.3"
+ }
+} \ No newline at end of file
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 10:42:49 +0000