From 9669bf50f86eab41c631a97c1630a3e3de6cd045 Mon Sep 17 00:00:00 2001 From: Robert Arkenklo Date: Wed, 3 Feb 2021 20:06:48 +0100 Subject: [PATCH 1/5] Update hosts for ansible 2.10 --- hosts | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/hosts b/hosts index 06616ad..de355b6 100644 --- a/hosts +++ b/hosts @@ -1,16 +1,16 @@ # Define hosts -gw05=198.167.222.5 -gw06=198.167.222.6 -fwalpine=198.167.222.7 -builder=198.167.222.9 -simsek=simsek.pjodd.se +gw05 gateway_number=5 ssh_port=5522 ansible_host=198.167.222.5 +gw06 gateway_number=6 ssh_port=6622 ansible_host=198.167.222.6 +fwalpine ansible_host=198.167.222.7 +builder ssh_port=9922 ansible_host=198.167.222.9 +simsek ansible_host=simsek.pjodd.se [gateways] -gw05 gateway_number=5 ssh_port=5522 -gw06 gateway_number=6 ssh_port=6622 +gw05 +gw06 [builders] -builder ssh_port=9922 +builder [debians] gw05 From 1e6eef6b4e70c1b62a7d3e8931cb1b361336799f Mon Sep 17 00:00:00 2001 From: Robert Arkenklo Date: Sun, 7 Mar 2021 15:06:55 +0100 Subject: [PATCH 2/5] Update gateway role for debian 10 on Hetzner --- README.md | 6 ++++ group_vars/gateways.yml | 9 +++--- .../gateway/files/install_kea_dhcp_server.sh | 23 +++++++++++++ .../gateway/files/kea_dhcp_server_pinned.pref | 3 ++ roles/gateway/handlers/main.yml | 7 ++-- roles/gateway/tasks/batman.yml | 2 +- roles/gateway/tasks/dns.yml | 8 +++++ roles/gateway/tasks/interfaces.yml | 14 +++++++- roles/gateway/tasks/main.yml | 5 +++ roles/gateway/tasks/packages.yml | 32 ++++++++++++++++--- roles/gateway/templates/interfaces.j2 | 7 ++++ 11 files changed, 102 insertions(+), 14 deletions(-) create mode 100644 README.md create mode 100644 roles/gateway/files/install_kea_dhcp_server.sh create mode 100644 roles/gateway/files/kea_dhcp_server_pinned.pref diff --git a/README.md b/README.md new file mode 100644 index 0000000..92e13e1 --- /dev/null +++ b/README.md @@ -0,0 +1,6 @@ +# Pjodd Ansible repo +Tested with ansible version 2.10.5. + +## How to setup new gateway +Setup a Debian 10 machine. Then run: `ansible-playbook -i hosts --limit gw00 ./setup-gateway.yml` + diff --git a/group_vars/gateways.yml b/group_vars/gateways.yml index bd7186d..712aebe 100644 --- a/group_vars/gateways.yml +++ b/group_vars/gateways.yml @@ -38,15 +38,16 @@ gateway_packages: - iptables-persistent - net-tools - iftop - - tcpdump - - ifupdown2 - - kea-dhcp4-server - - kea-dhcp6-server - radvd - unbound - ldnsutils - nsd +# This is a hack. kea-dhcp-server is not available in debian 10, only debian 9. +gateway_packages_kea: + - kea-dhcp4-server + - kea-dhcp6-server + gateway_users: - omni - quite diff --git a/roles/gateway/files/install_kea_dhcp_server.sh b/roles/gateway/files/install_kea_dhcp_server.sh new file mode 100644 index 0000000..f64974e --- /dev/null +++ b/roles/gateway/files/install_kea_dhcp_server.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +# Instructions from https://kb.isc.org/docs/kea-build-on-debian + +# install the build environment +sudo apt -y install automake libtool pkg-config build-essential ccache +# install the dependancies +sudo apt -y install libboost-dev libboost-system-dev liblog4cplus-dev libssl-dev + +wget https://ftp.isc.org/isc/kea/1.5.0/kea-1.5.0.tar.gz +tar xvfz kea-1.5.0.tar.gz +cd kea-1.5.0 + +export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig +# export CC="ccache gcc" CXX="ccache g++" +declare -x PATH="/usr/lib64/ccache:$PATH" +autoreconf --install +./configure [your additional options here] +make -j4 +sudo make install +echo "/usr/local/lib/hooks" > /etc/ld.so.conf.d/kea.conf +ldconfig + diff --git a/roles/gateway/files/kea_dhcp_server_pinned.pref b/roles/gateway/files/kea_dhcp_server_pinned.pref new file mode 100644 index 0000000..f6048a4 --- /dev/null +++ b/roles/gateway/files/kea_dhcp_server_pinned.pref @@ -0,0 +1,3 @@ +Package: * +Pin: release o=Debian,a=oldstable,n=stretch +Pin-Priority: 50 diff --git a/roles/gateway/handlers/main.yml b/roles/gateway/handlers/main.yml index 9890883..aa07b2b 100644 --- a/roles/gateway/handlers/main.yml +++ b/roles/gateway/handlers/main.yml @@ -13,9 +13,10 @@ shell: ip6tables-save > /etc/iptables/rules.v6 listen: "save iptables" -- name: run ifreload - command: ifreload -a - listen: "ifreload" +- name: reload networking + service: + name: network + state: reoladed - name: restart fastd service: diff --git a/roles/gateway/tasks/batman.yml b/roles/gateway/tasks/batman.yml index f7227aa..4016c17 100644 --- a/roles/gateway/tasks/batman.yml +++ b/roles/gateway/tasks/batman.yml @@ -21,4 +21,4 @@ owner: root group: root mode: 0644 - notify: ifreload + notify: reload networking diff --git a/roles/gateway/tasks/dns.yml b/roles/gateway/tasks/dns.yml index 0341689..96f6304 100644 --- a/roles/gateway/tasks/dns.yml +++ b/roles/gateway/tasks/dns.yml @@ -1,6 +1,7 @@ --- # file: roles/gateway/tasks/dns.yml + - name: unbound.conf template: src: 'unbound.conf.j2' @@ -18,6 +19,13 @@ group: root mode: 0644 +- name: Disable nsd on Hetzner hosts + ansible.builtin.service: + name: nsd + enabled: no + state: stopped + when: provider == "hetzner" + - name: unbound enabled & started service: name: unbound diff --git a/roles/gateway/tasks/interfaces.yml b/roles/gateway/tasks/interfaces.yml index f908cbc..5bcb8a7 100644 --- a/roles/gateway/tasks/interfaces.yml +++ b/roles/gateway/tasks/interfaces.yml @@ -1,6 +1,18 @@ --- # file: roles/gateway/tasks/interfaces.yml +- name: Disable Hetzner cloud config + copy: + content: "network: {config: disabled}" + dest: /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg + force: yes + when: provider == "hetzner" + +- name: Delete Hetzner cloud config as well + file: + name: /etc/network/interfaces.d/50-cloud-init + state: absent + - name: Template /etc/network/interfaces template: src: 'interfaces.j2' @@ -8,4 +20,4 @@ owner: root group: root mode: 0644 - notify: ifreload + notify: reload networking diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml index 1761b55..5367285 100644 --- a/roles/gateway/tasks/main.yml +++ b/roles/gateway/tasks/main.yml @@ -4,6 +4,11 @@ - import_tasks: packages.yml - import_tasks: interfaces.yml - import_tasks: firewall.yml + +- name: Reboot machine to enable network changes + reboot: + when: provider == "hetzner" + - import_tasks: fastd.yml - import_tasks: batman.yml - import_tasks: dns.yml diff --git a/roles/gateway/tasks/packages.yml b/roles/gateway/tasks/packages.yml index 838dc65..95e4fd5 100644 --- a/roles/gateway/tasks/packages.yml +++ b/roles/gateway/tasks/packages.yml @@ -1,11 +1,28 @@ --- # file: roles/gateway/tasks/packages.yml -- name: Setup Debian Backports repo - apt_repository: - repo: deb http://ftp.se.debian.org/debian/ stretch-backports main +# Not required for debian 10 +#- name: Setup Debian Backports repo +# apt_repository: +# repo: deb http://ftp.se.debian.org/debian/ stretch-backports main +# state: present + +#- name: Setup Debian Backports repo +# apt_repository: +# repo: deb http://ftp.se.debian.org/debian/ stretch-backports main +# state: present + +# TODO: switch to another dhcp server +- name: Setup debian 9 repo (for kea-dhcp-server) + ansible.builtin.apt_repository: + repo: deb http://deb.debian.org/debian stretch main contrib non-free state: present +- name: Set debian 9 repo to lower prio + copy: + src: files/kea_dhcp_server_pinned.pref + dest: /etc/apt/preferences.d/ + - name: Update installed packages apt: upgrade: dist @@ -13,6 +30,11 @@ - name: Install packages apt: - pkg: "{{ item }}" + pkg: "{{ gateway_packages }}" state: latest - with_items: "{{ gateway_packages }}" + +# kea-dhcp-server is not available in debian 10 +- name: Install kea-dhcp-server + apt: + pkg: "{{ gateway_packages_kea }}" + state: latest \ No newline at end of file diff --git a/roles/gateway/templates/interfaces.j2 b/roles/gateway/templates/interfaces.j2 index e298aa4..4481912 100644 --- a/roles/gateway/templates/interfaces.j2 +++ b/roles/gateway/templates/interfaces.j2 @@ -12,8 +12,15 @@ iface lo inet loopback # The primary network interface auto eth0 iface eth0 inet static +{% if outernet.inet.address is defined %} + address {{ outernet.inet.address }}/{{ outernet.inet.cidr }} +{% else %} address {{ outernet.inet.subnet }}.{{ gateway_number }}/{{ outernet.inet.cidr }} +{% endif %} gateway {{ outernet.inet.gw }} +{% if outernet.inet.pointtopoint is defined %} + pointtopoint {{ outernet.inet.pointtopoint }} +{% endif %} # dns-* options are implemented by the resolvconf package, if installed dns-nameservers {{ outernet.inet.dns }} dns-search pjodd.se From 5bb6f63534ef243f38093ca27faa9038bc765954 Mon Sep 17 00:00:00 2001 From: Robert Arkenklo Date: Sun, 7 Mar 2021 15:49:49 +0100 Subject: [PATCH 3/5] Add new gw01 in Helsinki --- group_vars/dc-hel.yml | 17 +++++++++++++++++ hosts | 7 +++++++ 2 files changed, 24 insertions(+) create mode 100644 group_vars/dc-hel.yml diff --git a/group_vars/dc-hel.yml b/group_vars/dc-hel.yml new file mode 100644 index 0000000..9495c2f --- /dev/null +++ b/group_vars/dc-hel.yml @@ -0,0 +1,17 @@ +--- +# file: group_vars/dc-hel.yml +# VM on private server provided by friend of Robert + +outernet: + inet: + gw: 95.216.239.97 + netmask: 255.255.255.224 + subnet: 95.216.239.96 + cidr: 27 + dns: 46.246.46.246 194.132.32.32 + + inet6: + gw: "fe80::1" + subnet: "fe80::" + cidr: 64 + dns: "2001:67C:1350:DEAD:BEEF::246 2C0F:F930:DEAD:BEEF::32" diff --git a/hosts b/hosts index de355b6..8a6a25c 100644 --- a/hosts +++ b/hosts @@ -1,4 +1,6 @@ # Define hosts + +gw01 gateway_number=1 ssh_port=7722 ansible_host=95.216.239.120 gw05 gateway_number=5 ssh_port=5522 ansible_host=198.167.222.5 gw06 gateway_number=6 ssh_port=6622 ansible_host=198.167.222.6 fwalpine ansible_host=198.167.222.7 @@ -6,6 +8,7 @@ builder ssh_port=9922 ansible_host=198.167.222.9 simsek ansible_host=simsek.pjodd.se [gateways] +gw01 gw05 gw06 @@ -13,6 +16,7 @@ gw06 builder [debians] +gw01 gw05 gw06 builder @@ -27,5 +31,8 @@ gw05 gw06 builder +[dc-hel] +gw01 + [web] simsek ansible_user=root ansible_python_interpreter=/usr/bin/python3 From fcebe95e6098a727ad6cce2279ac8ec97885e479 Mon Sep 17 00:00:00 2001 From: Robert Arkenklo Date: Sun, 21 Mar 2021 10:24:19 +0100 Subject: [PATCH 4/5] Allow undefined provider, typos --- group_vars/dc-hel.yml | 2 +- roles/gateway/handlers/main.yml | 2 +- roles/gateway/tasks/dns.yml | 2 +- roles/gateway/tasks/interfaces.yml | 3 ++- 4 files changed, 5 insertions(+), 4 deletions(-) diff --git a/group_vars/dc-hel.yml b/group_vars/dc-hel.yml index 9495c2f..6d9a408 100644 --- a/group_vars/dc-hel.yml +++ b/group_vars/dc-hel.yml @@ -6,7 +6,7 @@ outernet: inet: gw: 95.216.239.97 netmask: 255.255.255.224 - subnet: 95.216.239.96 + subnet: 95.216.239 cidr: 27 dns: 46.246.46.246 194.132.32.32 diff --git a/roles/gateway/handlers/main.yml b/roles/gateway/handlers/main.yml index aa07b2b..3c75059 100644 --- a/roles/gateway/handlers/main.yml +++ b/roles/gateway/handlers/main.yml @@ -16,7 +16,7 @@ - name: reload networking service: name: network - state: reoladed + state: reloaded - name: restart fastd service: diff --git a/roles/gateway/tasks/dns.yml b/roles/gateway/tasks/dns.yml index 96f6304..951687a 100644 --- a/roles/gateway/tasks/dns.yml +++ b/roles/gateway/tasks/dns.yml @@ -24,7 +24,7 @@ name: nsd enabled: no state: stopped - when: provider == "hetzner" + when: provider is defined and provider == "hetzner" - name: unbound enabled & started service: diff --git a/roles/gateway/tasks/interfaces.yml b/roles/gateway/tasks/interfaces.yml index 5bcb8a7..117e4f8 100644 --- a/roles/gateway/tasks/interfaces.yml +++ b/roles/gateway/tasks/interfaces.yml @@ -6,12 +6,13 @@ content: "network: {config: disabled}" dest: /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg force: yes - when: provider == "hetzner" + when: provider is defined and provider == "hetzner" - name: Delete Hetzner cloud config as well file: name: /etc/network/interfaces.d/50-cloud-init state: absent + when: provider is defined and provider == "hetzner" - name: Template /etc/network/interfaces template: From 6a0b7863d8b40ae9acdbaf09e64d2b282f3ae7a8 Mon Sep 17 00:00:00 2001 From: Robert Arkenklo Date: Sun, 21 Mar 2021 10:32:57 +0100 Subject: [PATCH 5/5] Add required group_vars for new gw01 --- group_vars/gateways.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/group_vars/gateways.yml b/group_vars/gateways.yml index 712aebe..3e6d5a9 100644 --- a/group_vars/gateways.yml +++ b/group_vars/gateways.yml @@ -11,6 +11,8 @@ pjoddnet: gw: 1: range: "10.46.64.1 - 10.46.95.254" + dns: 46.246.46.246 194.132.32.32 + bw: "128Mbit/128Mbit" 2: range: "10.46.96.1 - 10.46.127.254" 3: