Compare commits
No commits in common. "183b91b9f2d289fcbde59687f476632cef024250" and "c39cb0e3909ca53df08e6389603cfbb77e32da2b" have entirely different histories.
183b91b9f2
...
c39cb0e390
21 changed files with 0 additions and 288 deletions
|
|
@ -1,2 +0,0 @@
|
|||
systemd_networkd__config_dir: 'resources/chaosknoten/router/systemd_networkd/'
|
||||
nftables__config: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/router/nftables/nftables.conf') }}"
|
||||
|
|
@ -51,9 +51,6 @@ all:
|
|||
public-reverse-proxy:
|
||||
ansible_host: public-reverse-proxy.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
router:
|
||||
ansible_host: router.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
wiki:
|
||||
ansible_host: wiki-intern.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
|
|
@ -91,19 +88,12 @@ base_config_hosts:
|
|||
pad:
|
||||
pretalx:
|
||||
public-reverse-proxy:
|
||||
router:
|
||||
tickets:
|
||||
wiki:
|
||||
zammad:
|
||||
ntfy:
|
||||
sunders:
|
||||
renovate:
|
||||
systemd_networkd_hosts:
|
||||
hosts:
|
||||
router:
|
||||
nftables_hosts:
|
||||
hosts:
|
||||
router:
|
||||
docker_compose_hosts:
|
||||
hosts:
|
||||
ccchoir:
|
||||
|
|
@ -183,7 +173,6 @@ infrastructure_authorized_keys_hosts:
|
|||
pad:
|
||||
pretalx:
|
||||
public-reverse-proxy:
|
||||
router:
|
||||
wiki:
|
||||
zammad:
|
||||
ntfy:
|
||||
|
|
|
|||
|
|
@ -4,16 +4,6 @@
|
|||
roles:
|
||||
- base_config
|
||||
|
||||
- name: Ensure systemd-networkd config deployment on systemd_networkd_hosts
|
||||
hosts: systemd_networkd_hosts
|
||||
roles:
|
||||
- systemd_networkd
|
||||
|
||||
- name: Ensure nftables deployment on nftables_hosts
|
||||
hosts: nftables_hosts
|
||||
roles:
|
||||
- nftables
|
||||
|
||||
- name: Ensure deployment of infrastructure authorized keys
|
||||
hosts: infrastructure_authorized_keys_hosts
|
||||
roles:
|
||||
|
|
|
|||
|
|
@ -1,73 +0,0 @@
|
|||
#!/usr/sbin/nft -f
|
||||
|
||||
## Variables
|
||||
|
||||
# Interfaces
|
||||
define if_net1_v4_wan = "net1"
|
||||
define if_net2_v6_wan = "net2"
|
||||
define if_net0_2_v4_nat = "net0.2"
|
||||
define if_net0_3_ci_runner = "net0.3"
|
||||
|
||||
# Interface Groups
|
||||
define wan_ifs = { $if_net1_v4_wan,
|
||||
$if_net2_v6_wan }
|
||||
define lan_ifs = { $if_net0_2_v4_nat,
|
||||
$if_net0_3_ci_runner }
|
||||
|
||||
|
||||
## Rules
|
||||
|
||||
table inet reverse-path-forwarding {
|
||||
chain rpf-filter {
|
||||
type filter hook prerouting priority mangle + 10; policy drop;
|
||||
|
||||
# Only allow packets if their source address is routed via their incoming interface.
|
||||
# https://github.com/NixOS/nixpkgs/blob/d9d87c51960050e89c79e4025082ed965e770d68/nixos/modules/services/networking/firewall-nftables.nix#L100
|
||||
fib saddr . mark . iif oif exists accept
|
||||
}
|
||||
}
|
||||
|
||||
table inet host {
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
|
||||
iifname "lo" accept comment "allow loopback"
|
||||
|
||||
ct state invalid drop
|
||||
ct state established,related accept
|
||||
|
||||
ip protocol icmp accept
|
||||
ip6 nexthdr icmpv6 accept
|
||||
|
||||
# Allow SSH access.
|
||||
tcp dport 22 accept comment "allow ssh access"
|
||||
|
||||
# Allow DHCP server access.
|
||||
iifname $if_net0_3_ci_runner udp dport 67 accept comment "allow dhcp server access"
|
||||
}
|
||||
}
|
||||
|
||||
table ip v4nat {
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
}
|
||||
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
|
||||
oifname $if_net1_v4_wan masquerade
|
||||
}
|
||||
}
|
||||
|
||||
table inet forward {
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
|
||||
ct state invalid drop
|
||||
ct state established,related accept
|
||||
|
||||
# Allow internet access.
|
||||
meta nfproto ipv6 iifname $lan_ifs oifname $if_net2_v6_wan accept comment "allow v6 internet access"
|
||||
meta nfproto ipv4 iifname $lan_ifs oifname $if_net1_v4_wan accept comment "allow v4 internet access"
|
||||
}
|
||||
}
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
[Match]
|
||||
MACAddress=BC:24:11:54:11:15
|
||||
Type=ether
|
||||
|
||||
[Link]
|
||||
Name=net0
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
[Match]
|
||||
MACAddress=BC:24:11:9A:FB:34
|
||||
Type=ether
|
||||
|
||||
[Link]
|
||||
Name=net1
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
[Match]
|
||||
MACAddress=BC:24:11:AE:C7:04
|
||||
Type=ether
|
||||
|
||||
[Link]
|
||||
Name=net2
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
[NetDev]
|
||||
Name=net0.2
|
||||
Kind=vlan
|
||||
|
||||
[VLAN]
|
||||
Id=2
|
||||
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
[NetDev]
|
||||
Name=net0.3
|
||||
Kind=vlan
|
||||
|
||||
[VLAN]
|
||||
Id=3
|
||||
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
[Match]
|
||||
Name=net0
|
||||
|
||||
[Link]
|
||||
RequiredForOnline=no
|
||||
|
||||
[Network]
|
||||
VLAN=net0.2
|
||||
VLAN=net0.3
|
||||
|
||||
LinkLocalAddressing=no
|
||||
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
[Match]
|
||||
Name=net1
|
||||
|
||||
[Network]
|
||||
DNS=212.12.50.158
|
||||
IPForward=ipv4
|
||||
IPv6AcceptRA=no
|
||||
|
||||
[Address]
|
||||
Address=212.12.48.123/24
|
||||
|
||||
[Route]
|
||||
Gateway=212.12.48.55
|
||||
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
[Match]
|
||||
Name=net2
|
||||
|
||||
[Network]
|
||||
#DNS=212.12.50.158
|
||||
IPForward=ipv6
|
||||
IPv6AcceptRA=no
|
||||
|
||||
[Address]
|
||||
Address=2a00:14b0:4200:3500::130:2/112
|
||||
|
||||
[Route]
|
||||
Gateway=2a00:14b0:4200:3500::130:1
|
||||
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
[Match]
|
||||
Name=net0.2
|
||||
Type=vlan
|
||||
|
||||
[Link]
|
||||
RequiredForOnline=no
|
||||
|
||||
[Network]
|
||||
Description=v4-NAT
|
||||
|
||||
# Masquerading done in nftables (nftables.conf).
|
||||
IPv6SendRA=yes
|
||||
|
||||
[Address]
|
||||
Address=10.32.2.1/24
|
||||
|
||||
[IPv6SendRA]
|
||||
UplinkInterface=net2
|
||||
|
||||
[IPv6Prefix]
|
||||
Prefix=2a00:14b0:42:102::/64
|
||||
Assign=true
|
||||
Token=static:::1
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
[Match]
|
||||
Name=net0.3
|
||||
Type=vlan
|
||||
|
||||
[Link]
|
||||
RequiredForOnline=no
|
||||
|
||||
[Network]
|
||||
Description=ci-runners
|
||||
|
||||
# Masquerading done in nftables (nftables.conf).
|
||||
IPv6SendRA=yes
|
||||
|
||||
DHCPServer=true
|
||||
|
||||
[DHCPServer]
|
||||
PoolOffset=100
|
||||
PoolSize=150
|
||||
|
||||
[Address]
|
||||
Address=10.32.3.1/24
|
||||
|
||||
[IPv6SendRA]
|
||||
UplinkInterface=net2
|
||||
|
||||
[IPv6Prefix]
|
||||
Prefix=2a00:14b0:42:103::/64
|
||||
Assign=true
|
||||
Token=static:::1
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
# Role `nftables`
|
||||
|
||||
Deploys nftables.
|
||||
|
||||
## Support Distributions
|
||||
|
||||
Should work on Debian-based distributions.
|
||||
|
||||
## Required Arguments
|
||||
|
||||
- `nftables__config`: nftables configuration to deploy.
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
- name: Restart nftables service
|
||||
ansible.builtin.systemd_service:
|
||||
name: nftables
|
||||
state: restarted
|
||||
become: true
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
argument_specs:
|
||||
main:
|
||||
options:
|
||||
nftables__config:
|
||||
type: str
|
||||
required: true
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
- name: ensure nftables is installed
|
||||
ansible.builtin.apt:
|
||||
name: nftables
|
||||
state: present
|
||||
become: true
|
||||
|
||||
- name: deploy nftables configuration
|
||||
ansible.builtin.copy:
|
||||
content: "{{ nftables__config }}"
|
||||
dest: "/etc/nftables.conf"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
become: true
|
||||
notify: Restart nftables service
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
# Role `systemd_networkd`
|
||||
|
||||
Deploys the given systemd-networkd configuration files.
|
||||
|
||||
## Support Distributions
|
||||
|
||||
Should work on Debian-based distributions.
|
||||
|
||||
## Required Arguments
|
||||
|
||||
- `systemd_networkd__config_dir`: Directory with systemd-networkd configs to deploy.
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
argument_specs:
|
||||
main:
|
||||
options:
|
||||
systemd_networkd__config_dir:
|
||||
type: path
|
||||
required: true
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
- name: ensure rsync is installed
|
||||
ansible.builtin.apt:
|
||||
name: rsync
|
||||
state: present
|
||||
become: true
|
||||
|
||||
- name: synchronize systemd-networkd configs
|
||||
ansible.posix.synchronize:
|
||||
src: "{{ systemd_networkd__config_dir }}"
|
||||
dest: "/etc/systemd/network"
|
||||
archive: false
|
||||
recursive: true
|
||||
delete: true
|
||||
become: true
|
||||
Loading…
Add table
Add a link
Reference in a new issue