Mercurial > code > home > repos > infra

annotate net.py @ 17:0c1496e11b8f

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
get skaffold on hosts that want to do deploys
author drewp@bigasterisk.com
date Sat, 13 Nov 2021 13:51:55 -0800
parents 516a91a3ec08
children 301dad3cdb7b
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
1 from pyinfra import host
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
2 from pyinfra.facts.hardware import Ipv4Addrs
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
3 from pyinfra.facts.server import LinuxDistribution
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
4 from pyinfra.operations import apt, files, server, systemd
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
5
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
6 is_pi = host.get_fact(LinuxDistribution)['name'] in ['Debian', 'Raspbian GNU/Linux']
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
7 is_wifi = host.name in ['frontdoor', 'living', 'plus']
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
8
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
9 if is_wifi:
15
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
10 # todo: netplan could do this, below
12
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
11 files.put(src="secrets/wpa_supplicant.conf", dest="/etc/wpa_supplicant/wpa_supplicant.conf")
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
12
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
13 files.template(src='templates/hosts.j2', dest='/etc/hosts')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
14
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
15 if host.name == 'prime':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
16 # prime should have gotten this through netplan, but i give up.
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
17 #
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
18 # Note the DNS list: this list is tried randomly, not in order, so we could have
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
19 # some trouble with internal names
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
20 files.template(src='templates/prime_resolved.conf.j2', dest='/etc/systemd/resolved.conf')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
21 else:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
22 files.template(src='templates/resolved.conf.j2', dest='/etc/systemd/resolved.conf')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
23 systemd.service(service='systemd-resolved.service', running=True, restarted=True)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
24
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
25 ns = '10.2.0.1'
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
26 if host.name == 'prime':
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
27 ns = '8.8.8.8'
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
28 elif host.name in ['dash', 'slash']:
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
29 ns = '10.1.0.1'
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
30 files.template(src='templates/resolv.conf.j2', dest='/etc/resolv.conf', ns=ns)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
31
15
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
32 if host.name in ['dash', 'slash', 'garage', 'frontbed', 'dot']:
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
33 # might need to upgrade pi systemd if there are errors in this part
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
34 apt.packages(packages=['netplan.io'])
15
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
35 for bad in [
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
36 '01-netcfg.yaml',
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
37 '01-network-manager-all.yaml',
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
38 '00-installer-config.yaml',
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
39 '99-ansible-written.yaml',
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
40 '99-dns.conf',
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
41 ]:
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
42 files.file(path=f'/etc/netplan/{bad}', present=False)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
43 addrs = host.get_fact(Ipv4Addrs)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
44 ipv4Interface = host.host_data['interface']
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
45 ipv4Address = host.host_data['addr']
12
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
46 files.template(src='templates/netplan.yaml.j2',
15
516a91a3ec08 closer to working netplan
drewp@bigasterisk.com
parents: 12
diff changeset
47 dest='/etc/netplan/99-pyinfra-written.yaml',
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
48 ipv4Interface=ipv4Interface,
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
49 ipv4Address=ipv4Address)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
50 server.shell(commands=['netplan apply'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
51
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
52 apt.packages(packages=['network-manager'], present=host.name in ['plus'])
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
53
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
54 if host.name == 'bang':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
55 files.template(src='templates/bang_interfaces.j2', dest='/etc/network/interfaces', user='root', group='root', mode='644')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
56 apt.packages(packages=['iptables', 'openntpd', 'ntpdate'])
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
57 server.shell(commands=['systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target'])
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
58
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
59 apt.packages(packages=['nfs-kernel-server'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
60 files.template(src='templates/bang_exports.j2', dest='/etc/exports')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
61
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
62 # Now using a HW router for this firewall. No incoming connections.
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
63 # test connections from the outside:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
64 # http://www.t1shopper.com/tools/port-scanner/
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
65 apt.packages(packages=['ufw'], present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
66
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
67 apt.packages(packages=['dnsmasq'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
68 systemd.service(service='dnsmasq', enabled=False, running=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
69 files.directory(path='/opt/dnsmasq')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
70
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
71 for net_name in ['10.1', '10.2', '10.5']:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
72 files.directory(path=f'/opt/dnsmasq/{net_name}')
12
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
73 files.template(src='templates/dnsmasq/dnsmasq.conf.j2', dest=f'/opt/dnsmasq/{net_name}/dnsmasq.conf', net=net_name)
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
74 files.template(src='templates/dnsmasq/hosts.j2', dest=f'/opt/dnsmasq/{net_name}/hosts', net=net_name)
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
75 files.template(src='templates/dnsmasq/dhcp_hosts.j2', dest=f'/opt/dnsmasq/{net_name}/dhcp_hosts', net=net_name)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
76
12
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
77 files.template(src='templates/dnsmasq/dnsmasq.service.j2',
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
78 dest=f'/etc/systemd/system/dnsmasq_{net_name}.service',
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
79 net=net_name)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
80 systemd.service(service=f'dnsmasq_{net_name}', restarted=True, daemon_reload=True)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
81
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
82 if host.name == 'prime':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
83 # using digitalocean network config:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
84 # https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
85 apt.packages(packages=['ufw'], present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
86
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
87 files.line(name='shorter systemctl log window, for disk space',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
88 path='/etc/systemd/journald.conf',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
89 line='MaxFileSec',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
90 replace="MaxFileSec=7day")
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
91
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
92 for port in [80, 443]:
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
93 files.template(src="templates/webforward.service.j2", dest=f"/etc/systemd/system/web_forward_{port}.service", port=port)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
94 systemd.service(service=f'web_forward_{port}', enabled=True, restarted=True)