Mercurial > code > home > repos > infra

annotate net.py @ 22:301dad3cdb7b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
WIP updating to use systemd networkd but it's not done or working, here
author drewp@bigasterisk.com
date Tue, 28 Dec 2021 22:09:43 -0800
parents 0c1496e11b8f
children d4fb38f13c79
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
1 from pyinfra import host
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
2 from pyinfra.operations import apt, files, server, systemd
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
3
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
4 is_wifi = host.name in ['frontdoor', 'living', 'plus']
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
5
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
6 if host.name in [
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
7 'garage',
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
8 'dash',
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
9 'slash',
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
10 'frontbed',
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
11 'prime',
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
12 ]:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
13 # previous version
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
14 files.file(path='/etc/netplan/99-pyinfra-written.yaml', present=False)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
15
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
16 for search_dir in [
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
17 # search path per `man systemd.network`:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
18 # /lib/systemd/network # These OS files are ok.
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
19 '/usr/local/lib/systemd/network/', # Probably no such dir.
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
20 '/run/systemd/network/', # Previous netplan attempts dumped in here.
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
21 '/etc/systemd/network/', # I'm going to work in here.
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
22 ]:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
23 files.sync(
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
24 src="files/empty_dir/",
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
25 dest=search_dir,
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
26 delete=True,
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
27 )
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
28
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
29 addr = host.host_data['addr']
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
30 if addr.startswith('10.'):
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
31 net = addr[:4]
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
32 gateway = net + '.0.1'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
33 dns = gateway
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
34 elif addr == '162.243.138.136':
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
35 gateway = '162.243.138.1'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
36 dns = '10.5.0.1 8.8.8.8 8.8.4.4'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
37 else:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
38 raise ValueError(addr)
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
39 files.template(src="templates/house.network.j2",
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
40 dest="/etc/systemd/network/99-house.network",
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
41 mac=host.host_data['mac'],
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
42 addr=addr,
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
43 gateway=gateway,
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
44 dns=dns)
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
45 systemd.service(service='systemd-networkd.service', running=True, restarted=True)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
46
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
47 # you may have to rm this file first: https://github.com/Fizzadar/pyinfra/issues/719
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
48 files.link(path='/etc/resolv.conf', target='/run/systemd/resolve/resolv.conf', force=True)
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
49 files.template(src='templates/resolved.conf.j2', dest='/etc/systemd/resolved.conf')
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
50
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
51 if is_wifi:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
52 files.put(src="secrets/wpa_supplicant.conf", dest="/etc/wpa_supplicant/wpa_supplicant.conf")
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
53
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
54 files.template(src='templates/hosts.j2', dest='/etc/hosts')
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
55
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
56 systemd.service(service='systemd-resolved.service', running=True, restarted=True)
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
57
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
58 # ns = '10.2.0.1'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
59 # if host.name == 'prime':
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
60 # ns = '8.8.8.8'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
61 # elif host.name in ['slash']:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
62 # ns = '10.1.0.1'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
63 # files.template(src='templates/resolv.conf.j2', dest='/etc/resolv.conf', ns=ns)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
64
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
65 apt.packages(packages=['network-manager'], present=host.name in ['plus'])
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
66
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
67 if host.name == 'bang':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
68 files.template(src='templates/bang_interfaces.j2', dest='/etc/network/interfaces', user='root', group='root', mode='644')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
69 apt.packages(packages=['iptables', 'openntpd', 'ntpdate'])
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
70 server.shell(commands=['systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target'])
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
71
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
72 apt.packages(packages=['nfs-kernel-server'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
73 files.template(src='templates/bang_exports.j2', dest='/etc/exports')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
74
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
75 # Now using a HW router for this firewall. No incoming connections.
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
76 # test connections from the outside:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
77 # http://www.t1shopper.com/tools/port-scanner/
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
78 apt.packages(packages=['ufw'], present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
79
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
80 apt.packages(packages=['dnsmasq'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
81 systemd.service(service='dnsmasq', enabled=False, running=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
82 files.directory(path='/opt/dnsmasq')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
83
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
84 for net_name in ['10.1', '10.2', '10.5']:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
85 files.directory(path=f'/opt/dnsmasq/{net_name}')
12
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
86 files.template(src='templates/dnsmasq/dnsmasq.conf.j2', dest=f'/opt/dnsmasq/{net_name}/dnsmasq.conf', net=net_name)
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
87 files.template(src='templates/dnsmasq/hosts.j2', dest=f'/opt/dnsmasq/{net_name}/hosts', net=net_name)
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
88 files.template(src='templates/dnsmasq/dhcp_hosts.j2', dest=f'/opt/dnsmasq/{net_name}/dhcp_hosts', net=net_name)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
89
12
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
90 files.template(src='templates/dnsmasq/dnsmasq.service.j2',
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
91 dest=f'/etc/systemd/system/dnsmasq_{net_name}.service',
15c5ce7c74b5 refactor, cleanup, split large deploys
drewp@bigasterisk.com
parents: 11
diff changeset
92 net=net_name)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
93 systemd.service(service=f'dnsmasq_{net_name}', restarted=True, daemon_reload=True)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
94
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
95 if host.name == 'prime':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
96 # using digitalocean network config:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
97 # https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
98 apt.packages(packages=['ufw'], present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
99
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
100 files.line(name='shorter systemctl log window, for disk space',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
101 path='/etc/systemd/journald.conf',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
102 line='MaxFileSec',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
103 replace="MaxFileSec=7day")
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
104
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
105 for port in [80, 443]:
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
106 files.template(src="templates/webforward.service.j2", dest=f"/etc/systemd/system/web_forward_{port}.service", port=port)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
107 systemd.service(service=f'web_forward_{port}', enabled=True, restarted=True)