Mercurial > code > home > repos > infra

annotate net.py @ 35:51c2f861764f

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
refactor
author drewp@bigasterisk.com
date Sat, 15 Jan 2022 15:41:01 -0800
parents d4fb38f13c79
children dc2100504c45
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
1 from pyinfra import host
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
2 from pyinfra.operations import apt, files, server, systemd
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
3
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
4 is_wifi = host.name in ['frontdoor', 'living', 'plus']
35
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
5 prime_public_addr = '162.243.138.136'
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
6 prime_gateway = '162.243.138.1'
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
7
35
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
8
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
9 def cleanup():
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
10 # past attempts
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
11 files.file(path='/etc/netplan/99-pyinfra-written.yaml', present=False)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
12
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
13 for search_dir in [
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
14 # search path per `man systemd.network`:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
15 # /lib/systemd/network # These OS files are ok.
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
16 '/usr/local/lib/systemd/network/', # Probably no such dir.
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
17 '/run/systemd/network/', # Previous netplan attempts dumped in here.
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
18 '/etc/systemd/network/', # I'm going to work in here.
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
19 ]:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
20 files.sync(
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
21 src="files/empty_dir/",
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
22 dest=search_dir,
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
23 delete=True,
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
24 )
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
25
35
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
26 apt.packages(packages=['network-manager'], present=False)
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
27
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
28
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
29 if host.name in [
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
30 'garage',
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
31 'dash',
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
32 'slash',
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
33 'frontbed',
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
34 'prime',
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
35 ]:
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
36 cleanup()
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
37
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
38 addr = host.host_data['addr']
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
39 if addr.startswith('10.'):
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
40 net = addr[:4]
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
41 gateway = net + '.0.1'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
42 dns = gateway
35
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
43 elif addr == prime_public_addr:
51c2f861764f refactor
drewp@bigasterisk.com
parents: 34
diff changeset
44 gateway = prime_gateway
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
45 dns = '10.5.0.1 8.8.8.8 8.8.4.4'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
46 else:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
47 raise ValueError(addr)
34
d4fb38f13c79 refactor dns and some other non-net setup
drewp@bigasterisk.com
parents: 22
diff changeset
48
d4fb38f13c79 refactor dns and some other non-net setup
drewp@bigasterisk.com
parents: 22
diff changeset
49 if is_wifi:
d4fb38f13c79 refactor dns and some other non-net setup
drewp@bigasterisk.com
parents: 22
diff changeset
50 files.put(src="secrets/wpa_supplicant.conf", dest="/etc/wpa_supplicant/wpa_supplicant.conf")
d4fb38f13c79 refactor dns and some other non-net setup
drewp@bigasterisk.com
parents: 22
diff changeset
51
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
52 files.template(src="templates/house.network.j2",
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
53 dest="/etc/systemd/network/99-house.network",
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
54 mac=host.host_data['mac'],
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
55 addr=addr,
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
56 gateway=gateway,
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
57 dns=dns)
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
58 systemd.service(service='systemd-networkd.service', running=True, restarted=True)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
59
22
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
60 # ns = '10.2.0.1'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
61 # if host.name == 'prime':
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
62 # ns = '8.8.8.8'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
63 # elif host.name in ['slash']:
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
64 # ns = '10.1.0.1'
301dad3cdb7b WIP updating to use systemd networkd but it's not done or working, here
drewp@bigasterisk.com
parents: 17
diff changeset
65 # files.template(src='templates/resolv.conf.j2', dest='/etc/resolv.conf', ns=ns)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
66
34
d4fb38f13c79 refactor dns and some other non-net setup
drewp@bigasterisk.com
parents: 22
diff changeset
67 if host.name == 'plus':
d4fb38f13c79 refactor dns and some other non-net setup
drewp@bigasterisk.com
parents: 22
diff changeset
68 apt.packages(packages=['network-manager'], present=True)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
69
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
70 if host.name == 'bang':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
71 files.template(src='templates/bang_interfaces.j2', dest='/etc/network/interfaces', user='root', group='root', mode='644')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
72
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
73 # Now using a HW router for this firewall. No incoming connections.
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
74 # test connections from the outside:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
75 # http://www.t1shopper.com/tools/port-scanner/
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
76 apt.packages(packages=['ufw'], present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
77
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
78 if host.name == 'prime':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
79 # using digitalocean network config:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
80 # https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
81 apt.packages(packages=['ufw'], present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
82
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
83 files.line(name='shorter systemctl log window, for disk space',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
84 path='/etc/systemd/journald.conf',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
85 line='MaxFileSec',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
86 replace="MaxFileSec=7day")
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
87
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
88 for port in [80, 443]:
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
89 files.template(src="templates/webforward.service.j2", dest=f"/etc/systemd/system/web_forward_{port}.service", port=port)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
90 systemd.service(service=f'web_forward_{port}', enabled=True, restarted=True)