Mercurial > code > home > repos > infra

annotate net.py @ 11:82e46d7ff527

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
net.py works on bang and other hosts. not sure if netplan works the 1st time or not
author drewp@bigasterisk.com
date Thu, 11 Nov 2021 22:46:32 -0800
parents b6fff51f8676
children 15c5ce7c74b5
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
1 from pyinfra import host
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
2 from pyinfra.facts.hardware import Ipv4Addrs
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
3 from pyinfra.facts.server import LinuxDistribution
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
4 from pyinfra.operations import apt, files, server, systemd
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
5
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
6 bang_is_old = True
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
7 is_pi = host.get_fact(LinuxDistribution)['name'] in ['Debian', 'Raspbian GNU/Linux']
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
8 is_wifi = host.name in ['frontdoor', 'living', 'plus']
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
9 ssh_host = host.host_data.get('ssh_hostname', host.name)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
10
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
11 if is_wifi:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
12 files.put(src="files/wpa_supplicant.conf", dest="/etc/wpa_supplicant/wpa_supplicant.conf")
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
13
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
14 files.template(src='templates/hosts.j2', dest='/etc/hosts')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
15
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
16 if host.name == 'prime':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
17 # prime should have gotten this through netplan, but i give up.
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
18 #
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
19 # Note the DNS list: this list is tried randomly, not in order, so we could have
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
20 # some trouble with internal names
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
21 files.template(src='templates/prime_resolved.conf.j2', dest='/etc/systemd/resolved.conf')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
22 else:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
23 files.template(src='templates/resolved.conf.j2', dest='/etc/systemd/resolved.conf')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
24 systemd.service(service='systemd-resolved.service', running=True, restarted=True)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
25
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
26 ns = '10.2.0.1'
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
27 if host.name == 'prime':
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
28 ns = '8.8.8.8'
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
29 elif host.name in ['dash', 'slash']:
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
30 ns = '10.1.0.1'
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
31 files.template(src='templates/resolv.conf.j2', dest='/etc/resolv.conf', ns=ns)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
32
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
33 if host.name in ['dash', 'slash', 'garage']:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
34 # might need to upgrade pi systemd if there are errors in this part
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
35 apt.packages(packages=['netplan.io'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
36 files.file(path='/etc/netplan/00-installer-config.yaml', present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
37 addrs = host.get_fact(Ipv4Addrs)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
38 ipv4Interface = host.host_data['interface']
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
39 ipv4Address = host.host_data['addr']
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
40 files.template(src='templates/netplan_dns.yaml.j2',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
41 dest='/etc/netplan/99-ansible-written.yaml',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
42 ipv4Interface=ipv4Interface,
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
43 ipv4Address=ipv4Address)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
44 server.shell(commands=['netplan apply'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
45
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
46 apt.packages(packages=['network-manager'], present=host.name in ['plus'])
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
47
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
48 if host.name == 'bang':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
49 files.template(src='templates/bang_interfaces.j2', dest='/etc/network/interfaces', user='root', group='root', mode='644')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
50 apt.packages(packages=['iptables', 'openntpd', 'ntpdate'])
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
51 server.shell(commands=['systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target'])
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
52
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
53 apt.packages(packages=['nfs-kernel-server'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
54 files.template(src='templates/bang_exports.j2', dest='/etc/exports')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
55
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
56 # Now using a HW router for this firewall. No incoming connections.
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
57 # test connections from the outside:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
58 # http://www.t1shopper.com/tools/port-scanner/
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
59 apt.packages(packages=['ufw'], present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
60
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
61 apt.packages(packages=['dnsmasq'])
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
62 systemd.service(service='dnsmasq', enabled=False, running=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
63 files.directory(path='/opt/dnsmasq')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
64
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
65 for net_name in ['10.1', '10.2', '10.5']:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
66 files.directory(path=f'/opt/dnsmasq/{net_name}')
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
67 files.template(src='templates/dnsmasq.conf.j2', dest=f'/opt/dnsmasq/{net_name}/dnsmasq.conf', net=net_name)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
68 files.template(src='templates/dhcp_hosts_file.j2', dest=f'/opt/dnsmasq/{net_name}/hosts', net=net_name)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
69 files.template(src='templates/dhcp_hosts.j2', dest=f'/opt/dnsmasq/{net_name}/dhcp_hosts', net=net_name)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
70
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
71 files.template(src='templates/dnsmasq.service.j2', dest=f'/etc/systemd/system/dnsmasq_{net_name}.service', net=net_name)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
72 systemd.service(service=f'dnsmasq_{net_name}', restarted=True, daemon_reload=True)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
73
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
74 if host.name == 'prime':
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
75 # using digitalocean network config:
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
76 # https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
77 apt.packages(packages=['ufw'], present=False)
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
78
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
79 files.line(name='shorter systemctl log window, for disk space',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
80 path='/etc/systemd/journald.conf',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
81 line='MaxFileSec',
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
82 replace="MaxFileSec=7day")
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
83
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
84 for port in [80, 443]:
11
82e46d7ff527 net.py works on bang and other hosts. not sure if netplan works the 1st time or not
drewp@bigasterisk.com
parents: 7
diff changeset
85 files.template(src="templates/webforward.service.j2", dest=f"/etc/systemd/system/web_forward_{port}.service", port=port)
7
b6fff51f8676 net.py setup. May not be safe on bang yet
drewp@bigasterisk.com
parents:
diff changeset
86 systemd.service(service=f'web_forward_{port}', enabled=True, restarted=True)