Mercurial > code > home > repos > infra

comparison net.py @ 289:65e28d2e0cd8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
author drewp@bigasterisk.com
date Sun, 21 Apr 2024 17:07:23 -0700
parents 3af02e24eaf9
children 11d3bcedb9f0
comparison
equal deleted inserted replaced
288:3af02e24eaf9 289:65e28d2e0cd8
1 from pyinfra import host 1 from pyinfra import host
2 from pyinfra.operations import apt, files, server, systemd 2 from pyinfra.operations import apt, files, server, systemd
3 from pyinfra.facts.server import Arch, LinuxDistribution
4
5 is_pi = host.get_fact(LinuxDistribution)['name'] in ['Debian', 'Raspbian GNU/Linux']
6 is_wifi = False
7 3
8 4
9 def cleanup(): 5 def cleanup():
10 # past attempts 6 # past attempts
11 files.file(path='/etc/network/interfaces', present=False) 7 files.file(path='/etc/network/interfaces', present=False)
21 src="files/empty_dir/", 17 src="files/empty_dir/",
22 dest=search_dir, 18 dest=search_dir,
23 delete=True, 19 delete=True,
24 ) 20 )
25 21
26 # On bang (now pipe): 22 # On pipe:
27 # Now using a HW router for this firewall. No incoming connections. 23 # Now using a HW router for this firewall. No incoming connections.
28 # test connections from the outside: 24 # test connections from the outside:
29 # http://www.t1shopper.com/tools/port-scanner/ 25 # http://www.t1shopper.com/tools/port-scanner/
30 # On prime: 26 # On prime:
31 # using digitalocean network config: 27 # using digitalocean network config:
32 # https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072 28 # https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072
33 apt.packages(packages=['ufw'], present=False) 29 apt.packages(packages=['ufw'], present=False)
34 30
35 31
36 # https://github.com/k3s-io/k3s/issues/1812 unclear, but more importantly, this has to be set 32 def iptables_version():
37 # on pipe in a way that works with the commands in house_net.service (and net_routes) 33 # https://github.com/k3s-io/k3s/issues/1812 unclear, but more importantly, this has to be set
38 server.shell(commands=[ 34 # on pipe in a way that works with the commands in house_net.service (and net_routes)
39 'update-alternatives --set iptables /usr/sbin/iptables-legacy', 35 server.shell(commands=[
40 'update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy', 36 'update-alternatives --set iptables /usr/sbin/iptables-legacy',
41 ]) 37 'update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy',
42 # needs reboot if this changed 38 ])
39 # needs reboot if this changed
43 40
44 if host.name in ['prime', 'bang', 'pipe', 'ditto']:
45 server.sysctl(key='net.ipv6.conf.all.disable_ipv6', value=1, persist=True)
46 41
47 # if is_wifi_pi: 42 iptables_version()
48 # files.put(dest="/etc/network/interfaces.d/wlan0", src="files/pi_wlan0_powersave") 43 server.sysctl(key='net.ipv6.conf.all.disable_ipv6', value=1, persist=True)
49 # ssh.command(host.name, "iw wlan0 set power_save off")
50 44
51 files.directory('/etc/systemd/network') 45 if host.name == 'prime':
52 if host.name == 'prime': 46 cleanup()
53 cleanup()
54 47
55 files.template( 48 files.template(
56 src="templates/net/prime.network.j2", 49 src="files/net/prime.network",
57 dest="/etc/systemd/network/99-prime.network", 50 dest="/etc/systemd/network/99-prime.network",
58 mac=host.host_data['mac'], 51 )
59 ) 52 systemd.service(service='systemd-networkd.service', enabled=True, running=True, restarted=True)
60 53
61 elif host.name == 'bang': 54 if host.name == 'bang':
62 cleanup() 55 cleanup()
63 56
64 files.template(src="templates/net/bang_10.2.network.j2", dest="/etc/systemd/network/20-10.2.network") 57 files.template(src="files/net/bang_10.2.network", dest="/etc/systemd/network/20-10.2.network")
65 apt.packages(packages=['network-manager'], present=False) 58 apt.packages(packages=['network-manager'], present=False)
59 systemd.service(service='systemd-networkd.service', enabled=True, running=True, restarted=True)
66 60
67 elif host.name == 'plus': 61 if host.name == 'pipe':
68 apt.packages(packages=['network-manager'], present=True) 62 cleanup()
69 63
70 elif host.name == 'pipe': 64 files.template(src="files/net/pipe_10.2.network", dest="/etc/systemd/network/99-10.2.network")
71 cleanup() 65 files.template(src="files/net/pipe_isp.network", dest="/etc/systemd/network/99-isp.network")
66 server.sysctl(key='net.ipv4.ip_forward', value=1, persist=True)
67 files.template(src="files/net/house_net.service", dest="/etc/systemd/system/house_net.service", out_interface='eth0')
68 systemd.service(service='house_net.service', daemon_reload=True, enabled=True, running=True, restarted=True)
69 systemd.service(service='systemd-networkd.service', enabled=True, running=True, restarted=True)
72 70
73 files.template(src="templates/net/pipe_10.2.network.j2", dest="/etc/systemd/network/99-10.2.network") 71 if host.name == 'ditto':
74 files.template(src="templates/net/pipe_isp.network.j2", dest="/etc/systemd/network/99-isp.network") 72 files.template(
75 server.sysctl(key='net.ipv4.ip_forward', value=1, persist=True) 73 src="files/net/ditto-netplan.yaml",
76 files.template(src="templates/net/house_net.service.j2", 74 dest="/etc/netplan/00-installer-config.yaml",
77 dest="/etc/systemd/system/house_net.service", 75 create_remote_dir=True,
78 out_interface='eth0') 76 )
79 systemd.service(service='house_net.service', daemon_reload=True, enabled=True, running=True, restarted=True)
80
81 elif host.name == 'ditto':
82 files.template(
83 src="templates/net/ditto-netplan.yaml.j2",
84 dest="/etc/netplan/00-installer-config.yaml",
85 create_remote_dir=True,
86 )
87
88 else:
89 cleanup()
90
91 if is_wifi:
92 files.put(src="secrets/wpa_supplicant.conf", dest="/etc/wpa_supplicant/wpa_supplicant.conf")
93
94 files.template(
95 src="templates/net/singlenic.network.j2",
96 dest="/etc/systemd/network/20-bigasterisk.network",
97 create_remote_dir=True,
98 )
99 apt.packages(packages=['network-manager'], present=False)
100 77
101 systemd.service(service='systemd-networkd.service', enabled=True, running=True, restarted=True) 78 systemd.service(service='systemd-networkd.service', enabled=True, running=True, restarted=True)
102
103 # delete?
104 # # TODO this breaks wireguard wg on garage, i think. workaround:
105 # if host.name == 'garage':
106 # server.shell('ip -4 address add 10.5.0.14/24 dev wg0')