Mercurial > code > home > repos > infra

comparison net.py @ 7:b6fff51f8676

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
net.py setup. May not be safe on bang yet
author drewp@bigasterisk.com
date Wed, 10 Nov 2021 09:57:02 -0800
parents
children 82e46d7ff527
comparison
equal deleted inserted replaced
6:aa633eb49c63 7:b6fff51f8676
1 from pyinfra import host
2 from pyinfra.facts.hardware import Ipv4Addrs
3 from pyinfra.facts.server import LinuxDistribution
4 from pyinfra.operations import apt, files, server, systemd
5
6 bang_is_old = True
7 is_pi = host.get_fact(LinuxDistribution)['name'] in ['Debian', 'Raspbian GNU/Linux']
8 is_wifi = host.name in ['frontdoor', 'living', 'plus']
9 ssh_host = host.host_data.get('ssh_hostname', host.name)
10
11 if is_wifi:
12 files.put(src="files/wpa_supplicant.conf", dest="/etc/wpa_supplicant/wpa_supplicant.conf")
13
14 files.template(src='templates/hosts.j2', dest='/etc/hosts')
15
16 if host.name == 'prime':
17 # prime should have gotten this through netplan, but i give up.
18 #
19 # Note the DNS list: this list is tried randomly, not in order, so we could have
20 # some trouble with internal names
21 files.template(src='templates/prime_resolved.conf.j2', dest='/etc/systemd/resolved.conf')
22 else:
23 files.template(src='templates/resolved.conf.j2', dest='/etc/systemd/resolved.conf')
24 systemd.service(service='systemd-resolved.service', running=True, restarted=True)
25
26 files.template(src='templates/resolv.conf.j2', dest='/etc/resolv.conf')
27
28 if host.name in ['dash', 'slash', 'garage']:
29 # might need to upgrade pi systemd if there are errors in this part
30 apt.packages(packages=['netplan.io'])
31 files.file(path='/etc/netplan/00-installer-config.yaml', present=False)
32 addrs = host.get_fact(Ipv4Addrs)
33 ipv4Interface = host.host_data['interface']
34 ipv4Address = host.host_data['addr']
35 files.template(src='templates/netplan_dns.yaml.j2',
36 dest='/etc/netplan/99-ansible-written.yaml',
37 ipv4Interface=ipv4Interface,
38 ipv4Address=ipv4Address)
39 server.shell(commands=['netplan apply'])
40
41 if host.name not in ['plus']:
42 apt.packages(packages=['network-manager'], present=False)
43
44 if host.name == 'bang':
45 files.template(src='templates/bang_interfaces.j2', dest='/etc/network/interfaces', user='root', group='root', mode='644')
46 apt.packages(packages=['iptables', 'openntpd', 'ntpdate'])
47 server.shell(commands=['systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target'], user='root')
48
49 apt.packages(packages=['nfs-kernel-server'])
50 files.template(src='templates/bang_exports.j2', dest='/etc/exports')
51
52 # Now using a HW router for this firewall. No incoming connections.
53 # test connections from the outside:
54 # http://www.t1shopper.com/tools/port-scanner/
55 apt.packages(packages=['ufw'], present=False)
56
57 apt.packages(packages=['dnsmasq'])
58 systemd.service(service='dnsmasq', enabled=False, running=False)
59 files.directory(path='/opt/dnsmasq')
60
61 for net_name in ['10.1', '10.2', '10.5']:
62 files.directory(path=f'/opt/dnsmasq/{net_name}')
63 files.template(src='templates/dnsmasq.conf.j2', dest=f'/opt/dnsmasq/{net_name}/dnsmasq.conf', net=net_name)
64 files.template(src='templates/dhcp_hosts_file.j2', dest=f'/opt/dnsmasq/{net_name}/hosts', net=net_name)
65 files.template(src='templates/dhcp_hosts.j2', dest=f'/opt/dnsmasq/{net_name}/dhcp_hosts', net=net_name)
66
67 files.template(src='templates/dnsmasq.service.j2', dest=f'/etc/systemd/system/dnsmasq_{net_name}.service', net=net_name)
68 systemd.service(service=f'dnsmasq_{net_name}', restarted=True, daemon_reload=True)
69
70 if host.name == 'prime':
71 # using digitalocean network config:
72 # https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072
73 apt.packages(packages=['ufw'], present=False)
74
75 files.line(name='shorter systemctl log window, for disk space',
76 path='/etc/systemd/journald.conf',
77 line='MaxFileSec',
78 replace="MaxFileSec=7day")
79
80 for port in [80, 443]:
81 files.template(src="webforward.service.j2", dest=f"/etc/systemd/system/web_forward_{port}.service", port=port)
82 systemd.service(service=f'web_forward_{port}', enabled=True, restarted=True)