--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/net/net.py	Mon Jan 20 21:55:08 2025 -0800
@@ -0,0 +1,61 @@
+from pyinfra.context import host
+from pyinfra.operations import apt, files, server, systemd
+
+
+def no_ufw():
+    # On pipe:
+    #   Now using a HW router for this firewall. No incoming connections.
+    #   test connections from the outside:
+    #   http://www.t1shopper.com/tools/port-scanner/
+    # On prime:
+    #   using digitalocean network config:
+    #   https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072
+    apt.packages(packages=['ufw'], present=False)
+
+
+def iptables_version():
+    # https://github.com/k3s-io/k3s/issues/1812 unclear, but more importantly, this has to be set
+    # on pipe in a way that works with the commands in house_net.service (and net_routes)
+    server.shell(commands=[
+        'update-alternatives --set iptables /usr/sbin/iptables-legacy',
+        'update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy',
+    ])
+    # needs reboot if this changed
+
+
+def no_ipv6():
+    server.sysctl(key='net.ipv6.conf.all.disable_ipv6', value=1, persist=True)
+
+
+def special_configs():
+    if host.name == 'prime':
+        files.template(
+            src="net/files/prime.network",
+            dest="/etc/systemd/network/99-prime.network",
+        )
+
+    elif host.name == 'pipe':
+        files.template(src="net/files/pipe_10.2.network", dest="/etc/systemd/network/99-10.2.network")
+        files.template(src="net/files/pipe_isp.network", dest="/etc/systemd/network/99-isp.network")
+        server.sysctl(key='net.ipv4.ip_forward', value=1, persist=True)
+        files.template(src="net/files/house_net.service", dest="/etc/systemd/system/house_net.service", out_interface='eth0')
+        systemd.service(service='house_net.service', daemon_reload=True, enabled=True, running=True, restarted=True)
+
+    elif host.name == 'ditto':
+        files.template(
+            src="net/files/ditto-netplan.yaml",
+            dest="/etc/netplan/00-installer-config.yaml",
+            create_remote_dir=True,
+        )
+
+    else:
+        return
+    systemd.service(service='systemd-networkd.service', enabled=True, running=True, restarted=True)
+
+
+operations = [
+    no_ufw,
+    iptables_version,
+    no_ipv6,
+    special_configs,
+]