view net.py @ 275:058c312ffdce

new host `pillow`
author drewp@bigasterisk.com
date Sat, 23 Mar 2024 14:20:20 -0700
parents 33d2de3d7e70
children 4e424a144183
line wrap: on
line source

from pyinfra import host
from pyinfra.operations import apt, files, server, systemd

is_wifi = host.name in ['living', 'plus']


def cleanup():
    # past attempts
    files.file(path='/etc/network/interfaces', present=False)

    for search_dir in [
            # search path per `man systemd.network`:
            # /lib/systemd/network              # These OS files are ok.
            '/usr/local/lib/systemd/network/',  # Probably no such dir.
            '/run/systemd/network/',  # Previous netplan attempts dumped in here.
            # '/etc/systemd/network/',  # I'm going to work in here.
    ]:
        files.sync(
            src="files/empty_dir/",
            dest=search_dir,
            delete=True,
        )

    # On bang (now pipe):
    #   Now using a HW router for this firewall. No incoming connections.
    #   test connections from the outside:
    #   http://www.t1shopper.com/tools/port-scanner/
    # On prime:
    #   using digitalocean network config:
    #   https://cloud.digitalocean.com/networking/firewalls/f68899ae-1aac-4469-b379-59ce2bbc988f/droplets?i=7c5072
    apt.packages(packages=['ufw'], present=False)


# https://github.com/k3s-io/k3s/issues/1812 unclear, but more importantly, this has to be set
# on pipe in a way that works with the commands in house_net.service (and net_routes)
server.shell(commands=[
    'update-alternatives --set iptables /usr/sbin/iptables-legacy',
    'update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy',
])
# needs reboot if this changed

if host.name in ['slash', 'dash', 'dot', 'squib', 'pillow']:
    pass  # don't break k3s networking! the else-part really breaks it
else:
    server.sysctl(key='net.ipv6.conf.all.disable_ipv6', value=1, persist=True)

    # if is_wifi_pi:
    #     files.put(dest="/etc/network/interfaces.d/wlan0", src="files/pi_wlan0_powersave")
    #     ssh.command(host.name, "iw wlan0 set power_save off")

    files.directory('/etc/systemd/network')
    if host.name == 'prime':
        cleanup()

        files.template(
            src="templates/net/prime.network.j2",
            dest="/etc/systemd/network/99-prime.network",
            mac=host.host_data['mac'],
        )

    elif host.name == 'bang':
        cleanup()

        files.template(src="templates/net/bang_10.2.network.j2", dest="/etc/systemd/network/20-10.2.network")
        apt.packages(packages=['network-manager'], present=False)

    elif host.name == 'plus':
        apt.packages(packages=['network-manager'], present=True)

    elif host.name == 'pipe':
        cleanup()

        files.template(src="templates/net/pipe_10.2.network.j2", dest="/etc/systemd/network/99-10.2.network")
        files.template(src="templates/net/pipe_isp.network.j2", dest="/etc/systemd/network/99-isp.network")
        server.sysctl(key='net.ipv4.ip_forward', value=1, persist=True)
        files.template(src="templates/net/house_net.service.j2",
                       dest="/etc/systemd/system/house_net.service",
                       out_interface='eth0')
        systemd.service(service='house_net.service', daemon_reload=True, enabled=True, running=True, restarted=True)

    elif host.name == 'ditto':
        files.template(
            src="templates/net/ditto-netplan.yaml.j2",
            dest="/etc/netplan/00-installer-config.yaml",
            create_remote_dir=True,
        )

    else:
        cleanup()

        if is_wifi:
            files.put(src="secrets/wpa_supplicant.conf", dest="/etc/wpa_supplicant/wpa_supplicant.conf")

        files.template(
            src="templates/net/singlenic.network.j2",
            dest="/etc/systemd/network/20-bigasterisk.network",
            create_remote_dir=True,
        )
        apt.packages(packages=['network-manager'], present=False)
    
    systemd.service(service='systemd-networkd.service', enabled=True, running=True, restarted=True)

    # TODO this breaks wg on garage, i think. workaround:
    if host.name == 'garage':
        server.shell('ip -4 address add 10.5.0.14/24 dev wg0')