Salt-Orchestrated OpenSource based Software-Defined-Freifunk-Infrastructre-Network configuration

Maximilian Wilhelm d4d9f4bab6 dhcp-client: Only request address/router config 5 mēneši atpakaļ
Documentation 80c977116f Doc: Add monitoring rule configuration examples 1 gadu atpakaļ
_modules fce6123ee6 SDN: netfilter: return None when node cfg section doesn't exist 5 mēneši atpakaļ
anycast-healthchecker 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
apt 69f9d4be0f apt: Salt sources.list and GPG key for Bookworm 11 mēneši atpakaļ
apu2 0ae03f896f apu2: Document how to force firmware update. 5 gadi atpakaļ
bash 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
batman 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
bird 9f86fe6eb8 bird: Don't generate potential down BGP peers in template 7 mēneši atpakaļ
build 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
burp 51a28612c0 burp: client: Only log to burp's own log file 5 mēneši atpakaļ
certs 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
dhcp-client d4d9f4bab6 dhcp-client: Only request address/router config 5 mēneši atpakaļ
dhcp-server 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
dns-server 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
docker 4cf47cbc5f Add docker state. 5 gadi atpakaļ
elasticsearch 5b3cbfb6c3 Added elasticsearch config 4 gadi atpakaļ
fastd 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
ffinfo 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
firewall a77faefab6 firewall: Add files to load on boot-up 3 gadi atpakaļ
firmware 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
gogs 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
grafana 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
graylog 172990e9c3 graylog: Use mongodb with authentication 1 gadu atpakaļ
icinga2 e45c09b14b icinga2: Raise warn/crit levels for host cert expiry 5 mēneši atpakaļ
icingaweb2 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
influxdb 1ea0d959e7 influxdb: Switch to new repo key 1 gadu atpakaļ
install-server a021074e44 install-server: Add preseed for Debian Bookworm 8 mēneši atpakaļ
kernel 5ee6a1bd4e kernel: Install backports Kernel for Buster for B.A.T.M.A.N. iface penalty support 3 gadi atpakaļ
kvm 9c7c0bd8b1 KVM: Remove need for ifupdown* to configure VM interfaces 1 gadu atpakaļ
locales 54cdaf4438 locales: Add new config file for Debian Bookworm 11 mēneši atpakaļ
mongodb 29b4318138 mongodb: Enable authorization by default 1 gadu atpakaļ
mosh d243476e23 First bunch of ffho salt configuration files to be public. 8 gadi atpakaļ
motd 6605a8fd50 add motd state 7 gadi atpakaļ
needrestart d77bad69c3 Install needrestart on all nodes. 4 gadi atpakaļ
network 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
nftables 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
nginx 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
ntp d243476e23 First bunch of ffho salt configuration files to be public. 8 gadi atpakaļ
openvpn 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
postfix 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
pppoe 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
prometheus-exporters 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
prometheus-server 0728957ae0 prometheus-server: Scrape database exporters 5 mēneši atpakaļ
respondd 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
rsyslog 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
salt-minion 10f714bd5f salt-minion: python3-tornado isn't required anymore 3 gadi atpakaļ
screen d243476e23 First bunch of ffho salt configuration files to be public. 8 gadi atpakaļ
slapd ebaf2828e5 Add slapd state to configure LDAP servers. 4 gadi atpakaļ
snmpd 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
ssh 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
sudo 28aaa76adf sudo: Add sudoers file for Debian Bookworm 11 mēneši atpakaļ
sury 74dbf64e12 Add sury php repository 1 gadu atpakaļ
sysctl 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
systemd 1c6d5423bd systemd: Work around new systemd persistent MAC "feature" 3 gadi atpakaļ
timezone f07fb87dcd Set system timezone to Europe/Berlin. 5 gadi atpakaļ
unattended-upgrades 678580eb76 unattended-upgrades: Upgrade libc6 and fastd, too 5 mēneši atpakaļ
users 07d06cc8dc Add users statee to manage users and passwords 2 gadi atpakaļ
vim 40755b33a6 vim: Do not use the Debian default vimrc. Ever. 4 gadi atpakaļ
wireguard 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
yanic 60a5299b0b Use 'node' pillar instead of 'nodes:' ~ grains.id 7 mēneši atpakaļ
.gitignore 5d8869e75a Ignore VIM's *.swp files 1 gadu atpakaļ
README.md 26bc096db5 Update README 1 gadu atpakaļ
top.sls 521dc738c6 top: Use new "node" pillar key for matching 5 mēneši atpakaļ
utils.sls 47b4966ae8 Add simple utils state to list utils worth installing 3 gadi atpakaļ

README.md

Freifunk Hochstift infrastructure - SaltStack configuration

This repository contains the Salt environment (states + modules) used to configure the infrastructure of the Freifunk Hochstift community network.

It uses the NetBox Abstraction and Caching Layer (NACL) as its interface to communicate with NetBox, which holds all node specific configuration. This includes the node name, role(s), interfaces, IP addresses, tags, config contexts, etc.

Principles

This whole code base follows the principles of Holistic (network) automation, which means that as much configuration bits are derived from properties of nodes or its relationship(s) to other nodes. This includes but is not limited to, OSPF adjacencies, internal BGP sessions, B.A.T.M.A.N. adv. configuration, Nftables rules, etc.

Most of these bits live inside the Python modules which are included in this repository (see the _modules/ directory), which contains modules for authentication, netfilter, and networking related configuration. The ffho_net modules currently is the heart of our SDN logic, with more recent pieces (e.g. iBGP mesh calculation) living inside NACL. Eventually most logic should move over to NACL or another daemon which takes over the SDN role, so that Salt is only used to apply configuration based on a generic device configuration.

Further Reading

Our CTO, @BarbarossaTM, has started a blog series about our infrastructure, its architecture and evolution and also blogs about NetBox related things, which may or may not be related to this code base - it mostly is though :-)