Inicio Explorar Axuda
Rexistro Iniciar sesión
FreifunkHochstift
/
ffho-salt-public
2
0
Fork 2
Ficheiros Incidencias 0 Pull Requests 0

Salt-Orchestrated OpenSource based Software-Defined-Freifunk-Infrastructre-Network configuration

Árbore: 9c7c0bd8b1
Ramas Etiquetas
ffho-salt-pu...
ZIP TAR.GZ
Maximilian Wilhelm 9c7c0bd8b1 KVM: Remove need for ifupdown* to configure VM interfaces hai 1 ano
Documentation c35d5ff817 Examples: Update DNS example pillar hai 1 ano
_modules 3f5eb5be5f SDN: Only enable OSPf in interface in main VRF hai 1 ano
anycast-healthchecker 2455517ceb Add anycast-healthcecker state hai 1 ano
apt bb26185b9c apt: Update Salt to version 3004 %!s(int64=2) %!d(string=hai) anos
apu2 0ae03f896f apu2: Document how to force firmware update. %!s(int64=4) %!d(string=hai) anos
bash 517b3b0d4a bash: Increase history and make sure it's always appended. %!s(int64=5) %!d(string=hai) anos
batman 24ffdc622c Use global root alias for cron job mails %!s(int64=2) %!d(string=hai) anos
bird 49004e4a9b Bird/Icinga2: Bird related monitoring config should ship with bird hai 1 ano
build 6cb331e575 GIT: Use internal DNS alias for our GIT hai 1 ano
burp 0b3ae3b258 burp: Let server listen on IPv6 %!s(int64=3) %!d(string=hai) anos
certs c7297d3e69 certs: Check for certificates applied to single hosts. %!s(int64=3) %!d(string=hai) anos
dhcp-server fb3141938a Clean up obsolete templates for Debian Stretch (which is long gone) hai 1 ano
dns-server 4f6711f16e DNS: Reflect pillar change to write replica NS name into config hai 1 ano
docker 4cf47cbc5f Add docker state. %!s(int64=5) %!d(string=hai) anos
elasticsearch 5b3cbfb6c3 Added elasticsearch config %!s(int64=3) %!d(string=hai) anos
fastd 4e1d44b0f0 fastd: Use SDN to determine B.A.T.M.A.N. adv. iface penalty %!s(int64=2) %!d(string=hai) anos
ffinfo ab3833e402 ffinfo: Store main node role (from NetBox) on the system hai 1 ano
firewall a77faefab6 firewall: Add files to load on boot-up %!s(int64=3) %!d(string=hai) anos
firmware 6cb331e575 GIT: Use internal DNS alias for our GIT hai 1 ano
gogs bef28a1d26 gogs: Replace us-ascii with binary key %!s(int64=3) %!d(string=hai) anos
grafana 3109dffb24 grafana: Switch to new repo URL hai 1 ano
graylog 1f8ffd3a77 graylog: Use keystore to verify ldap connection hai 1 ano
icinga2 3594940a1d Icinga2: Read NS replica information from DNS pillar hai 1 ano
icingaweb2 dd46e91fbe icingaweb2: The icingaweb2-module-monitoring pkg doesn't seem required hai 1 ano
influxdb 1ea0d959e7 influxdb: Switch to new repo key hai 1 ano
install-server 57645b4099 Set up install server on infra service VMs hai 1 ano
kernel 5ee6a1bd4e kernel: Install backports Kernel for Buster for B.A.T.M.A.N. iface penalty support %!s(int64=3) %!d(string=hai) anos
kvm 9c7c0bd8b1 KVM: Remove need for ifupdown* to configure VM interfaces hai 1 ano
locales d243476e23 First bunch of ffho salt configuration files to be public. %!s(int64=8) %!d(string=hai) anos
mongodb efcc12bfd4 mongodb: Set repo version by variable hai 1 ano
mosh d243476e23 First bunch of ffho salt configuration files to be public. %!s(int64=8) %!d(string=hai) anos
motd 6605a8fd50 add motd state %!s(int64=7) %!d(string=hai) anos
needrestart d77bad69c3 Install needrestart on all nodes. %!s(int64=3) %!d(string=hai) anos
network 5295aa0bd8 Make ifupdown-ng the default suite to configure interfaces hai 1 ano
nftables db28535889 nftables: Don't purge iptables on docker and KVM hosts hai 1 ano
nginx 533917fb8b Update firmware/openwrt redirect path to up-to-date mirror hai 1 ano
ntp d243476e23 First bunch of ffho salt configuration files to be public. %!s(int64=8) %!d(string=hai) anos
openvpn df8977fb36 openvpn: Add configuration for OPS VPNs %!s(int64=2) %!d(string=hai) anos
postfix bcc3747de7 postfix: smtp_use_tls is legacy and can go away. hai 1 ano
pppoe 2032bdc052 pppoe: Remove Debian stretch Sonderlocke %!s(int64=2) %!d(string=hai) anos
prometheus-exporters 9a18d14c44 Groundwork for Prometheus observabilty - node_exporter for all boxes hai 1 ano
respondd 16d83640de respondd: Start respondd service after network-online target %!s(int64=3) %!d(string=hai) anos
rsyslog 825d0c5915 rsyslog: Rotate slapd logs %!s(int64=2) %!d(string=hai) anos
salt-minion 10f714bd5f salt-minion: python3-tornado isn't required anymore %!s(int64=3) %!d(string=hai) anos
screen d243476e23 First bunch of ffho salt configuration files to be public. %!s(int64=8) %!d(string=hai) anos
slapd ebaf2828e5 Add slapd state to configure LDAP servers. %!s(int64=4) %!d(string=hai) anos
snmpd b408b8d06f snmpd: Generate interface configs for VMs running on this host %!s(int64=2) %!d(string=hai) anos
ssh f2e3a9f6ac ssh: Add sshd_config for Debian bullseye %!s(int64=2) %!d(string=hai) anos
sudo f7e5578fe0 sudo: Fix typo, D'oh. hai 1 ano
sury 74dbf64e12 Add sury php repository hai 1 ano
sysctl 67ebce5507 sysctl: Wireguard with fwmark requires udp_l3mdev_accept %!s(int64=2) %!d(string=hai) anos
systemd 1c6d5423bd systemd: Work around new systemd persistent MAC "feature" %!s(int64=2) %!d(string=hai) anos
timezone f07fb87dcd Set system timezone to Europe/Berlin. %!s(int64=5) %!d(string=hai) anos
unattended-upgrades 51aba08c0b unattended-upgrades: Use Bullseye repos for icinga2/Salt hai 1 ano
users 07d06cc8dc Add users statee to manage users and passwords hai 1 ano
vim 40755b33a6 vim: Do not use the Debian default vimrc. Ever. %!s(int64=4) %!d(string=hai) anos
wireguard 4c2f0c4408 Wireguard: Reflect data structure changes %!s(int64=2) %!d(string=hai) anos
yanic d39f2267be yanic: Forget offline nodes after 14d (instead of 30d) hai 1 ano
.gitignore c5c65aa615 Add .gitignore hai 1 ano
README.md 26bc096db5 Update README hai 1 ano
top.sls 57645b4099 Set up install server on infra service VMs hai 1 ano
utils.sls 47b4966ae8 Add simple utils state to list utils worth installing %!s(int64=3) %!d(string=hai) anos

README.md

Freifunk Hochstift infrastructure - SaltStack configuration

This repository contains the Salt environment (states + modules) used to configure the infrastructure of the Freifunk Hochstift community network.

It uses the NetBox Abstraction and Caching Layer (NACL) as its interface to communicate with NetBox, which holds all node specific configuration. This includes the node name, role(s), interfaces, IP addresses, tags, config contexts, etc.

Principles

This whole code base follows the principles of Holistic (network) automation, which means that as much configuration bits are derived from properties of nodes or its relationship(s) to other nodes. This includes but is not limited to, OSPF adjacencies, internal BGP sessions, B.A.T.M.A.N. adv. configuration, Nftables rules, etc.

Most of these bits live inside the Python modules which are included in this repository (see the _modules/ directory), which contains modules for authentication, netfilter, and networking related configuration. The ffho_net modules currently is the heart of our SDN logic, with more recent pieces (e.g. iBGP mesh calculation) living inside NACL. Eventually most logic should move over to NACL or another daemon which takes over the SDN role, so that Salt is only used to apply configuration based on a generic device configuration.

Further Reading

Our CTO, @BarbarossaTM, has started a blog series about our infrastructure, its architecture and evolution and also blogs about NetBox related things, which may or may not be related to this code base - it mostly is though :-)