Salt-Orchestrated OpenSource based Software-Defined-Freifunk-Infrastructre-Network configuration

Maximilian Wilhelm b1dbf6c161 prometheus-server: Scrape routers (bird_exporter)		1 年之前
Documentation	c35d5ff817 Examples: Update DNS example pillar	1 年之前
_modules	8416ee42b4 nftables: Check for system role too when calculating monitoring config	1 年之前
anycast-healthchecker	2455517ceb Add anycast-healthcecker state	1 年之前
apt	bb26185b9c apt: Update Salt to version 3004	3 年之前
apu2	0ae03f896f apu2: Document how to force firmware update.	5 年之前
bash	517b3b0d4a bash: Increase history and make sure it's always appended.	5 年之前
batman	24ffdc622c Use global root alias for cron job mails	3 年之前
bird	49004e4a9b Bird/Icinga2: Bird related monitoring config should ship with bird	1 年之前
build	6cb331e575 GIT: Use internal DNS alias for our GIT	1 年之前
burp	0b3ae3b258 burp: Let server listen on IPv6	4 年之前
certs	42fdb07d21 certs: Allow more flexibal configuration	1 年之前
dhcp-server	fb3141938a Clean up obsolete templates for Debian Stretch (which is long gone)	1 年之前
dns-server	d8ac36a679 bind9: Allow statistics scraping by bind-exporter	1 年之前
docker	4cf47cbc5f Add docker state.	5 年之前
elasticsearch	5b3cbfb6c3 Added elasticsearch config	4 年之前
fastd	4e1d44b0f0 fastd: Use SDN to determine B.A.T.M.A.N. adv. iface penalty	2 年之前
ffinfo	ab3833e402 ffinfo: Store main node role (from NetBox) on the system	1 年之前
firewall	a77faefab6 firewall: Add files to load on boot-up	3 年之前
firmware	6cb331e575 GIT: Use internal DNS alias for our GIT	1 年之前
gogs	bef28a1d26 gogs: Replace us-ascii with binary key	3 年之前
grafana	3109dffb24 grafana: Switch to new repo URL	1 年之前
graylog	1f8ffd3a77 graylog: Use keystore to verify ldap connection	1 年之前
icinga2	3594940a1d Icinga2: Read NS replica information from DNS pillar	1 年之前
icingaweb2	dd46e91fbe icingaweb2: The icingaweb2-module-monitoring pkg doesn't seem required	1 年之前
influxdb	1ea0d959e7 influxdb: Switch to new repo key	1 年之前
install-server	57645b4099 Set up install server on infra service VMs	1 年之前
kernel	5ee6a1bd4e kernel: Install backports Kernel for Buster for B.A.T.M.A.N. iface penalty support	3 年之前
kvm	9c7c0bd8b1 KVM: Remove need for ifupdown* to configure VM interfaces	1 年之前
locales	38c9622968 locales: Store full generatd configuration to avoid unnecessary diff	1 年之前
mongodb	efcc12bfd4 mongodb: Set repo version by variable	1 年之前
mosh	d243476e23 First bunch of ffho salt configuration files to be public.	8 年之前
motd	6605a8fd50 add motd state	7 年之前
needrestart	d77bad69c3 Install needrestart on all nodes.	4 年之前
network	5295aa0bd8 Make ifupdown-ng the default suite to configure interfaces	1 年之前
nftables	5998da7d83 nftables: Allow specifying node role specific monitoring services	1 年之前
nginx	533917fb8b Update firmware/openwrt redirect path to up-to-date mirror	2 年之前
ntp	d243476e23 First bunch of ffho salt configuration files to be public.	8 年之前
openvpn	df8977fb36 openvpn: Add configuration for OPS VPNs	3 年之前
postfix	bcc3747de7 postfix: smtp_use_tls is legacy and can go away.	2 年之前
pppoe	2032bdc052 pppoe: Remove Debian stretch Sonderlocke	3 年之前
prometheus-exporters	c69ac4fd59 Prometheus: Install bird-exporter on routers	1 年之前
prometheus-server	b1dbf6c161 prometheus-server: Scrape routers (bird_exporter)	1 年之前
respondd	16d83640de respondd: Start respondd service after network-online target	3 年之前
rsyslog	825d0c5915 rsyslog: Rotate slapd logs	3 年之前
salt-minion	10f714bd5f salt-minion: python3-tornado isn't required anymore	3 年之前
screen	d243476e23 First bunch of ffho salt configuration files to be public.	8 年之前
slapd	ebaf2828e5 Add slapd state to configure LDAP servers.	4 年之前
snmpd	b408b8d06f snmpd: Generate interface configs for VMs running on this host	2 年之前
ssh	f2e3a9f6ac ssh: Add sshd_config for Debian bullseye	3 年之前
sudo	f7e5578fe0 sudo: Fix typo, D'oh.	1 年之前
sury	74dbf64e12 Add sury php repository	1 年之前
sysctl	67ebce5507 sysctl: Wireguard with fwmark requires udp_l3mdev_accept	2 年之前
systemd	1c6d5423bd systemd: Work around new systemd persistent MAC "feature"	3 年之前
timezone	f07fb87dcd Set system timezone to Europe/Berlin.	5 年之前
unattended-upgrades	51aba08c0b unattended-upgrades: Use Bullseye repos for icinga2/Salt	1 年之前
users	07d06cc8dc Add users statee to manage users and passwords	2 年之前
vim	40755b33a6 vim: Do not use the Debian default vimrc. Ever.	4 年之前
wireguard	4c2f0c4408 Wireguard: Reflect data structure changes	2 年之前
yanic	d39f2267be yanic: Forget offline nodes after 14d (instead of 30d)	1 年之前
.gitignore	5d8869e75a Ignore VIM's *.swp files	1 年之前
README.md	26bc096db5 Update README	1 年之前
top.sls	e10852f001 Install Set up nginx reverse proxy on Prometheus servers	1 年之前
utils.sls	47b4966ae8 Add simple utils state to list utils worth installing	3 年之前

Freifunk Hochstift infrastructure - SaltStack configuration

This repository contains the Salt environment (states + modules) used to configure the infrastructure of the Freifunk Hochstift community network.

It uses the NetBox Abstraction and Caching Layer (NACL) as its interface to communicate with NetBox, which holds all node specific configuration. This includes the node name, role(s), interfaces, IP addresses, tags, config contexts, etc.

Principles

This whole code base follows the principles of Holistic (network) automation, which means that as much configuration bits are derived from properties of nodes or its relationship(s) to other nodes. This includes but is not limited to, OSPF adjacencies, internal BGP sessions, B.A.T.M.A.N. adv. configuration, Nftables rules, etc.

Most of these bits live inside the Python modules which are included in this repository (see the _modules/ directory), which contains modules for authentication, netfilter, and networking related configuration. The ffho_net modules currently is the heart of our SDN logic, with more recent pieces (e.g. iBGP mesh calculation) living inside NACL. Eventually most logic should move over to NACL or another daemon which takes over the SDN role, so that Salt is only used to apply configuration based on a generic device configuration.

README.md

Freifunk Hochstift infrastructure - SaltStack configuration

Principles

Further Reading