bundlewrap/nodes/home/router.py

230 lines
9.1 KiB
Python
Raw Normal View History

2020-11-13 17:47:40 +00:00
nodes['home.router'] = {
2020-11-13 22:57:12 +00:00
'hostname': '172.19.138.1',
2020-11-13 20:41:24 +00:00
'bundles': {
2021-09-29 17:47:14 +00:00
'bird',
2020-12-06 18:52:32 +00:00
'dhcpd',
'nginx',
2020-11-13 20:41:24 +00:00
'pppd',
'radvd',
'unbound',
'vnstat',
'wide-dhcp6c',
'wireguard',
2020-11-13 20:41:24 +00:00
},
2020-11-21 09:55:09 +00:00
'groups': {
2021-04-10 07:20:34 +00:00
'debian-bullseye',
2020-11-21 09:55:09 +00:00
},
2020-11-13 17:47:40 +00:00
'metadata': {
'interfaces': {
'enp1s0.23': {
'ips': {
2020-11-13 22:57:12 +00:00
'172.19.139.1/24',
2020-11-13 17:47:40 +00:00
},
},
'enp1s0.42': {
'ips': {
2020-11-13 22:57:12 +00:00
'172.19.138.1/24',
2020-11-13 17:47:40 +00:00
},
},
},
2020-11-13 17:47:40 +00:00
'backups': {
'exclude_from_backups': True,
},
2021-09-29 17:47:14 +00:00
'bird': {
'static_routes': {
'172.19.138.0/24',
'172.19.139.0/24',
},
},
'cron': {
'jobs': {
# Our internet provider resets the connection if you're
# connected longer than 24 hours. We install this cronjob
# to make sure we don't get disconnected randomly during the
# day.
'restart_pppd': '23 2 * * * root systemctl restart pppoe && date -u +\%s > /var/tmp/pppd-last-restart.status',
},
},
2020-12-06 18:52:32 +00:00
'dhcpd': {
'subnets': {
2021-04-20 16:17:52 +00:00
'enp1s0.23': {
'range_lower': '172.19.139.200',
'range_higher': '172.19.139.250',
2021-04-20 16:17:52 +00:00
'subnet': '172.19.139.0/24',
'options': {
'broadcast-address': '172.19.139.255',
'domain-name-servers': '172.19.139.1',
'routers': '172.19.139.1',
'subnet-mask': '255.255.255.0',
},
},
2021-04-20 16:17:52 +00:00
'enp1s0.42': {
2020-12-06 18:52:32 +00:00
'range_lower': '172.19.138.100',
'range_higher': '172.19.138.250',
2021-04-20 16:17:52 +00:00
'subnet': '172.19.138.0/24',
2020-12-06 18:52:32 +00:00
'options': {
'broadcast-address': '172.19.138.255',
'domain-name': 'franzi-home.kunbox.net',
'domain-name-servers': '172.19.138.1',
'domain-search': 'home.kunbox.net',
'routers': '172.19.138.1',
2020-12-06 18:52:32 +00:00
'subnet-mask': '255.255.255.0',
},
},
},
},
'hosts': {
'entries': {
# Hackaround to force wireguard to only use IPv4 for
# the connection to this system.
'51.195.47.180': {
'wireguard.ovh.kunbox.net',
},
},
},
'icinga_options': {
# override group default
'also_affected_by': atomic({
'home.nas',
'ovh.wireguard',
}),
# disabled on group level
# XXX reenable this once we can leave the house safely again
#'vars.notification.sms': True
},
'nftables': {
'rules': {
'50-router': [
# This is a router. Allow forwarding traffic for internal networks.
'inet filter forward ct state { related, established } accept',
# yaaaaay, IPv6! No NAT!
'inet filter forward ip6 nexthdr ipv6-icmp accept',
'inet filter forward tcp dport 22 accept',
'nat prerouting tcp dport 2022 dnat 172.19.138.20:22',
],
'60-fossgis-video': [
2022-03-20 10:13:43 +00:00
'inet filter forward meta nfproto ipv6 meta l4proto tcp ip6 daddr 2001:9e8:2755:4001:f085:33ff:feaf:db87 accept comment "fossgis temporary"',
],
},
},
'nginx': {
'restrict-to': {
'172.19.136.0/25',
'172.19.138.0/24',
},
'vhosts': {
'vnstat': {
'domain': 'router.home.kunbox.net',
'ssl': '_.home.kunbox.net',
},
},
},
'radvd': {
'interfaces': {
'enp1s0.23': {},
'enp1s0.42': {},
},
},
'postfix': {
'mynetworks': {
'172.19.138.0/24',
},
},
2020-11-13 20:41:24 +00:00
'pppd': {
'username': vault.decrypt('encrypt$gAAAAABfruZ5AZbgJ3mfMLWqIMx8o4bBRMJsDPD1jElh-vWN_gnhiuZVjrQ1-7Y6zDXNkxXiyhx8rxc2enmvo26axd7EBI8FqknCptXAPruVtDZrBCis4TE='),
'password': vault.decrypt('encrypt$gAAAAABfruaXEDkaFksFMU8g97ydWyJF8p2KcSDJJBlzaOLDsLL6oCDYjG1kMPVESOzqjn8ThtSht1uZDuMCstA-sATmLS-EWQ=='),
'interface': 'enp1s0.100',
2020-11-14 11:46:19 +00:00
'dyndns': {
'domain': 'franzi-home.kunbox.net',
2020-11-14 11:46:19 +00:00
'url': 'https://ns-1.kunbox.net/nic/update?hostname=franzi-home.kunbox.net&myip={ip}',
'username': vault.decrypt('encrypt$gAAAAABfr8DLAJhmUIhdxLq83I8MnRRvkRgDZcO8Brvw1KpvplC3K8ZGj0jIIWD3Us33vIP6t0ybd_mgD8slpRUk78Kqd3BMoQ=='),
'password': vault.decrypt('encrypt$gAAAAABfr8Cq5M1hweeJTQAl0dLhFntdlw-QnkIYUQpY-_ycODVWOpyeAwjwOgWLSdsdXIUvqcoiXPZPV-BE12p5C42NGnj9r7sKYpoGz8xfuGIk6haMa2g='),
},
'nftables-rules.d': {
'inet filter forward iif enp1s0.23 oif $INTERFACE accept',
'inet filter forward iif enp1s0.42 accept',
},
2020-11-13 20:41:24 +00:00
},
'unbound': {
'restrict-to': {
'172.19.138.0/23',
},
},
'telegraf': {
'input_plugins': {
'builtin': {
'snmp': [
{
'agents': ['udp://172.19.138.2'],
'agent_host_tag': 'host',
'table': [{'oid': 'IF-MIB::ifTable'}],
'interval': '10s',
},
{
'agents': ['udp://172.19.138.3'],
'agent_host_tag': 'host',
'field': [
{'oid': 'SNMPv2-SMI::mib-2.33.1.2.3.0', 'name': 'battery_runtime_to_empty'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.2.4.0', 'name': 'battery_capacity'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.2.5.0', 'name': 'battery_voltage', 'conversion': 'float(1)'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.2.6.0', 'name': 'battery_current', 'conversion': 'float(1)'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.3.3.1.2.1', 'name': 'input_frequency', 'conversion': 'float(1)'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.3.3.1.3.1', 'name': 'input_voltage'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.4.2.0', 'name': 'output_frequency', 'conversion': 'float(1)'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.4.4.1.2.1', 'name': 'output_voltage'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.4.4.1.3.1', 'name': 'output_frequency', 'conversion': 'float(1)'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.4.4.1.4.1', 'name': 'output_watts'},
{'oid': 'SNMPv2-SMI::mib-2.33.1.4.4.1.5.1', 'name': 'output_percent'},
],
'interval': '10s',
},
{
'agents': ['udp://172.19.138.41'],
'agent_host_tag': 'host',
'table': [{'oid': 'IF-MIB::ifTable'}],
},
],
},
},
},
'users': {
'f2k1de': {
'ssh_pubkey': {
'command="/bin/false",no-pty ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrvhqC/tZzpLMs/qy+1xNSVi2mfn8LXPIEhh7dcGn9e',
'command="/bin/false",no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDH5+j2vDW1FHSSEEI/Sf5qiKJq1uoxGO5BPv84mqohvol7GxDFObv69tn7g6HYfZY/SaS75C4ZXy+cKa0xy8UCpF0SBa2xHASkenS9v55oweDL4rYSPARzn2XKt3RFJG/d8V5NOWtcyq5DFSzewUF35E4hx1pUc/CIxgJEem5ZvzvN0hlIKXUN2djkVUx+mz6RryBysLTJEFBamjJxIkvDG/PZU73W4SHaKAYV4Ojz2NY7T5/NYKePfIU5F9pkE3RU0LRj58usvA1eP0PvEArWlGNCd8EJU+HQ5xr2dZ6MKPpEyG0KJkC88DuapeF5RwUV53ZhNpF+QgzpI72fH5up',
},
},
'fkunsmann': {
'sudo_commands': {
'ALL',
2020-12-12 08:12:26 +00:00
},
},
},
'vnstat': {
'generate-web-dashboard': True,
'interface': 'enp1s0.100',
},
2020-11-13 17:47:40 +00:00
'vm': {
'cpu': 2,
'ram': 2,
},
'wide-dhcp6c': {
'source': 'ppp0',
'targets': {
'enp1s0.23': '2',
'enp1s0.42': '1',
},
},
'wireguard': {
2021-04-01 14:27:31 +00:00
'external_hostname': 'franzi-home.kunbox.net', # Set via DynDNS
'peers': {
2021-09-29 17:47:14 +00:00
'ovh.wireguard': {
'health_check': True,
2021-09-29 17:47:14 +00:00
'snat_to': '172.19.138.1',
},
},
},
2020-11-13 17:47:40 +00:00
},
}