bundlewrap/nodes/home/nas.py

338 lines
13 KiB
Python
Raw Normal View History

# Dell Local Node Manager running on <http://172.19.138.20:4679/>
2020-11-12 18:40:41 +00:00
nodes['home.nas'] = {
2020-11-13 17:47:24 +00:00
'hostname': '172.19.138.20',
2020-11-12 18:40:41 +00:00
'bundles': {
2022-01-13 14:56:57 +00:00
'backup-client',
2023-09-24 13:22:38 +00:00
'jellyfin',
'lm-sensors',
'mixcloud-downloader',
'mosquitto',
2020-11-12 18:59:02 +00:00
'nfs-server',
2023-08-28 15:21:48 +00:00
'rsyslogd',
'scansnap',
'smartd',
2020-11-13 15:29:42 +00:00
'vmhost',
2020-11-12 18:40:41 +00:00
'zfs',
},
2020-11-21 09:55:09 +00:00
'groups': {
'debian-bullseye',
2023-09-24 14:48:19 +00:00
'webserver',
2020-11-21 09:55:09 +00:00
},
2020-11-12 18:40:41 +00:00
'metadata': {
'interfaces': {
2023-03-27 11:52:23 +00:00
'br1138': {
2020-11-12 18:40:41 +00:00
'ips': {
'172.19.138.20/24',
},
'gateway4': '172.19.138.1',
'ipv6_accept_ra': True,
2020-11-12 18:40:41 +00:00
},
},
'apt': {
'unattended-upgrades': {
'day': 6,
# requires manual decryption of zfs after reboot
'reboot_enabled': False,
},
'packages': {
'mpv': {},
# for hardware transcoding of video
'firmware-amd-graphics': {},
'mesa-va-drivers': {},
# for compiling yate
'autoconf': {},
'subversion': {},
# svn checkout http://yate.null.ro/svn/yate/tags/RELEASE_6_4_0/ .
# ./autogen.sh
# ./configure --prefix=/opt/yate
# make -j8
# systemctl stop yate
# make install-noconf
# systemctl start yate
},
},
2020-11-13 11:58:23 +00:00
'backups': {
2022-01-13 14:56:57 +00:00
'paths': {
2022-02-05 14:39:33 +00:00
'/storage/nas/Audiobooks',
2022-01-13 14:56:57 +00:00
'/storage/nas/Bilder',
'/storage/nas/Bilder_Archiv',
2022-02-05 14:39:33 +00:00
'/storage/nas/Books',
2023-05-02 03:45:50 +00:00
'/storage/nas/Installer',
2022-01-13 14:56:57 +00:00
'/storage/nas/Musik',
2022-02-05 14:39:33 +00:00
'/storage/nas/Musikvideos',
'/storage/nas/normen',
2022-01-13 14:56:57 +00:00
},
2020-11-13 11:58:23 +00:00
},
'groups': {
'nas': {},
},
'firewall': {
'port_rules': {
2023-09-24 18:59:58 +00:00
'4679/tcp': { # Dell ULNM
'172.19.136.0/25',
'172.19.138.0/24',
},
2023-09-24 18:59:58 +00:00
'5060/tcp': { # yate SIP
'home.snom-wohnzimmer',
'home.mitel-rfp35',
},
2023-09-24 18:59:58 +00:00
'5061/tcp': { # yate SIPS
'home.snom-wohnzimmer',
'home.mitel-rfp35',
},
# yate RTP uses some random UDP port. We cannot firewall
# it, because for incoming calls the other side decides
# which port to use. That's why we simply allow all UDP
# traffic from our SIP clients. It's fine to do so, because
# all sip clients are known to bundlewrap, so we won't have
# to deal with randomly changing IPs here.
'*/udp': {
'home.snom-wohnzimmer',
'home.mitel-rfp35',
},
},
2021-03-21 11:01:56 +00:00
},
'jellyfin': {
'restrict-to': {
'home.lgtv-wohnzimmer',
},
},
'mosquitto': {
'bridges': {
'c3voc': {
'peer': 'mqtt.c3voc.de',
'client_id': 'kunsi-home',
'auth': {
'username': vault.decrypt('encrypt$gAAAAABgaBa5UZyZlsMM9TV5pa-VyOieFWYzAslxWVnXjOeXHvF4kMHHSHSMOrv-U9k7Ec3mMCDuJFO3ybpOsZSeFQDL7GgEfw=='),
'password': vault.decrypt('encrypt$gAAAAABgaBbfm65cYBuod0UehWNmY0NfeUH9xsrP2kENYNF_LWP2iV5a8db_cqMoITwyjjBsHpvjaeDq07Z5K5nQ_BLZG6zPqapL-Qvp20wyck49Dy2R4V4='),
},
'topics': [
{
'pattern': '#',
'remote_prefix': '/voc/',
'local_prefix': 'voc'
},
],
},
},
'listeners': {
'8083': {
'protocol': 'websockets',
},
},
'tasmota-telegraf-topic': '/switch/#',
'restrict-to': {
'172.19.136.0/25',
'172.19.138.0/24',
2021-04-04 08:30:45 +00:00
},
},
2020-11-12 18:59:02 +00:00
'nfs-server': {
'shares': {
'/storage/download': {
'home.downloadhelper': 'rw,all_squash,anonuid=65534,anongid=1012,no_subtree_check',
},
2020-11-12 18:59:02 +00:00
'/storage/nas': {
'172.19.138.0/24': 'ro,all_squash,anonuid=65534,anongid=65534,no_subtree_check',
2020-11-12 18:59:02 +00:00
},
2021-05-23 15:41:19 +00:00
'/srv/paperless': {
'home.paperless': 'rw,all_squash,anonuid=65534,anongid=65534,no_subtree_check',
2021-05-23 15:41:19 +00:00
},
'/srv/scansnap': {
'172.19.138.0/24': 'rw,all_squash,anonuid=65534,anongid=65534,no_subtree_check',
},
2020-11-12 18:59:02 +00:00
},
},
2023-09-24 14:48:19 +00:00
'nginx': {
'vhosts': {
'jellyfin': {
'domain': 'jellyfin.home.kunbox.net',
'ssl': '_.home.kunbox.net',
},
},
},
2023-08-28 15:21:48 +00:00
'rsyslogd': {
'restrict-to': {
'home',
},
},
'smartd': {
'disks': {
'/dev/nvme0',
# ZFS cache disks
'/dev/disk/by-id/ata-TS64GSSD370_B807810503',
'/dev/disk/by-id/ata-TS64GSSD370_B807810527',
},
},
2021-06-04 05:27:49 +00:00
'sysctl': {
'options': {
# XXX find out if this is really needed
'net.ipv4.ip_forward': '1',
},
},
2020-11-12 18:40:41 +00:00
'systemd-networkd': {
'bridges': {
'br0': {
'match': {
'eno1',
2020-11-12 18:40:41 +00:00
},
},
2023-03-27 11:52:23 +00:00
'br1138': {
'match': {
2023-03-27 11:52:23 +00:00
'br0.1138',
},
},
2020-11-12 18:40:41 +00:00
},
},
'systemd-timers': {
'timers': {
# Ensure every user is able to read and write to the NAS dataset.
'nas_permissions': {
'command': [
'chown -R :nas /storage/nas/',
'find /storage/nas/ -type d -exec chmod 0775 {} \;',
'find /storage/nas/ -type f -exec chmod 0664 {} \;',
],
'when': '*-*-* 02:00:00',
},
},
},
'openssh': {
'enable_x_forwarding_for_admins': True,
},
2020-11-13 15:29:42 +00:00
'users': {
2020-11-15 09:36:40 +00:00
'f2k1de': {
'ssh_pubkey': {
'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrvhqC/tZzpLMs/qy+1xNSVi2mfn8LXPIEhh7dcGn9e',
'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDH5+j2vDW1FHSSEEI/Sf5qiKJq1uoxGO5BPv84mqohvol7GxDFObv69tn7g6HYfZY/SaS75C4ZXy+cKa0xy8UCpF0SBa2xHASkenS9v55oweDL4rYSPARzn2XKt3RFJG/d8V5NOWtcyq5DFSzewUF35E4hx1pUc/CIxgJEem5ZvzvN0hlIKXUN2djkVUx+mz6RryBysLTJEFBamjJxIkvDG/PZU73W4SHaKAYV4Ojz2NY7T5/NYKePfIU5F9pkE3RU0LRj58usvA1eP0PvEArWlGNCd8EJU+HQ5xr2dZ6MKPpEyG0KJkC88DuapeF5RwUV53ZhNpF+QgzpI72fH5up',
},
},
2022-03-06 10:09:57 +00:00
'inbox': {
'ssh_pubkey': {
#'command="/usr/share/rsync/scripts/rrsync -wo /storage/inbox/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ',
'command="/usr/share/rsync/scripts/rrsync -wo /storage/inbox/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDl9zOB7FBeqecfGBRQXZB9nM8e2HNIOKj7IhjgD47GUPh/niD4kUWfVsd6JiNs6RZZE7mQBAKD1wh3/sTd5Twn3ptMIZpoTrLAYEknICzdtwoLRlkHVfb3eK/Q9ufpOGV7Pd24viONSSWSgtd/GcXFCclpEtM06/47USwytFcN5NPmE3/yi68IKDSbIo3hWNo5ZUdeS7g0v+/uF/DkYMJRv0oQatcZx+P/yPLrKqekg/5nMw3RHRwcYVCDqoTc2KjAwWJQw1hOtt105tOpfmbo4eX9cmjcw3Eihwdyl+EeZelaTay1oIzHlKnuxp2oTI0O0KHNQngRt7YDgnEICY16SvyIOJD9ZOam1VeOr0+Z8QgPgGu82Wv+UG+/21yjIoB48VlkNNNpUBeGTBad23Cb+wHVFC5PIQN4iEH2i0PS0xVCIU2bOlXUPJx6/XK51vFoZdknH/8/Mr0jvMsw9i3QSrSy76AjxkexNYje0phNiseMRCakZ8uKdL2yA0g3P5s=',
},
},
2020-11-13 15:29:42 +00:00
'kunsi': {
'groups': {
'nas',
},
},
'sophie': {
'groups': {
'nas',
2020-11-13 15:29:42 +00:00
},
},
'qcn': {
'ssh_pubkey': {
#'command="/usr/share/rsync/scripts/rrsync -ro /storage/nas/movies/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ',
'command="/usr/share/rsync/scripts/rrsync -ro /storage/nas/movies/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILAwUA5t2cSy9YD+ilu5nklvokSRAoNOq/gUV73/KTsv lexi@aranea',
'command="/usr/share/rsync/scripts/rrsync -ro /storage/nas/movies/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC7cCmJ1+btuwpbGrGAuiK8R/hTMCK7CFK0aK2vPcSy+ lexi@kanaya',
'command="/usr/share/rsync/scripts/rrsync -ro /storage/nas/movies/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILLx+8d429D1KjaqOaGRFK09j6j3/FuU4xQMsrNLdflg lexi@toriel',
2022-11-04 06:06:10 +00:00
'command="/usr/share/rsync/scripts/rrsync -ro /storage/nas/Serien_Englisch/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPGPse+vv3+kHBYt6bdab/4AbP1hU34/3qH9SBuC8LCJ jenny@normandy',
},
},
2020-11-13 15:29:42 +00:00
},
2020-11-13 11:58:23 +00:00
'zfs': {
'module_options': {
'zfs_arc_max_gb': 8,
},
2020-11-13 11:58:23 +00:00
'pools': {
2021-08-17 16:09:51 +00:00
'storage': {
'when_creating': {
'config': [
{
'type': 'raidz2',
'devices': {
'/dev/disk/by-id/ata-WDC_WD6003FFBX-68MU3N0_V8GE15GR',
'/dev/disk/by-id/ata-WDC_WD6003FFBX-68MU3N0_V8HJ406R',
'/dev/disk/by-id/ata-WDC_WD6003FFBX-68MU3N0_V8HJBTLR',
'/dev/disk/by-id/ata-WDC_WD6003FFBX-68MU3N0_V8HJGN6R',
2023-05-16 11:01:04 +00:00
'/dev/disk/by-id/ata-WDC_WD6003FFBX-68MU3N0_V9JS5UYL',
2021-08-17 16:09:51 +00:00
'/dev/disk/by-id/ata-WDC_WD6003FFBX-68MU3N0_V8J8ZKRR',
},
},
{
'type': 'log',
'devices': {
'/dev/disk/by-id/ata-TS64GSSD370_B807810503-part1',
'/dev/disk/by-id/ata-TS64GSSD370_B807810527-part1',
},
},
{
'type': 'cache',
'devices': {
'/dev/disk/by-id/ata-TS64GSSD370_B807810503-part2',
'/dev/disk/by-id/ata-TS64GSSD370_B807810527-part2',
},
},
],
'ashift': 12,
},
2021-08-17 16:09:51 +00:00
},
2020-11-13 11:58:23 +00:00
},
'datasets': {
2022-04-03 15:41:27 +00:00
'storage': {
'primarycache': 'metadata',
},
'storage/opt-yate': {
'mountpoint': '/opt/yate',
},
2020-11-13 11:58:23 +00:00
'storage/f2k1de': {
'mountpoint': '/storage/f2k1de',
},
'storage/download': {
'mountpoint': '/storage/download',
},
2022-03-06 10:09:57 +00:00
'storage/inbox': {
'quota': str(1024*1024*1024*1024), # 1TB
'mountpoint': '/storage/inbox',
},
2020-11-13 11:58:23 +00:00
'storage/nas': {
'mountpoint': '/storage/nas',
},
2021-05-23 15:41:19 +00:00
'storage/paperless': {
'mountpoint': '/srv/paperless',
},
'storage/scan': {
'mountpoint': '/srv/scansnap',
},
2020-11-13 11:58:23 +00:00
},
'snapshots': {
'retain_per_dataset': {
'storage/download': {
'hourly': 48,
'daily': 0,
'weekly': 0,
'monthly': 0,
},
'storage/nas': {
# juuuuuuuust to be sure.
'daily': 14,
'weekly': 6,
'monthly': 12,
},
2021-05-23 15:41:19 +00:00
'storage/paperless': {
'daily': 14,
'weekly': 6,
'monthly': 24,
},
'storage/scan': {
'hourly': 6,
'daily': 0,
'weekly': 0,
'monthly': 0,
},
},
},
2020-11-13 11:58:23 +00:00
},
2020-11-12 18:40:41 +00:00
'vm': {
'cpu': 8,
2021-06-26 04:18:01 +00:00
'ram': 32,
2020-11-12 18:40:41 +00:00
},
},
}