173 lines
5.4 KiB
Python
173 lines
5.4 KiB
Python
nodes['home.router'] = {
|
|
'hostname': '172.19.138.1',
|
|
'bundles': {
|
|
'bird',
|
|
'jool',
|
|
'kea-dhcp-server',
|
|
'nginx',
|
|
'pppd',
|
|
'radvd',
|
|
'unbound',
|
|
'vnstat',
|
|
'wide-dhcp6c',
|
|
'wireguard',
|
|
},
|
|
'groups': {
|
|
'debian-bookworm',
|
|
},
|
|
'metadata': {
|
|
'interfaces': {
|
|
'enp1s0.1138': {
|
|
'ips': {
|
|
'172.19.138.1/24',
|
|
'fe80::1/64',
|
|
},
|
|
},
|
|
'enp1s0.1139': {
|
|
'ips': {
|
|
'172.19.139.1/24',
|
|
'fe80::1/64',
|
|
},
|
|
},
|
|
},
|
|
'backups': {
|
|
'exclude_from_backups': True,
|
|
},
|
|
'bird': {
|
|
'static_routes': {
|
|
'172.19.138.0/24',
|
|
'172.19.139.0/24',
|
|
},
|
|
},
|
|
# 'cron': {
|
|
# 'jobs': {
|
|
# # Our internet provider resets the connection if you're
|
|
# # connected longer than 24 hours. We install this cronjob
|
|
# # to make sure we don't get disconnected randomly during the
|
|
# # day.
|
|
# 'restart_pppd': '23 2 * * * root systemctl restart pppoe && date -u +\%s > /var/tmp/pppd-last-restart.status',
|
|
# },
|
|
# },
|
|
'kea-dhcp-server': {
|
|
'subnets': {
|
|
'enp1s0.1138': {
|
|
'lower': '172.19.138.100',
|
|
'higher': '172.19.138.250',
|
|
'subnet': '172.19.138.0/24',
|
|
'options': {
|
|
'domain-name-servers': '172.19.138.1',
|
|
'routers': '172.19.138.1',
|
|
},
|
|
},
|
|
'enp1s0.1139': {
|
|
'lower': '172.19.139.200',
|
|
'higher': '172.19.139.250',
|
|
'subnet': '172.19.139.0/24',
|
|
'options': {
|
|
'domain-name-servers': '172.19.139.1',
|
|
'routers': '172.19.139.1',
|
|
},
|
|
},
|
|
},
|
|
},
|
|
'icinga_options': {
|
|
# override group default
|
|
'also_affected_by': atomic(set()),
|
|
# disabled on group level
|
|
# XXX reenable this once we can leave the house safely again
|
|
#'vars.notification.sms': True
|
|
},
|
|
'nftables': {
|
|
'forward': {
|
|
'50-router': [
|
|
'ct state { related, established } accept',
|
|
'iifname enp1s0.1138 accept',
|
|
'ip6 nexthdr ipv6-icmp accept',
|
|
'tcp dport 22 accept',
|
|
],
|
|
},
|
|
'prerouting': {
|
|
'50-router': [
|
|
'tcp dport 2022 dnat 172.19.138.20:22',
|
|
],
|
|
},
|
|
},
|
|
'nginx': {
|
|
'restrict-to': {
|
|
'172.19.136.0/25',
|
|
'172.19.138.0/24',
|
|
'htz-cloud.molly-connector',
|
|
},
|
|
'vhosts': {
|
|
'vnstat': {
|
|
'domain': 'router.home.kunbox.net',
|
|
'ssl': '_.home.kunbox.net',
|
|
},
|
|
},
|
|
},
|
|
'radvd': {
|
|
'interfaces': {
|
|
'enp1s0.1138': {
|
|
'rdnss': {
|
|
'fe80::1',
|
|
},
|
|
},
|
|
'enp1s0.1139': {
|
|
'rdnss': {
|
|
'fe80::1',
|
|
},
|
|
},
|
|
},
|
|
},
|
|
'postfix': {
|
|
'mynetworks': {
|
|
'172.19.138.0/24',
|
|
},
|
|
},
|
|
'pppd': {
|
|
'username': vault.decrypt('encrypt$gAAAAABfruZ5AZbgJ3mfMLWqIMx8o4bBRMJsDPD1jElh-vWN_gnhiuZVjrQ1-7Y6zDXNkxXiyhx8rxc2enmvo26axd7EBI8FqknCptXAPruVtDZrBCis4TE='),
|
|
'password': vault.decrypt('encrypt$gAAAAABfruaXEDkaFksFMU8g97ydWyJF8p2KcSDJJBlzaOLDsLL6oCDYjG1kMPVESOzqjn8ThtSht1uZDuMCstA-sATmLS-EWQ=='),
|
|
'interface': 'enp1s0.7',
|
|
'dyndns': {
|
|
'domain': 'franzi-home.kunbox.net',
|
|
'url': 'https://ns-mephisto.kunbox.net/nic/update?hostname=franzi-home.kunbox.net&myip={ips}',
|
|
'username': vault.decrypt('encrypt$gAAAAABfr8DLAJhmUIhdxLq83I8MnRRvkRgDZcO8Brvw1KpvplC3K8ZGj0jIIWD3Us33vIP6t0ybd_mgD8slpRUk78Kqd3BMoQ=='),
|
|
'password': vault.decrypt('encrypt$gAAAAABfr8Cq5M1hweeJTQAl0dLhFntdlw-QnkIYUQpY-_ycODVWOpyeAwjwOgWLSdsdXIUvqcoiXPZPV-BE12p5C42NGnj9r7sKYpoGz8xfuGIk6haMa2g='),
|
|
},
|
|
'nftables-rules.d': {
|
|
'inet filter forward iifname enp1s0.1139 oifname $INTERFACE accept',
|
|
},
|
|
},
|
|
'unbound': {
|
|
'dns64': False,
|
|
'restrict-to': {
|
|
'172.19.138.0/23',
|
|
'fe80::/64',
|
|
},
|
|
},
|
|
'users': {
|
|
'f2k1de': {
|
|
'delete': True,
|
|
},
|
|
'fkunsmann': {},
|
|
'sophie': {},
|
|
},
|
|
'vnstat': {
|
|
'interface': 'enp1s0.7',
|
|
},
|
|
'vm': {
|
|
'cpu': 2,
|
|
'ram': 4,
|
|
},
|
|
'wide-dhcp6c': {
|
|
'source': 'ppp0',
|
|
'targets': {
|
|
'enp1s0.1138': '1',
|
|
'enp1s0.1139': '2',
|
|
},
|
|
},
|
|
'wireguard': {
|
|
'snat_ip': '172.19.138.1',
|
|
},
|
|
},
|
|
}
|