bundlewrap/nodes/home/router.py

from bundlewrap.metadata import atomic

nodes['home.router'] = {
    'hostname': '172.19.138.1',
    'bundles': {
        'dhcpd',
        'iptables',
        'netdata',
        'nginx',
        'openvpn-client',
        'pppd',
        'radvd',
        'unbound',
        'vnstat',
        'wide-dhcp6c',
        'wireguard',
    },
    'groups': {
        'debian-buster',
    },
    'metadata': {
        'interfaces': {
            'enp1s0.23': {
                'ips': {
                    '172.19.139.1/24',
                },
            },
            'enp1s0.42': {
                'ips': {
                    '172.19.138.1/24',
                },
            },
            'enp1s0.100': {
                'ignore': True,
            },
        },
        'backups': {
            'exclude_from_backups': True,
        },
        'cron': {
            # Our internet provider resets the connection if you're
            # connected longer than 24 hours. We install this cronjob
            # to make sure we don't get disconnected randomly during the
            # day.
            'restart_pppd': '23 2 * * *    root    systemctl restart pppoe && date -u +\%s > /var/tmp/pppd-last-restart.status',
        },
        'dhcpd': {
            'subnets': {
                'dmz': {
                    'interface': 'enp1s0.23',
                    'netmask': '255.255.255.0',
                    'range_lower':  '172.19.139.200',
                    'range_higher': '172.19.139.250',
                    'subnet': '172.19.139.0',
                    'options': {
                        'broadcast-address': '172.19.139.255',
                        'domain-name-servers': '172.19.139.1',
                        'routers': '172.19.131.1',
                        'subnet-mask': '255.255.255.0',
                    },
                },
                'home': {
                    'interface': 'enp1s0.42',
                    'netmask': '255.255.255.0',
                    'range_lower':  '172.19.138.100',
                    'range_higher': '172.19.138.250',
                    'subnet': '172.19.138.0',
                    'options': {
                        'broadcast-address': '172.19.138.255',
                        'domain-name': 'franzi-home.kunbox.net',
                        'domain-name-servers': '172.19.138.1',
                        'domain-search': 'home.kunbox.net',
                        'routers': '172.19.138.1',
                        'subnet-mask': '255.255.255.0',
                    },
                },
            },
        },
        'icinga_options': {
            # disabled on group level
            'vars.notification.sms': True
        },
        'iptables': {
            'custom_rules': [
                # This is a router. Allow forwarding traffic for internal networks.
                'iptables_both -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT',
                'iptables_both -A FORWARD -i enp1s0.23 -o ppp0 -j ACCEPT',
                'iptables_both -A FORWARD -i enp1s0.42 -j ACCEPT',

                # External port 2022 should be home.nas
                'iptables -t nat -A PREROUTING -p tcp --dport 2022 -j DNAT --to 172.19.138.20:22',
                'iptables -A FORWARD -p tcp -d 172.19.138.20 --dport 22 -j ACCEPT',

                # Allow mail from internal network
                'iptables_both -A INPUT -s 172.19.138.0/24 -p tcp --dport 25 -j ACCEPT',

                # use MASQUERADE for tun0 (c3voc)
                'iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE',

                # yaaaaay, IPv6! No NAT!
                'ip6tables -A FORWARD -p ipv6-icmp -j ACCEPT',
                'ip6tables -A FORWARD -p tcp --dport 22 -j ACCEPT',
            ],
        },
        'netdata': {
            'restrict-to': {
                '172.19.136.0/22',
            },
        },
        'nginx': {
            'restrict-to': {
                '172.19.136.0/22',
            },
            'vhosts': {
                'vnstat': {
                    'ssl': False,
                },
            },
        },
        'openvpn-client': {
            'configs': {
                'c3voc',
            },
        },
        'radvd': {
            'interfaces': {
                'enp1s0.23': {},
                'enp1s0.42': {},
            },
        },
        'postfix': {
            'mynetworks': {
                '172.19.138.0/24',
            },
        },
        'pppd': {
            'username': vault.decrypt('encrypt$gAAAAABfruZ5AZbgJ3mfMLWqIMx8o4bBRMJsDPD1jElh-vWN_gnhiuZVjrQ1-7Y6zDXNkxXiyhx8rxc2enmvo26axd7EBI8FqknCptXAPruVtDZrBCis4TE='),
            'password': vault.decrypt('encrypt$gAAAAABfruaXEDkaFksFMU8g97ydWyJF8p2KcSDJJBlzaOLDsLL6oCDYjG1kMPVESOzqjn8ThtSht1uZDuMCstA-sATmLS-EWQ=='),
            'interface': 'enp1s0.100',
            'dyndns': {
                'url': 'https://ns-1.kunbox.net/nic/update?hostname=franzi-home.kunbox.net&myip={ip}',
                'username': vault.decrypt('encrypt$gAAAAABfr8DLAJhmUIhdxLq83I8MnRRvkRgDZcO8Brvw1KpvplC3K8ZGj0jIIWD3Us33vIP6t0ybd_mgD8slpRUk78Kqd3BMoQ=='),
                'password': vault.decrypt('encrypt$gAAAAABfr8Cq5M1hweeJTQAl0dLhFntdlw-QnkIYUQpY-_ycODVWOpyeAwjwOgWLSdsdXIUvqcoiXPZPV-BE12p5C42NGnj9r7sKYpoGz8xfuGIk6haMa2g='),
            },
        },
        'unbound': {
            'restrict-to': {
                '172.19.138.0/23',
            },
        },
        'users': {
            'f2k1de': {
                'ssh_pubkey': {
                    'command="/bin/false",no-pty ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrvhqC/tZzpLMs/qy+1xNSVi2mfn8LXPIEhh7dcGn9e',
                    'command="/bin/false",no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDH5+j2vDW1FHSSEEI/Sf5qiKJq1uoxGO5BPv84mqohvol7GxDFObv69tn7g6HYfZY/SaS75C4ZXy+cKa0xy8UCpF0SBa2xHASkenS9v55oweDL4rYSPARzn2XKt3RFJG/d8V5NOWtcyq5DFSzewUF35E4hx1pUc/CIxgJEem5ZvzvN0hlIKXUN2djkVUx+mz6RryBysLTJEFBamjJxIkvDG/PZU73W4SHaKAYV4Ojz2NY7T5/NYKePfIU5F9pkE3RU0LRj58usvA1eP0PvEArWlGNCd8EJU+HQ5xr2dZ6MKPpEyG0KJkC88DuapeF5RwUV53ZhNpF+QgzpI72fH5up',
                },
            },
            'kunsi': {
                'ssh_pubkey': {
                    # work laptop
                    'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICYst1HK+gJYhNxzqJGnz4iB73pa89Xz2yH+8wufOcsA',
                },
            },
        },
        'vnstat': {
            'generate-web-dashboard': True,
            'interface': 'enp1s0.100',
        },
        'vm': {
            'cpu': 2,
            'ram': 2,
        },
        'wide-dhcp6c': {
            'source': 'ppp0',
            'targets': {
                'enp1s0.23': '2',
                'enp1s0.42': '1',
            },
        },
        'wireguard': {
            # TODO autogenerate?
            'my_ip': '172.19.136.2/32',
            'subnets': {
                '172.19.138.0/24',
                '172.19.139.0/24',
            },
            'peers': {
                'ovh.wireguard': {
                    'do_not_initiate_a_connection_from_your_side': True,
                },
            },
        },
    },
}