48b987180a
Move firewall_master role to servers repo
2024-07-04 15:35:41 +02:00
ff1abcb508
firewall: drop a line
...
It was rubbish.
2024-06-20 20:54:42 +02:00
668af8bdb6
firewall: use a handler to reboot
2024-05-19 10:10:02 +02:00
0e9dac6985
fabric: support arbitrary port breakouts
...
Not that we use anything but 1x and 4x. Mainly done so I can drop
nonexistent (because they have been broken out) interfaces from NetBox.
2024-05-13 17:44:39 +02:00
8c82af23e4
firewall: also configure VPN forwards in the app
...
There we can define forwards only for networks with actual VPN users.
2024-05-03 11:27:27 +02:00
7656c05b2d
Revert "firewall: configure NAT from NetBox data"
...
Changed my mind. All NAT and VPN is configured from the app now.
2024-04-30 20:59:49 +02:00
8a9d47f176
firewall: configure NAT from NetBox data
...
This is dynamic NAT for (mostly) physical networks. NAT for custom
prefixes can still be defined in the app.
2024-04-28 15:54:01 +02:00
457ab7d3b7
Query prefixes once for all hosts
...
And group them into vrf_prefixes for VLAN networks and bgp_prefixes for
servers plugged directly into fabric.
This should reduce the number of queries to NetBox when configuring
firewalls and exit switches. Not sure but I think set_fact helps to
avoid queries (as opposed to setting group_vars).
2024-04-28 12:14:05 +02:00
1c0709a6a6
fabric: allow all VLANs on bridge
...
Don’t try to guess what should be allowed because not all switch links
are tagged in NetBox. For now we limit mainly on access switches.
2024-04-27 11:30:20 +02:00
2443a90bc5
fabric: use FHRP groups for virtual router IPs
...
More realistic- and supported-like and also avoids duplicated gateway
addresses.
2024-04-14 15:15:48 +02:00
db397cb2b1
exit: store VLAN interface addresses in NetBox
...
… instead of generating them from prefixes. A NetBox script can be
used to create and configure all necessary data for a new VLAN.
Instead of VLAN roles “inside" and “outside” we now create separate
VRFs for inside VLANs to match the actual exit/firewall configuration.
The “outside” VRF is for all VLANs that are directly accessible from
the internet.
2024-04-10 14:03:50 +02:00
ece3b8a377
exit: sort prefixes by family values
...
Because I made some seemingly unrelated changes in NetBox and they all
got flipped‐turned upside down.
2024-04-09 10:47:51 +02:00
000f625988
Move VM secrets to a separate password store directory
2024-04-08 15:06:18 +02:00
6dcae194d7
firewall: accept VPN connections from inside also
...
People tend to leave WireGuard tunnels active and we don’t want things
to become unreachable when moving to one of the inside networks.
2024-04-08 15:03:29 +02:00
c479f90669
access: move switch config templates back to this repo
...
Let’s keep it simple. Also editing templates in NetBox is a pain.
2024-04-08 14:45:39 +02:00
1ffdea8e43
firewall: fix duplicate space in template
2024-04-05 12:00:55 +02:00
f489555ba1
access: fix password store subdirectory for switches
2024-04-05 12:00:22 +02:00
7ef4023424
firewall: add known IP ranges in network ipset definitions
...
This data should only change in NetBox, so no point deploying it from
firewall master. Sometimes the first approach is the best approach.
2024-03-19 09:46:26 +01:00
aa82e5aa18
firewall_master: don’t define ipsets for VLAN groups
...
Was a harebrained idea from the start.
2024-03-19 09:45:23 +01:00
a97d133873
fabric: don’t set bond slaves if there are none
...
Not that that should happen except by mistake.
2024-03-05 12:46:26 +01:00
be0cc49b33
access: ignore more non‐changes
...
Should probably move this somewhere more listy if it keeps growing.
2024-03-04 10:12:38 +01:00
dbc00fd448
fabric: add custom field on dcim.Interface for bond mode
2024-02-27 13:35:29 +01:00
ce7c1bd49e
fabric: consolidate interface templates
...
Mostly to avoid special‐casing bond interfaces, and to support BGP
connections over virtual interfaces.
2024-02-27 13:35:29 +01:00
5381fecaa4
fabric: fix check for peer switch
2024-02-27 13:35:29 +01:00
65c16dbc63
Drop BGP update-delay option
...
Dropped from Cumulus manual and advised by seniors.
2024-02-27 13:35:29 +01:00
e93877c83d
firewall_master: add newly required option to pip invocation
...
System in Schutt und Asche legen.
2024-02-27 13:35:29 +01:00
7fe1dac008
firewall: use slurp instead of generic command to get host key
2024-02-27 13:35:29 +01:00
c20c47709c
exit: fix keepalive configuration
...
There will be order or there will be chaos.
2024-02-18 16:28:35 +01:00
37c025e2a0
firewall_master: move secrets to password store
2024-02-13 13:13:56 +01:00
d94e79f8b7
certbot_dns: move secrets to password store
2024-02-13 13:13:43 +01:00
27dac09549
access: move secrets to password store
...
Keeping ansible-vault values in NetBox is too cumbersome and limited.
2024-02-13 10:33:14 +01:00
91afaec9c2
firewall: allow connections from master with NATted IP
2024-02-06 09:19:49 +01:00
f54b23f49a
firewall: disable forwarding for mgmt interfaces in if-pre-up
...
Should be more robust and more importantly works when interfaces are
not renamed by mdev as is the situation now.
2024-01-30 13:11:35 +01:00
25289dd82f
firewall: fix interface renaming
...
The mdev rules for renaming interfaces at boot seem to not work with
latest Alpine. So rename with ifupdown instead.
2024-01-30 13:11:35 +01:00
544aa0a088
firewall: create empty ipsets for known networks
...
So we don’t crash and burn before config is set up.
2024-01-30 12:37:14 +01:00
161ce73be7
exit: restart keepalived on DHCP config update
2024-01-30 12:36:19 +01:00
aeb124e346
Add inside and outside roles for VLANs
...
Will probably rename inside/outside and office/server to int/ext.
2024-01-30 12:35:33 +01:00
0802dc8637
access: move templates to netbox
...
And adjust tasks to work with FS switches also.
2023-12-29 14:55:00 +01:00
be398e54fe
fabric: sort bridge VLANs by ID
...
Instead of barfing on unsortable dicts.
2023-12-29 13:52:05 +01:00
6fd5432b69
fabric: reload switchd before reloading interfaces
...
Don’t want to bring up a nonexisting interface.
2023-12-29 09:01:01 +01:00
0d24f9fdc7
firewall: log policy update messages to syslog
2023-12-18 12:55:50 +01:00
2b275c2ab4
exit: receive VPN IPv6 addresses from firewalls
...
And share them with peer over backup link.
2023-12-18 12:55:50 +01:00
c2d0e88996
firewall: set IPv6 address for wireguard interface
...
And advertise it.
2023-12-18 12:55:50 +01:00
d789e4a037
leaf: don’t talk BGP at bridges and bonds
2023-12-18 12:55:50 +01:00
9e8db74d24
fabric: allow setting bridge access VLANs on non-bond ports
2023-12-18 12:55:50 +01:00
950cd41c33
fabric: only add enabled ports to bridge
2023-12-18 12:55:50 +01:00
158e8740b8
Initial commit, squashed
2023-12-18 12:55:47 +01:00
