rc/servers
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deconsolidate network setup for proxmox and debian roles

Browse source 
They are just different enough to be annoying.
This commit is contained in:
Timotej Lazar 2024-08-28 12:37:41 +02:00
parent c3d1a6c4b1
commit 211d4bdb9a
10 changed files with 104 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

16
roles/debian/files/sshd@mgmt.service
View file

@ -1,16 +0,0 @@
[Unit]
Description=OpenBSD Secure Shell server (management VRF)
After=network.target auditd.service
[Service]
ExecStartPre=/usr/sbin/sshd -t
ExecStart=ip vrf exec mgmt /usr/sbin/sshd -f /etc/ssh/sshd_config.mgmt
ExecReload=/usr/sbin/sshd -t
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255
Type=notify
[Install]
WantedBy=multi-user.target

14
roles/debian/files/sshd_config.mgmt
View file

@ -1,14 +0,0 @@
# This is for sshd in management VRF, for ansible and other not-really-OOB stuff.
PidFile none
UsePAM no
Subsystem sftp /usr/lib/openssh/sftp-server
# Only allow pubkey auth.
KbdInteractiveAuthentication no
PasswordAuthentication no
PermitRootLogin prohibit-password
# Disable what we can.
AllowTcpForwarding no
GatewayPorts no
X11Forwarding no

3
roles/debian/templates/10-network.rules.j2
View file

@ -1,3 +0,0 @@
{% for iface in hostvars[inventory_hostname].interfaces | selectattr('mac_address') %}
SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="{{ iface.mac_address|lower }}", NAME="{{ iface.name }}"
{% endfor %}

31
roles/debian/templates/ansible.intf.j2
View file

@ -1,31 +0,0 @@
{% for vrf in interfaces | selectattr('vrf') | map(attribute='vrf.name') | sort | unique %}
auto {{ vrf }}
iface {{ vrf }}
vrf-table auto
address 127.0.0.1/8
address ::1/128
{%+ endfor %}
{%- for iface in interfaces | selectattr('enabled') %}
{% if iface.mgmt_only is not defined or not iface.mgmt_only %}
auto {{ iface.name }}
iface {{ iface.name }}{% if iface.name == 'lo' %} inet loopback{% endif +%}
{% if iface.mtu %}
mtu {{ iface.mtu }}
{% endif %}
{% if iface.vrf %}
vrf {{ iface.vrf.name }}
{% endif %}
{% for ip in iface.ip_addresses %}
address {{ ip.address }}
{% set subnet = ip.address | ipaddr('subnet') %}
{% set prefix = prefixes | selectattr('prefix', '==', subnet) | first %}
{% set gateway = prefix.custom_fields.gateway.address %}
{% if gateway is defined %}
gateway {{ gateway | ipaddr('address') }}
{% endif %}
{% endfor %}
{% endif %}
{% endfor %}

4
roles/debian/templates/resolv.conf.j2
View file

@ -1,4 +0,0 @@
search {{ domain }}
{% for server in dns %}
nameserver {{ server }}
{% endfor %}