Timotej Lazar
5762236ac2
ceph: fix nftables management rule
...
The mgmt VRF might not exist yet when nftables rules are loaded, so
use iifname instead of iif for dynamic interface lookup.
2024-05-09 12:30:42 +02:00
Timotej Lazar
5a7fa02909
proxmox: don’t route host traffic over VNIs
...
Very bad, much slow.
2024-05-05 12:58:54 +02:00
Timotej Lazar
1a4652fd87
ceph: parametrize cephadm checksum
2024-04-27 10:44:58 +02:00
Timotej Lazar
a637da5c21
proxmox: set vxlan-local-tunnelip for loopback interface
...
Oops. Not sure why stuff apparently worked without it. Especially
switchd on exits which worked itself into a bit of a frenzy.
2024-04-22 13:30:35 +02:00
Timotej Lazar
923d877208
proxmox: use inner L3 info for ECMP hashing
...
I’m sure I saw fib_multipath_hash_policy=2 (or =1 from last commit)
actually working once, but cannot reproduce. Maybe revisit this at
some point.
2024-04-08 08:49:16 +02:00
Timotej Lazar
f404922d6b
proxmox: use L4 info for ECMP hashing
...
This should make VXLAN-encapsulated traffic multipath.
2024-04-05 10:28:15 +02:00
Timotej Lazar
8be55c2bde
ceph: set up firewall
...
Still need to drop the hardcoded allowed set.
2024-04-05 06:12:58 +02:00
Timotej Lazar
e7f9132571
proxmox: set up firewall
...
Firewall policy is set in NetBox as cluster services¹. For Proxmox we
have to manually allow communication between nodes when using L3,
since the default management ipset does not get populated correctly.
We also need to open VTEP communication between nodes, which the
default rules don’t. We allow all inter-node traffic, as SSH without
passwords must be permitted anyway.
This also adds some helper filters that are spectacularly annoying to
implement purely in templates.
¹ There is actually no such thing as as a cluster service (yet?), so
instead we create a fake VM for the cluster, define services for it,
and then add the same services to a custom field on the cluster.
Alternative would be to tie services to a specific node, but that
could be problematic if that node is replaced.
2024-04-05 06:00:50 +02:00
Timotej Lazar
179547beff
debian: only advertise local routes
...
Also of course.
2024-04-04 10:53:01 +02:00
Timotej Lazar
2095494531
proxmox: only advertise local routes
...
Of course.
2024-04-04 10:17:58 +02:00
Timotej Lazar
14439048fa
proxmox: set datacenter defaults for frr
2024-03-22 18:51:29 +01:00
Timotej Lazar
0c063a017b
ceph: allow some ICMP
2024-03-14 14:34:44 +01:00
Timotej Lazar
ce7903e43a
ceph: improve cluster setup
...
Remove separate NetBox lookups. Explicitly allow connections between
cluster nodes. Tigthen temporary allowed IPv6 ranges.
2024-03-01 08:45:51 +01:00
Timotej Lazar
0af8474e52
proxmox: consolidate interface templates
2024-02-26 16:52:01 +01:00
Timotej Lazar
fbfdc83ee5
proxmox: use multiple non-VLAN-aware bridges
...
The Proxmox SDN feature does not play nice with our FRR and VXLAN setup.
With a single bridge we can’t have interface aliases. So use a bridge
for each VLAN. Actually don’t even have VLANs, just bridges mainlined
into VXLAN tunnels.
Read the list of VLANs carried by Proxmox nodes from a custom field on
the cluster in NetBox. Remove the vmbr0 device from individual nodes.
2024-02-20 16:43:47 +01:00
Timotej Lazar
c1344e8f59
dokuwiki: upgrade to latest
2024-02-20 16:01:51 +01:00
Timotej Lazar
90b55d8e8d
doku: tweak fonts and stuff
2024-02-20 11:05:59 +01:00
Timotej Lazar
cc10b4b265
dokuwiki: upgrade to latest
2024-02-06 19:50:25 +01:00
Timotej Lazar
02f778604c
Add dokuwiki role
...
For an Alpine Linux VM.
2024-01-20 19:00:41 +01:00
Timotej Lazar
c395fe22c7
ceph: allow connections from more addresses
...
Should unhardcode this at some point.
2024-01-17 19:19:55 +01:00
Timotej Lazar
d399fc0a24
proxmox: simplify interface setup tasks
2023-11-20 14:13:46 +01:00
Timotej Lazar
5038411af3
Add ceph role
...
Just prepares the servers, all management is then done through cephadm.
2023-11-20 13:04:11 +01:00
Timotej Lazar
2d89cd730c
proxmox: get all data from netbox
2023-11-20 12:56:34 +01:00
Timotej Lazar
62a3dc5121
proxmox: fix SFTP in management VRF
2023-11-20 12:55:52 +01:00
Timotej Lazar
eed2308609
debian: get all data from netbox
2023-11-18 19:44:52 +01:00
Timotej Lazar
d334e9aafa
debian: allow overriding release
2023-11-18 19:44:00 +01:00
Timotej Lazar
5cca841e6b
debian: allow sftp over management ssh
2023-11-18 19:42:33 +01:00
Timotej Lazar
5da50c14f9
debian: run a separate sshd in mgmt VRF
...
Leave the default sshd alone. If ssh is not necessary in default VRF,
another role should disable it.
2023-10-25 13:06:57 +02:00
Timotej Lazar
c9479cc786
proxmox: set hostname
2023-10-20 09:05:54 +02:00
Timotej Lazar
68efa7adcf
proxmox: simplify bridge definition
2023-10-19 10:18:50 +02:00
Timotej Lazar
0c1cc14e01
proxmox: add initial support for L2 VXLAN
...
I heard we like L2 so I put some L2 in our L3 so we can L2 as we L3 on L2.
2023-10-18 15:02:36 +02:00
Timotej Lazar
ce2d0f3cd4
proxmox: add interfaces for fabric links
...
Same as debian.
2023-10-05 12:43:35 +02:00
Timotej Lazar
a324da076b
Consolidate interface setup for debian and proxmox roles
2023-07-20 13:46:13 +02:00
Timotej Lazar
63ab087645
debian: get inventory data from netbox
...
Set standardized interface names (mgmt0… for L2 management interfaces
and lan0… for L3 data interfaces speaking BGP). ASN is stored as a
custom field in netbox but that might change.
2023-07-20 13:24:51 +02:00
Timotej Lazar
2330edf479
proxmox: standardize interface names and set up management VRF
...
No idea how badly this clashes with GUI configuration.
2023-07-17 16:39:40 +02:00
Timotej Lazar
aae782a66b
Add role to set up base Proxmox server
2023-07-14 16:12:03 +02:00
Timotej Lazar
db310ba716
debian: take it easy with the reboots
2023-06-05 17:52:25 +02:00
Timotej Lazar
7c209a7c5c
debian: set hostname
2023-06-05 17:52:20 +02:00
Timotej Lazar
8dd2476238
Add role to set up base Debian server
...
With sshd in separate management VRF and FRR to announce routes to
self over unnumbered BGP.
2023-06-01 17:22:26 +02:00
Timotej Lazar