il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(dns): set source of dns domain on fw.yaml

Browse Source
This commit is contained in:
il
2026-06-29 11:46:53 +09:00
parent 5ccb60bd2a
commit 88e85fff56
43 changed files with 606 additions and 406 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/inventory/group_vars/all.yaml
+1 -1
View File
@@ -301,7 +301,7 @@ version:
redis: "8.8.0"
immich: "v2.7.5"
paperless: "2.20.15"
nextcloud: "34.0.1"
nextcloud: "34.0.0"
collabora: "26.04.1.4.1"
sure: "0.7.1-hotfix.1"
outline: "1.8.1"
ansible/inventory/host_vars/fw.yaml
+109 -54
View File
@@ -28,71 +28,126 @@ vm:
lan_group: "vlan-trunk"
# Network Factors
# LLA is like MAC address for L3 (Network layer). Usually, subnet is used to separate network.
network4:
network:
dns_serial: "{{ now().strftime('%Y%m%d') }}00"
subnet:
client: "192.168.1.0/24"
server: "192.168.10.0/24"
user: "192.168.20.0/24"
wg: "192.168.99.0/24"
lla: "169.254.0.0/16"
# You can use "{{ hostvars['fw']['network4']['firewall'].values() | join(', ') }}" for all
firewall:
client: "192.168.1.1"
server: "192.168.10.1"
user: "192.168.20.1"
wg: "192.168.99.1"
ipv4:
client: "192.168.1.0/24"
server: "192.168.10.0/24"
user: "192.168.20.0/24"
wg: "192.168.99.0/24"
lla: "169.254.0.0/16"
ipv6:
client: "fd00:1::/64"
server: "fd00:10::/64"
wg: "fd00:99::/64"
lla: "fe80::/10"
reverse_zone:
ipv4:
client: "1.168.192.in-addr.arpa"
server: "10.168.192.in-addr.arpa"
ipv6:
client: "0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa"
server: "0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa"
fw:
ipv4:
client: "192.168.1.1"
server: "192.168.10.1"
user: "192.168.20.1"
wg: "192.168.99.1"
reverse: "1"
ipv6:
client: "fd00:1::1"
server: "fd00:10::1"
wg: "fd00:99::1"
reverse: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "ntp"
- "crowdsec"
blocky:
server: "192.168.10.2"
ipv4:
server: "192.168.10.2"
reverse: "2"
ipv6:
server: "fd00:10::2"
reverse: "2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
bind:
server: "192.168.10.3"
ipv4:
server: "192.168.10.3"
reverse: "3"
ipv6:
server: "fd00:10::3"
reverse: "3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
console:
client: "192.168.1.20"
wg: "192.168.99.20"
ipv4:
client: "192.168.1.20"
wg: "192.168.99.20"
reverse: "20"
ipv6:
client: "fd00:1::20"
wg: "fd00:99::20"
reverse: "0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
vmm:
client: "192.168.1.10"
server: "192.168.10.10"
ipv4:
client: "192.168.1.10"
server: "192.168.10.10"
reverse: "10"
ipv6:
client: "fd00:1::10"
server: "fd00:10::10"
reverse: "0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "init.vmm"
bk:
server: "192.168.10.9"
ipv4:
server: "192.168.10.9"
reverse: "9"
ipv6:
server: "fd00:10::9"
reverse: "9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "kopia"
infra:
server: "192.168.10.11"
ipv4:
server: "192.168.10.11"
reverse: "11"
ipv6:
server: "fd00:10::11"
reverse: "1.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "ca"
- "postgresql"
- "ldap"
- "maddy"
- "prometheus"
- "loki"
- "grafana"
auth:
server: "192.168.10.12"
ipv4:
server: "192.168.10.12"
reverse: "12"
ipv6:
server: "fd00:10::12"
reverse: "2.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "authelia"
app:
server: "192.168.10.13"
ipv4:
server: "192.168.10.13"
reverse: "13"
ipv6:
server: "fd00:10::13"
reverse: "3.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "*.app"
switch:
client: "192.168.1.2"
ipv4:
client: "192.168.1.2"
reverse: "2"
printer:
client: "192.168.1.101"
network6:
subnet:
client: "fd00:1::/64"
server: "fd00:10::/64"
wg: "fd00:99::/64"
lla: "fe80::/10"
firewall:
client: "fd00:1::1"
server: "fd00:10::1"
wg: "fd00:99::1"
blocky:
server: "fd00:10::2"
bind:
server: "fd00:10::3"
console:
client: "fd00:1::20"
wg: "fd00:99::20"
vmm:
client: "fd00:1::10"
server: "fd00:10::10"
bk:
server: "fd00:10::9"
infra:
server: "fd00:10::11"
auth:
server: "fd00:10::12"
app:
server: "fd00:10::13"
ipv4:
client: "192.168.1.101"
reverse: "101"
# Suricata Factors
# suricata_home_net: '[10.0.0.0/8,172.16.0.0/12,192.168.0.0/16]'
ansible/roles/common/tasks/services/set_crowdsec.yaml
+6
View File
@@ -184,6 +184,12 @@
- name: Set crowdsec bouncer
when: node['name'] in acquisd_list
block:
- name: Update and upgrade crowdsec hub
ansible.builtin.shell: |
cscli hub update && cscli hub upgrade
become: true
changed_when: false
- name: Install crowdsec collection
ansible.builtin.command: |
cscli collections install {{ item }}
ansible/roles/fw/tasks/services/set_bind.yaml
+49 -18
View File
@@ -8,16 +8,6 @@
register: "is_bind_installed"
ignore_errors: true
- name: Set bind9 zone files
ansible.builtin.set_fact:
bind_zone_files:
- "db.ilnmors.internal"
- "db.ilnmors.com"
- "db.1.168.192.in-addr.arpa"
- "db.10.168.192.in-addr.arpa"
- "db.1.00df.ip6.arpa"
- "db.10.00df.ip6.arpa"
- name: Install bind9
ansible.builtin.apt:
name: "bind9"
@@ -36,23 +26,64 @@
notify: "notification_restart_bind"
no_log: true
- name: Deploy db files
ansible.builtin.copy:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/{{ item }}"
dest: "/var/lib/bind/{{ item }}"
- name: Deploy forward zone files
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/{{ item.src }}.j2"
dest: "/var/lib/bind/{{ item.dest }}"
owner: "bind"
group: "bind"
mode: "0640"
loop: "{{ bind_zone_files }}"
loop:
- src: "db.public"
dest: "db.{{ domain['public'] }}"
- src: "db.internal"
dest: "db.{{ domain['internal'] }}"
become: true
notify: "notification_restart_bind"
no_log: true
- name: Deploy IPv4 reverse zone files
vars:
reverse_net: "{{ item.key }}"
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/db.ipv4.rev.j2"
dest: "/var/lib/bind/db.{{ item.key }}.ipv4.rev"
owner: bind
group: bind
mode: "0644"
loop: "{{ network['reverse_zone']['ipv4'] | dict2items }}"
become: true
notify: "notification_restart_bind"
no_log: true
- name: Deploy IPv6 reverse zones
vars:
reverse_net: "{{ item.key }}"
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/db.ipv6.rev.j2"
dest: "/var/lib/bind/db.{{ item.key }}.ipv6.rev"
owner: bind
group: bind
mode: "0644"
loop: "{{ network['reverse_zone']['ipv6'] | dict2items }}"
become: true
notify: "notification_restart_bind"
no_log: true
- name: Find BIND journal files
ansible.builtin.find:
paths: "/var/lib/bind"
patterns: "*.jnl"
file_type: file
become: true
register: bind_journal_files
no_log: true
- name: Clean BIND journal files
ansible.builtin.file:
path: "/var/lib/bind/{{ item }}.jnl"
path: "{{ item.path }}"
state: absent
loop: "{{ bind_zone_files }}"
loop: "{{ bind_journal_files.files }}"
become: true
notify: "notification_restart_bind"
no_log: true
@@ -67,7 +98,7 @@
validate: "/usr/bin/named-checkconf -z %s"
become: true
notify: "notification_restart_bind"
no_log: true
- name: Create named.service.d
ansible.builtin.file:
ansible/roles/infra/tasks/services/set_loki.yaml
+13
View File
@@ -9,6 +9,8 @@
loop:
- "loki"
- "loki/etc"
- "loki/etc/rules"
- "loki/etc/rules/{{ domain['internal'] }}"
- "loki/data"
- "loki/ssl"
become: true
@@ -24,6 +26,17 @@
notify: "notification_restart_loki"
no_log: true
- name: Deploy loki rules file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/etc/rules.yaml.j2"
dest: "{{ node['home_path'] }}/containers/loki/etc/rules/{{ domain['internal'] }}/rules.yaml"
owner: "{{ services['loki']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0600"
become: true
notify: "notification_restart_loki"
no_log: true
- name: Deploy loki certificate and key
ansible.builtin.copy:
content: |
ansible/roles/infra/tasks/services/set_postgresql.yaml
+1
View File
@@ -182,6 +182,7 @@
mode: "0644"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
when: not is_postgresql_init_marker.stat.exists
- name: Check container archive images
ansible.builtin.stat:
config/node/app/nftables.conf.j2
+6 -6
View File
@@ -1,12 +1,12 @@
#!/usr/sbin/nft -f
flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }}
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_AUTH = {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
define PORTS_SSH = 22
define PORTS_HTTP = 80
define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
config/node/auth/nftables.conf.j2
+4 -4
View File
@@ -1,10 +1,10 @@
#!/usr/sbin/nft -f
flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22
define PORTS_HTTP = 80
define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
config/node/bk/nftables.conf.j2
+8 -8
View File
@@ -1,14 +1,14 @@
#!/usr/sbin/nft -f
flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network6']['infra']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network6']['app']['server'] }}
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_INFRA = {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network']['app']['ipv4']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network']['app']['ipv6']['server'] }}
define PORTS_SSH = 22
define PORTS_HTTPS = 443
define PORTS_KOPIA = {{ services['kopia']['ports']['https'] }}
config/node/common/hosts.j2
+34 -36
View File
@@ -1,36 +1,34 @@
# localhost
127.0.0.1 {{ node['local_san'] }}
::1 {{ node['local_san'] }}
{% if node['name'] == 'console' %}
# Hosts IPv4
{{ hostvars['fw']['network4']['firewall']['server'] }} fw.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['bk']['server'] }} bk.{{ domain['internal'] }} kopia.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['vmm']['client'] }} init.vmm.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['vmm']['server'] }} vmm.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['infra']['server'] }} infra.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['auth']['server'] }} auth.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['app']['server'] }} app.{{ domain['internal'] }}
# Hosts IPv6
{{ hostvars['fw']['network6']['firewall']['server'] }} fw.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['bk']['server'] }} bk.{{ domain['internal'] }} kopia.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['vmm']['client'] }} init.vmm.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['vmm']['server'] }} vmm.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['infra']['server'] }} infra.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['auth']['server'] }} auth.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['app']['server'] }} app.{{ domain['internal'] }}
{% else %}
# IPv4
# Crowdsec, blocky, bind(fw)
{{ hostvars['fw']['network4']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['blocky']['server'] }} blocky.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['bind']['server'] }} bind.{{ domain['internal'] }}
# DB, LDAP, CA, Prometheus, Loki, mail (infra)
{{ hostvars['fw']['network4']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
# IPv6
# Crowdsec, blocky, bind(fw)
{{ hostvars['fw']['network6']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['blocky']['server'] }} blocky.{{ domain['internal'] }}
{{ hostvars['fw']['network6']['bind']['server'] }} bind.{{ domain['internal'] }}
# DB, LDAP, CA, Prometheus, Loki, mail (infra)
{{ hostvars['fw']['network6']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
{% endif %}
# Managed by Ansible
# Bootstrap name resolution only.
# Full service discovery is handled by BIND.
127.0.0.1 localhost
::1 localhost
{% set net = hostvars['fw']['network'] %}
{%
set server_hosts = (
net
| dict2items
| rejectattr('key', 'equalto', 'dns_serial')
| rejectattr('key', 'equalto', 'subnet')
| rejectattr('key', 'equalto', 'reverse_zone')
| selectattr('value.ipv4.server', 'defined')
| selectattr('value.ipv6.server', 'defined')
| map(attribute='key')
| list
)
%}
# node canonical names
{% for ip in ['ipv4', 'ipv6'] %}
# {{ ip }}
## vmm init
{{ "%-36s" | format(net['vmm'][ip]['client']) }} init.vmm init.vmm.{{ domain['internal'] }}
## console
{{ "%-36s" | format(net['console'][ip]['client']) }} console console.{{ domain['internal'] }}
## nodes
{% for service in server_hosts %}
{{ "%-36s" | format(net[service][ip]['server']) }} {{ service }} {{ service }}.{{ domain['internal'] }}{% for alias in net[service]['alias'] | default([]) %}{% if service in ['vmm', 'fw'] and alias != 'init.vmm' %} {{ alias }}.{{ domain['internal'] }}{% endif %}{% endfor %}{{ '' }}
{% endfor %}
{% endfor %}
config/node/common/networkd/20-eth0.network
+6 -6
View File
@@ -3,11 +3,11 @@ Name=eth0
[Network]
# IPv4
Address={{ hostvars['fw']['network4'][target_vm]['server'] }}/24
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network'][target_vm]['ipv4']['server'] }}/24
Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6
IPv6AcceptRA=false
Address={{ hostvars['fw']['network6'][target_vm]['server'] }}/64
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
Address={{ hostvars['fw']['network'][target_vm]['ipv6']['server'] }}/64
Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/networkd/21-fw-client.network
+4 -4
View File
@@ -9,8 +9,8 @@ IPv6AcceptRA=false
VLAN=server
VLAN=user
# IPv4
Address={{ hostvars['fw']['network4']['firewall']['client'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv4']['client'] }}/24
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6
Address={{ hostvars['fw']['network6']['firewall']['client'] }}/64
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv6']['client'] }}/64
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/networkd/22-fw-server.network
+8 -8
View File
@@ -6,19 +6,19 @@ IPForward=true
IPv6SendRA=false
IPv6AcceptRA=false
# IPv4
Address={{ hostvars['fw']['network4']['firewall']['server'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}/24
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6
Address={{ hostvars['fw']['network6']['firewall']['server'] }}/64
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}/64
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
[Address]
Address={{ hostvars['fw']['network4']['blocky']['server'] }}/24
Address={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}/24
[Address]
Address={{ hostvars['fw']['network4']['bind']['server'] }}/24
Address={{ hostvars['fw']['network']['bind']['ipv4']['server'] }}/24
[Address]
Address={{ hostvars['fw']['network6']['blocky']['server'] }}/64
Address={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}/64
PreferredLifetime=0
[Address]
Address={{ hostvars['fw']['network6']['bind']['server'] }}/64
Address={{ hostvars['fw']['network']['bind']['ipv6']['server'] }}/64
PreferredLifetime=0
config/node/fw/networkd/23-fw-user.network
+3 -3
View File
@@ -7,8 +7,8 @@ IPv6PrefixDelegation=true
IPv6SendRA=true
IPv6SendRAExtension=false
# IPv4
Address={{ hostvars['fw']['network4']['firewall']['user'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['fw']['ipv4']['user'] }}/24
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
[IPv6PrefixDelegation]
SubnetId=20
@@ -22,4 +22,4 @@ Managed=false
# O-Flag: Other information form DHCPv6
OtherInformation=false
EmitDNS=true
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/nftables.conf.j2
+29 -29
View File
@@ -9,39 +9,39 @@ define IF_SERVER = "server"
define IF_USER = "user"
define IF_WG = "wg0"
define NET4_CLIENT = {{ hostvars['fw']['network4']['subnet']['client'] }}
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET4_USER = {{ hostvars['fw']['network4']['subnet']['user'] }}
define NET4_WG = {{ hostvars['fw']['network4']['subnet']['wg'] }}
define NET4_LLA = {{ hostvars['fw']['network4']['subnet']['lla'] }}
define NET4_CLIENT = {{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET4_USER = {{ hostvars['fw']['network']['subnet']['ipv4']['user'] }}
define NET4_WG = {{ hostvars['fw']['network']['subnet']['ipv4']['wg'] }}
define NET4_LLA = {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }}
define NET4_RFC1918 = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }
define NET6_CLIENT = {{ hostvars['fw']['network6']['subnet']['client'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define NET6_WG = {{ hostvars['fw']['network6']['subnet']['wg'] }}
define NET6_LLA = {{ hostvars['fw']['network6']['subnet']['lla'] }}
define NET6_CLIENT = {{ hostvars['fw']['network']['subnet']['ipv6']['client'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define NET6_WG = {{ hostvars['fw']['network']['subnet']['ipv6']['wg'] }}
define NET6_LLA = {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }}
define HOSTS4_FW = { {{ hostvars['fw']['network4']['firewall'].values() | join(', ') }} }
define HOSTS4_BLOCKY = {{ hostvars['fw']['network4']['blocky']['server'] }}
define HOSTS4_BIND = {{ hostvars['fw']['network4']['bind']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS4_VMM = { {{ hostvars['fw']['network4']['vmm'].values() | join(', ') }} }
define HOSTS4_BK = {{ hostvars['fw']['network4']['bk']['server'] }}
define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }}
define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }}
define HOSTS4_SWITCH = {{ hostvars['fw']['network4']['switch']['client'] }}
define HOSTS4_PRINTER = {{ hostvars['fw']['network4']['printer']['client'] }}
define HOSTS4_FW = { {{ hostvars['fw']['network']['fw']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_BLOCKY = {{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
define HOSTS4_BIND = {{ hostvars['fw']['network']['bind']['ipv4']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_VMM = { {{ hostvars['fw']['network']['vmm']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_BK = {{ hostvars['fw']['network']['bk']['ipv4']['server'] }}
define HOSTS4_INFRA = {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}
define HOSTS4_AUTH = {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network']['app']['ipv4']['server'] }}
define HOSTS4_SWITCH = {{ hostvars['fw']['network']['switch']['ipv4']['client'] }}
define HOSTS4_PRINTER = {{ hostvars['fw']['network']['printer']['ipv4']['client'] }}
define HOSTS6_FW = { {{ hostvars['fw']['network6']['firewall'].values() | join(', ') }} }
define HOSTS6_BLOCKY = {{ hostvars['fw']['network6']['blocky']['server'] }}
define HOSTS6_BIND = {{ hostvars['fw']['network6']['bind']['server'] }}
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define HOSTS6_VMM = { {{ hostvars['fw']['network6']['vmm'].values() | join(', ') }} }
define HOSTS6_BK = {{ hostvars['fw']['network6']['bk']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network6']['infra']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network6']['app']['server'] }}
define HOSTS6_FW = { {{ hostvars['fw']['network']['fw']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_BLOCKY = {{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
define HOSTS6_BIND = {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_VMM = { {{ hostvars['fw']['network']['vmm']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_BK = {{ hostvars['fw']['network']['bk']['ipv6']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network']['app']['ipv6']['server'] }}
define PORTS_SSH = 22
define PORTS_WEB = { 80, 443 }
config/node/fw/wireguard/30-fw-wg0.netdev
+1 -1
View File
@@ -7,4 +7,4 @@ PrivateKey={{ hostvars['console']['wireguard']['server']['private_key'] }}
[WireGuardPeer]
PublicKey={{ hostvars['console']['wireguard']['console']['public_key'] }}
PresharedKey={{ hostvars['console']['wireguard']['console']['preshared_key'] }}
AllowedIPs={{ hostvars['fw']["network4"]["console"]["wg"] }}/32, {{ hostvars['fw']["network6"]["console"]["wg"] }}/128
AllowedIPs={{ hostvars['fw']["network"]["console"]['ipv4']["wg"] }}/32, {{ hostvars['fw']["network"]["console"]['ipv6']["wg"] }}/128
config/node/fw/wireguard/31-fw-wg0.network
+2 -2
View File
@@ -1,6 +1,6 @@
[Match]
Name=wg0
[Network]
Address={{ hostvars['fw']["network4"]["firewall"]["wg"] }}/24
Address={{ hostvars['fw']["network6"]["firewall"]["wg"] }}/64
Address={{ hostvars['fw']["network"]["fw"]['ipv4']["wg"] }}/24
Address={{ hostvars['fw']["network"]["fw"]['ipv6']["wg"] }}/64
IPForward=yes
config/node/infra/nftables.conf.j2
+4 -4
View File
@@ -3,10 +3,10 @@
# iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something
flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22
define PORTS_DB = 5432
define PORTS_CA = {{ services['ca']['ports']['https'] }}
config/node/vmm/networkd/24-vmm-vlan1.network.j2
+6 -6
View File
@@ -3,26 +3,26 @@ Name=vlan1
[Network]
# IPv4
Address={{ hostvars['fw']['network4']['vmm']['client'] }}/24
Address={{ hostvars['fw']['network']['vmm']['ipv4']['client'] }}/24
# IPv6
Address={{ hostvars['fw']['network6']['vmm']['client'] }}/64
Address={{ hostvars['fw']['network']['vmm']['ipv6']['client'] }}/64
[RoutingPolicyRule]
From={{ hostvars['fw']['network4']['vmm']['client'] }}/32
From={{ hostvars['fw']['network']['vmm']['ipv4']['client'] }}/32
Table=1
Priority=100
[Route]
Destination={{ hostvars['fw']['network4']['subnet']['client'] }}
Destination={{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}
Scope=link
Table=1
[RoutingPolicyRule]
From={{ hostvars['fw']['network6']['vmm']['client'] }}/128
From={{ hostvars['fw']['network']['vmm']['ipv6']['client'] }}/128
Table=61
Priority=100
[Route]
Destination={{ hostvars['fw']['network6']['subnet']['client'] }}
Destination={{ hostvars['fw']['network']['subnet']['ipv6']['client'] }}
Scope=link
Table=61
config/node/vmm/networkd/25-vmm-vlan10.network.j2
+10 -10
View File
@@ -3,30 +3,30 @@ Name=vlan10
[Network]
RequiredForOnline=false
# IPv4
Address={{ hostvars['fw']['network4']['vmm']['server'] }}/24
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['vmm']['ipv4']['server'] }}/24
Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6
Address={{ hostvars['fw']['network6']['vmm']['server'] }}/64
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
Address={{ hostvars['fw']['network']['vmm']['ipv6']['server'] }}/64
Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
[RoutingPolicyRule]
From={{ hostvars['fw']['network4']['vmm']['server'] }}/32
From={{ hostvars['fw']['network']['vmm']['ipv4']['server'] }}/32
Table=2
Priority=100
[Route]
Destination=0.0.0.0/0
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
Table=2
[RoutingPolicyRule]
From={{ hostvars['fw']['network6']['vmm']['server'] }}/128
From={{ hostvars['fw']['network']['vmm']['ipv6']['server'] }}/128
Table=62
Priority=100
[Route]
Destination=::/0
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
Table=62
config/node/vmm/nftables.conf.j2
+2 -2
View File
@@ -3,8 +3,8 @@
# iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something
flush ruleset
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22
table inet filter {
config/services/containers/common/caddy/etc/Caddyfile.j2
+1 -1
View File
@@ -24,7 +24,7 @@
{
servers {
# Only accept packets from auth main caddy
trusted_proxies static {{ hostvars['fw']['network4']['auth']['server'] }} {{ hostvars['fw']['network6']['auth']['server'] }}
trusted_proxies static {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
}
}
{% endif %}
config/services/containers/infra/loki/etc/loki.yaml.j2
+8
View File
@@ -11,6 +11,14 @@ server:
# bind_addr: ['::']
# bind_port: 7946
ruler:
enable_api: true
rule_path: /loki/rules
storage:
type: local
local:
directory: /etc/loki/rules
schema_config:
configs:
- from: "2023-01-01"
config/services/containers/infra/loki/etc/rules.yaml.j2
+63
View File
@@ -0,0 +1,63 @@
groups:
- name: backup_logs
interval: 1m
rules:
- alert: KopiaBackupFailure
expr: |
sum by (instance, job, service_name) (
count_over_time({job="kopia-backup", level=~"error|fatal"}[20m])
) > 0
for: 1m
labels:
severity: critical
source: loki
category: backup
service: kopia
annotations:
summary: {% raw %}"Kopia backup failed on {{ $labels.instance }}"{% endraw %}{{ '' }}
description: "kopia-backup emitted error/fatal logs."
- alert: RcloneBackupFailure
expr: |
sum by (instance, job, service_name) (
count_over_time({job="rclone", level=~"error|fatal"}[20m])
) > 0
for: 1m
labels:
severity: critical
source: loki
category: backup
service: rclone
annotations:
summary: {% raw %}"rclone backup failed on {{ $labels.instance }}"{% endraw %}{{ '' }}
description: "rclone emitted error/fatal logs."
- name: caddy_logs
interval: 1m
rules:
- alert: Caddy5xxBurst
expr: |
sum by (instance, host) (
count_over_time({job="caddy_access", status=~"5.."}[5m])
) > 5
for: 2m
labels:
severity: warning
source: loki
category: http
service: caddy
annotations:
summary: {% raw %}"Caddy 5xx burst on {{ $labels.host }}"{% endraw %}{{ '' }}
description: {% raw %}"Caddy returned more than 5 server errors in 5 minutes on {{ $labels.instance }}."{% endraw %}{{ '' }}
- alert: CaddyRateLimitBurst
expr: |
sum by (instance, host) (
count_over_time({job="caddy_access", status="429"}[10m])
) > 20
for: 2m
labels:
severity: warning
source: loki
category: http
service: caddy
annotations:
summary: {% raw %}"Caddy 429 burst on {{ $labels.host }}"{% endraw %}{{ '' }}
description: "Caddy returned more than 20 rate-limit responses in 10 minutes."
config/services/containers/infra/postgresql/config/pg_hba.conf.j2
+12 -12
View File
@@ -4,25 +4,25 @@
local all all trust
# Local monitoring connection (host - infra VM) `trust`
hostssl postgres alloy {{ hostvars['fw']['network4']['infra']['server'] }}/32 trust
hostssl postgres alloy {{ hostvars['fw']['network6']['infra']['server'] }}/128 trust
hostssl postgres alloy {{ hostvars['fw']['network4']['subnet']['lla'] }} trust
hostssl postgres alloy {{ hostvars['fw']['network6']['subnet']['lla'] }} trust
hostssl postgres alloy {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}/32 trust
hostssl postgres alloy {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}/128 trust
hostssl postgres alloy {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }} trust
hostssl postgres alloy {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }} trust
# Local connection (in postgresql container) needs password (127.0.0.1 - container loopback)
host all all 127.0.0.1/32 scram-sha-256
host all all ::1/128 scram-sha-256
# Local connection (host - infra VM) needs password (169.254.1.0/24 - link_local subnet for containers in pasta mode)
hostssl all all {{ hostvars['fw']['network4']['infra']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network6']['infra']['server'] }}/128 scram-sha-256
hostssl all all {{ hostvars['fw']['network4']['subnet']['lla'] }} scram-sha-256
hostssl all all {{ hostvars['fw']['network6']['subnet']['lla'] }} scram-sha-256
hostssl all all {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}/128 scram-sha-256
hostssl all all {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }} scram-sha-256
hostssl all all {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }} scram-sha-256
# auth VM
hostssl all all {{ hostvars['fw']['network4']['auth']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network6']['auth']['server'] }}/128 scram-sha-256
hostssl all all {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}/128 scram-sha-256
# app VM (Applications, 192.168.10.13)
hostssl all all {{ hostvars['fw']['network4']['app']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network6']['app']['server'] }}/128 scram-sha-256
hostssl all all {{ hostvars['fw']['network']['app']['ipv4']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network']['app']['ipv6']['server'] }}/128 scram-sha-256
config/services/containers/infra/prometheus/etc/rules.yaml.j2
+2 -2
View File
@@ -4,7 +4,7 @@ groups:
{% for instance in (((groups['hypervisor'] | default([])) + (groups['vms'] | default([]))) | difference(['vmm_init']) | sort) %}
- alert: {{ instance }}_node_exporter_down
expr: |
(present_over_time(up{instance="{{ instance }}"}[5m]) or on() vector(0)) == 0
(max_over_time(up{instance="{{ instance }}"}[5m]) or on() vector(0)) == 0
for: 30s
labels:
severity: critical
@@ -16,7 +16,7 @@ groups:
rules:
- alert: Postgresql_Down
expr: |
(present_over_time(pg_up{instance="infra", job="postgres"}[5m]) or on() vector(0)) == 0
(max_over_time(pg_up{instance="infra", job="postgres"}[5m]) or on() vector(0)) == 0
for: 30s
labels:
severity: critical
config/services/systemd/common/alloy/config.alloy.j2
+45 -6
View File
@@ -179,6 +179,13 @@ loki.relabel "journal_logs" {
target_label = "job"
replacement = "systemd-journal"
}
rule {
source_labels = ["__journal__systemd_unit", "__journal__systemd_user_unit", "__journal_syslog_identifier"]
separator = ";"
regex = ";;(ssh|sshd|sudo|su|login|polkitd|cron|crond)"
target_label = "job"
replacement = "$1"
}
rule {
source_labels = ["__journal__systemd_unit"]
regex = "(.+)\\.service"
@@ -197,12 +204,6 @@ loki.relabel "journal_logs" {
target_label = "job"
replacement = "$1.socket"
}
rule {
source_labels = ["__journal_syslog_identifier"]
regex = "(.+)"
target_label = "job"
replacement = "$1"
}
rule {
source_labels = ["job"]
regex = "user@\\d+"
@@ -279,6 +280,44 @@ loki.relabel "journal_logs" {
loki.process "journal_parser" {
forward_to = [loki.write.loki.receiver]
stage.match {
selector = "{job=~\".+\"} |~ \"container health_status .*health_status=\""
stage.regex {
expression = "container (?P<podman_event>health_status) (?P<container_id>[^ ]+)"
}
stage.regex {
expression = "name=(?P<container_name>[^,\\)]+)"
}
stage.regex {
expression = "health_status=(?P<health_status>[^,\\)]+)"
}
stage.labels {
values = {
job = "container_name",
service_name = "container_name",
podman_event = "",
health_status = "",
}
}
stage.structured_metadata {
values = {
container_id = "",
}
}
stage.static_labels {
values = {
level = "info",
}
}
}
stage.match {
selector = "{podman_event=\"health_status\",health_status=\"unhealthy\"}"
stage.static_labels {
values = {
level = "error",
}
}
}
stage.match {
selector = "{level!=\"fatal\", job!~\"loki|prometheus|grafana\"} |~ \"(?i)(fatal|critical|panic|uncaught|unhandled|assertion failed|out of memory|\\bboom\\b|killed process)\""
stage.static_labels {
config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2
+4 -4
View File
@@ -6,10 +6,10 @@ whitelist:
# Console IP lists
- "127.0.0.1"
- "::1"
- "{{ hostvars['fw']['network4']['console']['client'] }}"
- "{{ hostvars['fw']['network4']['console']['wg'] }}"
- "{{ hostvars['fw']['network6']['console']['client'] }}"
- "{{ hostvars['fw']['network6']['console']['wg'] }}"
- "{{ hostvars['fw']['network']['console']['ipv4']['client'] }}"
- "{{ hostvars['fw']['network']['console']['ipv4']['wg'] }}"
- "{{ hostvars['fw']['network']['console']['ipv6']['client'] }}"
- "{{ hostvars['fw']['network']['console']['ipv6']['wg'] }}"
{% if node['name'] == 'auth' %}
expression:
# immich thumbnail request 404 error false positive
config/services/systemd/common/crowdsec/etc/config.yaml.j2
+2 -2
View File
@@ -53,8 +53,8 @@ api:
trusted_ips: # IP ranges, or IPs which can have admin API access
- ::1
- 127.0.0.1
- {{ hostvars['fw']['network6']['subnet']['server'] }}
- {{ hostvars['fw']['network4']['subnet']['server'] }}
- {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
- {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
tls:
cert_file: /etc/crowdsec/ssl/crowdsec.crt
key_file: /etc/crowdsec/ssl/crowdsec.key
config/services/systemd/fw/bind/etc/named.conf.j2
+23 -31
View File
@@ -3,8 +3,8 @@ include "/etc/bind/acme.key";
options {
directory "/var/cache/bind";
listen-on port 53 { {{ hostvars['fw']['network4']['bind']['server'] }}; };
listen-on-v6 port 53 { {{ hostvars['fw']['network6']['bind']['server'] }}; };
listen-on port 53 { {{ hostvars['fw']['network']['bind']['ipv4']['server'] }}; };
listen-on-v6 port 53 { {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}; };
// Authoritative DNS setting
allow-recursion { none; };
@@ -16,47 +16,39 @@ options {
check-names master warn;
};
zone "ilnmors.internal." {
zone "{{ domain['internal'] }}." {
type primary;
file "/var/lib/bind/db.ilnmors.internal";
file "/var/lib/bind/db.{{ domain['internal'] }}";
notify yes;
// ACME-01 challenge policy. It allows only TXT record of subdomain update.
update-policy {
grant acme-key subdomain ilnmors.internal. TXT;
grant acme-key subdomain {{ domain['internal'] }}. TXT;
};
};
zone "1.168.192.in-addr.arpa" {
type primary;
file "/var/lib/bind/db.1.168.192.in-addr.arpa";
notify yes;
};
zone "10.168.192.in-addr.arpa" {
type primary;
file "/var/lib/bind/db.10.168.192.in-addr.arpa";
notify yes;
};
zone "0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa" {
type primary;
file "/var/lib/bind/db.1.00df.ip6.arpa";
notify yes;
};
zone "0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa" {
type primary;
file "/var/lib/bind/db.10.00df.ip6.arpa";
notify yes;
};
zone "ilnmors.com." {
zone "{{ domain['public'] }}." {
//split horizon dns
type primary;
file "/var/lib/bind/db.ilnmors.com";
file "/var/lib/bind/db.{{ domain['public'] }}";
notify yes;
};
{% for net, zone in network['reverse_zone']['ipv4'].items() %}
zone "{{ zone }}" {
type primary;
file "/var/lib/bind/db.{{ net }}.ipv4.rev";
notify yes;
};
{% endfor %}
{% for net, zone in network['reverse_zone']['ipv6'].items() %}
zone "{{ zone }}" {
type primary;
file "/var/lib/bind/db.{{ net }}.ipv6.rev";
notify yes;
};
{% endfor %}
logging {
channel default_log {
stderr;
config/services/systemd/fw/bind/lib/db.1.00df.ip6.arpa
-12
View File
@@ -1,12 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR fw.ilnmors.internal.
0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR console.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.1.168.192.in-addr.arpa
-14
View File
@@ -1,14 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
1 IN PTR fw.ilnmors.internal.
2 IN PTR switch.ilnmors.internal.
20 IN PTR console.ilnmors.internal.
101 IN PTR printer.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.10.00df.ip6.arpa
-18
View File
@@ -1,18 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR fw.ilnmors.internal.
2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR blocky.ilnmors.internal.
3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR bind.ilnmors.internal.
9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR bk.ilnmors.internal.
0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR vmm.ilnmors.internal.
1.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR infra.ilnmors.internal.
2.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR auth.ilnmors.internal.
3.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR app.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.10.168.192.in-addr.arpa
-18
View File
@@ -1,18 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
1 IN PTR fw.ilnmors.internal.
2 IN PTR blocky.ilnmors.internal.
3 IN PTR bind.ilnmors.internal.
9 IN PTR bk.ilnmors.internal.
10 IN PTR vmm.ilnmors.internal.
11 IN PTR infra.ilnmors.internal.
12 IN PTR auth.ilnmors.internal.
13 IN PTR app.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.ilnmors.com
-14
View File
@@ -1,14 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
@ IN A 192.168.10.12
@ IN AAAA fd00:10::12
* IN A 192.168.10.12
* IN AAAA fd00:10::12
config/services/systemd/fw/bind/lib/db.ilnmors.internal
-43
View File
@@ -1,43 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
bind IN A 192.168.10.3
bind IN AAAA fd00:10::3
fw IN A 192.168.10.1
fw IN AAAA fd00:10::1
blocky IN A 192.168.10.2
blocky IN AAAA fd00:10::2
bk IN A 192.168.10.9
bk IN AAAA fd00:10::9
vmm IN A 192.168.10.10
vmm IN AAAA fd00:10::10
infra IN A 192.168.10.11
infra IN AAAA fd00:10::11
auth IN A 192.168.10.12
auth IN AAAA fd00:10::12
app IN A 192.168.10.13
app IN AAAA fd00:10::13
switch IN A 192.168.1.2
console IN A 192.168.1.20
console IN AAAA fd00:1::20
printer IN A 192.168.1.101
init.vmm IN CNAME vmm.ilnmors.internal.
ntp IN CNAME fw.ilnmors.internal.
crowdsec IN CNAME fw.ilnmors.internal.
kopia IN CNAME bk.ilnmors.internal.
ca IN CNAME infra.ilnmors.internal.
postgresql IN CNAME infra.ilnmors.internal.
ldap IN CNAME infra.ilnmors.internal.
maddy IN CNAME infra.ilnmors.internal.
prometheus IN CNAME infra.ilnmors.internal.
loki IN CNAME infra.ilnmors.internal.
grafana IN CNAME infra.ilnmors.internal.
authelia IN CNAME auth.ilnmors.internal.
*.app IN CNAME app.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.internal.j2
+50
View File
@@ -0,0 +1,50 @@
$TTL 86400
@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. (
{{ network['dns_serial'] }} ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}.
{%
set hosts = (
network
| dict2items
| rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone'])
| list
)
%}
{%
set alias_hosts = (
network
| dict2items
| rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone'])
| selectattr('value.alias', 'defined')
| list
)
%}
{% for item in hosts %}
{% set name = item['key'] %}
{% set host = item['value'] %}
{% if host['ipv4'] is defined %}
{% if host['ipv4']['server'] is defined %}
{{ "%-12s" | format(name) }}IN A {{ host['ipv4']['server'] }}
{% elif host['ipv4']['client'] is defined %}
{{ "%-12s" | format(name) }}IN A {{ host['ipv4']['client'] }}
{% endif %}
{% endif %}
{% if host['ipv6'] is defined %}
{% if host['ipv6']['server'] is defined %}
{{ "%-12s" | format(name) }}IN AAAA {{ host['ipv6']['server'] }}
{% elif host['ipv6']['client'] is defined %}
{{ "%-12s" | format(name) }}IN AAAA {{ host['ipv6']['client'] }}
{% endif %}
{% endif %}
{% endfor %}
{% for item in alias_hosts %}
{% for alias in item['value']['alias'] %}
{{ "%-12s" | format(alias) }}IN CNAME {{ item['key'] }}.{{ domain['internal'] }}.
{% endfor %}
{% endfor %}
config/services/systemd/fw/bind/lib/db.ipv4.rev.j2
+25
View File
@@ -0,0 +1,25 @@
$TTL 86400
@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. (
{{ network['dns_serial'] }} ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}.
{% set hosts = (
network
| dict2items
| rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone'])
| list
) %}
{% for item in hosts %}
{% set name = item['key'] %}
{% set host = item['value'] %}
{% if host['ipv4'] is defined and host['ipv4'][reverse_net] is defined and host['ipv4']['reverse'] is defined %}
{{ "%-12s" | format(host['ipv4']['reverse']) }}IN PTR {{ name }}.{{ domain['internal'] }}.
{% endif %}
{% endfor %}
config/services/systemd/fw/bind/lib/db.ipv6.rev.j2
+24
View File
@@ -0,0 +1,24 @@
$TTL 86400
@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. (
{{ network['dns_serial'] }} ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}.
{% set hosts = (
network
| dict2items
| rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone'])
| list
) %}
{% for item in hosts %}
{% set name = item['key'] %}
{% set host = item['value'] %}
{% if host['ipv6'] is defined and host['ipv6'][reverse_net] is defined and host['ipv6']['reverse'] is defined %}
{{ "%-36s" | format(host['ipv6']['reverse']) }}IN PTR {{ name }}.{{ domain['internal'] }}.
{% endif %}
{% endfor %}
config/services/systemd/fw/bind/lib/db.public.j2
+14
View File
@@ -0,0 +1,14 @@
$TTL 86400
@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. (
{{ network['dns_serial'] }} ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}.
@ IN A {{ network['auth']['ipv4']['server'] }}
@ IN AAAA {{ network['auth']['ipv6']['server'] }}
* IN A {{ network['auth']['ipv4']['server'] }}
* IN AAAA {{ network['auth']['ipv6']['server'] }}
config/services/systemd/fw/blocky/etc/config.yaml.j2
+12 -12
View File
@@ -5,14 +5,14 @@ connectIPVersion: dual
ports:
dns:
- "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['dns'] }}"
- "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['dns'] }}"
- "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['dns'] }}"
- "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['dns'] }}"
tls:
- "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['dot'] }}"
- "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['dot'] }}"
- "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['dot'] }}"
- "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['dot'] }}"
https:
- "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['https'] }}"
- "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['https'] }}"
- "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['https'] }}"
- "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['https'] }}"
log:
level: info
@@ -31,12 +31,12 @@ upstreams:
conditional:
fallbackUpstream: false
mapping:
{{ domain['internal'] }}: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}"
{{ domain['public'] }}: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}"
1.168.192.in-addr.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}"
10.168.192.in-addr.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}"
0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}"
0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}"
{{ domain['internal'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
{{ domain['public'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
{{ network['reverse_zone']['ipv4']['client'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
{{ network['reverse_zone']['ipv4']['server'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
{{ network['reverse_zone']['ipv6']['client'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
{{ network['reverse_zone']['ipv6']['server'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
vpn.{{ domain['public'] }}: "tcp-tls:1.1.1.1:853, tcp-tls:1.0.0.1:853, tcp-tls:[2606:4700:4700::1111]:853, tcp-tls:[2606:4700:4700::1001]:853"
blocking:
config/services/systemd/fw/chrony/local-acl.conf.j2
+6 -6
View File
@@ -1,9 +1,9 @@
# 1. Access Control (IPv4)
allow {{ hostvars['fw']['network4']['subnet']['client'] }}
allow {{ hostvars['fw']['network4']['subnet']['server'] }}
allow {{ hostvars['fw']['network4']['subnet']['wg'] }}
allow {{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}
allow {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
allow {{ hostvars['fw']['network']['subnet']['ipv4']['wg'] }}
# 2. Access Control (IPv6)
allow {{ hostvars['fw']['network6']['subnet']['client'] }}
allow {{ hostvars['fw']['network6']['subnet']['server'] }}
allow {{ hostvars['fw']['network6']['subnet']['wg'] }}
allow {{ hostvars['fw']['network']['subnet']['ipv6']['client'] }}
allow {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
allow {{ hostvars['fw']['network']['subnet']['ipv6']['wg'] }}
config/services/systemd/fw/kea/kea-dhcp4.conf.j2
+9 -9
View File
@@ -2,7 +2,7 @@
"Dhcp4": {
"subnet4": [
{
"subnet": "{{ hostvars['fw']['network4']['subnet']['client'] }}",
"subnet": "{{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}",
"pools" : [
{
"pool": "192.168.1.254-192.168.1.254"
@@ -11,11 +11,11 @@
"option-data": [
{
"name": "routers",
"data": "{{ hostvars['fw']['network4']['firewall']['client'] }}"
"data": "{{ hostvars['fw']['network']['fw']['ipv4']['client'] }}"
},
{
"name": "domain-name-servers",
"data": "{{ hostvars['fw']['network4']['blocky']['server'] }}"
"data": "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}"
},
{
"name": "domain-name",
@@ -25,17 +25,17 @@
"reservations": [
{
"hw-address": "58:04:4f:18:6c:5e",
"ip-address": "{{ hostvars['fw']['network4']['switch']['client'] }}",
"ip-address": "{{ hostvars['fw']['network']['switch']['ipv4']['client'] }}",
"hostname": "switch"
},
{
"hw-address": "d8:e2:df:ff:1b:d5",
"ip-address": "{{ hostvars['fw']['network4']['console']['client'] }}",
"ip-address": "{{ hostvars['fw']['network']['console']['ipv4']['client'] }}",
"hostname": "console"
},
{
"hw-address": "38:ca:84:94:5e:06",
"ip-address": "{{ hostvars['fw']['network4']['printer']['client'] }}",
"ip-address": "{{ hostvars['fw']['network']['printer']['ipv4']['client'] }}",
"hostname": "printer"
}
],
@@ -43,7 +43,7 @@
"interface": "client"
},
{
"subnet": "{{ hostvars['fw']['network4']['subnet']['user'] }}",
"subnet": "{{ hostvars['fw']['network']['subnet']['ipv4']['user'] }}",
"pools" : [
{
"pool": "192.168.20.2-192.168.20.254"
@@ -52,11 +52,11 @@
"option-data": [
{
"name": "routers",
"data": "{{ hostvars['fw']['network4']['firewall']['user'] }}"
"data": "{{ hostvars['fw']['network']['fw']['ipv4']['user'] }}"
},
{
"name": "domain-name-servers",
"data": "{{ hostvars['fw']['network4']['blocky']['server'] }}"
"data": "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}"
},
{
"name": "domain-name",