From 88e85fff5617c6818fc658b0bec26b0a5942e5d2 Mon Sep 17 00:00:00 2001 From: il Date: Mon, 29 Jun 2026 11:46:53 +0900 Subject: [PATCH] refactor(dns): set source of dns domain on fw.yaml --- ansible/inventory/group_vars/all.yaml | 2 +- ansible/inventory/host_vars/fw.yaml | 163 ++++++++++++------ .../common/tasks/services/set_crowdsec.yaml | 6 + ansible/roles/fw/tasks/services/set_bind.yaml | 67 +++++-- .../roles/infra/tasks/services/set_loki.yaml | 13 ++ .../infra/tasks/services/set_postgresql.yaml | 1 + config/node/app/nftables.conf.j2 | 12 +- config/node/auth/nftables.conf.j2 | 8 +- config/node/bk/nftables.conf.j2 | 16 +- config/node/common/hosts.j2 | 70 ++++---- config/node/common/networkd/20-eth0.network | 12 +- config/node/fw/networkd/21-fw-client.network | 8 +- config/node/fw/networkd/22-fw-server.network | 16 +- config/node/fw/networkd/23-fw-user.network | 6 +- config/node/fw/nftables.conf.j2 | 58 +++---- config/node/fw/wireguard/30-fw-wg0.netdev | 2 +- config/node/fw/wireguard/31-fw-wg0.network | 4 +- config/node/infra/nftables.conf.j2 | 8 +- .../node/vmm/networkd/24-vmm-vlan1.network.j2 | 12 +- .../vmm/networkd/25-vmm-vlan10.network.j2 | 20 +-- config/node/vmm/nftables.conf.j2 | 4 +- .../containers/common/caddy/etc/Caddyfile.j2 | 2 +- .../containers/infra/loki/etc/loki.yaml.j2 | 8 + .../containers/infra/loki/etc/rules.yaml.j2 | 63 +++++++ .../infra/postgresql/config/pg_hba.conf.j2 | 24 +-- .../infra/prometheus/etc/rules.yaml.j2 | 4 +- .../systemd/common/alloy/config.alloy.j2 | 51 +++++- .../crowdsec/bouncers/whitelists.yaml.j2 | 8 +- .../common/crowdsec/etc/config.yaml.j2 | 4 +- .../systemd/fw/bind/etc/named.conf.j2 | 54 +++--- .../systemd/fw/bind/lib/db.1.00df.ip6.arpa | 12 -- .../fw/bind/lib/db.1.168.192.in-addr.arpa | 14 -- .../systemd/fw/bind/lib/db.10.00df.ip6.arpa | 18 -- .../fw/bind/lib/db.10.168.192.in-addr.arpa | 18 -- .../systemd/fw/bind/lib/db.ilnmors.com | 14 -- .../systemd/fw/bind/lib/db.ilnmors.internal | 43 ----- .../systemd/fw/bind/lib/db.internal.j2 | 50 ++++++ .../systemd/fw/bind/lib/db.ipv4.rev.j2 | 25 +++ .../systemd/fw/bind/lib/db.ipv6.rev.j2 | 24 +++ .../services/systemd/fw/bind/lib/db.public.j2 | 14 ++ .../systemd/fw/blocky/etc/config.yaml.j2 | 24 +-- .../systemd/fw/chrony/local-acl.conf.j2 | 12 +- .../services/systemd/fw/kea/kea-dhcp4.conf.j2 | 18 +- 43 files changed, 606 insertions(+), 406 deletions(-) create mode 100644 config/services/containers/infra/loki/etc/rules.yaml.j2 delete mode 100644 config/services/systemd/fw/bind/lib/db.1.00df.ip6.arpa delete mode 100644 config/services/systemd/fw/bind/lib/db.1.168.192.in-addr.arpa delete mode 100644 config/services/systemd/fw/bind/lib/db.10.00df.ip6.arpa delete mode 100644 config/services/systemd/fw/bind/lib/db.10.168.192.in-addr.arpa delete mode 100644 config/services/systemd/fw/bind/lib/db.ilnmors.com delete mode 100644 config/services/systemd/fw/bind/lib/db.ilnmors.internal create mode 100644 config/services/systemd/fw/bind/lib/db.internal.j2 create mode 100644 config/services/systemd/fw/bind/lib/db.ipv4.rev.j2 create mode 100644 config/services/systemd/fw/bind/lib/db.ipv6.rev.j2 create mode 100644 config/services/systemd/fw/bind/lib/db.public.j2 diff --git a/ansible/inventory/group_vars/all.yaml b/ansible/inventory/group_vars/all.yaml index ef81d49..eb83a01 100644 --- a/ansible/inventory/group_vars/all.yaml +++ b/ansible/inventory/group_vars/all.yaml @@ -301,7 +301,7 @@ version: redis: "8.8.0" immich: "v2.7.5" paperless: "2.20.15" - nextcloud: "34.0.1" + nextcloud: "34.0.0" collabora: "26.04.1.4.1" sure: "0.7.1-hotfix.1" outline: "1.8.1" diff --git a/ansible/inventory/host_vars/fw.yaml b/ansible/inventory/host_vars/fw.yaml index a5284a6..4d05d57 100644 --- a/ansible/inventory/host_vars/fw.yaml +++ b/ansible/inventory/host_vars/fw.yaml @@ -28,71 +28,126 @@ vm: lan_group: "vlan-trunk" # Network Factors -# LLA is like MAC address for L3 (Network layer). Usually, subnet is used to separate network. -network4: +network: + dns_serial: "{{ now().strftime('%Y%m%d') }}00" subnet: - client: "192.168.1.0/24" - server: "192.168.10.0/24" - user: "192.168.20.0/24" - wg: "192.168.99.0/24" - lla: "169.254.0.0/16" - # You can use "{{ hostvars['fw']['network4']['firewall'].values() | join(', ') }}" for all - firewall: - client: "192.168.1.1" - server: "192.168.10.1" - user: "192.168.20.1" - wg: "192.168.99.1" + ipv4: + client: "192.168.1.0/24" + server: "192.168.10.0/24" + user: "192.168.20.0/24" + wg: "192.168.99.0/24" + lla: "169.254.0.0/16" + ipv6: + client: "fd00:1::/64" + server: "fd00:10::/64" + wg: "fd00:99::/64" + lla: "fe80::/10" + reverse_zone: + ipv4: + client: "1.168.192.in-addr.arpa" + server: "10.168.192.in-addr.arpa" + ipv6: + client: "0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa" + server: "0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa" + fw: + ipv4: + client: "192.168.1.1" + server: "192.168.10.1" + user: "192.168.20.1" + wg: "192.168.99.1" + reverse: "1" + ipv6: + client: "fd00:1::1" + server: "fd00:10::1" + wg: "fd00:99::1" + reverse: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0" + alias: + - "ntp" + - "crowdsec" blocky: - server: "192.168.10.2" + ipv4: + server: "192.168.10.2" + reverse: "2" + ipv6: + server: "fd00:10::2" + reverse: "2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0" bind: - server: "192.168.10.3" + ipv4: + server: "192.168.10.3" + reverse: "3" + ipv6: + server: "fd00:10::3" + reverse: "3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0" console: - client: "192.168.1.20" - wg: "192.168.99.20" + ipv4: + client: "192.168.1.20" + wg: "192.168.99.20" + reverse: "20" + ipv6: + client: "fd00:1::20" + wg: "fd00:99::20" + reverse: "0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0" vmm: - client: "192.168.1.10" - server: "192.168.10.10" + ipv4: + client: "192.168.1.10" + server: "192.168.10.10" + reverse: "10" + ipv6: + client: "fd00:1::10" + server: "fd00:10::10" + reverse: "0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0" + alias: + - "init.vmm" bk: - server: "192.168.10.9" + ipv4: + server: "192.168.10.9" + reverse: "9" + ipv6: + server: "fd00:10::9" + reverse: "9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0" + alias: + - "kopia" infra: - server: "192.168.10.11" + ipv4: + server: "192.168.10.11" + reverse: "11" + ipv6: + server: "fd00:10::11" + reverse: "1.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0" + alias: + - "ca" + - "postgresql" + - "ldap" + - "maddy" + - "prometheus" + - "loki" + - "grafana" auth: - server: "192.168.10.12" + ipv4: + server: "192.168.10.12" + reverse: "12" + ipv6: + server: "fd00:10::12" + reverse: "2.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0" + alias: + - "authelia" app: - server: "192.168.10.13" + ipv4: + server: "192.168.10.13" + reverse: "13" + ipv6: + server: "fd00:10::13" + reverse: "3.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0" + alias: + - "*.app" switch: - client: "192.168.1.2" + ipv4: + client: "192.168.1.2" + reverse: "2" printer: - client: "192.168.1.101" - -network6: - subnet: - client: "fd00:1::/64" - server: "fd00:10::/64" - wg: "fd00:99::/64" - lla: "fe80::/10" - firewall: - client: "fd00:1::1" - server: "fd00:10::1" - wg: "fd00:99::1" - blocky: - server: "fd00:10::2" - bind: - server: "fd00:10::3" - console: - client: "fd00:1::20" - wg: "fd00:99::20" - vmm: - client: "fd00:1::10" - server: "fd00:10::10" - bk: - server: "fd00:10::9" - infra: - server: "fd00:10::11" - auth: - server: "fd00:10::12" - app: - server: "fd00:10::13" + ipv4: + client: "192.168.1.101" + reverse: "101" # Suricata Factors # suricata_home_net: '[10.0.0.0/8,172.16.0.0/12,192.168.0.0/16]' diff --git a/ansible/roles/common/tasks/services/set_crowdsec.yaml b/ansible/roles/common/tasks/services/set_crowdsec.yaml index eef946d..ac41fab 100644 --- a/ansible/roles/common/tasks/services/set_crowdsec.yaml +++ b/ansible/roles/common/tasks/services/set_crowdsec.yaml @@ -184,6 +184,12 @@ - name: Set crowdsec bouncer when: node['name'] in acquisd_list block: + - name: Update and upgrade crowdsec hub + ansible.builtin.shell: | + cscli hub update && cscli hub upgrade + become: true + changed_when: false + - name: Install crowdsec collection ansible.builtin.command: | cscli collections install {{ item }} diff --git a/ansible/roles/fw/tasks/services/set_bind.yaml b/ansible/roles/fw/tasks/services/set_bind.yaml index f606f45..86cc68b 100644 --- a/ansible/roles/fw/tasks/services/set_bind.yaml +++ b/ansible/roles/fw/tasks/services/set_bind.yaml @@ -8,16 +8,6 @@ register: "is_bind_installed" ignore_errors: true -- name: Set bind9 zone files - ansible.builtin.set_fact: - bind_zone_files: - - "db.ilnmors.internal" - - "db.ilnmors.com" - - "db.1.168.192.in-addr.arpa" - - "db.10.168.192.in-addr.arpa" - - "db.1.00df.ip6.arpa" - - "db.10.00df.ip6.arpa" - - name: Install bind9 ansible.builtin.apt: name: "bind9" @@ -36,23 +26,64 @@ notify: "notification_restart_bind" no_log: true -- name: Deploy db files - ansible.builtin.copy: - src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/{{ item }}" - dest: "/var/lib/bind/{{ item }}" +- name: Deploy forward zone files + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/{{ item.src }}.j2" + dest: "/var/lib/bind/{{ item.dest }}" owner: "bind" group: "bind" mode: "0640" - loop: "{{ bind_zone_files }}" + loop: + - src: "db.public" + dest: "db.{{ domain['public'] }}" + - src: "db.internal" + dest: "db.{{ domain['internal'] }}" become: true notify: "notification_restart_bind" no_log: true +- name: Deploy IPv4 reverse zone files + vars: + reverse_net: "{{ item.key }}" + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/db.ipv4.rev.j2" + dest: "/var/lib/bind/db.{{ item.key }}.ipv4.rev" + owner: bind + group: bind + mode: "0644" + loop: "{{ network['reverse_zone']['ipv4'] | dict2items }}" + become: true + notify: "notification_restart_bind" + no_log: true + +- name: Deploy IPv6 reverse zones + vars: + reverse_net: "{{ item.key }}" + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/db.ipv6.rev.j2" + dest: "/var/lib/bind/db.{{ item.key }}.ipv6.rev" + owner: bind + group: bind + mode: "0644" + loop: "{{ network['reverse_zone']['ipv6'] | dict2items }}" + become: true + notify: "notification_restart_bind" + no_log: true + +- name: Find BIND journal files + ansible.builtin.find: + paths: "/var/lib/bind" + patterns: "*.jnl" + file_type: file + become: true + register: bind_journal_files + no_log: true + - name: Clean BIND journal files ansible.builtin.file: - path: "/var/lib/bind/{{ item }}.jnl" + path: "{{ item.path }}" state: absent - loop: "{{ bind_zone_files }}" + loop: "{{ bind_journal_files.files }}" become: true notify: "notification_restart_bind" no_log: true @@ -67,7 +98,7 @@ validate: "/usr/bin/named-checkconf -z %s" become: true notify: "notification_restart_bind" - no_log: true + - name: Create named.service.d ansible.builtin.file: diff --git a/ansible/roles/infra/tasks/services/set_loki.yaml b/ansible/roles/infra/tasks/services/set_loki.yaml index e070aa8..e61c0c0 100644 --- a/ansible/roles/infra/tasks/services/set_loki.yaml +++ b/ansible/roles/infra/tasks/services/set_loki.yaml @@ -9,6 +9,8 @@ loop: - "loki" - "loki/etc" + - "loki/etc/rules" + - "loki/etc/rules/{{ domain['internal'] }}" - "loki/data" - "loki/ssl" become: true @@ -24,6 +26,17 @@ notify: "notification_restart_loki" no_log: true +- name: Deploy loki rules file + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/etc/rules.yaml.j2" + dest: "{{ node['home_path'] }}/containers/loki/etc/rules/{{ domain['internal'] }}/rules.yaml" + owner: "{{ services['loki']['subuid'] }}" + group: "{{ node['group'] }}" + mode: "0600" + become: true + notify: "notification_restart_loki" + no_log: true + - name: Deploy loki certificate and key ansible.builtin.copy: content: | diff --git a/ansible/roles/infra/tasks/services/set_postgresql.yaml b/ansible/roles/infra/tasks/services/set_postgresql.yaml index bae4559..6aaf8fe 100644 --- a/ansible/roles/infra/tasks/services/set_postgresql.yaml +++ b/ansible/roles/infra/tasks/services/set_postgresql.yaml @@ -182,6 +182,7 @@ mode: "0644" owner: "{{ ansible_user }}" group: "{{ node['group'] }}" + when: not is_postgresql_init_marker.stat.exists - name: Check container archive images ansible.builtin.stat: diff --git a/config/node/app/nftables.conf.j2 b/config/node/app/nftables.conf.j2 index 26a66a9..fb6e491 100644 --- a/config/node/app/nftables.conf.j2 +++ b/config/node/app/nftables.conf.j2 @@ -1,12 +1,12 @@ #!/usr/sbin/nft -f flush ruleset -define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} -define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} -define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } -define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } -define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }} -define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }} +define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }} +define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }} +define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS4_AUTH = {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} +define HOSTS6_AUTH = {{ hostvars['fw']['network']['auth']['ipv6']['server'] }} define PORTS_SSH = 22 define PORTS_HTTP = 80 define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }} diff --git a/config/node/auth/nftables.conf.j2 b/config/node/auth/nftables.conf.j2 index 2d060b3..b999437 100644 --- a/config/node/auth/nftables.conf.j2 +++ b/config/node/auth/nftables.conf.j2 @@ -1,10 +1,10 @@ #!/usr/sbin/nft -f flush ruleset -define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} -define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} -define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } -define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } +define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }} +define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }} +define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } define PORTS_SSH = 22 define PORTS_HTTP = 80 define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }} diff --git a/config/node/bk/nftables.conf.j2 b/config/node/bk/nftables.conf.j2 index 5b403ba..e7195dc 100644 --- a/config/node/bk/nftables.conf.j2 +++ b/config/node/bk/nftables.conf.j2 @@ -1,14 +1,14 @@ #!/usr/sbin/nft -f flush ruleset -define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} -define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} -define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } -define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } -define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }} -define HOSTS6_INFRA = {{ hostvars['fw']['network6']['infra']['server'] }} -define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }} -define HOSTS6_APP = {{ hostvars['fw']['network6']['app']['server'] }} +define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }} +define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }} +define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS4_INFRA = {{ hostvars['fw']['network']['infra']['ipv4']['server'] }} +define HOSTS6_INFRA = {{ hostvars['fw']['network']['infra']['ipv6']['server'] }} +define HOSTS4_APP = {{ hostvars['fw']['network']['app']['ipv4']['server'] }} +define HOSTS6_APP = {{ hostvars['fw']['network']['app']['ipv6']['server'] }} define PORTS_SSH = 22 define PORTS_HTTPS = 443 define PORTS_KOPIA = {{ services['kopia']['ports']['https'] }} diff --git a/config/node/common/hosts.j2 b/config/node/common/hosts.j2 index b899aeb..83dedfe 100644 --- a/config/node/common/hosts.j2 +++ b/config/node/common/hosts.j2 @@ -1,36 +1,34 @@ -# localhost -127.0.0.1 {{ node['local_san'] }} -::1 {{ node['local_san'] }} -{% if node['name'] == 'console' %} -# Hosts IPv4 -{{ hostvars['fw']['network4']['firewall']['server'] }} fw.{{ domain['internal'] }} -{{ hostvars['fw']['network4']['bk']['server'] }} bk.{{ domain['internal'] }} kopia.{{ domain['internal'] }} -{{ hostvars['fw']['network4']['vmm']['client'] }} init.vmm.{{ domain['internal'] }} -{{ hostvars['fw']['network4']['vmm']['server'] }} vmm.{{ domain['internal'] }} -{{ hostvars['fw']['network4']['infra']['server'] }} infra.{{ domain['internal'] }} -{{ hostvars['fw']['network4']['auth']['server'] }} auth.{{ domain['internal'] }} -{{ hostvars['fw']['network4']['app']['server'] }} app.{{ domain['internal'] }} -# Hosts IPv6 -{{ hostvars['fw']['network6']['firewall']['server'] }} fw.{{ domain['internal'] }} -{{ hostvars['fw']['network6']['bk']['server'] }} bk.{{ domain['internal'] }} kopia.{{ domain['internal'] }} -{{ hostvars['fw']['network6']['vmm']['client'] }} init.vmm.{{ domain['internal'] }} -{{ hostvars['fw']['network6']['vmm']['server'] }} vmm.{{ domain['internal'] }} -{{ hostvars['fw']['network6']['infra']['server'] }} infra.{{ domain['internal'] }} -{{ hostvars['fw']['network6']['auth']['server'] }} auth.{{ domain['internal'] }} -{{ hostvars['fw']['network6']['app']['server'] }} app.{{ domain['internal'] }} -{% else %} -# IPv4 -# Crowdsec, blocky, bind(fw) -{{ hostvars['fw']['network4']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }} -{{ hostvars['fw']['network4']['blocky']['server'] }} blocky.{{ domain['internal'] }} -{{ hostvars['fw']['network4']['bind']['server'] }} bind.{{ domain['internal'] }} -# DB, LDAP, CA, Prometheus, Loki, mail (infra) -{{ hostvars['fw']['network4']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }} -# IPv6 -# Crowdsec, blocky, bind(fw) -{{ hostvars['fw']['network6']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }} -{{ hostvars['fw']['network6']['blocky']['server'] }} blocky.{{ domain['internal'] }} -{{ hostvars['fw']['network6']['bind']['server'] }} bind.{{ domain['internal'] }} -# DB, LDAP, CA, Prometheus, Loki, mail (infra) -{{ hostvars['fw']['network6']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }} -{% endif %} +# Managed by Ansible +# Bootstrap name resolution only. +# Full service discovery is handled by BIND. + +127.0.0.1 localhost +::1 localhost + +{% set net = hostvars['fw']['network'] %} +{% + set server_hosts = ( + net + | dict2items + | rejectattr('key', 'equalto', 'dns_serial') + | rejectattr('key', 'equalto', 'subnet') + | rejectattr('key', 'equalto', 'reverse_zone') + | selectattr('value.ipv4.server', 'defined') + | selectattr('value.ipv6.server', 'defined') + | map(attribute='key') + | list + ) +%} +# node canonical names +{% for ip in ['ipv4', 'ipv6'] %} +# {{ ip }} +## vmm init +{{ "%-36s" | format(net['vmm'][ip]['client']) }} init.vmm init.vmm.{{ domain['internal'] }} +## console +{{ "%-36s" | format(net['console'][ip]['client']) }} console console.{{ domain['internal'] }} +## nodes +{% for service in server_hosts %} +{{ "%-36s" | format(net[service][ip]['server']) }} {{ service }} {{ service }}.{{ domain['internal'] }}{% for alias in net[service]['alias'] | default([]) %}{% if service in ['vmm', 'fw'] and alias != 'init.vmm' %} {{ alias }}.{{ domain['internal'] }}{% endif %}{% endfor %}{{ '' }} +{% endfor %} + +{% endfor %} diff --git a/config/node/common/networkd/20-eth0.network b/config/node/common/networkd/20-eth0.network index 2fb5337..27dc244 100644 --- a/config/node/common/networkd/20-eth0.network +++ b/config/node/common/networkd/20-eth0.network @@ -3,11 +3,11 @@ Name=eth0 [Network] # IPv4 -Address={{ hostvars['fw']['network4'][target_vm]['server'] }}/24 -Gateway={{ hostvars['fw']['network4']['firewall']['server'] }} -DNS={{ hostvars['fw']['network4']['blocky']['server'] }} +Address={{ hostvars['fw']['network'][target_vm]['ipv4']['server'] }}/24 +Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }} +DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }} # IPv6 IPv6AcceptRA=false -Address={{ hostvars['fw']['network6'][target_vm]['server'] }}/64 -Gateway={{ hostvars['fw']['network6']['firewall']['server'] }} -DNS={{ hostvars['fw']['network6']['blocky']['server'] }} +Address={{ hostvars['fw']['network'][target_vm]['ipv6']['server'] }}/64 +Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }} +DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }} diff --git a/config/node/fw/networkd/21-fw-client.network b/config/node/fw/networkd/21-fw-client.network index c73d274..92d7f0b 100644 --- a/config/node/fw/networkd/21-fw-client.network +++ b/config/node/fw/networkd/21-fw-client.network @@ -9,8 +9,8 @@ IPv6AcceptRA=false VLAN=server VLAN=user # IPv4 -Address={{ hostvars['fw']['network4']['firewall']['client'] }}/24 -DNS={{ hostvars['fw']['network4']['blocky']['server'] }} +Address={{ hostvars['fw']['network']['fw']['ipv4']['client'] }}/24 +DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }} # IPv6 -Address={{ hostvars['fw']['network6']['firewall']['client'] }}/64 -DNS={{ hostvars['fw']['network6']['blocky']['server'] }} +Address={{ hostvars['fw']['network']['fw']['ipv6']['client'] }}/64 +DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }} diff --git a/config/node/fw/networkd/22-fw-server.network b/config/node/fw/networkd/22-fw-server.network index f4924f5..5e5d4d8 100644 --- a/config/node/fw/networkd/22-fw-server.network +++ b/config/node/fw/networkd/22-fw-server.network @@ -6,19 +6,19 @@ IPForward=true IPv6SendRA=false IPv6AcceptRA=false # IPv4 -Address={{ hostvars['fw']['network4']['firewall']['server'] }}/24 -DNS={{ hostvars['fw']['network4']['blocky']['server'] }} +Address={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}/24 +DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }} # IPv6 -Address={{ hostvars['fw']['network6']['firewall']['server'] }}/64 -DNS={{ hostvars['fw']['network6']['blocky']['server'] }} +Address={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}/64 +DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }} [Address] -Address={{ hostvars['fw']['network4']['blocky']['server'] }}/24 +Address={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}/24 [Address] -Address={{ hostvars['fw']['network4']['bind']['server'] }}/24 +Address={{ hostvars['fw']['network']['bind']['ipv4']['server'] }}/24 [Address] -Address={{ hostvars['fw']['network6']['blocky']['server'] }}/64 +Address={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}/64 PreferredLifetime=0 [Address] -Address={{ hostvars['fw']['network6']['bind']['server'] }}/64 +Address={{ hostvars['fw']['network']['bind']['ipv6']['server'] }}/64 PreferredLifetime=0 diff --git a/config/node/fw/networkd/23-fw-user.network b/config/node/fw/networkd/23-fw-user.network index 47f3b4b..0a038dd 100644 --- a/config/node/fw/networkd/23-fw-user.network +++ b/config/node/fw/networkd/23-fw-user.network @@ -7,8 +7,8 @@ IPv6PrefixDelegation=true IPv6SendRA=true IPv6SendRAExtension=false # IPv4 -Address={{ hostvars['fw']['network4']['firewall']['user'] }}/24 -DNS={{ hostvars['fw']['network4']['blocky']['server'] }} +Address={{ hostvars['fw']['network']['fw']['ipv4']['user'] }}/24 +DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }} [IPv6PrefixDelegation] SubnetId=20 @@ -22,4 +22,4 @@ Managed=false # O-Flag: Other information form DHCPv6 OtherInformation=false EmitDNS=true -DNS={{ hostvars['fw']['network6']['blocky']['server'] }} +DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }} diff --git a/config/node/fw/nftables.conf.j2 b/config/node/fw/nftables.conf.j2 index 56e3ff2..5daff0e 100644 --- a/config/node/fw/nftables.conf.j2 +++ b/config/node/fw/nftables.conf.j2 @@ -9,39 +9,39 @@ define IF_SERVER = "server" define IF_USER = "user" define IF_WG = "wg0" -define NET4_CLIENT = {{ hostvars['fw']['network4']['subnet']['client'] }} -define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} -define NET4_USER = {{ hostvars['fw']['network4']['subnet']['user'] }} -define NET4_WG = {{ hostvars['fw']['network4']['subnet']['wg'] }} -define NET4_LLA = {{ hostvars['fw']['network4']['subnet']['lla'] }} +define NET4_CLIENT = {{ hostvars['fw']['network']['subnet']['ipv4']['client'] }} +define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }} +define NET4_USER = {{ hostvars['fw']['network']['subnet']['ipv4']['user'] }} +define NET4_WG = {{ hostvars['fw']['network']['subnet']['ipv4']['wg'] }} +define NET4_LLA = {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }} define NET4_RFC1918 = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } -define NET6_CLIENT = {{ hostvars['fw']['network6']['subnet']['client'] }} -define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} -define NET6_WG = {{ hostvars['fw']['network6']['subnet']['wg'] }} -define NET6_LLA = {{ hostvars['fw']['network6']['subnet']['lla'] }} +define NET6_CLIENT = {{ hostvars['fw']['network']['subnet']['ipv6']['client'] }} +define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }} +define NET6_WG = {{ hostvars['fw']['network']['subnet']['ipv6']['wg'] }} +define NET6_LLA = {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }} -define HOSTS4_FW = { {{ hostvars['fw']['network4']['firewall'].values() | join(', ') }} } -define HOSTS4_BLOCKY = {{ hostvars['fw']['network4']['blocky']['server'] }} -define HOSTS4_BIND = {{ hostvars['fw']['network4']['bind']['server'] }} -define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } -define HOSTS4_VMM = { {{ hostvars['fw']['network4']['vmm'].values() | join(', ') }} } -define HOSTS4_BK = {{ hostvars['fw']['network4']['bk']['server'] }} -define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }} -define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }} -define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }} -define HOSTS4_SWITCH = {{ hostvars['fw']['network4']['switch']['client'] }} -define HOSTS4_PRINTER = {{ hostvars['fw']['network4']['printer']['client'] }} +define HOSTS4_FW = { {{ hostvars['fw']['network']['fw']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS4_BLOCKY = {{ hostvars['fw']['network']['blocky']['ipv4']['server'] }} +define HOSTS4_BIND = {{ hostvars['fw']['network']['bind']['ipv4']['server'] }} +define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS4_VMM = { {{ hostvars['fw']['network']['vmm']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS4_BK = {{ hostvars['fw']['network']['bk']['ipv4']['server'] }} +define HOSTS4_INFRA = {{ hostvars['fw']['network']['infra']['ipv4']['server'] }} +define HOSTS4_AUTH = {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} +define HOSTS4_APP = {{ hostvars['fw']['network']['app']['ipv4']['server'] }} +define HOSTS4_SWITCH = {{ hostvars['fw']['network']['switch']['ipv4']['client'] }} +define HOSTS4_PRINTER = {{ hostvars['fw']['network']['printer']['ipv4']['client'] }} -define HOSTS6_FW = { {{ hostvars['fw']['network6']['firewall'].values() | join(', ') }} } -define HOSTS6_BLOCKY = {{ hostvars['fw']['network6']['blocky']['server'] }} -define HOSTS6_BIND = {{ hostvars['fw']['network6']['bind']['server'] }} -define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } -define HOSTS6_VMM = { {{ hostvars['fw']['network6']['vmm'].values() | join(', ') }} } -define HOSTS6_BK = {{ hostvars['fw']['network6']['bk']['server'] }} -define HOSTS6_INFRA = {{ hostvars['fw']['network6']['infra']['server'] }} -define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }} -define HOSTS6_APP = {{ hostvars['fw']['network6']['app']['server'] }} +define HOSTS6_FW = { {{ hostvars['fw']['network']['fw']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS6_BLOCKY = {{ hostvars['fw']['network']['blocky']['ipv6']['server'] }} +define HOSTS6_BIND = {{ hostvars['fw']['network']['bind']['ipv6']['server'] }} +define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS6_VMM = { {{ hostvars['fw']['network']['vmm']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS6_BK = {{ hostvars['fw']['network']['bk']['ipv6']['server'] }} +define HOSTS6_INFRA = {{ hostvars['fw']['network']['infra']['ipv6']['server'] }} +define HOSTS6_AUTH = {{ hostvars['fw']['network']['auth']['ipv6']['server'] }} +define HOSTS6_APP = {{ hostvars['fw']['network']['app']['ipv6']['server'] }} define PORTS_SSH = 22 define PORTS_WEB = { 80, 443 } diff --git a/config/node/fw/wireguard/30-fw-wg0.netdev b/config/node/fw/wireguard/30-fw-wg0.netdev index 74a0949..a59a28a 100644 --- a/config/node/fw/wireguard/30-fw-wg0.netdev +++ b/config/node/fw/wireguard/30-fw-wg0.netdev @@ -7,4 +7,4 @@ PrivateKey={{ hostvars['console']['wireguard']['server']['private_key'] }} [WireGuardPeer] PublicKey={{ hostvars['console']['wireguard']['console']['public_key'] }} PresharedKey={{ hostvars['console']['wireguard']['console']['preshared_key'] }} -AllowedIPs={{ hostvars['fw']["network4"]["console"]["wg"] }}/32, {{ hostvars['fw']["network6"]["console"]["wg"] }}/128 +AllowedIPs={{ hostvars['fw']["network"]["console"]['ipv4']["wg"] }}/32, {{ hostvars['fw']["network"]["console"]['ipv6']["wg"] }}/128 diff --git a/config/node/fw/wireguard/31-fw-wg0.network b/config/node/fw/wireguard/31-fw-wg0.network index 8ca8b10..4c34e1f 100644 --- a/config/node/fw/wireguard/31-fw-wg0.network +++ b/config/node/fw/wireguard/31-fw-wg0.network @@ -1,6 +1,6 @@ [Match] Name=wg0 [Network] -Address={{ hostvars['fw']["network4"]["firewall"]["wg"] }}/24 -Address={{ hostvars['fw']["network6"]["firewall"]["wg"] }}/64 +Address={{ hostvars['fw']["network"]["fw"]['ipv4']["wg"] }}/24 +Address={{ hostvars['fw']["network"]["fw"]['ipv6']["wg"] }}/64 IPForward=yes diff --git a/config/node/infra/nftables.conf.j2 b/config/node/infra/nftables.conf.j2 index 607c832..d7926ea 100644 --- a/config/node/infra/nftables.conf.j2 +++ b/config/node/infra/nftables.conf.j2 @@ -3,10 +3,10 @@ # iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something flush ruleset -define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} -define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} -define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } -define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } +define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }} +define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }} +define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } define PORTS_SSH = 22 define PORTS_DB = 5432 define PORTS_CA = {{ services['ca']['ports']['https'] }} diff --git a/config/node/vmm/networkd/24-vmm-vlan1.network.j2 b/config/node/vmm/networkd/24-vmm-vlan1.network.j2 index 59caba5..e03b543 100644 --- a/config/node/vmm/networkd/24-vmm-vlan1.network.j2 +++ b/config/node/vmm/networkd/24-vmm-vlan1.network.j2 @@ -3,26 +3,26 @@ Name=vlan1 [Network] # IPv4 -Address={{ hostvars['fw']['network4']['vmm']['client'] }}/24 +Address={{ hostvars['fw']['network']['vmm']['ipv4']['client'] }}/24 # IPv6 -Address={{ hostvars['fw']['network6']['vmm']['client'] }}/64 +Address={{ hostvars['fw']['network']['vmm']['ipv6']['client'] }}/64 [RoutingPolicyRule] -From={{ hostvars['fw']['network4']['vmm']['client'] }}/32 +From={{ hostvars['fw']['network']['vmm']['ipv4']['client'] }}/32 Table=1 Priority=100 [Route] -Destination={{ hostvars['fw']['network4']['subnet']['client'] }} +Destination={{ hostvars['fw']['network']['subnet']['ipv4']['client'] }} Scope=link Table=1 [RoutingPolicyRule] -From={{ hostvars['fw']['network6']['vmm']['client'] }}/128 +From={{ hostvars['fw']['network']['vmm']['ipv6']['client'] }}/128 Table=61 Priority=100 [Route] -Destination={{ hostvars['fw']['network6']['subnet']['client'] }} +Destination={{ hostvars['fw']['network']['subnet']['ipv6']['client'] }} Scope=link Table=61 diff --git a/config/node/vmm/networkd/25-vmm-vlan10.network.j2 b/config/node/vmm/networkd/25-vmm-vlan10.network.j2 index a0b46e4..bb298f1 100644 --- a/config/node/vmm/networkd/25-vmm-vlan10.network.j2 +++ b/config/node/vmm/networkd/25-vmm-vlan10.network.j2 @@ -3,30 +3,30 @@ Name=vlan10 [Network] RequiredForOnline=false # IPv4 -Address={{ hostvars['fw']['network4']['vmm']['server'] }}/24 -Gateway={{ hostvars['fw']['network4']['firewall']['server'] }} -DNS={{ hostvars['fw']['network4']['blocky']['server'] }} +Address={{ hostvars['fw']['network']['vmm']['ipv4']['server'] }}/24 +Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }} +DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }} # IPv6 -Address={{ hostvars['fw']['network6']['vmm']['server'] }}/64 -Gateway={{ hostvars['fw']['network6']['firewall']['server'] }} -DNS={{ hostvars['fw']['network6']['blocky']['server'] }} +Address={{ hostvars['fw']['network']['vmm']['ipv6']['server'] }}/64 +Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }} +DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }} [RoutingPolicyRule] -From={{ hostvars['fw']['network4']['vmm']['server'] }}/32 +From={{ hostvars['fw']['network']['vmm']['ipv4']['server'] }}/32 Table=2 Priority=100 [Route] Destination=0.0.0.0/0 -Gateway={{ hostvars['fw']['network4']['firewall']['server'] }} +Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }} Table=2 [RoutingPolicyRule] -From={{ hostvars['fw']['network6']['vmm']['server'] }}/128 +From={{ hostvars['fw']['network']['vmm']['ipv6']['server'] }}/128 Table=62 Priority=100 [Route] Destination=::/0 -Gateway={{ hostvars['fw']['network6']['firewall']['server'] }} +Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }} Table=62 diff --git a/config/node/vmm/nftables.conf.j2 b/config/node/vmm/nftables.conf.j2 index 99f0666..40fa12b 100644 --- a/config/node/vmm/nftables.conf.j2 +++ b/config/node/vmm/nftables.conf.j2 @@ -3,8 +3,8 @@ # iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something flush ruleset -define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } -define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } +define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } +define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} } define PORTS_SSH = 22 table inet filter { diff --git a/config/services/containers/common/caddy/etc/Caddyfile.j2 b/config/services/containers/common/caddy/etc/Caddyfile.j2 index 43e4714..06c0a12 100644 --- a/config/services/containers/common/caddy/etc/Caddyfile.j2 +++ b/config/services/containers/common/caddy/etc/Caddyfile.j2 @@ -24,7 +24,7 @@ { servers { # Only accept packets from auth main caddy - trusted_proxies static {{ hostvars['fw']['network4']['auth']['server'] }} {{ hostvars['fw']['network6']['auth']['server'] }} + trusted_proxies static {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} {{ hostvars['fw']['network']['auth']['ipv6']['server'] }} } } {% endif %} diff --git a/config/services/containers/infra/loki/etc/loki.yaml.j2 b/config/services/containers/infra/loki/etc/loki.yaml.j2 index 5c00d0e..a9e177d 100644 --- a/config/services/containers/infra/loki/etc/loki.yaml.j2 +++ b/config/services/containers/infra/loki/etc/loki.yaml.j2 @@ -11,6 +11,14 @@ server: # bind_addr: ['::'] # bind_port: 7946 +ruler: + enable_api: true + rule_path: /loki/rules + storage: + type: local + local: + directory: /etc/loki/rules + schema_config: configs: - from: "2023-01-01" diff --git a/config/services/containers/infra/loki/etc/rules.yaml.j2 b/config/services/containers/infra/loki/etc/rules.yaml.j2 new file mode 100644 index 0000000..b5cb0bd --- /dev/null +++ b/config/services/containers/infra/loki/etc/rules.yaml.j2 @@ -0,0 +1,63 @@ +groups: + - name: backup_logs + interval: 1m + rules: + - alert: KopiaBackupFailure + expr: | + sum by (instance, job, service_name) ( + count_over_time({job="kopia-backup", level=~"error|fatal"}[20m]) + ) > 0 + for: 1m + labels: + severity: critical + source: loki + category: backup + service: kopia + annotations: + summary: {% raw %}"Kopia backup failed on {{ $labels.instance }}"{% endraw %}{{ '' }} + description: "kopia-backup emitted error/fatal logs." + - alert: RcloneBackupFailure + expr: | + sum by (instance, job, service_name) ( + count_over_time({job="rclone", level=~"error|fatal"}[20m]) + ) > 0 + for: 1m + labels: + severity: critical + source: loki + category: backup + service: rclone + annotations: + summary: {% raw %}"rclone backup failed on {{ $labels.instance }}"{% endraw %}{{ '' }} + description: "rclone emitted error/fatal logs." + - name: caddy_logs + interval: 1m + rules: + - alert: Caddy5xxBurst + expr: | + sum by (instance, host) ( + count_over_time({job="caddy_access", status=~"5.."}[5m]) + ) > 5 + for: 2m + labels: + severity: warning + source: loki + category: http + service: caddy + annotations: + summary: {% raw %}"Caddy 5xx burst on {{ $labels.host }}"{% endraw %}{{ '' }} + description: {% raw %}"Caddy returned more than 5 server errors in 5 minutes on {{ $labels.instance }}."{% endraw %}{{ '' }} + - alert: CaddyRateLimitBurst + expr: | + sum by (instance, host) ( + count_over_time({job="caddy_access", status="429"}[10m]) + ) > 20 + for: 2m + labels: + severity: warning + source: loki + category: http + service: caddy + annotations: + summary: {% raw %}"Caddy 429 burst on {{ $labels.host }}"{% endraw %}{{ '' }} + description: "Caddy returned more than 20 rate-limit responses in 10 minutes." diff --git a/config/services/containers/infra/postgresql/config/pg_hba.conf.j2 b/config/services/containers/infra/postgresql/config/pg_hba.conf.j2 index 79fce4e..d0aa7d8 100644 --- a/config/services/containers/infra/postgresql/config/pg_hba.conf.j2 +++ b/config/services/containers/infra/postgresql/config/pg_hba.conf.j2 @@ -4,25 +4,25 @@ local all all trust # Local monitoring connection (host - infra VM) `trust` -hostssl postgres alloy {{ hostvars['fw']['network4']['infra']['server'] }}/32 trust -hostssl postgres alloy {{ hostvars['fw']['network6']['infra']['server'] }}/128 trust -hostssl postgres alloy {{ hostvars['fw']['network4']['subnet']['lla'] }} trust -hostssl postgres alloy {{ hostvars['fw']['network6']['subnet']['lla'] }} trust +hostssl postgres alloy {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}/32 trust +hostssl postgres alloy {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}/128 trust +hostssl postgres alloy {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }} trust +hostssl postgres alloy {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }} trust # Local connection (in postgresql container) needs password (127.0.0.1 - container loopback) host all all 127.0.0.1/32 scram-sha-256 host all all ::1/128 scram-sha-256 # Local connection (host - infra VM) needs password (169.254.1.0/24 - link_local subnet for containers in pasta mode) -hostssl all all {{ hostvars['fw']['network4']['infra']['server'] }}/32 scram-sha-256 -hostssl all all {{ hostvars['fw']['network6']['infra']['server'] }}/128 scram-sha-256 -hostssl all all {{ hostvars['fw']['network4']['subnet']['lla'] }} scram-sha-256 -hostssl all all {{ hostvars['fw']['network6']['subnet']['lla'] }} scram-sha-256 +hostssl all all {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}/32 scram-sha-256 +hostssl all all {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}/128 scram-sha-256 +hostssl all all {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }} scram-sha-256 +hostssl all all {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }} scram-sha-256 # auth VM -hostssl all all {{ hostvars['fw']['network4']['auth']['server'] }}/32 scram-sha-256 -hostssl all all {{ hostvars['fw']['network6']['auth']['server'] }}/128 scram-sha-256 +hostssl all all {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}/32 scram-sha-256 +hostssl all all {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}/128 scram-sha-256 # app VM (Applications, 192.168.10.13) -hostssl all all {{ hostvars['fw']['network4']['app']['server'] }}/32 scram-sha-256 -hostssl all all {{ hostvars['fw']['network6']['app']['server'] }}/128 scram-sha-256 +hostssl all all {{ hostvars['fw']['network']['app']['ipv4']['server'] }}/32 scram-sha-256 +hostssl all all {{ hostvars['fw']['network']['app']['ipv6']['server'] }}/128 scram-sha-256 diff --git a/config/services/containers/infra/prometheus/etc/rules.yaml.j2 b/config/services/containers/infra/prometheus/etc/rules.yaml.j2 index 164e3ba..b26ce7a 100644 --- a/config/services/containers/infra/prometheus/etc/rules.yaml.j2 +++ b/config/services/containers/infra/prometheus/etc/rules.yaml.j2 @@ -4,7 +4,7 @@ groups: {% for instance in (((groups['hypervisor'] | default([])) + (groups['vms'] | default([]))) | difference(['vmm_init']) | sort) %} - alert: {{ instance }}_node_exporter_down expr: | - (present_over_time(up{instance="{{ instance }}"}[5m]) or on() vector(0)) == 0 + (max_over_time(up{instance="{{ instance }}"}[5m]) or on() vector(0)) == 0 for: 30s labels: severity: critical @@ -16,7 +16,7 @@ groups: rules: - alert: Postgresql_Down expr: | - (present_over_time(pg_up{instance="infra", job="postgres"}[5m]) or on() vector(0)) == 0 + (max_over_time(pg_up{instance="infra", job="postgres"}[5m]) or on() vector(0)) == 0 for: 30s labels: severity: critical diff --git a/config/services/systemd/common/alloy/config.alloy.j2 b/config/services/systemd/common/alloy/config.alloy.j2 index ab40935..9211793 100644 --- a/config/services/systemd/common/alloy/config.alloy.j2 +++ b/config/services/systemd/common/alloy/config.alloy.j2 @@ -179,6 +179,13 @@ loki.relabel "journal_logs" { target_label = "job" replacement = "systemd-journal" } + rule { + source_labels = ["__journal__systemd_unit", "__journal__systemd_user_unit", "__journal_syslog_identifier"] + separator = ";" + regex = ";;(ssh|sshd|sudo|su|login|polkitd|cron|crond)" + target_label = "job" + replacement = "$1" + } rule { source_labels = ["__journal__systemd_unit"] regex = "(.+)\\.service" @@ -197,12 +204,6 @@ loki.relabel "journal_logs" { target_label = "job" replacement = "$1.socket" } - rule { - source_labels = ["__journal_syslog_identifier"] - regex = "(.+)" - target_label = "job" - replacement = "$1" - } rule { source_labels = ["job"] regex = "user@\\d+" @@ -279,6 +280,44 @@ loki.relabel "journal_logs" { loki.process "journal_parser" { forward_to = [loki.write.loki.receiver] + stage.match { + selector = "{job=~\".+\"} |~ \"container health_status .*health_status=\"" + stage.regex { + expression = "container (?Phealth_status) (?P[^ ]+)" + } + stage.regex { + expression = "name=(?P[^,\\)]+)" + } + stage.regex { + expression = "health_status=(?P[^,\\)]+)" + } + stage.labels { + values = { + job = "container_name", + service_name = "container_name", + podman_event = "", + health_status = "", + } + } + stage.structured_metadata { + values = { + container_id = "", + } + } + stage.static_labels { + values = { + level = "info", + } + } + } + stage.match { + selector = "{podman_event=\"health_status\",health_status=\"unhealthy\"}" + stage.static_labels { + values = { + level = "error", + } + } + } stage.match { selector = "{level!=\"fatal\", job!~\"loki|prometheus|grafana\"} |~ \"(?i)(fatal|critical|panic|uncaught|unhandled|assertion failed|out of memory|\\bboom\\b|killed process)\"" stage.static_labels { diff --git a/config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2 b/config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2 index 952efea..4b82000 100644 --- a/config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2 +++ b/config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2 @@ -6,10 +6,10 @@ whitelist: # Console IP lists - "127.0.0.1" - "::1" - - "{{ hostvars['fw']['network4']['console']['client'] }}" - - "{{ hostvars['fw']['network4']['console']['wg'] }}" - - "{{ hostvars['fw']['network6']['console']['client'] }}" - - "{{ hostvars['fw']['network6']['console']['wg'] }}" + - "{{ hostvars['fw']['network']['console']['ipv4']['client'] }}" + - "{{ hostvars['fw']['network']['console']['ipv4']['wg'] }}" + - "{{ hostvars['fw']['network']['console']['ipv6']['client'] }}" + - "{{ hostvars['fw']['network']['console']['ipv6']['wg'] }}" {% if node['name'] == 'auth' %} expression: # immich thumbnail request 404 error false positive diff --git a/config/services/systemd/common/crowdsec/etc/config.yaml.j2 b/config/services/systemd/common/crowdsec/etc/config.yaml.j2 index 86d0da2..d252b08 100644 --- a/config/services/systemd/common/crowdsec/etc/config.yaml.j2 +++ b/config/services/systemd/common/crowdsec/etc/config.yaml.j2 @@ -53,8 +53,8 @@ api: trusted_ips: # IP ranges, or IPs which can have admin API access - ::1 - 127.0.0.1 - - {{ hostvars['fw']['network6']['subnet']['server'] }} - - {{ hostvars['fw']['network4']['subnet']['server'] }} + - {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }} + - {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }} tls: cert_file: /etc/crowdsec/ssl/crowdsec.crt key_file: /etc/crowdsec/ssl/crowdsec.key diff --git a/config/services/systemd/fw/bind/etc/named.conf.j2 b/config/services/systemd/fw/bind/etc/named.conf.j2 index 2ac873a..5ee25aa 100644 --- a/config/services/systemd/fw/bind/etc/named.conf.j2 +++ b/config/services/systemd/fw/bind/etc/named.conf.j2 @@ -3,8 +3,8 @@ include "/etc/bind/acme.key"; options { directory "/var/cache/bind"; - listen-on port 53 { {{ hostvars['fw']['network4']['bind']['server'] }}; }; - listen-on-v6 port 53 { {{ hostvars['fw']['network6']['bind']['server'] }}; }; + listen-on port 53 { {{ hostvars['fw']['network']['bind']['ipv4']['server'] }}; }; + listen-on-v6 port 53 { {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}; }; // Authoritative DNS setting allow-recursion { none; }; @@ -16,47 +16,39 @@ options { check-names master warn; }; -zone "ilnmors.internal." { +zone "{{ domain['internal'] }}." { type primary; - file "/var/lib/bind/db.ilnmors.internal"; + file "/var/lib/bind/db.{{ domain['internal'] }}"; notify yes; // ACME-01 challenge policy. It allows only TXT record of subdomain update. update-policy { - grant acme-key subdomain ilnmors.internal. TXT; + grant acme-key subdomain {{ domain['internal'] }}. TXT; }; }; -zone "1.168.192.in-addr.arpa" { - type primary; - file "/var/lib/bind/db.1.168.192.in-addr.arpa"; - notify yes; -}; - -zone "10.168.192.in-addr.arpa" { - type primary; - file "/var/lib/bind/db.10.168.192.in-addr.arpa"; - notify yes; -}; - -zone "0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa" { - type primary; - file "/var/lib/bind/db.1.00df.ip6.arpa"; - notify yes; -}; - -zone "0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa" { - type primary; - file "/var/lib/bind/db.10.00df.ip6.arpa"; - notify yes; -}; - -zone "ilnmors.com." { +zone "{{ domain['public'] }}." { //split horizon dns type primary; - file "/var/lib/bind/db.ilnmors.com"; + file "/var/lib/bind/db.{{ domain['public'] }}"; notify yes; }; +{% for net, zone in network['reverse_zone']['ipv4'].items() %} +zone "{{ zone }}" { + type primary; + file "/var/lib/bind/db.{{ net }}.ipv4.rev"; + notify yes; +}; +{% endfor %} + +{% for net, zone in network['reverse_zone']['ipv6'].items() %} +zone "{{ zone }}" { + type primary; + file "/var/lib/bind/db.{{ net }}.ipv6.rev"; + notify yes; +}; +{% endfor %} + logging { channel default_log { stderr; diff --git a/config/services/systemd/fw/bind/lib/db.1.00df.ip6.arpa b/config/services/systemd/fw/bind/lib/db.1.00df.ip6.arpa deleted file mode 100644 index 8d3fc55..0000000 --- a/config/services/systemd/fw/bind/lib/db.1.00df.ip6.arpa +++ /dev/null @@ -1,12 +0,0 @@ -$TTL 86400 - -@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. ( - 2026021201 ; serial - 3600 ; refresh (1 hour) - 1800 ; retry (30 minutes) - 604800 ; expire (1 week) - 86400 ; minimum (1 day) - ) - IN NS bind.ilnmors.internal. -1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR fw.ilnmors.internal. -0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR console.ilnmors.internal. diff --git a/config/services/systemd/fw/bind/lib/db.1.168.192.in-addr.arpa b/config/services/systemd/fw/bind/lib/db.1.168.192.in-addr.arpa deleted file mode 100644 index 01cf961..0000000 --- a/config/services/systemd/fw/bind/lib/db.1.168.192.in-addr.arpa +++ /dev/null @@ -1,14 +0,0 @@ -$TTL 86400 - -@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. ( - 2026021201 ; serial - 3600 ; refresh (1 hour) - 1800 ; retry (30 minutes) - 604800 ; expire (1 week) - 86400 ; minimum (1 day) - ) - IN NS bind.ilnmors.internal. -1 IN PTR fw.ilnmors.internal. -2 IN PTR switch.ilnmors.internal. -20 IN PTR console.ilnmors.internal. -101 IN PTR printer.ilnmors.internal. diff --git a/config/services/systemd/fw/bind/lib/db.10.00df.ip6.arpa b/config/services/systemd/fw/bind/lib/db.10.00df.ip6.arpa deleted file mode 100644 index f5fdc9f..0000000 --- a/config/services/systemd/fw/bind/lib/db.10.00df.ip6.arpa +++ /dev/null @@ -1,18 +0,0 @@ -$TTL 86400 - -@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. ( - 2026021201 ; serial - 3600 ; refresh (1 hour) - 1800 ; retry (30 minutes) - 604800 ; expire (1 week) - 86400 ; minimum (1 day) - ) - IN NS bind.ilnmors.internal. -1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR fw.ilnmors.internal. -2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR blocky.ilnmors.internal. -3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR bind.ilnmors.internal. -9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR bk.ilnmors.internal. -0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR vmm.ilnmors.internal. -1.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR infra.ilnmors.internal. -2.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR auth.ilnmors.internal. -3.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR app.ilnmors.internal. diff --git a/config/services/systemd/fw/bind/lib/db.10.168.192.in-addr.arpa b/config/services/systemd/fw/bind/lib/db.10.168.192.in-addr.arpa deleted file mode 100644 index fd27991..0000000 --- a/config/services/systemd/fw/bind/lib/db.10.168.192.in-addr.arpa +++ /dev/null @@ -1,18 +0,0 @@ -$TTL 86400 - -@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. ( - 2026021201 ; serial - 3600 ; refresh (1 hour) - 1800 ; retry (30 minutes) - 604800 ; expire (1 week) - 86400 ; minimum (1 day) - ) - IN NS bind.ilnmors.internal. -1 IN PTR fw.ilnmors.internal. -2 IN PTR blocky.ilnmors.internal. -3 IN PTR bind.ilnmors.internal. -9 IN PTR bk.ilnmors.internal. -10 IN PTR vmm.ilnmors.internal. -11 IN PTR infra.ilnmors.internal. -12 IN PTR auth.ilnmors.internal. -13 IN PTR app.ilnmors.internal. diff --git a/config/services/systemd/fw/bind/lib/db.ilnmors.com b/config/services/systemd/fw/bind/lib/db.ilnmors.com deleted file mode 100644 index 4fac5f3..0000000 --- a/config/services/systemd/fw/bind/lib/db.ilnmors.com +++ /dev/null @@ -1,14 +0,0 @@ -$TTL 86400 - -@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. ( - 2026021201 ; serial - 3600 ; refresh (1 hour) - 1800 ; retry (30 minutes) - 604800 ; expire (1 week) - 86400 ; minimum (1 day) - ) - IN NS bind.ilnmors.internal. -@ IN A 192.168.10.12 -@ IN AAAA fd00:10::12 -* IN A 192.168.10.12 -* IN AAAA fd00:10::12 diff --git a/config/services/systemd/fw/bind/lib/db.ilnmors.internal b/config/services/systemd/fw/bind/lib/db.ilnmors.internal deleted file mode 100644 index f0658a5..0000000 --- a/config/services/systemd/fw/bind/lib/db.ilnmors.internal +++ /dev/null @@ -1,43 +0,0 @@ -$TTL 86400 - -@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. ( - 2026021201 ; serial - 3600 ; refresh (1 hour) - 1800 ; retry (30 minutes) - 604800 ; expire (1 week) - 86400 ; minimum (1 day) - ) - IN NS bind.ilnmors.internal. -bind IN A 192.168.10.3 -bind IN AAAA fd00:10::3 -fw IN A 192.168.10.1 -fw IN AAAA fd00:10::1 -blocky IN A 192.168.10.2 -blocky IN AAAA fd00:10::2 -bk IN A 192.168.10.9 -bk IN AAAA fd00:10::9 -vmm IN A 192.168.10.10 -vmm IN AAAA fd00:10::10 -infra IN A 192.168.10.11 -infra IN AAAA fd00:10::11 -auth IN A 192.168.10.12 -auth IN AAAA fd00:10::12 -app IN A 192.168.10.13 -app IN AAAA fd00:10::13 -switch IN A 192.168.1.2 -console IN A 192.168.1.20 -console IN AAAA fd00:1::20 -printer IN A 192.168.1.101 -init.vmm IN CNAME vmm.ilnmors.internal. -ntp IN CNAME fw.ilnmors.internal. -crowdsec IN CNAME fw.ilnmors.internal. -kopia IN CNAME bk.ilnmors.internal. -ca IN CNAME infra.ilnmors.internal. -postgresql IN CNAME infra.ilnmors.internal. -ldap IN CNAME infra.ilnmors.internal. -maddy IN CNAME infra.ilnmors.internal. -prometheus IN CNAME infra.ilnmors.internal. -loki IN CNAME infra.ilnmors.internal. -grafana IN CNAME infra.ilnmors.internal. -authelia IN CNAME auth.ilnmors.internal. -*.app IN CNAME app.ilnmors.internal. diff --git a/config/services/systemd/fw/bind/lib/db.internal.j2 b/config/services/systemd/fw/bind/lib/db.internal.j2 new file mode 100644 index 0000000..a4c5504 --- /dev/null +++ b/config/services/systemd/fw/bind/lib/db.internal.j2 @@ -0,0 +1,50 @@ +$TTL 86400 + +@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. ( + {{ network['dns_serial'] }} ; serial + 3600 ; refresh (1 hour) + 1800 ; retry (30 minutes) + 604800 ; expire (1 week) + 86400 ; minimum (1 day) + ) + IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. +{% + set hosts = ( + network + | dict2items + | rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone']) + | list + ) +%} +{% + set alias_hosts = ( + network + | dict2items + | rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone']) + | selectattr('value.alias', 'defined') + | list + ) +%} +{% for item in hosts %} +{% set name = item['key'] %} +{% set host = item['value'] %} +{% if host['ipv4'] is defined %} +{% if host['ipv4']['server'] is defined %} +{{ "%-12s" | format(name) }}IN A {{ host['ipv4']['server'] }} +{% elif host['ipv4']['client'] is defined %} +{{ "%-12s" | format(name) }}IN A {{ host['ipv4']['client'] }} +{% endif %} +{% endif %} +{% if host['ipv6'] is defined %} +{% if host['ipv6']['server'] is defined %} +{{ "%-12s" | format(name) }}IN AAAA {{ host['ipv6']['server'] }} +{% elif host['ipv6']['client'] is defined %} +{{ "%-12s" | format(name) }}IN AAAA {{ host['ipv6']['client'] }} +{% endif %} +{% endif %} +{% endfor %} +{% for item in alias_hosts %} +{% for alias in item['value']['alias'] %} +{{ "%-12s" | format(alias) }}IN CNAME {{ item['key'] }}.{{ domain['internal'] }}. +{% endfor %} +{% endfor %} diff --git a/config/services/systemd/fw/bind/lib/db.ipv4.rev.j2 b/config/services/systemd/fw/bind/lib/db.ipv4.rev.j2 new file mode 100644 index 0000000..832f1a0 --- /dev/null +++ b/config/services/systemd/fw/bind/lib/db.ipv4.rev.j2 @@ -0,0 +1,25 @@ +$TTL 86400 + +@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. ( + {{ network['dns_serial'] }} ; serial + 3600 ; refresh (1 hour) + 1800 ; retry (30 minutes) + 604800 ; expire (1 week) + 86400 ; minimum (1 day) + ) + IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. + +{% set hosts = ( + network + | dict2items + | rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone']) + | list +) %} + +{% for item in hosts %} +{% set name = item['key'] %} +{% set host = item['value'] %} +{% if host['ipv4'] is defined and host['ipv4'][reverse_net] is defined and host['ipv4']['reverse'] is defined %} +{{ "%-12s" | format(host['ipv4']['reverse']) }}IN PTR {{ name }}.{{ domain['internal'] }}. +{% endif %} +{% endfor %} diff --git a/config/services/systemd/fw/bind/lib/db.ipv6.rev.j2 b/config/services/systemd/fw/bind/lib/db.ipv6.rev.j2 new file mode 100644 index 0000000..c6fd24e --- /dev/null +++ b/config/services/systemd/fw/bind/lib/db.ipv6.rev.j2 @@ -0,0 +1,24 @@ +$TTL 86400 + +@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. ( + {{ network['dns_serial'] }} ; serial + 3600 ; refresh (1 hour) + 1800 ; retry (30 minutes) + 604800 ; expire (1 week) + 86400 ; minimum (1 day) + ) + IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. + +{% set hosts = ( + network + | dict2items + | rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone']) + | list +) %} +{% for item in hosts %} +{% set name = item['key'] %} +{% set host = item['value'] %} +{% if host['ipv6'] is defined and host['ipv6'][reverse_net] is defined and host['ipv6']['reverse'] is defined %} +{{ "%-36s" | format(host['ipv6']['reverse']) }}IN PTR {{ name }}.{{ domain['internal'] }}. +{% endif %} +{% endfor %} \ No newline at end of file diff --git a/config/services/systemd/fw/bind/lib/db.public.j2 b/config/services/systemd/fw/bind/lib/db.public.j2 new file mode 100644 index 0000000..a0efa13 --- /dev/null +++ b/config/services/systemd/fw/bind/lib/db.public.j2 @@ -0,0 +1,14 @@ +$TTL 86400 + +@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. ( + {{ network['dns_serial'] }} ; serial + 3600 ; refresh (1 hour) + 1800 ; retry (30 minutes) + 604800 ; expire (1 week) + 86400 ; minimum (1 day) + ) + IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. +@ IN A {{ network['auth']['ipv4']['server'] }} +@ IN AAAA {{ network['auth']['ipv6']['server'] }} +* IN A {{ network['auth']['ipv4']['server'] }} +* IN AAAA {{ network['auth']['ipv6']['server'] }} diff --git a/config/services/systemd/fw/blocky/etc/config.yaml.j2 b/config/services/systemd/fw/blocky/etc/config.yaml.j2 index 36736a8..c47c360 100644 --- a/config/services/systemd/fw/blocky/etc/config.yaml.j2 +++ b/config/services/systemd/fw/blocky/etc/config.yaml.j2 @@ -5,14 +5,14 @@ connectIPVersion: dual ports: dns: - - "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['dns'] }}" - - "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['dns'] }}" + - "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['dns'] }}" + - "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['dns'] }}" tls: - - "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['dot'] }}" - - "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['dot'] }}" + - "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['dot'] }}" + - "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['dot'] }}" https: - - "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['https'] }}" - - "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['https'] }}" + - "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['https'] }}" + - "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['https'] }}" log: level: info @@ -31,12 +31,12 @@ upstreams: conditional: fallbackUpstream: false mapping: - {{ domain['internal'] }}: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" - {{ domain['public'] }}: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" - 1.168.192.in-addr.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" - 10.168.192.in-addr.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" - 0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" - 0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" + {{ domain['internal'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}" + {{ domain['public'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}" + {{ network['reverse_zone']['ipv4']['client'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}" + {{ network['reverse_zone']['ipv4']['server'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}" + {{ network['reverse_zone']['ipv6']['client'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}" + {{ network['reverse_zone']['ipv6']['server'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}" vpn.{{ domain['public'] }}: "tcp-tls:1.1.1.1:853, tcp-tls:1.0.0.1:853, tcp-tls:[2606:4700:4700::1111]:853, tcp-tls:[2606:4700:4700::1001]:853" blocking: diff --git a/config/services/systemd/fw/chrony/local-acl.conf.j2 b/config/services/systemd/fw/chrony/local-acl.conf.j2 index 0db83b8..044fa93 100644 --- a/config/services/systemd/fw/chrony/local-acl.conf.j2 +++ b/config/services/systemd/fw/chrony/local-acl.conf.j2 @@ -1,9 +1,9 @@ # 1. Access Control (IPv4) -allow {{ hostvars['fw']['network4']['subnet']['client'] }} -allow {{ hostvars['fw']['network4']['subnet']['server'] }} -allow {{ hostvars['fw']['network4']['subnet']['wg'] }} +allow {{ hostvars['fw']['network']['subnet']['ipv4']['client'] }} +allow {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }} +allow {{ hostvars['fw']['network']['subnet']['ipv4']['wg'] }} # 2. Access Control (IPv6) -allow {{ hostvars['fw']['network6']['subnet']['client'] }} -allow {{ hostvars['fw']['network6']['subnet']['server'] }} -allow {{ hostvars['fw']['network6']['subnet']['wg'] }} +allow {{ hostvars['fw']['network']['subnet']['ipv6']['client'] }} +allow {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }} +allow {{ hostvars['fw']['network']['subnet']['ipv6']['wg'] }} diff --git a/config/services/systemd/fw/kea/kea-dhcp4.conf.j2 b/config/services/systemd/fw/kea/kea-dhcp4.conf.j2 index 04f1acf..1d41b0e 100644 --- a/config/services/systemd/fw/kea/kea-dhcp4.conf.j2 +++ b/config/services/systemd/fw/kea/kea-dhcp4.conf.j2 @@ -2,7 +2,7 @@ "Dhcp4": { "subnet4": [ { - "subnet": "{{ hostvars['fw']['network4']['subnet']['client'] }}", + "subnet": "{{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}", "pools" : [ { "pool": "192.168.1.254-192.168.1.254" @@ -11,11 +11,11 @@ "option-data": [ { "name": "routers", - "data": "{{ hostvars['fw']['network4']['firewall']['client'] }}" + "data": "{{ hostvars['fw']['network']['fw']['ipv4']['client'] }}" }, { "name": "domain-name-servers", - "data": "{{ hostvars['fw']['network4']['blocky']['server'] }}" + "data": "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}" }, { "name": "domain-name", @@ -25,17 +25,17 @@ "reservations": [ { "hw-address": "58:04:4f:18:6c:5e", - "ip-address": "{{ hostvars['fw']['network4']['switch']['client'] }}", + "ip-address": "{{ hostvars['fw']['network']['switch']['ipv4']['client'] }}", "hostname": "switch" }, { "hw-address": "d8:e2:df:ff:1b:d5", - "ip-address": "{{ hostvars['fw']['network4']['console']['client'] }}", + "ip-address": "{{ hostvars['fw']['network']['console']['ipv4']['client'] }}", "hostname": "console" }, { "hw-address": "38:ca:84:94:5e:06", - "ip-address": "{{ hostvars['fw']['network4']['printer']['client'] }}", + "ip-address": "{{ hostvars['fw']['network']['printer']['ipv4']['client'] }}", "hostname": "printer" } ], @@ -43,7 +43,7 @@ "interface": "client" }, { - "subnet": "{{ hostvars['fw']['network4']['subnet']['user'] }}", + "subnet": "{{ hostvars['fw']['network']['subnet']['ipv4']['user'] }}", "pools" : [ { "pool": "192.168.20.2-192.168.20.254" @@ -52,11 +52,11 @@ "option-data": [ { "name": "routers", - "data": "{{ hostvars['fw']['network4']['firewall']['user'] }}" + "data": "{{ hostvars['fw']['network']['fw']['ipv4']['user'] }}" }, { "name": "domain-name-servers", - "data": "{{ hostvars['fw']['network4']['blocky']['server'] }}" + "data": "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}" }, { "name": "domain-name",