il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(dns): set source of dns domain on fw.yaml

Browse Source
This commit is contained in:
il
2026-06-29 11:46:53 +09:00
parent 5ccb60bd2a
commit 88e85fff56
43 changed files with 606 additions and 406 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/inventory/group_vars/all.yaml
+1 -1
View File
@@ -301,7 +301,7 @@ version:
redis: "8.8.0" redis: "8.8.0"
immich: "v2.7.5" immich: "v2.7.5"
paperless: "2.20.15" paperless: "2.20.15"
nextcloud: "34.0.1" nextcloud: "34.0.0"
collabora: "26.04.1.4.1" collabora: "26.04.1.4.1"
sure: "0.7.1-hotfix.1" sure: "0.7.1-hotfix.1"
outline: "1.8.1" outline: "1.8.1"
ansible/inventory/host_vars/fw.yaml
+109 -54
View File
@@ -28,71 +28,126 @@ vm:
lan_group: "vlan-trunk" lan_group: "vlan-trunk"
# Network Factors # Network Factors
# LLA is like MAC address for L3 (Network layer). Usually, subnet is used to separate network. network:
network4: dns_serial: "{{ now().strftime('%Y%m%d') }}00"
subnet: subnet:
client: "192.168.1.0/24" ipv4:
server: "192.168.10.0/24" client: "192.168.1.0/24"
user: "192.168.20.0/24" server: "192.168.10.0/24"
wg: "192.168.99.0/24" user: "192.168.20.0/24"
lla: "169.254.0.0/16" wg: "192.168.99.0/24"
# You can use "{{ hostvars['fw']['network4']['firewall'].values() | join(', ') }}" for all lla: "169.254.0.0/16"
firewall: ipv6:
client: "192.168.1.1" client: "fd00:1::/64"
server: "192.168.10.1" server: "fd00:10::/64"
user: "192.168.20.1" wg: "fd00:99::/64"
wg: "192.168.99.1" lla: "fe80::/10"
reverse_zone:
ipv4:
client: "1.168.192.in-addr.arpa"
server: "10.168.192.in-addr.arpa"
ipv6:
client: "0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa"
server: "0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa"
fw:
ipv4:
client: "192.168.1.1"
server: "192.168.10.1"
user: "192.168.20.1"
wg: "192.168.99.1"
reverse: "1"
ipv6:
client: "fd00:1::1"
server: "fd00:10::1"
wg: "fd00:99::1"
reverse: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "ntp"
- "crowdsec"
blocky: blocky:
server: "192.168.10.2" ipv4:
server: "192.168.10.2"
reverse: "2"
ipv6:
server: "fd00:10::2"
reverse: "2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
bind: bind:
server: "192.168.10.3" ipv4:
server: "192.168.10.3"
reverse: "3"
ipv6:
server: "fd00:10::3"
reverse: "3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
console: console:
client: "192.168.1.20" ipv4:
wg: "192.168.99.20" client: "192.168.1.20"
wg: "192.168.99.20"
reverse: "20"
ipv6:
client: "fd00:1::20"
wg: "fd00:99::20"
reverse: "0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
vmm: vmm:
client: "192.168.1.10" ipv4:
server: "192.168.10.10" client: "192.168.1.10"
server: "192.168.10.10"
reverse: "10"
ipv6:
client: "fd00:1::10"
server: "fd00:10::10"
reverse: "0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "init.vmm"
bk: bk:
server: "192.168.10.9" ipv4:
server: "192.168.10.9"
reverse: "9"
ipv6:
server: "fd00:10::9"
reverse: "9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "kopia"
infra: infra:
server: "192.168.10.11" ipv4:
server: "192.168.10.11"
reverse: "11"
ipv6:
server: "fd00:10::11"
reverse: "1.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "ca"
- "postgresql"
- "ldap"
- "maddy"
- "prometheus"
- "loki"
- "grafana"
auth: auth:
server: "192.168.10.12" ipv4:
server: "192.168.10.12"
reverse: "12"
ipv6:
server: "fd00:10::12"
reverse: "2.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "authelia"
app: app:
server: "192.168.10.13" ipv4:
server: "192.168.10.13"
reverse: "13"
ipv6:
server: "fd00:10::13"
reverse: "3.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0"
alias:
- "*.app"
switch: switch:
client: "192.168.1.2" ipv4:
client: "192.168.1.2"
reverse: "2"
printer: printer:
client: "192.168.1.101" ipv4:
client: "192.168.1.101"
network6: reverse: "101"
subnet:
client: "fd00:1::/64"
server: "fd00:10::/64"
wg: "fd00:99::/64"
lla: "fe80::/10"
firewall:
client: "fd00:1::1"
server: "fd00:10::1"
wg: "fd00:99::1"
blocky:
server: "fd00:10::2"
bind:
server: "fd00:10::3"
console:
client: "fd00:1::20"
wg: "fd00:99::20"
vmm:
client: "fd00:1::10"
server: "fd00:10::10"
bk:
server: "fd00:10::9"
infra:
server: "fd00:10::11"
auth:
server: "fd00:10::12"
app:
server: "fd00:10::13"
# Suricata Factors # Suricata Factors
# suricata_home_net: '[10.0.0.0/8,172.16.0.0/12,192.168.0.0/16]' # suricata_home_net: '[10.0.0.0/8,172.16.0.0/12,192.168.0.0/16]'
ansible/roles/common/tasks/services/set_crowdsec.yaml
+6
View File
@@ -184,6 +184,12 @@
- name: Set crowdsec bouncer - name: Set crowdsec bouncer
when: node['name'] in acquisd_list when: node['name'] in acquisd_list
block: block:
- name: Update and upgrade crowdsec hub
ansible.builtin.shell: |
cscli hub update && cscli hub upgrade
become: true
changed_when: false
- name: Install crowdsec collection - name: Install crowdsec collection
ansible.builtin.command: | ansible.builtin.command: |
cscli collections install {{ item }} cscli collections install {{ item }}
ansible/roles/fw/tasks/services/set_bind.yaml
+49 -18
View File
@@ -8,16 +8,6 @@
register: "is_bind_installed" register: "is_bind_installed"
ignore_errors: true ignore_errors: true
- name: Set bind9 zone files
ansible.builtin.set_fact:
bind_zone_files:
- "db.ilnmors.internal"
- "db.ilnmors.com"
- "db.1.168.192.in-addr.arpa"
- "db.10.168.192.in-addr.arpa"
- "db.1.00df.ip6.arpa"
- "db.10.00df.ip6.arpa"
- name: Install bind9 - name: Install bind9
ansible.builtin.apt: ansible.builtin.apt:
name: "bind9" name: "bind9"
@@ -36,23 +26,64 @@
notify: "notification_restart_bind" notify: "notification_restart_bind"
no_log: true no_log: true
- name: Deploy db files - name: Deploy forward zone files
ansible.builtin.copy: ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/{{ item }}" src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/{{ item.src }}.j2"
dest: "/var/lib/bind/{{ item }}" dest: "/var/lib/bind/{{ item.dest }}"
owner: "bind" owner: "bind"
group: "bind" group: "bind"
mode: "0640" mode: "0640"
loop: "{{ bind_zone_files }}" loop:
- src: "db.public"
dest: "db.{{ domain['public'] }}"
- src: "db.internal"
dest: "db.{{ domain['internal'] }}"
become: true become: true
notify: "notification_restart_bind" notify: "notification_restart_bind"
no_log: true no_log: true
- name: Deploy IPv4 reverse zone files
vars:
reverse_net: "{{ item.key }}"
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/db.ipv4.rev.j2"
dest: "/var/lib/bind/db.{{ item.key }}.ipv4.rev"
owner: bind
group: bind
mode: "0644"
loop: "{{ network['reverse_zone']['ipv4'] | dict2items }}"
become: true
notify: "notification_restart_bind"
no_log: true
- name: Deploy IPv6 reverse zones
vars:
reverse_net: "{{ item.key }}"
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/bind/lib/db.ipv6.rev.j2"
dest: "/var/lib/bind/db.{{ item.key }}.ipv6.rev"
owner: bind
group: bind
mode: "0644"
loop: "{{ network['reverse_zone']['ipv6'] | dict2items }}"
become: true
notify: "notification_restart_bind"
no_log: true
- name: Find BIND journal files
ansible.builtin.find:
paths: "/var/lib/bind"
patterns: "*.jnl"
file_type: file
become: true
register: bind_journal_files
no_log: true
- name: Clean BIND journal files - name: Clean BIND journal files
ansible.builtin.file: ansible.builtin.file:
path: "/var/lib/bind/{{ item }}.jnl" path: "{{ item.path }}"
state: absent state: absent
loop: "{{ bind_zone_files }}" loop: "{{ bind_journal_files.files }}"
become: true become: true
notify: "notification_restart_bind" notify: "notification_restart_bind"
no_log: true no_log: true
@@ -67,7 +98,7 @@
validate: "/usr/bin/named-checkconf -z %s" validate: "/usr/bin/named-checkconf -z %s"
become: true become: true
notify: "notification_restart_bind" notify: "notification_restart_bind"
no_log: true
- name: Create named.service.d - name: Create named.service.d
ansible.builtin.file: ansible.builtin.file:
ansible/roles/infra/tasks/services/set_loki.yaml
+13
View File
@@ -9,6 +9,8 @@
loop: loop:
- "loki" - "loki"
- "loki/etc" - "loki/etc"
- "loki/etc/rules"
- "loki/etc/rules/{{ domain['internal'] }}"
- "loki/data" - "loki/data"
- "loki/ssl" - "loki/ssl"
become: true become: true
@@ -24,6 +26,17 @@
notify: "notification_restart_loki" notify: "notification_restart_loki"
no_log: true no_log: true
- name: Deploy loki rules file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/etc/rules.yaml.j2"
dest: "{{ node['home_path'] }}/containers/loki/etc/rules/{{ domain['internal'] }}/rules.yaml"
owner: "{{ services['loki']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0600"
become: true
notify: "notification_restart_loki"
no_log: true
- name: Deploy loki certificate and key - name: Deploy loki certificate and key
ansible.builtin.copy: ansible.builtin.copy:
content: | content: |
ansible/roles/infra/tasks/services/set_postgresql.yaml
+1
View File
@@ -182,6 +182,7 @@
mode: "0644" mode: "0644"
owner: "{{ ansible_user }}" owner: "{{ ansible_user }}"
group: "{{ node['group'] }}" group: "{{ node['group'] }}"
when: not is_postgresql_init_marker.stat.exists
- name: Check container archive images - name: Check container archive images
ansible.builtin.stat: ansible.builtin.stat:
config/node/app/nftables.conf.j2
+6 -6
View File
@@ -1,12 +1,12 @@
#!/usr/sbin/nft -f #!/usr/sbin/nft -f
flush ruleset flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }} define HOSTS4_AUTH = {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }} define HOSTS6_AUTH = {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
define PORTS_SSH = 22 define PORTS_SSH = 22
define PORTS_HTTP = 80 define PORTS_HTTP = 80
define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }} define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
config/node/auth/nftables.conf.j2
+4 -4
View File
@@ -1,10 +1,10 @@
#!/usr/sbin/nft -f #!/usr/sbin/nft -f
flush ruleset flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22 define PORTS_SSH = 22
define PORTS_HTTP = 80 define PORTS_HTTP = 80
define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }} define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
config/node/bk/nftables.conf.j2
+8 -8
View File
@@ -1,14 +1,14 @@
#!/usr/sbin/nft -f #!/usr/sbin/nft -f
flush ruleset flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }} define HOSTS4_INFRA = {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network6']['infra']['server'] }} define HOSTS6_INFRA = {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }} define HOSTS4_APP = {{ hostvars['fw']['network']['app']['ipv4']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network6']['app']['server'] }} define HOSTS6_APP = {{ hostvars['fw']['network']['app']['ipv6']['server'] }}
define PORTS_SSH = 22 define PORTS_SSH = 22
define PORTS_HTTPS = 443 define PORTS_HTTPS = 443
define PORTS_KOPIA = {{ services['kopia']['ports']['https'] }} define PORTS_KOPIA = {{ services['kopia']['ports']['https'] }}
config/node/common/hosts.j2
+34 -36
View File
@@ -1,36 +1,34 @@
# localhost # Managed by Ansible
127.0.0.1 {{ node['local_san'] }} # Bootstrap name resolution only.
::1 {{ node['local_san'] }} # Full service discovery is handled by BIND.
{% if node['name'] == 'console' %}
# Hosts IPv4 127.0.0.1 localhost
{{ hostvars['fw']['network4']['firewall']['server'] }} fw.{{ domain['internal'] }} ::1 localhost
{{ hostvars['fw']['network4']['bk']['server'] }} bk.{{ domain['internal'] }} kopia.{{ domain['internal'] }}
{{ hostvars['fw']['network4']['vmm']['client'] }} init.vmm.{{ domain['internal'] }} {% set net = hostvars['fw']['network'] %}
{{ hostvars['fw']['network4']['vmm']['server'] }} vmm.{{ domain['internal'] }} {%
{{ hostvars['fw']['network4']['infra']['server'] }} infra.{{ domain['internal'] }} set server_hosts = (
{{ hostvars['fw']['network4']['auth']['server'] }} auth.{{ domain['internal'] }} net
{{ hostvars['fw']['network4']['app']['server'] }} app.{{ domain['internal'] }} | dict2items
# Hosts IPv6 | rejectattr('key', 'equalto', 'dns_serial')
{{ hostvars['fw']['network6']['firewall']['server'] }} fw.{{ domain['internal'] }} | rejectattr('key', 'equalto', 'subnet')
{{ hostvars['fw']['network6']['bk']['server'] }} bk.{{ domain['internal'] }} kopia.{{ domain['internal'] }} | rejectattr('key', 'equalto', 'reverse_zone')
{{ hostvars['fw']['network6']['vmm']['client'] }} init.vmm.{{ domain['internal'] }} | selectattr('value.ipv4.server', 'defined')
{{ hostvars['fw']['network6']['vmm']['server'] }} vmm.{{ domain['internal'] }} | selectattr('value.ipv6.server', 'defined')
{{ hostvars['fw']['network6']['infra']['server'] }} infra.{{ domain['internal'] }} | map(attribute='key')
{{ hostvars['fw']['network6']['auth']['server'] }} auth.{{ domain['internal'] }} | list
{{ hostvars['fw']['network6']['app']['server'] }} app.{{ domain['internal'] }} )
{% else %} %}
# IPv4 # node canonical names
# Crowdsec, blocky, bind(fw) {% for ip in ['ipv4', 'ipv6'] %}
{{ hostvars['fw']['network4']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }} # {{ ip }}
{{ hostvars['fw']['network4']['blocky']['server'] }} blocky.{{ domain['internal'] }} ## vmm init
{{ hostvars['fw']['network4']['bind']['server'] }} bind.{{ domain['internal'] }} {{ "%-36s" | format(net['vmm'][ip]['client']) }} init.vmm init.vmm.{{ domain['internal'] }}
# DB, LDAP, CA, Prometheus, Loki, mail (infra) ## console
{{ hostvars['fw']['network4']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }} {{ "%-36s" | format(net['console'][ip]['client']) }} console console.{{ domain['internal'] }}
# IPv6 ## nodes
# Crowdsec, blocky, bind(fw) {% for service in server_hosts %}
{{ hostvars['fw']['network6']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }} {{ "%-36s" | format(net[service][ip]['server']) }} {{ service }} {{ service }}.{{ domain['internal'] }}{% for alias in net[service]['alias'] | default([]) %}{% if service in ['vmm', 'fw'] and alias != 'init.vmm' %} {{ alias }}.{{ domain['internal'] }}{% endif %}{% endfor %}{{ '' }}
{{ hostvars['fw']['network6']['blocky']['server'] }} blocky.{{ domain['internal'] }} {% endfor %}
{{ hostvars['fw']['network6']['bind']['server'] }} bind.{{ domain['internal'] }}
# DB, LDAP, CA, Prometheus, Loki, mail (infra) {% endfor %}
{{ hostvars['fw']['network6']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
{% endif %}
config/node/common/networkd/20-eth0.network
+6 -6
View File
@@ -3,11 +3,11 @@ Name=eth0
[Network] [Network]
# IPv4 # IPv4
Address={{ hostvars['fw']['network4'][target_vm]['server'] }}/24 Address={{ hostvars['fw']['network'][target_vm]['ipv4']['server'] }}/24
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }} Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
DNS={{ hostvars['fw']['network4']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6 # IPv6
IPv6AcceptRA=false IPv6AcceptRA=false
Address={{ hostvars['fw']['network6'][target_vm]['server'] }}/64 Address={{ hostvars['fw']['network'][target_vm]['ipv6']['server'] }}/64
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }} Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
DNS={{ hostvars['fw']['network6']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/networkd/21-fw-client.network
+4 -4
View File
@@ -9,8 +9,8 @@ IPv6AcceptRA=false
VLAN=server VLAN=server
VLAN=user VLAN=user
# IPv4 # IPv4
Address={{ hostvars['fw']['network4']['firewall']['client'] }}/24 Address={{ hostvars['fw']['network']['fw']['ipv4']['client'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6 # IPv6
Address={{ hostvars['fw']['network6']['firewall']['client'] }}/64 Address={{ hostvars['fw']['network']['fw']['ipv6']['client'] }}/64
DNS={{ hostvars['fw']['network6']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/networkd/22-fw-server.network
+8 -8
View File
@@ -6,19 +6,19 @@ IPForward=true
IPv6SendRA=false IPv6SendRA=false
IPv6AcceptRA=false IPv6AcceptRA=false
# IPv4 # IPv4
Address={{ hostvars['fw']['network4']['firewall']['server'] }}/24 Address={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6 # IPv6
Address={{ hostvars['fw']['network6']['firewall']['server'] }}/64 Address={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}/64
DNS={{ hostvars['fw']['network6']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
[Address] [Address]
Address={{ hostvars['fw']['network4']['blocky']['server'] }}/24 Address={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}/24
[Address] [Address]
Address={{ hostvars['fw']['network4']['bind']['server'] }}/24 Address={{ hostvars['fw']['network']['bind']['ipv4']['server'] }}/24
[Address] [Address]
Address={{ hostvars['fw']['network6']['blocky']['server'] }}/64 Address={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}/64
PreferredLifetime=0 PreferredLifetime=0
[Address] [Address]
Address={{ hostvars['fw']['network6']['bind']['server'] }}/64 Address={{ hostvars['fw']['network']['bind']['ipv6']['server'] }}/64
PreferredLifetime=0 PreferredLifetime=0
config/node/fw/networkd/23-fw-user.network
+3 -3
View File
@@ -7,8 +7,8 @@ IPv6PrefixDelegation=true
IPv6SendRA=true IPv6SendRA=true
IPv6SendRAExtension=false IPv6SendRAExtension=false
# IPv4 # IPv4
Address={{ hostvars['fw']['network4']['firewall']['user'] }}/24 Address={{ hostvars['fw']['network']['fw']['ipv4']['user'] }}/24
DNS={{ hostvars['fw']['network4']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
[IPv6PrefixDelegation] [IPv6PrefixDelegation]
SubnetId=20 SubnetId=20
@@ -22,4 +22,4 @@ Managed=false
# O-Flag: Other information form DHCPv6 # O-Flag: Other information form DHCPv6
OtherInformation=false OtherInformation=false
EmitDNS=true EmitDNS=true
DNS={{ hostvars['fw']['network6']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
config/node/fw/nftables.conf.j2
+29 -29
View File
@@ -9,39 +9,39 @@ define IF_SERVER = "server"
define IF_USER = "user" define IF_USER = "user"
define IF_WG = "wg0" define IF_WG = "wg0"
define NET4_CLIENT = {{ hostvars['fw']['network4']['subnet']['client'] }} define NET4_CLIENT = {{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET4_USER = {{ hostvars['fw']['network4']['subnet']['user'] }} define NET4_USER = {{ hostvars['fw']['network']['subnet']['ipv4']['user'] }}
define NET4_WG = {{ hostvars['fw']['network4']['subnet']['wg'] }} define NET4_WG = {{ hostvars['fw']['network']['subnet']['ipv4']['wg'] }}
define NET4_LLA = {{ hostvars['fw']['network4']['subnet']['lla'] }} define NET4_LLA = {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }}
define NET4_RFC1918 = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } define NET4_RFC1918 = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }
define NET6_CLIENT = {{ hostvars['fw']['network6']['subnet']['client'] }} define NET6_CLIENT = {{ hostvars['fw']['network']['subnet']['ipv6']['client'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define NET6_WG = {{ hostvars['fw']['network6']['subnet']['wg'] }} define NET6_WG = {{ hostvars['fw']['network']['subnet']['ipv6']['wg'] }}
define NET6_LLA = {{ hostvars['fw']['network6']['subnet']['lla'] }} define NET6_LLA = {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }}
define HOSTS4_FW = { {{ hostvars['fw']['network4']['firewall'].values() | join(', ') }} } define HOSTS4_FW = { {{ hostvars['fw']['network']['fw']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_BLOCKY = {{ hostvars['fw']['network4']['blocky']['server'] }} define HOSTS4_BLOCKY = {{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
define HOSTS4_BIND = {{ hostvars['fw']['network4']['bind']['server'] }} define HOSTS4_BIND = {{ hostvars['fw']['network']['bind']['ipv4']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_VMM = { {{ hostvars['fw']['network4']['vmm'].values() | join(', ') }} } define HOSTS4_VMM = { {{ hostvars['fw']['network']['vmm']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS4_BK = {{ hostvars['fw']['network4']['bk']['server'] }} define HOSTS4_BK = {{ hostvars['fw']['network']['bk']['ipv4']['server'] }}
define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }} define HOSTS4_INFRA = {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}
define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }} define HOSTS4_AUTH = {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}
define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }} define HOSTS4_APP = {{ hostvars['fw']['network']['app']['ipv4']['server'] }}
define HOSTS4_SWITCH = {{ hostvars['fw']['network4']['switch']['client'] }} define HOSTS4_SWITCH = {{ hostvars['fw']['network']['switch']['ipv4']['client'] }}
define HOSTS4_PRINTER = {{ hostvars['fw']['network4']['printer']['client'] }} define HOSTS4_PRINTER = {{ hostvars['fw']['network']['printer']['ipv4']['client'] }}
define HOSTS6_FW = { {{ hostvars['fw']['network6']['firewall'].values() | join(', ') }} } define HOSTS6_FW = { {{ hostvars['fw']['network']['fw']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_BLOCKY = {{ hostvars['fw']['network6']['blocky']['server'] }} define HOSTS6_BLOCKY = {{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
define HOSTS6_BIND = {{ hostvars['fw']['network6']['bind']['server'] }} define HOSTS6_BIND = {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_VMM = { {{ hostvars['fw']['network6']['vmm'].values() | join(', ') }} } define HOSTS6_VMM = { {{ hostvars['fw']['network']['vmm']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_BK = {{ hostvars['fw']['network6']['bk']['server'] }} define HOSTS6_BK = {{ hostvars['fw']['network']['bk']['ipv6']['server'] }}
define HOSTS6_INFRA = {{ hostvars['fw']['network6']['infra']['server'] }} define HOSTS6_INFRA = {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}
define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }} define HOSTS6_AUTH = {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
define HOSTS6_APP = {{ hostvars['fw']['network6']['app']['server'] }} define HOSTS6_APP = {{ hostvars['fw']['network']['app']['ipv6']['server'] }}
define PORTS_SSH = 22 define PORTS_SSH = 22
define PORTS_WEB = { 80, 443 } define PORTS_WEB = { 80, 443 }
config/node/fw/wireguard/30-fw-wg0.netdev
+1 -1
View File
@@ -7,4 +7,4 @@ PrivateKey={{ hostvars['console']['wireguard']['server']['private_key'] }}
[WireGuardPeer] [WireGuardPeer]
PublicKey={{ hostvars['console']['wireguard']['console']['public_key'] }} PublicKey={{ hostvars['console']['wireguard']['console']['public_key'] }}
PresharedKey={{ hostvars['console']['wireguard']['console']['preshared_key'] }} PresharedKey={{ hostvars['console']['wireguard']['console']['preshared_key'] }}
AllowedIPs={{ hostvars['fw']["network4"]["console"]["wg"] }}/32, {{ hostvars['fw']["network6"]["console"]["wg"] }}/128 AllowedIPs={{ hostvars['fw']["network"]["console"]['ipv4']["wg"] }}/32, {{ hostvars['fw']["network"]["console"]['ipv6']["wg"] }}/128
config/node/fw/wireguard/31-fw-wg0.network
+2 -2
View File
@@ -1,6 +1,6 @@
[Match] [Match]
Name=wg0 Name=wg0
[Network] [Network]
Address={{ hostvars['fw']["network4"]["firewall"]["wg"] }}/24 Address={{ hostvars['fw']["network"]["fw"]['ipv4']["wg"] }}/24
Address={{ hostvars['fw']["network6"]["firewall"]["wg"] }}/64 Address={{ hostvars['fw']["network"]["fw"]['ipv6']["wg"] }}/64
IPForward=yes IPForward=yes
config/node/infra/nftables.conf.j2
+4 -4
View File
@@ -3,10 +3,10 @@
# iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something # iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something
flush ruleset flush ruleset
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }} define NET4_SERVER = {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }} define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22 define PORTS_SSH = 22
define PORTS_DB = 5432 define PORTS_DB = 5432
define PORTS_CA = {{ services['ca']['ports']['https'] }} define PORTS_CA = {{ services['ca']['ports']['https'] }}
config/node/vmm/networkd/24-vmm-vlan1.network.j2
+6 -6
View File
@@ -3,26 +3,26 @@ Name=vlan1
[Network] [Network]
# IPv4 # IPv4
Address={{ hostvars['fw']['network4']['vmm']['client'] }}/24 Address={{ hostvars['fw']['network']['vmm']['ipv4']['client'] }}/24
# IPv6 # IPv6
Address={{ hostvars['fw']['network6']['vmm']['client'] }}/64 Address={{ hostvars['fw']['network']['vmm']['ipv6']['client'] }}/64
[RoutingPolicyRule] [RoutingPolicyRule]
From={{ hostvars['fw']['network4']['vmm']['client'] }}/32 From={{ hostvars['fw']['network']['vmm']['ipv4']['client'] }}/32
Table=1 Table=1
Priority=100 Priority=100
[Route] [Route]
Destination={{ hostvars['fw']['network4']['subnet']['client'] }} Destination={{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}
Scope=link Scope=link
Table=1 Table=1
[RoutingPolicyRule] [RoutingPolicyRule]
From={{ hostvars['fw']['network6']['vmm']['client'] }}/128 From={{ hostvars['fw']['network']['vmm']['ipv6']['client'] }}/128
Table=61 Table=61
Priority=100 Priority=100
[Route] [Route]
Destination={{ hostvars['fw']['network6']['subnet']['client'] }} Destination={{ hostvars['fw']['network']['subnet']['ipv6']['client'] }}
Scope=link Scope=link
Table=61 Table=61
config/node/vmm/networkd/25-vmm-vlan10.network.j2
+10 -10
View File
@@ -3,30 +3,30 @@ Name=vlan10
[Network] [Network]
RequiredForOnline=false RequiredForOnline=false
# IPv4 # IPv4
Address={{ hostvars['fw']['network4']['vmm']['server'] }}/24 Address={{ hostvars['fw']['network']['vmm']['ipv4']['server'] }}/24
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }} Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
DNS={{ hostvars['fw']['network4']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}
# IPv6 # IPv6
Address={{ hostvars['fw']['network6']['vmm']['server'] }}/64 Address={{ hostvars['fw']['network']['vmm']['ipv6']['server'] }}/64
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }} Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
DNS={{ hostvars['fw']['network6']['blocky']['server'] }} DNS={{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}
[RoutingPolicyRule] [RoutingPolicyRule]
From={{ hostvars['fw']['network4']['vmm']['server'] }}/32 From={{ hostvars['fw']['network']['vmm']['ipv4']['server'] }}/32
Table=2 Table=2
Priority=100 Priority=100
[Route] [Route]
Destination=0.0.0.0/0 Destination=0.0.0.0/0
Gateway={{ hostvars['fw']['network4']['firewall']['server'] }} Gateway={{ hostvars['fw']['network']['fw']['ipv4']['server'] }}
Table=2 Table=2
[RoutingPolicyRule] [RoutingPolicyRule]
From={{ hostvars['fw']['network6']['vmm']['server'] }}/128 From={{ hostvars['fw']['network']['vmm']['ipv6']['server'] }}/128
Table=62 Table=62
Priority=100 Priority=100
[Route] [Route]
Destination=::/0 Destination=::/0
Gateway={{ hostvars['fw']['network6']['firewall']['server'] }} Gateway={{ hostvars['fw']['network']['fw']['ipv6']['server'] }}
Table=62 Table=62
config/node/vmm/nftables.conf.j2
+2 -2
View File
@@ -3,8 +3,8 @@
# iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something # iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something
flush ruleset flush ruleset
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} } define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} } define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22 define PORTS_SSH = 22
table inet filter { table inet filter {
config/services/containers/common/caddy/etc/Caddyfile.j2
+1 -1
View File
@@ -24,7 +24,7 @@
{ {
servers { servers {
# Only accept packets from auth main caddy # Only accept packets from auth main caddy
trusted_proxies static {{ hostvars['fw']['network4']['auth']['server'] }} {{ hostvars['fw']['network6']['auth']['server'] }} trusted_proxies static {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
} }
} }
{% endif %} {% endif %}
config/services/containers/infra/loki/etc/loki.yaml.j2
+8
View File
@@ -11,6 +11,14 @@ server:
# bind_addr: ['::'] # bind_addr: ['::']
# bind_port: 7946 # bind_port: 7946
ruler:
enable_api: true
rule_path: /loki/rules
storage:
type: local
local:
directory: /etc/loki/rules
schema_config: schema_config:
configs: configs:
- from: "2023-01-01" - from: "2023-01-01"
config/services/containers/infra/loki/etc/rules.yaml.j2
+63
View File
@@ -0,0 +1,63 @@
groups:
- name: backup_logs
interval: 1m
rules:
- alert: KopiaBackupFailure
expr: |
sum by (instance, job, service_name) (
count_over_time({job="kopia-backup", level=~"error|fatal"}[20m])
) > 0
for: 1m
labels:
severity: critical
source: loki
category: backup
service: kopia
annotations:
summary: {% raw %}"Kopia backup failed on {{ $labels.instance }}"{% endraw %}{{ '' }}
description: "kopia-backup emitted error/fatal logs."
- alert: RcloneBackupFailure
expr: |
sum by (instance, job, service_name) (
count_over_time({job="rclone", level=~"error|fatal"}[20m])
) > 0
for: 1m
labels:
severity: critical
source: loki
category: backup
service: rclone
annotations:
summary: {% raw %}"rclone backup failed on {{ $labels.instance }}"{% endraw %}{{ '' }}
description: "rclone emitted error/fatal logs."
- name: caddy_logs
interval: 1m
rules:
- alert: Caddy5xxBurst
expr: |
sum by (instance, host) (
count_over_time({job="caddy_access", status=~"5.."}[5m])
) > 5
for: 2m
labels:
severity: warning
source: loki
category: http
service: caddy
annotations:
summary: {% raw %}"Caddy 5xx burst on {{ $labels.host }}"{% endraw %}{{ '' }}
description: {% raw %}"Caddy returned more than 5 server errors in 5 minutes on {{ $labels.instance }}."{% endraw %}{{ '' }}
- alert: CaddyRateLimitBurst
expr: |
sum by (instance, host) (
count_over_time({job="caddy_access", status="429"}[10m])
) > 20
for: 2m
labels:
severity: warning
source: loki
category: http
service: caddy
annotations:
summary: {% raw %}"Caddy 429 burst on {{ $labels.host }}"{% endraw %}{{ '' }}
description: "Caddy returned more than 20 rate-limit responses in 10 minutes."
config/services/containers/infra/postgresql/config/pg_hba.conf.j2
+12 -12
View File
@@ -4,25 +4,25 @@
local all all trust local all all trust
# Local monitoring connection (host - infra VM) `trust` # Local monitoring connection (host - infra VM) `trust`
hostssl postgres alloy {{ hostvars['fw']['network4']['infra']['server'] }}/32 trust hostssl postgres alloy {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}/32 trust
hostssl postgres alloy {{ hostvars['fw']['network6']['infra']['server'] }}/128 trust hostssl postgres alloy {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}/128 trust
hostssl postgres alloy {{ hostvars['fw']['network4']['subnet']['lla'] }} trust hostssl postgres alloy {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }} trust
hostssl postgres alloy {{ hostvars['fw']['network6']['subnet']['lla'] }} trust hostssl postgres alloy {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }} trust
# Local connection (in postgresql container) needs password (127.0.0.1 - container loopback) # Local connection (in postgresql container) needs password (127.0.0.1 - container loopback)
host all all 127.0.0.1/32 scram-sha-256 host all all 127.0.0.1/32 scram-sha-256
host all all ::1/128 scram-sha-256 host all all ::1/128 scram-sha-256
# Local connection (host - infra VM) needs password (169.254.1.0/24 - link_local subnet for containers in pasta mode) # Local connection (host - infra VM) needs password (169.254.1.0/24 - link_local subnet for containers in pasta mode)
hostssl all all {{ hostvars['fw']['network4']['infra']['server'] }}/32 scram-sha-256 hostssl all all {{ hostvars['fw']['network']['infra']['ipv4']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network6']['infra']['server'] }}/128 scram-sha-256 hostssl all all {{ hostvars['fw']['network']['infra']['ipv6']['server'] }}/128 scram-sha-256
hostssl all all {{ hostvars['fw']['network4']['subnet']['lla'] }} scram-sha-256 hostssl all all {{ hostvars['fw']['network']['subnet']['ipv4']['lla'] }} scram-sha-256
hostssl all all {{ hostvars['fw']['network6']['subnet']['lla'] }} scram-sha-256 hostssl all all {{ hostvars['fw']['network']['subnet']['ipv6']['lla'] }} scram-sha-256
# auth VM # auth VM
hostssl all all {{ hostvars['fw']['network4']['auth']['server'] }}/32 scram-sha-256 hostssl all all {{ hostvars['fw']['network']['auth']['ipv4']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network6']['auth']['server'] }}/128 scram-sha-256 hostssl all all {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}/128 scram-sha-256
# app VM (Applications, 192.168.10.13) # app VM (Applications, 192.168.10.13)
hostssl all all {{ hostvars['fw']['network4']['app']['server'] }}/32 scram-sha-256 hostssl all all {{ hostvars['fw']['network']['app']['ipv4']['server'] }}/32 scram-sha-256
hostssl all all {{ hostvars['fw']['network6']['app']['server'] }}/128 scram-sha-256 hostssl all all {{ hostvars['fw']['network']['app']['ipv6']['server'] }}/128 scram-sha-256
config/services/containers/infra/prometheus/etc/rules.yaml.j2
+2 -2
View File
@@ -4,7 +4,7 @@ groups:
{% for instance in (((groups['hypervisor'] | default([])) + (groups['vms'] | default([]))) | difference(['vmm_init']) | sort) %} {% for instance in (((groups['hypervisor'] | default([])) + (groups['vms'] | default([]))) | difference(['vmm_init']) | sort) %}
- alert: {{ instance }}_node_exporter_down - alert: {{ instance }}_node_exporter_down
expr: | expr: |
(present_over_time(up{instance="{{ instance }}"}[5m]) or on() vector(0)) == 0 (max_over_time(up{instance="{{ instance }}"}[5m]) or on() vector(0)) == 0
for: 30s for: 30s
labels: labels:
severity: critical severity: critical
@@ -16,7 +16,7 @@ groups:
rules: rules:
- alert: Postgresql_Down - alert: Postgresql_Down
expr: | expr: |
(present_over_time(pg_up{instance="infra", job="postgres"}[5m]) or on() vector(0)) == 0 (max_over_time(pg_up{instance="infra", job="postgres"}[5m]) or on() vector(0)) == 0
for: 30s for: 30s
labels: labels:
severity: critical severity: critical
config/services/systemd/common/alloy/config.alloy.j2
+45 -6
View File
@@ -179,6 +179,13 @@ loki.relabel "journal_logs" {
target_label = "job" target_label = "job"
replacement = "systemd-journal" replacement = "systemd-journal"
} }
rule {
source_labels = ["__journal__systemd_unit", "__journal__systemd_user_unit", "__journal_syslog_identifier"]
separator = ";"
regex = ";;(ssh|sshd|sudo|su|login|polkitd|cron|crond)"
target_label = "job"
replacement = "$1"
}
rule { rule {
source_labels = ["__journal__systemd_unit"] source_labels = ["__journal__systemd_unit"]
regex = "(.+)\\.service" regex = "(.+)\\.service"
@@ -197,12 +204,6 @@ loki.relabel "journal_logs" {
target_label = "job" target_label = "job"
replacement = "$1.socket" replacement = "$1.socket"
} }
rule {
source_labels = ["__journal_syslog_identifier"]
regex = "(.+)"
target_label = "job"
replacement = "$1"
}
rule { rule {
source_labels = ["job"] source_labels = ["job"]
regex = "user@\\d+" regex = "user@\\d+"
@@ -279,6 +280,44 @@ loki.relabel "journal_logs" {
loki.process "journal_parser" { loki.process "journal_parser" {
forward_to = [loki.write.loki.receiver] forward_to = [loki.write.loki.receiver]
stage.match {
selector = "{job=~\".+\"} |~ \"container health_status .*health_status=\""
stage.regex {
expression = "container (?P<podman_event>health_status) (?P<container_id>[^ ]+)"
}
stage.regex {
expression = "name=(?P<container_name>[^,\\)]+)"
}
stage.regex {
expression = "health_status=(?P<health_status>[^,\\)]+)"
}
stage.labels {
values = {
job = "container_name",
service_name = "container_name",
podman_event = "",
health_status = "",
}
}
stage.structured_metadata {
values = {
container_id = "",
}
}
stage.static_labels {
values = {
level = "info",
}
}
}
stage.match {
selector = "{podman_event=\"health_status\",health_status=\"unhealthy\"}"
stage.static_labels {
values = {
level = "error",
}
}
}
stage.match { stage.match {
selector = "{level!=\"fatal\", job!~\"loki|prometheus|grafana\"} |~ \"(?i)(fatal|critical|panic|uncaught|unhandled|assertion failed|out of memory|\\bboom\\b|killed process)\"" selector = "{level!=\"fatal\", job!~\"loki|prometheus|grafana\"} |~ \"(?i)(fatal|critical|panic|uncaught|unhandled|assertion failed|out of memory|\\bboom\\b|killed process)\""
stage.static_labels { stage.static_labels {
config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2
+4 -4
View File
@@ -6,10 +6,10 @@ whitelist:
# Console IP lists # Console IP lists
- "127.0.0.1" - "127.0.0.1"
- "::1" - "::1"
- "{{ hostvars['fw']['network4']['console']['client'] }}" - "{{ hostvars['fw']['network']['console']['ipv4']['client'] }}"
- "{{ hostvars['fw']['network4']['console']['wg'] }}" - "{{ hostvars['fw']['network']['console']['ipv4']['wg'] }}"
- "{{ hostvars['fw']['network6']['console']['client'] }}" - "{{ hostvars['fw']['network']['console']['ipv6']['client'] }}"
- "{{ hostvars['fw']['network6']['console']['wg'] }}" - "{{ hostvars['fw']['network']['console']['ipv6']['wg'] }}"
{% if node['name'] == 'auth' %} {% if node['name'] == 'auth' %}
expression: expression:
# immich thumbnail request 404 error false positive # immich thumbnail request 404 error false positive
config/services/systemd/common/crowdsec/etc/config.yaml.j2
+2 -2
View File
@@ -53,8 +53,8 @@ api:
trusted_ips: # IP ranges, or IPs which can have admin API access trusted_ips: # IP ranges, or IPs which can have admin API access
- ::1 - ::1
- 127.0.0.1 - 127.0.0.1
- {{ hostvars['fw']['network6']['subnet']['server'] }} - {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
- {{ hostvars['fw']['network4']['subnet']['server'] }} - {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
tls: tls:
cert_file: /etc/crowdsec/ssl/crowdsec.crt cert_file: /etc/crowdsec/ssl/crowdsec.crt
key_file: /etc/crowdsec/ssl/crowdsec.key key_file: /etc/crowdsec/ssl/crowdsec.key
config/services/systemd/fw/bind/etc/named.conf.j2
+23 -31
View File
@@ -3,8 +3,8 @@ include "/etc/bind/acme.key";
options { options {
directory "/var/cache/bind"; directory "/var/cache/bind";
listen-on port 53 { {{ hostvars['fw']['network4']['bind']['server'] }}; }; listen-on port 53 { {{ hostvars['fw']['network']['bind']['ipv4']['server'] }}; };
listen-on-v6 port 53 { {{ hostvars['fw']['network6']['bind']['server'] }}; }; listen-on-v6 port 53 { {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}; };
// Authoritative DNS setting // Authoritative DNS setting
allow-recursion { none; }; allow-recursion { none; };
@@ -16,47 +16,39 @@ options {
check-names master warn; check-names master warn;
}; };
zone "ilnmors.internal." { zone "{{ domain['internal'] }}." {
type primary; type primary;
file "/var/lib/bind/db.ilnmors.internal"; file "/var/lib/bind/db.{{ domain['internal'] }}";
notify yes; notify yes;
// ACME-01 challenge policy. It allows only TXT record of subdomain update. // ACME-01 challenge policy. It allows only TXT record of subdomain update.
update-policy { update-policy {
grant acme-key subdomain ilnmors.internal. TXT; grant acme-key subdomain {{ domain['internal'] }}. TXT;
}; };
}; };
zone "1.168.192.in-addr.arpa" { zone "{{ domain['public'] }}." {
type primary;
file "/var/lib/bind/db.1.168.192.in-addr.arpa";
notify yes;
};
zone "10.168.192.in-addr.arpa" {
type primary;
file "/var/lib/bind/db.10.168.192.in-addr.arpa";
notify yes;
};
zone "0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa" {
type primary;
file "/var/lib/bind/db.1.00df.ip6.arpa";
notify yes;
};
zone "0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa" {
type primary;
file "/var/lib/bind/db.10.00df.ip6.arpa";
notify yes;
};
zone "ilnmors.com." {
//split horizon dns //split horizon dns
type primary; type primary;
file "/var/lib/bind/db.ilnmors.com"; file "/var/lib/bind/db.{{ domain['public'] }}";
notify yes; notify yes;
}; };
{% for net, zone in network['reverse_zone']['ipv4'].items() %}
zone "{{ zone }}" {
type primary;
file "/var/lib/bind/db.{{ net }}.ipv4.rev";
notify yes;
};
{% endfor %}
{% for net, zone in network['reverse_zone']['ipv6'].items() %}
zone "{{ zone }}" {
type primary;
file "/var/lib/bind/db.{{ net }}.ipv6.rev";
notify yes;
};
{% endfor %}
logging { logging {
channel default_log { channel default_log {
stderr; stderr;
config/services/systemd/fw/bind/lib/db.1.00df.ip6.arpa
-12
View File
@@ -1,12 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR fw.ilnmors.internal.
0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR console.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.1.168.192.in-addr.arpa
-14
View File
@@ -1,14 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
1 IN PTR fw.ilnmors.internal.
2 IN PTR switch.ilnmors.internal.
20 IN PTR console.ilnmors.internal.
101 IN PTR printer.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.10.00df.ip6.arpa
-18
View File
@@ -1,18 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR fw.ilnmors.internal.
2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR blocky.ilnmors.internal.
3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR bind.ilnmors.internal.
9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR bk.ilnmors.internal.
0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR vmm.ilnmors.internal.
1.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR infra.ilnmors.internal.
2.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR auth.ilnmors.internal.
3.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR app.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.10.168.192.in-addr.arpa
-18
View File
@@ -1,18 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
1 IN PTR fw.ilnmors.internal.
2 IN PTR blocky.ilnmors.internal.
3 IN PTR bind.ilnmors.internal.
9 IN PTR bk.ilnmors.internal.
10 IN PTR vmm.ilnmors.internal.
11 IN PTR infra.ilnmors.internal.
12 IN PTR auth.ilnmors.internal.
13 IN PTR app.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.ilnmors.com
-14
View File
@@ -1,14 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
@ IN A 192.168.10.12
@ IN AAAA fd00:10::12
* IN A 192.168.10.12
* IN AAAA fd00:10::12
config/services/systemd/fw/bind/lib/db.ilnmors.internal
-43
View File
@@ -1,43 +0,0 @@
$TTL 86400
@ IN SOA bind.ilnmors.internal. bind.ilnmors.internal. (
2026021201 ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS bind.ilnmors.internal.
bind IN A 192.168.10.3
bind IN AAAA fd00:10::3
fw IN A 192.168.10.1
fw IN AAAA fd00:10::1
blocky IN A 192.168.10.2
blocky IN AAAA fd00:10::2
bk IN A 192.168.10.9
bk IN AAAA fd00:10::9
vmm IN A 192.168.10.10
vmm IN AAAA fd00:10::10
infra IN A 192.168.10.11
infra IN AAAA fd00:10::11
auth IN A 192.168.10.12
auth IN AAAA fd00:10::12
app IN A 192.168.10.13
app IN AAAA fd00:10::13
switch IN A 192.168.1.2
console IN A 192.168.1.20
console IN AAAA fd00:1::20
printer IN A 192.168.1.101
init.vmm IN CNAME vmm.ilnmors.internal.
ntp IN CNAME fw.ilnmors.internal.
crowdsec IN CNAME fw.ilnmors.internal.
kopia IN CNAME bk.ilnmors.internal.
ca IN CNAME infra.ilnmors.internal.
postgresql IN CNAME infra.ilnmors.internal.
ldap IN CNAME infra.ilnmors.internal.
maddy IN CNAME infra.ilnmors.internal.
prometheus IN CNAME infra.ilnmors.internal.
loki IN CNAME infra.ilnmors.internal.
grafana IN CNAME infra.ilnmors.internal.
authelia IN CNAME auth.ilnmors.internal.
*.app IN CNAME app.ilnmors.internal.
config/services/systemd/fw/bind/lib/db.internal.j2
+50
View File
@@ -0,0 +1,50 @@
$TTL 86400
@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. (
{{ network['dns_serial'] }} ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}.
{%
set hosts = (
network
| dict2items
| rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone'])
| list
)
%}
{%
set alias_hosts = (
network
| dict2items
| rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone'])
| selectattr('value.alias', 'defined')
| list
)
%}
{% for item in hosts %}
{% set name = item['key'] %}
{% set host = item['value'] %}
{% if host['ipv4'] is defined %}
{% if host['ipv4']['server'] is defined %}
{{ "%-12s" | format(name) }}IN A {{ host['ipv4']['server'] }}
{% elif host['ipv4']['client'] is defined %}
{{ "%-12s" | format(name) }}IN A {{ host['ipv4']['client'] }}
{% endif %}
{% endif %}
{% if host['ipv6'] is defined %}
{% if host['ipv6']['server'] is defined %}
{{ "%-12s" | format(name) }}IN AAAA {{ host['ipv6']['server'] }}
{% elif host['ipv6']['client'] is defined %}
{{ "%-12s" | format(name) }}IN AAAA {{ host['ipv6']['client'] }}
{% endif %}
{% endif %}
{% endfor %}
{% for item in alias_hosts %}
{% for alias in item['value']['alias'] %}
{{ "%-12s" | format(alias) }}IN CNAME {{ item['key'] }}.{{ domain['internal'] }}.
{% endfor %}
{% endfor %}
config/services/systemd/fw/bind/lib/db.ipv4.rev.j2
+25
View File
@@ -0,0 +1,25 @@
$TTL 86400
@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. (
{{ network['dns_serial'] }} ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}.
{% set hosts = (
network
| dict2items
| rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone'])
| list
) %}
{% for item in hosts %}
{% set name = item['key'] %}
{% set host = item['value'] %}
{% if host['ipv4'] is defined and host['ipv4'][reverse_net] is defined and host['ipv4']['reverse'] is defined %}
{{ "%-12s" | format(host['ipv4']['reverse']) }}IN PTR {{ name }}.{{ domain['internal'] }}.
{% endif %}
{% endfor %}
config/services/systemd/fw/bind/lib/db.ipv6.rev.j2
+24
View File
@@ -0,0 +1,24 @@
$TTL 86400
@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. (
{{ network['dns_serial'] }} ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}.
{% set hosts = (
network
| dict2items
| rejectattr('key', 'in', ['dns_serial', 'subnet', 'reverse_zone'])
| list
) %}
{% for item in hosts %}
{% set name = item['key'] %}
{% set host = item['value'] %}
{% if host['ipv6'] is defined and host['ipv6'][reverse_net] is defined and host['ipv6']['reverse'] is defined %}
{{ "%-36s" | format(host['ipv6']['reverse']) }}IN PTR {{ name }}.{{ domain['internal'] }}.
{% endif %}
{% endfor %}
config/services/systemd/fw/bind/lib/db.public.j2
+14
View File
@@ -0,0 +1,14 @@
$TTL 86400
@ IN SOA {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}. (
{{ network['dns_serial'] }} ; serial
3600 ; refresh (1 hour)
1800 ; retry (30 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
IN NS {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}.
@ IN A {{ network['auth']['ipv4']['server'] }}
@ IN AAAA {{ network['auth']['ipv6']['server'] }}
* IN A {{ network['auth']['ipv4']['server'] }}
* IN AAAA {{ network['auth']['ipv6']['server'] }}
config/services/systemd/fw/blocky/etc/config.yaml.j2
+12 -12
View File
@@ -5,14 +5,14 @@ connectIPVersion: dual
ports: ports:
dns: dns:
- "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['dns'] }}" - "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['dns'] }}"
- "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['dns'] }}" - "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['dns'] }}"
tls: tls:
- "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['dot'] }}" - "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['dot'] }}"
- "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['dot'] }}" - "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['dot'] }}"
https: https:
- "{{ hostvars['fw']['network4']['blocky']['server'] }}:{{ services['blocky']['ports']['https'] }}" - "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}:{{ services['blocky']['ports']['https'] }}"
- "[{{ hostvars['fw']['network6']['blocky']['server'] }}]:{{ services['blocky']['ports']['https'] }}" - "[{{ hostvars['fw']['network']['blocky']['ipv6']['server'] }}]:{{ services['blocky']['ports']['https'] }}"
log: log:
level: info level: info
@@ -31,12 +31,12 @@ upstreams:
conditional: conditional:
fallbackUpstream: false fallbackUpstream: false
mapping: mapping:
{{ domain['internal'] }}: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" {{ domain['internal'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
{{ domain['public'] }}: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" {{ domain['public'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
1.168.192.in-addr.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" {{ network['reverse_zone']['ipv4']['client'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
10.168.192.in-addr.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" {{ network['reverse_zone']['ipv4']['server'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
0.0.0.0.0.0.0.0.1.0.0.0.0.0.d.f.ip6.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" {{ network['reverse_zone']['ipv6']['client'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
0.0.0.0.0.0.0.0.0.1.0.0.0.0.d.f.ip6.arpa: "{{ hostvars['fw']['network4']['bind']['server'] }}, {{ hostvars['fw']['network6']['bind']['server'] }}" {{ network['reverse_zone']['ipv6']['server'] }}: "{{ hostvars['fw']['network']['bind']['ipv4']['server'] }}, {{ hostvars['fw']['network']['bind']['ipv6']['server'] }}"
vpn.{{ domain['public'] }}: "tcp-tls:1.1.1.1:853, tcp-tls:1.0.0.1:853, tcp-tls:[2606:4700:4700::1111]:853, tcp-tls:[2606:4700:4700::1001]:853" vpn.{{ domain['public'] }}: "tcp-tls:1.1.1.1:853, tcp-tls:1.0.0.1:853, tcp-tls:[2606:4700:4700::1111]:853, tcp-tls:[2606:4700:4700::1001]:853"
blocking: blocking:
config/services/systemd/fw/chrony/local-acl.conf.j2
+6 -6
View File
@@ -1,9 +1,9 @@
# 1. Access Control (IPv4) # 1. Access Control (IPv4)
allow {{ hostvars['fw']['network4']['subnet']['client'] }} allow {{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}
allow {{ hostvars['fw']['network4']['subnet']['server'] }} allow {{ hostvars['fw']['network']['subnet']['ipv4']['server'] }}
allow {{ hostvars['fw']['network4']['subnet']['wg'] }} allow {{ hostvars['fw']['network']['subnet']['ipv4']['wg'] }}
# 2. Access Control (IPv6) # 2. Access Control (IPv6)
allow {{ hostvars['fw']['network6']['subnet']['client'] }} allow {{ hostvars['fw']['network']['subnet']['ipv6']['client'] }}
allow {{ hostvars['fw']['network6']['subnet']['server'] }} allow {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
allow {{ hostvars['fw']['network6']['subnet']['wg'] }} allow {{ hostvars['fw']['network']['subnet']['ipv6']['wg'] }}
config/services/systemd/fw/kea/kea-dhcp4.conf.j2
+9 -9
View File
@@ -2,7 +2,7 @@
"Dhcp4": { "Dhcp4": {
"subnet4": [ "subnet4": [
{ {
"subnet": "{{ hostvars['fw']['network4']['subnet']['client'] }}", "subnet": "{{ hostvars['fw']['network']['subnet']['ipv4']['client'] }}",
"pools" : [ "pools" : [
{ {
"pool": "192.168.1.254-192.168.1.254" "pool": "192.168.1.254-192.168.1.254"
@@ -11,11 +11,11 @@
"option-data": [ "option-data": [
{ {
"name": "routers", "name": "routers",
"data": "{{ hostvars['fw']['network4']['firewall']['client'] }}" "data": "{{ hostvars['fw']['network']['fw']['ipv4']['client'] }}"
}, },
{ {
"name": "domain-name-servers", "name": "domain-name-servers",
"data": "{{ hostvars['fw']['network4']['blocky']['server'] }}" "data": "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}"
}, },
{ {
"name": "domain-name", "name": "domain-name",
@@ -25,17 +25,17 @@
"reservations": [ "reservations": [
{ {
"hw-address": "58:04:4f:18:6c:5e", "hw-address": "58:04:4f:18:6c:5e",
"ip-address": "{{ hostvars['fw']['network4']['switch']['client'] }}", "ip-address": "{{ hostvars['fw']['network']['switch']['ipv4']['client'] }}",
"hostname": "switch" "hostname": "switch"
}, },
{ {
"hw-address": "d8:e2:df:ff:1b:d5", "hw-address": "d8:e2:df:ff:1b:d5",
"ip-address": "{{ hostvars['fw']['network4']['console']['client'] }}", "ip-address": "{{ hostvars['fw']['network']['console']['ipv4']['client'] }}",
"hostname": "console" "hostname": "console"
}, },
{ {
"hw-address": "38:ca:84:94:5e:06", "hw-address": "38:ca:84:94:5e:06",
"ip-address": "{{ hostvars['fw']['network4']['printer']['client'] }}", "ip-address": "{{ hostvars['fw']['network']['printer']['ipv4']['client'] }}",
"hostname": "printer" "hostname": "printer"
} }
], ],
@@ -43,7 +43,7 @@
"interface": "client" "interface": "client"
}, },
{ {
"subnet": "{{ hostvars['fw']['network4']['subnet']['user'] }}", "subnet": "{{ hostvars['fw']['network']['subnet']['ipv4']['user'] }}",
"pools" : [ "pools" : [
{ {
"pool": "192.168.20.2-192.168.20.254" "pool": "192.168.20.2-192.168.20.254"
@@ -52,11 +52,11 @@
"option-data": [ "option-data": [
{ {
"name": "routers", "name": "routers",
"data": "{{ hostvars['fw']['network4']['firewall']['user'] }}" "data": "{{ hostvars['fw']['network']['fw']['ipv4']['user'] }}"
}, },
{ {
"name": "domain-name-servers", "name": "domain-name-servers",
"data": "{{ hostvars['fw']['network4']['blocky']['server'] }}" "data": "{{ hostvars['fw']['network']['blocky']['ipv4']['server'] }}"
}, },
{ {
"name": "domain-name", "name": "domain-name",