feat(repo): IaaS baseline

2026-06-17 13:17:24 +09:00
parent a6bba986a5
commit 927b5b4934
250 changed files with 1074 additions and 28750 deletions
@@ -16,6 +16,9 @@
 {{ hostvars['fw']['network6']['infra']['server'] }} infra.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['auth']['server'] }} auth.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['app']['server'] }} app.{{ domain['internal'] }}
+# kopia repository
+{{ hostvars['fw']['network4']['nas']['client'] }} nas.{{ domain['internal'] }}
+{{ hostvars['fw']['network6']['nas']['client'] }} nas.{{ domain['internal'] }}
 {% else %}
 # IPv4
 # Crowdsec, blocky, bind(fw)
@@ -78,7 +78,7 @@ table inet filter {
        set crowdsec6-blacklists {
                type ipv6_addr
                flags timeout
-        }        
+        }
        chain global {
                # invalid packets
                ct state invalid drop comment "deny invalid connection"
@@ -114,7 +114,7 @@ table inet filter {
                iifname "lo" accept comment "allow local connection: FW > FW"
                udp dport $PORTS_VPN accept comment "allow vpn connection: > FW"
                iifname { $IF_CLIENT, $IF_SERVER, $IF_USER, $IF_WG } meta l4proto { icmp, icmpv6 } accept comment "allow icmp, icmpv6 connection: CLIENT/SERVER/USER/WG > FW"
-                iifname { $IF_CLIENT, $IF_SERVER, $IF_USER, $IF_WG } udp dport $PORTS_NTP accept comment "allow ntp connection: CLIENT/SERVER/USER/WG > FW"
+                iifname { $IF_CLIENT, $IF_SERVER, $IF_WG } udp dport $PORTS_NTP accept comment "allow ntp connection: CLIENT/SERVER/USER/WG > FW"
                # Global chain contains "WAN !> :SSH_PORT"
                ip saddr $HOSTS4_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv4 ssh connection: CONSOLE > FW"
                ip6 saddr $HOSTS6_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv6 ssh connection: CONSOLE > FW"
@@ -1,5 +0,0 @@
-[Match]
-MACAddress=c8:ff:bf:05:aa:b0
-
-[Link]
-Name=eth0
@@ -0,0 +1,5 @@
+[Match]
+MACAddress={{ hostvars['vmm']['hardware']['mac']['nic0'] }}
+
+[Link]
+Name=eth0
@@ -1,5 +0,0 @@
-[Match]
-MACAddress=c8:ff:bf:05:aa:b1
-
-[Link]
-Name=eth1
@@ -0,0 +1,5 @@
+[Match]
+MACAddress={{ hostvars['vmm']['hardware']['mac']['nic1'] }}
+
+[Link]
+Name=eth1
@@ -1,28 +0,0 @@
-[Match]
-Name=vlan1
-
-[Network]
-# IPv4
-Address=192.168.1.10/24
-# IPv6
-Address=fd00:1::10/64
-
-[RoutingPolicyRule]
-From=192.168.1.10/32
-Table=1
-Priority=100
-
-[Route]
-Destination=192.168.1.0/24
-Scope=link
-Table=1
-
-[RoutingPolicyRule]
-From=fd00:1::10/128
-Table=61
-Priority=100
-
-[Route]
-Destination=fd00:1::/64
-Scope=link
-Table=61
@@ -0,0 +1,28 @@
+[Match]
+Name=vlan1
+
+[Network]
+# IPv4
+Address={{ hostvars['fw']['network4']['vmm']['client'] }}/24
+# IPv6
+Address={{ hostvars['fw']['network6']['vmm']['client'] }}/64
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network4']['vmm']['client'] }}/32
+Table=1
+Priority=100
+
+[Route]
+Destination={{ hostvars['fw']['network4']['subnet']['client'] }}
+Scope=link
+Table=1
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network6']['vmm']['client'] }}/128
+Table=61
+Priority=100
+
+[Route]
+Destination={{ hostvars['fw']['network6']['subnet']['client'] }}
+Scope=link
+Table=61
@@ -1,32 +0,0 @@
-[Match]
-Name=vlan10
-[Network]
-RequiredForOnline=false
-# IPv4
-Address=192.168.10.10/24
-Gateway=192.168.10.1
-DNS=192.168.10.2
-# IPv6
-Address=fd00:10::10/64
-Gateway=fd00:10::1
-DNS=fd00:10::2
-
-[RoutingPolicyRule]
-From=192.168.10.10/32
-Table=2
-Priority=100
-
-[Route]
-Destination=0.0.0.0/0
-Gateway=192.168.10.1
-Table=2
-
-[RoutingPolicyRule]
-From=fd00:10::10/128
-Table=62
-Priority=100
-
-[Route]
-Destination=::/0
-Gateway=fd00:10::1
-Table=62
@@ -0,0 +1,32 @@
+[Match]
+Name=vlan10
+[Network]
+RequiredForOnline=false
+# IPv4
+Address={{ hostvars['fw']['network4']['vmm']['server'] }}/24
+Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
+DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
+# IPv6
+Address={{ hostvars['fw']['network6']['vmm']['server'] }}/64
+Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
+DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network4']['vmm']['server'] }}/32
+Table=2
+Priority=100
+
+[Route]
+Destination=0.0.0.0/0
+Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
+Table=2
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network6']['vmm']['server'] }}/128
+Table=62
+Priority=100
+
+[Route]
+Destination=::/0
+Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
+Table=62