1.0.0 Release IaaS

2026-03-15 04:41:02 +09:00
commit a7365da431
292 changed files with 36059 additions and 0 deletions
@@ -0,0 +1,5 @@
+[Match]
+MACAddress=c8:ff:bf:05:aa:b0
+
+[Link]
+Name=eth0
@@ -0,0 +1,5 @@
+[Match]
+MACAddress=c8:ff:bf:05:aa:b1
+
+[Link]
+Name=eth1
@@ -0,0 +1,3 @@
+[NetDev]
+Name=br0
+Kind=bridge
@@ -0,0 +1,7 @@
+[NetDev]
+Name=br1
+Kind=bridge
+
+[Bridge]
+VLANFiltering=true
+DefaultPVID=1
@@ -0,0 +1,6 @@
+[NetDev]
+Name=vlan1
+Kind=vlan
+
+[VLAN]
+Id=1
@@ -0,0 +1,6 @@
+[NetDev]
+Name=vlan10
+Kind=vlan
+
+[VLAN]
+Id=10
@@ -0,0 +1,6 @@
+[NetDev]
+Name=vlan20
+Kind=vlan
+
+[VLAN]
+Id=20
@@ -0,0 +1,6 @@
+[Match]
+Name=eth0
+
+[Network]
+Bridge=br0
+LinkLocalAddressing=false
@@ -0,0 +1,15 @@
+[Match]
+Name=eth1
+
+[Network]
+Bridge=br1
+LinkLocalAddressing=false
+
+[BridgeVLAN]
+VLAN=1
+PVID=true
+EgressUntagged=true
+
+[BridgeVLAN]
+VLAN=10
+VLAN=20
@@ -0,0 +1,5 @@
+[Match]
+Name=br0
+
+[Network]
+LinkLocalAddressing=false
@@ -0,0 +1,17 @@
+[Match]
+Name=br1
+
+[Network]
+VLAN=vlan1
+VLAN=vlan10
+VLAN=vlan20
+LinkLocalAddressing=false
+
+[BridgeVLAN]
+VLAN=1
+PVID=yes
+EgressUntagged=true
+
+[BridgeVLAN]
+VLAN=10
+VLAN=20
@@ -0,0 +1,28 @@
+[Match]
+Name=vlan1
+
+[Network]
+# IPv4
+Address=192.168.1.10/24
+# IPv6
+Address=fd00:1::10/64
+
+[RoutingPolicyRule]
+From=192.168.1.10/32
+Table=1
+Priority=100
+
+[Route]
+Destination=192.168.1.0/24
+Scope=link
+Table=1
+
+[RoutingPolicyRule]
+From=fd00:1::10/128
+Table=61
+Priority=100
+
+[Route]
+Destination=fd00:1::/64
+Scope=link
+Table=61
@@ -0,0 +1,32 @@
+[Match]
+Name=vlan10
+[Network]
+RequiredForOnline=false
+# IPv4
+Address=192.168.10.10/24
+Gateway=192.168.10.1
+DNS=192.168.10.2
+# IPv6
+Address=fd00:10::10/64
+Gateway=fd00:10::1
+DNS=fd00:10::2
+
+[RoutingPolicyRule]
+From=192.168.10.10/32
+Table=2
+Priority=100
+
+[Route]
+Destination=0.0.0.0/0
+Gateway=192.168.10.1
+Table=2
+
+[RoutingPolicyRule]
+From=fd00:10::10/128
+Table=62
+Priority=100
+
+[Route]
+Destination=::/0
+Gateway=fd00:10::1
+Table=62
@@ -0,0 +1,26 @@
+#!/usr/sbin/nft -f
+# Convention
+# iifname oifname saddr daddr proto dport ct state action / Ellipsis if you can something
+flush ruleset
+
+define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
+define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
+define PORTS_SSH = 22
+
+table inet filter {
+    chain input {
+        type filter hook input priority 0; policy drop;
+        ct state invalid drop comment "deny invalid connection"
+        ct state established, related accept comment "allow all connection already existing"
+        iifname "lo" accept comment "allow local connection"
+        meta l4proto { icmp, icmpv6 } accept comment "allow icmp connection: > VMM"
+        ip saddr $HOSTS4_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv4 ssh connection: CONSOLE > VMM"
+        ip6 saddr $HOSTS6_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv6 ssh connection: CONSOLE > VMM"
+   }
+    chain forward {
+        type filter hook forward priority 0; policy drop;
+    }
+    chain output {
+        type filter hook output priority 0; policy accept;
+    }
+}