Convert mediawiki to use systemd timers

[chef.git] / cookbooks / networking / recipes / default.rb

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index c76d47e3e120bf91b4478b5f7e8d909dfeddf012..5cdaf91f635fc5bc894e454e6002407e71cfbe71 100644 (file)
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -94,17 +94,17 @@ node[:networking][:interfaces].each do |name, interface|
 
       deviceplan["parameters"] = {
         "mode" => interface[:bond][:mode] || "active-backup",
 
       deviceplan["parameters"] = {
         "mode" => interface[:bond][:mode] || "active-backup",

-        "primary" => interface[:bond][:slaves].first,

         "mii-monitor-interval" => interface[:bond][:miimon] || 100,
         "down-delay" => interface[:bond][:downdelay] || 200,
         "up-delay" => interface[:bond][:updelay] || 200
       }
 
         "mii-monitor-interval" => interface[:bond][:miimon] || 100,
         "down-delay" => interface[:bond][:downdelay] || 200,
         "up-delay" => interface[:bond][:updelay] || 200
       }
 

+      deviceplan["parameters"]["primary"] = interface[:bond][:slaves].first if deviceplan["parameters"]["mode"] == "active-backup"

       deviceplan["parameters"]["transmit-hash-policy"] = interface[:bond][:xmithashpolicy] if interface[:bond][:xmithashpolicy]
       deviceplan["parameters"]["lacp-rate"] = interface[:bond][:lacprate] if interface[:bond][:lacprate]
     end
 
       deviceplan["parameters"]["transmit-hash-policy"] = interface[:bond][:xmithashpolicy] if interface[:bond][:xmithashpolicy]
       deviceplan["parameters"]["lacp-rate"] = interface[:bond][:lacprate] if interface[:bond][:lacprate]
     end
 

-    if interface[:gateway]
+    if interface[:gateway] && interface[:gateway] != interface[:address]

       if interface[:family] == "inet"
         default_route = "0.0.0.0/0"
       elsif interface[:family] == "inet6"
       if interface[:family] == "inet"
         default_route = "0.0.0.0/0"
       elsif interface[:family] == "inet6"


@@ -156,7 +156,7 @@ end
 
 netplan["network"]["bonds"].each_value do |bond|
   bond["interfaces"].each do |interface|
 
 netplan["network"]["bonds"].each_value do |bond|
   bond["interfaces"].each do |interface|

-    netplan["network"]["ethernets"][interface] ||= { "accept-ra" => false }
+    netplan["network"]["ethernets"][interface] ||= { "accept-ra" => false, "optional" => true }

   end
 end
 
   end
 end
 


@@ -166,6 +166,10 @@ netplan["network"]["vlans"].each_value do |vlan|
   end
 end
 
   end
 end
 

+file "/etc/netplan/00-installer-config.yaml" do
+  action :delete
+end
+

 file "/etc/netplan/01-netcfg.yaml" do
   action :delete
 end
 file "/etc/netplan/01-netcfg.yaml" do
   action :delete
 end


@@ -236,7 +240,7 @@ if node[:networking][:wireguard][:enabled]
       }
     end
 
       }
     end
 

-    search(:node, "roles:mail OR roles:prometheus") do |server|
+    search(:node, "roles:shenron OR roles:prometheus") do |server|

       allowed_ips = server.interfaces(:role => :internal).map do |interface|
         "#{interface[:network]}/#{interface[:prefix]}"
       end
       allowed_ips = server.interfaces(:role => :internal).map do |interface|
         "#{interface[:network]}/#{interface[:prefix]}"
       end


@@ -257,6 +261,32 @@ if node[:networking][:wireguard][:enabled]
       :allowed_ips => "10.0.16.1/32",
       :endpoint => "gate.compton.nu:51820"
     }
       :allowed_ips => "10.0.16.1/32",
       :endpoint => "gate.compton.nu:51820"
     }

+
+    # Grant home
+    node.default[:networking][:wireguard][:peers] << {
+      :public_key => "RofATnvlWxP3mt87+QKRXFE5MVxtoCcTsJ+yftZYEE4=",
+      :allowed_ips => "10.89.122.1/32",
+      :endpoint => "gate.firefishy.com:51820"
+    }
+
+    # Grant roaming
+    node.default[:networking][:wireguard][:peers] << {
+      :public_key => "YbUkREE9TAmomqgL/4Fh2e5u2Hh7drN/2o5qg3ndRxg=",
+      :allowed_ips => "10.89.123.1/32",
+      :endpoint => "roaming.firefishy.com:51820"
+    }
+  elsif node[:roles].include?("shenron")
+    search(:node, "roles:gateway") do |gateway|
+      allowed_ips = gateway.interfaces(:role => :internal).map do |interface|
+        "#{interface[:network]}/#{interface[:prefix]}"
+      end
+
+      node.default[:networking][:wireguard][:peers] << {
+        :public_key => gateway[:networking][:wireguard][:public_key],
+        :allowed_ips => allowed_ips,
+        :endpoint => "#{gateway.name}:51820"
+      }
+    end

   end
 
   template "/etc/systemd/network/wireguard.netdev" do
   end
 
   template "/etc/systemd/network/wireguard.netdev" do


@@ -285,7 +315,7 @@ if node[:networking][:wireguard][:enabled]
       action :nothing
       subscribes :restart, "template[/etc/systemd/network/wireguard.netdev]"
       subscribes :restart, "template[/etc/systemd/network/wireguard.network]"
       action :nothing
       subscribes :restart, "template[/etc/systemd/network/wireguard.netdev]"
       subscribes :restart, "template[/etc/systemd/network/wireguard.network]"

-      not_if { ENV.key?("TEST_KITCHEN") }
+      not_if { kitchen? }

     end
   else
     execute "networkctl-delete-wg0" do
     end
   else
     execute "networkctl-delete-wg0" do


@@ -300,7 +330,7 @@ if node[:networking][:wireguard][:enabled]
       command "networkctl reload"
       subscribes :run, "template[/etc/systemd/network/wireguard.netdev]"
       subscribes :run, "template[/etc/systemd/network/wireguard.network]"
       command "networkctl reload"
       subscribes :run, "template[/etc/systemd/network/wireguard.netdev]"
       subscribes :run, "template[/etc/systemd/network/wireguard.network]"

-      not_if { ENV.key?("TEST_KITCHEN") }
+      not_if { kitchen? }

     end
   end
 end
     end
   end
 end


@@ -313,7 +343,7 @@ end
 execute "hostnamectl-set-hostname" do
   command "hostnamectl set-hostname #{node[:networking][:hostname]}"
   notifies :reload, "ohai[reload-hostname]"
 execute "hostnamectl-set-hostname" do
   command "hostnamectl set-hostname #{node[:networking][:hostname]}"
   notifies :reload, "ohai[reload-hostname]"

-  not_if { ENV.key?("TEST_KITCHEN") || node[:hostnamectl][:static_hostname] == node[:networking][:hostname] }
+  not_if { kitchen? || node[:hostnamectl][:static_hostname] == node[:networking][:hostname] }

 end
 
 template "/etc/hosts" do
 end
 
 template "/etc/hosts" do


@@ -321,7 +351,7 @@ template "/etc/hosts" do
   owner "root"
   group "root"
   mode "644"
   owner "root"
   group "root"
   mode "644"

-  not_if { ENV["TEST_KITCHEN"] }
+  not_if { kitchen? }

 end
 
 service "systemd-resolved" do
 end
 
 service "systemd-resolved" do


@@ -502,16 +532,24 @@ if node[:networking][:wireguard][:enabled]
   end
 end
 
   end
 end
 

+file "/etc/shorewall/masq" do
+  action :delete
+end
+
+file "/etc/shorewall/masq.bak" do
+  action :delete
+end
+

 if node[:roles].include?("gateway")
 if node[:roles].include?("gateway")

-  template "/etc/shorewall/masq" do
-    source "shorewall-masq.erb"
+  template "/etc/shorewall/snat" do
+    source "shorewall-snat.erb"

     owner "root"
     group "root"
     mode "644"
     notifies :restart, "service[shorewall]"
   end
 else
     owner "root"
     group "root"
     mode "644"
     notifies :restart, "service[shorewall]"
   end
 else

-  file "/etc/shorewall/masq" do
+  file "/etc/shorewall/snat" do

     action :delete
     notifies :restart, "service[shorewall]"
   end
     action :delete
     notifies :restart, "service[shorewall]"
   end