deviceplan["parameters"] = {
"mode" => interface[:bond][:mode] || "active-backup",
- "primary" => interface[:bond][:slaves].first,
"mii-monitor-interval" => interface[:bond][:miimon] || 100,
"down-delay" => interface[:bond][:downdelay] || 200,
"up-delay" => interface[:bond][:updelay] || 200
}
+ deviceplan["parameters"]["primary"] = interface[:bond][:slaves].first if deviceplan["parameters"]["mode"] == "active-backup"
deviceplan["parameters"]["transmit-hash-policy"] = interface[:bond][:xmithashpolicy] if interface[:bond][:xmithashpolicy]
deviceplan["parameters"]["lacp-rate"] = interface[:bond][:lacprate] if interface[:bond][:lacprate]
end
package "wireguard-tools" do
compile_time true
+ options "--no-install-recommends"
end
directory "/var/lib/systemd/wireguard" do
}
end
- search(:node, "roles:mail OR roles:prometheus") do |server|
+ search(:node, "roles:prometheus") do |server|
allowed_ips = server.interfaces(:role => :internal).map do |interface|
"#{interface[:network]}/#{interface[:prefix]}"
end
:endpoint => "gate.compton.nu:51820"
}
+ # Grant home
node.default[:networking][:wireguard][:peers] << {
:public_key => "RofATnvlWxP3mt87+QKRXFE5MVxtoCcTsJ+yftZYEE4=",
:allowed_ips => "10.89.122.1/32",
:endpoint => "gate.firefishy.com:51820"
}
+
+ # Grant roaming
+ node.default[:networking][:wireguard][:peers] << {
+ :public_key => "YbUkREE9TAmomqgL/4Fh2e5u2Hh7drN/2o5qg3ndRxg=",
+ :allowed_ips => "10.89.123.1/32",
+ :endpoint => "roaming.firefishy.com:51820"
+ }
+ elsif node[:roles].include?("shenron")
+ search(:node, "roles:gateway") do |gateway|
+ allowed_ips = gateway.interfaces(:role => :internal).map do |interface|
+ "#{interface[:network]}/#{interface[:prefix]}"
+ end
+
+ node.default[:networking][:wireguard][:peers] << {
+ :public_key => gateway[:networking][:wireguard][:public_key],
+ :allowed_ips => allowed_ips,
+ :endpoint => "#{gateway.name}:51820"
+ }
+ end
end
template "/etc/systemd/network/wireguard.netdev" do
to "../run/systemd/resolve/stub-resolv.conf"
end
+hosts = { "inet" => [], "inet6" => [] }
zones = {}
search(:node, "networking:interfaces").collect do |n|
n.interfaces.each do |interface|
next unless interface[:role] == "external" && interface[:zone]
+ hosts[interface[:family]] << interface[:address]
+
zones[interface[:zone]] ||= {}
zones[interface[:zone]][interface[:family]] ||= []
zones[interface[:zone]][interface[:family]] << interface[:address]
end
end
-package "shorewall"
-
-systemd_service "shorewall-docker" do
- service "shorewall"
- dropin "docker"
- exec_stop "/sbin/shorewall $OPTIONS stop"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/default/shorewall" do
- source "shorewall-default.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/shorewall.conf" do
- source "shorewall.conf.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/zones" do
- source "shorewall-zones.erb"
- owner "root"
- group "root"
- mode "644"
- variables :type => "ipv4"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/interfaces" do
- source "shorewall-interfaces.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/hosts" do
- source "shorewall-hosts.erb"
- owner "root"
- group "root"
- mode "644"
- variables :zones => zones
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/conntrack" do
- source "shorewall-conntrack.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
- only_if { node[:networking][:firewall][:raw] }
-end
-
-template "/etc/shorewall/policy" do
- source "shorewall-policy.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
+if node[:networking][:firewall][:engine] == "shorewall"
+ package "shorewall"
-template "/etc/shorewall/rules" do
- source "shorewall-rules.erb"
- owner "root"
- group "root"
- mode "644"
- variables :family => "inet"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/stoppedrules" do
- source "shorewall-stoppedrules.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-if node[:networking][:firewall][:enabled]
- service "shorewall" do
- action [:enable, :start]
- supports :restart => true
- status_command "shorewall status"
- ignore_failure true
- end
-else
- service "shorewall" do
- action [:disable, :stop]
- supports :restart => true
- status_command "shorewall status"
- ignore_failure true
- end
-end
-
-template "/etc/logrotate.d/shorewall" do
- source "logrotate.shorewall.erb"
- owner "root"
- group "root"
- mode "644"
- variables :name => "shorewall"
-end
-
-firewall_rule "limit-icmp-echo" do
- action :accept
- family :inet
- source "net"
- dest "fw"
- proto "icmp"
- dest_ports "echo-request"
- rate_limit "s:1/sec:5"
-end
-
-if node[:networking][:wireguard][:enabled]
- wireguard_source = if node[:roles].include?("gateway")
- "net"
- else
- "osm"
- end
-
- firewall_rule "accept-wireguard" do
- action :accept
- source wireguard_source
- dest "fw"
- proto "udp"
- dest_ports "51820"
- source_ports "51820"
- end
-end
-
-if node[:roles].include?("gateway")
- template "/etc/shorewall/masq" do
- source "shorewall-masq.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
- end
-else
- file "/etc/shorewall/masq" do
- action :delete
+ systemd_service "shorewall-docker" do
+ service "shorewall"
+ dropin "docker"
+ exec_stop "/sbin/shorewall $OPTIONS stop"
notifies :restart, "service[shorewall]"
end
-end
-unless node.interfaces(:family => :inet6).empty?
- package "shorewall6"
-
- template "/etc/default/shorewall6" do
+ template "/etc/default/shorewall" do
source "shorewall-default.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/shorewall6.conf" do
- source "shorewall6.conf.erb"
+ template "/etc/shorewall/shorewall.conf" do
+ source "shorewall.conf.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/zones" do
+ template "/etc/shorewall/zones" do
source "shorewall-zones.erb"
owner "root"
group "root"
mode "644"
- variables :type => "ipv6"
- notifies :restart, "service[shorewall6]"
+ variables :type => "ipv4"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/interfaces" do
- source "shorewall6-interfaces.erb"
+ template "/etc/shorewall/interfaces" do
+ source "shorewall-interfaces.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/hosts" do
- source "shorewall6-hosts.erb"
+ template "/etc/shorewall/hosts" do
+ source "shorewall-hosts.erb"
owner "root"
group "root"
mode "644"
variables :zones => zones
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/conntrack" do
+ template "/etc/shorewall/conntrack" do
source "shorewall-conntrack.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
only_if { node[:networking][:firewall][:raw] }
end
- template "/etc/shorewall6/policy" do
+ template "/etc/shorewall/policy" do
source "shorewall-policy.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/rules" do
+ template "/etc/shorewall/rules" do
source "shorewall-rules.erb"
owner "root"
group "root"
mode "644"
- variables :family => "inet6"
- notifies :restart, "service[shorewall6]"
+ variables :family => "inet"
+ notifies :restart, "service[shorewall]"
+ end
+
+ template "/etc/shorewall/stoppedrules" do
+ source "shorewall-stoppedrules.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall]"
end
if node[:networking][:firewall][:enabled]
- service "shorewall6" do
+ service "shorewall" do
action [:enable, :start]
supports :restart => true
- status_command "shorewall6 status"
+ status_command "shorewall status"
ignore_failure true
end
else
- service "shorewall6" do
+ service "shorewall" do
action [:disable, :stop]
supports :restart => true
- status_command "shorewall6 status"
+ status_command "shorewall status"
ignore_failure true
end
end
- template "/etc/logrotate.d/shorewall6" do
+ template "/etc/logrotate.d/shorewall" do
source "logrotate.shorewall.erb"
owner "root"
group "root"
mode "644"
- variables :name => "shorewall6"
+ variables :name => "shorewall"
end
- firewall_rule "limit-icmp6-echo" do
+ firewall_rule "limit-icmp-echo" do
action :accept
- family :inet6
+ family :inet
source "net"
dest "fw"
- proto "ipv6-icmp"
+ proto "icmp"
dest_ports "echo-request"
rate_limit "s:1/sec:5"
end
+
+ file "/etc/shorewall/masq" do
+ action :delete
+ end
+
+ file "/etc/shorewall/masq.bak" do
+ action :delete
+ end
+
+ if node[:roles].include?("gateway")
+ template "/etc/shorewall/snat" do
+ source "shorewall-snat.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall]"
+ end
+ else
+ file "/etc/shorewall/snat" do
+ action :delete
+ notifies :restart, "service[shorewall]"
+ end
+ end
+
+ unless node.interfaces(:family => :inet6).empty?
+ package "shorewall6"
+
+ template "/etc/default/shorewall6" do
+ source "shorewall-default.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/shorewall6.conf" do
+ source "shorewall6.conf.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/zones" do
+ source "shorewall-zones.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ variables :type => "ipv6"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/interfaces" do
+ source "shorewall6-interfaces.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/hosts" do
+ source "shorewall6-hosts.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ variables :zones => zones
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/conntrack" do
+ source "shorewall-conntrack.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ only_if { node[:networking][:firewall][:raw] }
+ end
+
+ template "/etc/shorewall6/policy" do
+ source "shorewall-policy.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/rules" do
+ source "shorewall-rules.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ variables :family => "inet6"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ if node[:networking][:firewall][:enabled]
+ service "shorewall6" do
+ action [:enable, :start]
+ supports :restart => true
+ status_command "shorewall6 status"
+ ignore_failure true
+ end
+ else
+ service "shorewall6" do
+ action [:disable, :stop]
+ supports :restart => true
+ status_command "shorewall6 status"
+ ignore_failure true
+ end
+ end
+
+ template "/etc/logrotate.d/shorewall6" do
+ source "logrotate.shorewall.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ variables :name => "shorewall6"
+ end
+
+ firewall_rule "limit-icmp6-echo" do
+ action :accept
+ family :inet6
+ source "net"
+ dest "fw"
+ proto "ipv6-icmp"
+ dest_ports "echo-request"
+ rate_limit "s:1/sec:5"
+ end
+ end
+elsif node[:networking][:firewall][:engine] == "nftables"
+ service "shorewall6" do
+ action :stop
+ end
+
+ package "shorewall6" do
+ action :purge
+ end
+
+ service "shorewall" do
+ action :stop
+ end
+
+ systemd_service "shorewall-docker" do
+ action :delete
+ service "shorewall"
+ dropin "docker"
+ end
+
+ package "shorewall" do
+ action :purge
+ end
+
+ package "nftables"
+
+ interfaces = []
+
+ node.interfaces(:role => :external).each do |interface|
+ interfaces << interface[:interface]
+ end
+
+ interfaces << "eth0" if kitchen? && interfaces.empty?
+
+ template "/etc/nftables.conf" do
+ source "nftables.conf.erb"
+ owner "root"
+ group "root"
+ mode "755"
+ variables :interfaces => interfaces, :hosts => hosts
+ notifies :restart, "service[nftables]"
+ end
+
+ stop_commands = [
+ "/usr/sbin/nft delete table inet filter"
+ ]
+
+ stop_commands << "/usr/sbin/nft delete table ip nat" if node[:roles].include?("gateway")
+
+ systemd_service "nftables-stop" do
+ service "nftables"
+ dropin "stop"
+ exec_reload ""
+ exec_stop stop_commands
+ end
+
+ if node[:networking][:firewall][:enabled]
+ service "nftables" do
+ action [:enable, :start]
+ end
+ else
+ service "nftables" do
+ action [:disable, :stop]
+ end
+ end
+end
+
+if node[:networking][:wireguard][:enabled]
+ wireguard_source = if node[:roles].include?("gateway")
+ "net"
+ else
+ "osm"
+ end
+
+ firewall_rule "accept-wireguard" do
+ action :accept
+ source wireguard_source
+ dest "fw"
+ proto "udp"
+ dest_ports "51820"
+ source_ports "51820"
+ end
end
firewall_rule "accept-http" do
projects / chef.git / blobdiff