community: pin postgres v13

[chef.git] / cookbooks / networking / recipes / default.rb

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index 3a30f20f969ede3e6f314e27b6a4867d702cd5dd..9bf8345222393787a066ed0401c9c192cf6d7d70 100644 (file)
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -94,12 +94,12 @@ node[:networking][:interfaces].each do |name, interface|
 
       deviceplan["parameters"] = {
         "mode" => interface[:bond][:mode] || "active-backup",
-        "primary" => interface[:bond][:slaves].first,
         "mii-monitor-interval" => interface[:bond][:miimon] || 100,
         "down-delay" => interface[:bond][:downdelay] || 200,
         "up-delay" => interface[:bond][:updelay] || 200
       }
 
+      deviceplan["parameters"]["primary"] = interface[:bond][:slaves].first if deviceplan["parameters"]["mode"] == "active-backup"
       deviceplan["parameters"]["transmit-hash-policy"] = interface[:bond][:xmithashpolicy] if interface[:bond][:xmithashpolicy]
       deviceplan["parameters"]["lacp-rate"] = interface[:bond][:lacprate] if interface[:bond][:lacprate]
     end
@@ -196,6 +196,7 @@ if node[:networking][:wireguard][:enabled]
 
   package "wireguard-tools" do
     compile_time true
+    options "--no-install-recommends"
   end
 
   directory "/var/lib/systemd/wireguard" do
@@ -240,7 +241,7 @@ if node[:networking][:wireguard][:enabled]
       }
     end
 
-    search(:node, "roles:mail OR roles:prometheus") do |server|
+    search(:node, "roles:shenron OR roles:prometheus") do |server|
       allowed_ips = server.interfaces(:role => :internal).map do |interface|
         "#{interface[:network]}/#{interface[:prefix]}"
       end
@@ -262,11 +263,31 @@ if node[:networking][:wireguard][:enabled]
       :endpoint => "gate.compton.nu:51820"
     }
 
+    # Grant home
     node.default[:networking][:wireguard][:peers] << {
       :public_key => "RofATnvlWxP3mt87+QKRXFE5MVxtoCcTsJ+yftZYEE4=",
       :allowed_ips => "10.89.122.1/32",
       :endpoint => "gate.firefishy.com:51820"
     }
+
+    # Grant roaming
+    node.default[:networking][:wireguard][:peers] << {
+      :public_key => "YbUkREE9TAmomqgL/4Fh2e5u2Hh7drN/2o5qg3ndRxg=",
+      :allowed_ips => "10.89.123.1/32",
+      :endpoint => "roaming.firefishy.com:51820"
+    }
+  elsif node[:roles].include?("shenron")
+    search(:node, "roles:gateway") do |gateway|
+      allowed_ips = gateway.interfaces(:role => :internal).map do |interface|
+        "#{interface[:network]}/#{interface[:prefix]}"
+      end
+
+      node.default[:networking][:wireguard][:peers] << {
+        :public_key => gateway[:networking][:wireguard][:public_key],
+        :allowed_ips => allowed_ips,
+        :endpoint => "#{gateway.name}:51820"
+      }
+    end
   end
 
   template "/etc/systemd/network/wireguard.netdev" do
@@ -512,16 +533,24 @@ if node[:networking][:wireguard][:enabled]
   end
 end
 
+file "/etc/shorewall/masq" do
+  action :delete
+end
+
+file "/etc/shorewall/masq.bak" do
+  action :delete
+end
+
 if node[:roles].include?("gateway")
-  template "/etc/shorewall/masq" do
-    source "shorewall-masq.erb"
+  template "/etc/shorewall/snat" do
+    source "shorewall-snat.erb"
     owner "root"
     group "root"
     mode "644"
     notifies :restart, "service[shorewall]"
   end
 else
-  file "/etc/shorewall/masq" do
+  file "/etc/shorewall/snat" do
     action :delete
     notifies :restart, "service[shorewall]"
   end