X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/d67b78773673b939831588836bee081d1360fd3c..95febc9a1032b5ec5c26a56fe39d835638950bf4:/cookbooks/networking/recipes/default.rb diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb index c92ffc4bc..0ae4a12fb 100644 --- a/cookbooks/networking/recipes/default.rb +++ b/cookbooks/networking/recipes/default.rb @@ -104,7 +104,7 @@ node[:networking][:interfaces].each do |name, interface| deviceplan["parameters"]["lacp-rate"] = interface[:bond][:lacprate] if interface[:bond][:lacprate] end - if interface[:gateway] + if interface[:gateway] && interface[:gateway] != interface[:address] if interface[:family] == "inet" default_route = "0.0.0.0/0" elsif interface[:family] == "inet6" @@ -132,48 +132,12 @@ node[:networking][:interfaces].each do |name, interface| "scope" => "link" ) end - - if interface[:role] == "internal" && interface[:gateway] != interface[:address] - search(:node, "networking_interfaces*address:#{interface[:gateway]}") do |gateway| - next unless gateway[:openvpn] - - gateway[:openvpn][:tunnels].each_value do |tunnel| - if tunnel[:peer][:address] - deviceplan["routes"].push( - "to" => "#{tunnel[:peer][:address]}/32", - "via" => interface[:gateway] - ) - - route tunnel[:peer][:address] do - netmask "255.255.255.255" - gateway interface[:gateway] - device interface[:interface] - end - end - - next unless tunnel[:peer][:networks] - - tunnel[:peer][:networks].each do |network| - prefix = IPAddr.new("#{network[:address]}/#{network[:netmask]}").prefix - - deviceplan["routes"].push( - "to" => "#{network[:address]}/#{prefix}", - "via" => interface[:gateway] - ) - - route network[:address] do - netmask network[:netmask] - gateway interface[:gateway] - device interface[:interface] - end - end - end - end - end end if interface[:routes] interface[:routes].each do |to, parameters| + next if parameters[:via] == interface[:address] + route = { "to" => to } @@ -192,7 +156,7 @@ end netplan["network"]["bonds"].each_value do |bond| bond["interfaces"].each do |interface| - netplan["network"]["ethernets"][interface] ||= { "accept-ra" => false } + netplan["network"]["ethernets"][interface] ||= { "accept-ra" => false, "optional" => true } end end @@ -202,6 +166,10 @@ netplan["network"]["vlans"].each_value do |vlan| end end +file "/etc/netplan/00-installer-config.yaml" do + action :delete +end + file "/etc/netplan/01-netcfg.yaml" do action :delete end @@ -222,6 +190,10 @@ package "cloud-init" do end if node[:networking][:wireguard][:enabled] + wireguard_id = persistent_token("networking", "wireguard") + + node.default[:networking][:wireguard][:address] = "fd43:e709:ea6d:1:#{wireguard_id[0, 4]}:#{wireguard_id[4, 4]}:#{wireguard_id[8, 4]}:#{wireguard_id[12, 4]}" + package "wireguard-tools" do compile_time true end @@ -238,11 +210,11 @@ if node[:networking][:wireguard][:enabled] owner "root" group "systemd-network" mode "640" - content %x{wg genkey} + content %x(wg genkey) compile_time true end - node.default[:networking][:wireguard][:public_key] = %x{wg pubkey < /var/lib/systemd/wireguard/private.key} + node.default[:networking][:wireguard][:public_key] = %x(wg pubkey < /var/lib/systemd/wireguard/private.key).chomp file "/var/lib/systemd/wireguard/preshared.key" do action :create_if_missing @@ -252,11 +224,76 @@ if node[:networking][:wireguard][:enabled] content keys["wireguard"] end + if node[:roles].include?("gateway") + search(:node, "roles:gateway") do |gateway| + next if gateway.name == node.name + next unless gateway[:networking][:wireguard] && gateway[:networking][:wireguard][:enabled] + + allowed_ips = gateway.interfaces(:role => :internal).map do |interface| + "#{interface[:network]}/#{interface[:prefix]}" + end + + node.default[:networking][:wireguard][:peers] << { + :public_key => gateway[:networking][:wireguard][:public_key], + :allowed_ips => allowed_ips, + :endpoint => "#{gateway.name}:51820" + } + end + + search(:node, "roles:shenron OR roles:prometheus") do |server| + allowed_ips = server.interfaces(:role => :internal).map do |interface| + "#{interface[:network]}/#{interface[:prefix]}" + end + + if server[:networking][:private_address] + allowed_ips << "#{server[:networking][:private_address]}/32" + end + + node.default[:networking][:wireguard][:peers] << { + :public_key => server[:networking][:wireguard][:public_key], + :allowed_ips => allowed_ips, + :endpoint => "#{server.name}:51820" + } + end + + node.default[:networking][:wireguard][:peers] << { + :public_key => "7Oj9ufNlgidyH/xDc+aHQKMjJPqTmD/ab13agMh6AxA=", + :allowed_ips => "10.0.16.1/32", + :endpoint => "gate.compton.nu:51820" + } + + # Grant home + node.default[:networking][:wireguard][:peers] << { + :public_key => "RofATnvlWxP3mt87+QKRXFE5MVxtoCcTsJ+yftZYEE4=", + :allowed_ips => "10.89.122.1/32", + :endpoint => "gate.firefishy.com:51820" + } + + # Grant roaming + node.default[:networking][:wireguard][:peers] << { + :public_key => "YbUkREE9TAmomqgL/4Fh2e5u2Hh7drN/2o5qg3ndRxg=", + :allowed_ips => "10.89.123.1/32", + :endpoint => "roaming.firefishy.com:51820" + } + elsif node[:roles].include?("shenron") + search(:node, "roles:gateway") do |gateway| + allowed_ips = gateway.interfaces(:role => :internal).map do |interface| + "#{interface[:network]}/#{interface[:prefix]}" + end + + node.default[:networking][:wireguard][:peers] << { + :public_key => gateway[:networking][:wireguard][:public_key], + :allowed_ips => allowed_ips, + :endpoint => "#{gateway.name}:51820" + } + end + end + template "/etc/systemd/network/wireguard.netdev" do source "wireguard.netdev.erb" owner "root" - group "root" - mode "644" + group "systemd-network" + mode "640" end template "/etc/systemd/network/wireguard.network" do @@ -266,19 +303,35 @@ if node[:networking][:wireguard][:enabled] mode "644" end - execute "ip-link-delete-wg0" do - action :nothing - command "ip link delete wg0" - subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" - only_if { ::File.exist?("/sys/class/net/wg0") } - end + if node[:lsb][:release].to_f < 20.04 + execute "ip-link-delete-wg0" do + action :nothing + command "ip link delete wg0" + subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" + only_if { ::File.exist?("/sys/class/net/wg0") } + end + + service "systemd-networkd" do + action :nothing + subscribes :restart, "template[/etc/systemd/network/wireguard.netdev]" + subscribes :restart, "template[/etc/systemd/network/wireguard.network]" + not_if { kitchen? } + end + else + execute "networkctl-delete-wg0" do + action :nothing + command "networkctl delete wg0" + subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" + only_if { ::File.exist?("/sys/class/net/wg0") } + end - execute "networkctl-reload" do - action :nothing - command "networkctl reload" - subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" - subscribes :run, "template[/etc/systemd/network/wireguard.network]" - not_if { ENV.key?("TEST_KITCHEN") } + execute "networkctl-reload" do + action :nothing + command "networkctl reload" + subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" + subscribes :run, "template[/etc/systemd/network/wireguard.network]" + not_if { kitchen? } + end end end @@ -290,7 +343,7 @@ end execute "hostnamectl-set-hostname" do command "hostnamectl set-hostname #{node[:networking][:hostname]}" notifies :reload, "ohai[reload-hostname]" - not_if { ENV.key?("TEST_KITCHEN") || node[:hostnamectl][:static_hostname] == node[:networking][:hostname] } + not_if { kitchen? || node[:hostnamectl][:static_hostname] == node[:networking][:hostname] } end template "/etc/hosts" do @@ -298,7 +351,7 @@ template "/etc/hosts" do owner "root" group "root" mode "644" - not_if { ENV["TEST_KITCHEN"] } + not_if { kitchen? } end service "systemd-resolved" do @@ -320,9 +373,8 @@ template "/etc/systemd/resolved.conf.d/99-chef.conf" do end if node[:filesystem][:by_mountpoint][:"/etc/resolv.conf"] - mount "/etc/resolv.conf" do - action :umount - device node[:filesystem][:by_mountpoint][:"/etc/resolv.conf"][:devices].first + execute "umount-resolve-conf" do + command "umount -c /etc/resolv.conf" end end @@ -346,6 +398,13 @@ end package "shorewall" +systemd_service "shorewall-docker" do + service "shorewall" + dropin "docker" + exec_stop "/sbin/shorewall $OPTIONS stop" + notifies :restart, "service[shorewall]" +end + template "/etc/default/shorewall" do source "shorewall-default.erb" owner "root" @@ -406,7 +465,6 @@ template "/etc/shorewall/policy" do end template "/etc/shorewall/rules" do - action :nothing source "shorewall-rules.erb" owner "root" group "root" @@ -415,9 +473,12 @@ template "/etc/shorewall/rules" do notifies :restart, "service[shorewall]" end -notify_group "shorewall-rules" do - action :run - notifies :create, "template[/etc/shorewall/rules]" +template "/etc/shorewall/stoppedrules" do + source "shorewall-stoppedrules.erb" + owner "root" + group "root" + mode "644" + notifies :restart, "service[shorewall]" end if node[:networking][:firewall][:enabled] @@ -425,12 +486,14 @@ if node[:networking][:firewall][:enabled] action [:enable, :start] supports :restart => true status_command "shorewall status" + ignore_failure true end else service "shorewall" do action [:disable, :stop] supports :restart => true status_command "shorewall status" + ignore_failure true end end @@ -452,21 +515,16 @@ firewall_rule "limit-icmp-echo" do rate_limit "s:1/sec:5" end -%w[ucl ams bm].each do |zone| - firewall_rule "accept-openvpn-#{zone}" do - action :accept - source zone - dest "fw" - proto "udp" - dest_ports "1194:1197" - source_ports "1194:1197" - end -end - if node[:networking][:wireguard][:enabled] + wireguard_source = if node[:roles].include?("gateway") + "net" + else + "osm" + end + firewall_rule "accept-wireguard" do action :accept - source "osm" + source wireguard_source dest "fw" proto "udp" dest_ports "51820" @@ -474,16 +532,24 @@ if node[:networking][:wireguard][:enabled] end end +file "/etc/shorewall/masq" do + action :delete +end + +file "/etc/shorewall/masq.bak" do + action :delete +end + if node[:roles].include?("gateway") - template "/etc/shorewall/masq" do - source "shorewall-masq.erb" + template "/etc/shorewall/snat" do + source "shorewall-snat.erb" owner "root" group "root" mode "644" notifies :restart, "service[shorewall]" end else - file "/etc/shorewall/masq" do + file "/etc/shorewall/snat" do action :delete notifies :restart, "service[shorewall]" end @@ -552,7 +618,6 @@ unless node.interfaces(:family => :inet6).empty? end template "/etc/shorewall6/rules" do - action :nothing source "shorewall-rules.erb" owner "root" group "root" @@ -561,22 +626,19 @@ unless node.interfaces(:family => :inet6).empty? notifies :restart, "service[shorewall6]" end - notify_group "shorewall6-rules" do - action :run - notifies :create, "template[/etc/shorewall6/rules]" - end - if node[:networking][:firewall][:enabled] service "shorewall6" do action [:enable, :start] supports :restart => true status_command "shorewall6 status" + ignore_failure true end else service "shorewall6" do action [:disable, :stop] supports :restart => true status_command "shorewall6 status" + ignore_failure true end end