summaryrefslogtreecommitdiff
path: root/inventory/host_vars/ele-router-orpheum.yml
diff options
context:
space:
mode:
Diffstat (limited to 'inventory/host_vars/ele-router-orpheum.yml')
-rw-r--r--inventory/host_vars/ele-router-orpheum.yml81
1 files changed, 76 insertions, 5 deletions
diff --git a/inventory/host_vars/ele-router-orpheum.yml b/inventory/host_vars/ele-router-orpheum.yml
index 867f29be..890bd293 100644
--- a/inventory/host_vars/ele-router-orpheum.yml
+++ b/inventory/host_vars/ele-router-orpheum.yml
@@ -59,6 +59,20 @@ openwrt_network_base:
netmask: "{{ network_mgmt_zone.prefix | ansible.utils.ipaddr('netmask') }}"
accept_ra: 0
+ - name: device
+ options:
+ type: bridge
+ name: "br-mixer"
+ ports:
+ - "eth0.{{ network_zones.mixer.vlan }}"
+
+ - name: interface 'mixer'
+ options:
+ device: "br-mixer"
+ proto: static
+ ipaddr: "{{ network_zones.mixer.prefix | ansible.utils.ipaddr(network_zones.mixer.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}"
+ netmask: "{{ network_zones.mixer.prefix | ansible.utils.ipaddr('netmask') }}"
+ accept_ra: 0
openwrt_dhcp_external:
@@ -117,6 +131,11 @@ openwrt_dhcp_base:
interface: 'mgmt'
ignore: '1'
+ - name: dhcp 'mixer'
+ options:
+ interface: 'mixer'
+ ignore: '1'
+
openwrt_arch: x86
openwrt_target: geode
@@ -169,13 +188,30 @@ openwrt_mixin:
exit 0
/etc/openvpn/mgmt-ca-cert.pem:
- content: "{{ vault_ovpn_mgmt_ca_cert }}"
+ content: "{{ vault_ovpn_ca_cert }}"
/etc/openvpn/mgmt-cert.pem:
- content: "{{ vault_ovpn_mgmt_certs[inventory_hostname] }}"
+ content: "{{ vault_ovpn_certs[inventory_hostname] }}"
/etc/openvpn/mgmt-key.pem:
- content: "{{ vault_ovpn_mgmt_keys[inventory_hostname] }}"
+ content: "{{ vault_ovpn_keys[inventory_hostname] }}"
+ mode: '0400'
+
+ /etc/hotplug.d/openvpn/10-mixer:
+ content: |
+ #!/bin/sh
+ [ "$INSTANCE" != "mixer" ] && exit 0
+ [ "$ACTION" = "up" ] && ip link set up mtu "$3" dev "$2" master "br-mixer"
+ exit 0
+
+ /etc/openvpn/mixer-ca-cert.pem:
+ content: "{{ vault_ovpn_ca_cert }}"
+
+ /etc/openvpn/mixer-cert.pem:
+ content: "{{ vault_ovpn_certs[inventory_hostname] }}"
+
+ /etc/openvpn/mixer-key.pem:
+ content: "{{ vault_ovpn_keys[inventory_hostname] }}"
mode: '0400'
/etc/rc.d/S21nftables:
@@ -209,6 +245,8 @@ openwrt_mixin:
define nic_mgmt = "br-mgmt"
define prefix_mgmt = {{ network_mgmt_zone.prefix }}
+ define nic_mixer = "br-mixer"
+ define prefix_mixer = {{ network_zones.mixer.prefix }}
{% for zone_name in network_internal_zone_names %}
define nic_{{ zone_name }} = eth0.{{ network_zones[zone_name].vlan }}
@@ -221,7 +259,7 @@ openwrt_mixin:
ip protocol icmp accept
ip6 nexthdr ipv6-icmp accept
tcp dport { {{ ansible_port }} } accept
- udp dport { 1194 } accept
+ udp dport { 1194, 1195 } accept
}
chain input_internal {
@@ -231,10 +269,17 @@ openwrt_mixin:
udp dport { bootps, domain, ntp } accept
}
+ chain input_mixer {
+ ip protocol icmp accept
+ ip6 nexthdr ipv6-icmp accept
+ tcp dport { domain } accept
+ udp dport { domain, ntp } accept
+ }
+
chain input {
type filter hook input priority filter; policy drop;
ct state vmap { established: accept, related: accept, invalid: drop }
- iifname vmap { lo: accept, $nic_mgmt: accept{% for zone_name in network_internal_zone_names %}, $nic_{{ zone_name }}: jump input_internal {% endfor %}, $nic_citycom: jump input_external }
+ iifname vmap { lo: accept, $nic_mgmt: accept, $nic_mixer: jump input_mixer{% for zone_name in network_internal_zone_names %}, $nic_{{ zone_name }}: jump input_internal {% endfor %}, $nic_citycom: jump input_external }
}
@@ -338,6 +383,32 @@ openwrt_uci:
data_ciphers_fallback: 'AES-256-GCM'
allow_compression: 'no'
+ - name: openvpn mixer
+ options:
+ enabled: '1'
+ port: '1195'
+ proto: 'udp'
+ dev: 'ovpn-mixer'
+ dev_type: 'tap'
+ remote:
+ - "{{ network_zones.cc_hmtsaal.prefix | ansible.utils.ipaddr(network_zones.cc_hmtsaal.offsets['ele-router-hmtsaal']) | ansible.utils.ipaddr('address') }} 1195"
+
+ client: '1'
+ keepalive: '10 120'
+ persist_key: '1'
+ persist_tun: '1'
+ user: 'nobody'
+
+ tls_version_min: '1.3'
+ ca: '/etc/openvpn/mixer-ca-cert.pem'
+ cert: '/etc/openvpn/mixer-cert.pem'
+ key: '/etc/openvpn/mixer-key.pem'
+ remote_cert_tls: 'server'
+ data_ciphers:
+ - 'CHACHA20-POLY1305'
+ data_ciphers_fallback: 'AES-256-GCM'
+ allow_compression: 'no'
+
prometheus_scrape_endpoint: "{{ network_mgmt_zone.prefix | ansible.utils.ipaddr(network_mgmt_zone.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}:9100"
prometheus_exporters_default: