path: root/inventory/group_vars/accesspoints/vars.yml

---
accesspoint_wired_interface: eth0

accesspoint_wireless_frequency_bands:
  - 2g
  - 5g

accesspoint_wifi_device_htmode:
  2g: "HT20"
  5g: "VHT80"

accesspoint_wireless_device_paths:
  2g: "platform/ahb/18100000.wmac"
  5g: "pci0000:00/0000:00:00.0"


accesspoint_network_base: "{{ accesspoint_network_base_yaml | from_yaml }}"
accesspoint_network_base_yaml: |
  - name: globals 'globals'
    options:
      ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"

  - name: interface 'loopback'
    options:
      device: lo
      proto: static
      ipaddr: 127.0.0.1
      netmask: 255.0.0.0

  {% if 'vlan' in network_mgmt_zone %}
  - name: device
    options:
      type: 8021q
      ifname: "{{ accesspoint_wired_interface }}"
      vid: {{ network_mgmt_zone.vlan }}
      name: "{{ accesspoint_wired_interface }}.{{ network_mgmt_zone.vlan }}"

  {% endif %}
  - name: interface 'mgmt'
    options:
      device: "{{ accesspoint_wired_interface }}{% if 'vlan' in network_mgmt_zone %}.{{ network_mgmt_zone.vlan }}{% endif %}"
      accept_ra: 0
      proto: static
      ipaddr: "{{ network_mgmt_zone.prefix | ansible.utils.ipaddr(network_mgmt_zone.offsets[inventory_hostname]) }}"


accesspoint_network_zones: "{{ accesspoint_network_zones_yaml | from_yaml }}"
accesspoint_network_zones_yaml: |
  {% for zone_name in accesspoint_zones.keys() %}
  - name: device
    options:
      type: 8021q
      ifname: "{{ accesspoint_wired_interface }}"
      vid: {{ network_zones[zone_name].vlan }}
      name: "{{ accesspoint_wired_interface }}.{{ network_zones[zone_name].vlan }}"

  - name: device
    options:
      type: bridge
      name: "br-{{ zone_name }}"
      ports:
      - "{{ accesspoint_wired_interface }}.{{ network_zones[zone_name].vlan }}"

  - name: "interface '{{ zone_name }}'"
    options:
      device: "br-{{ zone_name }}"
      accept_ra: 0
      proto: none
  {% endfor %}



accesspoint_wireless_devices: "{{ accesspoint_wireless_devices_yaml | from_yaml }}"
accesspoint_wireless_devices_yaml: |
  {% for band in accesspoint_wireless_frequency_bands %}
  - name: wifi-device 'radio{{ band }}'
    options:
      type: 'mac80211'
      channel: "{{ accesspoint_wifi_channels[band][inventory_hostname] }}"
      band: '{{ band }}'
      country: AT
      path: "{{ accesspoint_wireless_device_paths[band] }}"
      htmode: '{{ accesspoint_wifi_device_htmode[band] }}'
      cell_density: '0'
  {%   set txpower = accesspoint_wifi_txpower[band][inventory_hostname] %}
  {%   if txpower is defined %}
      txpower: '{{ txpower }}'
  {%   endif %}
  {% endfor %}


accesspoint_wireless_ifaces: "{{ accesspoint_wireless_ifaces_yaml | from_yaml }}"
accesspoint_wireless_ifaces_yaml: |
  {% for zone in accesspoint_zones.keys() %}
  {%   set outer_loop = loop %}
  {%   for band in accesspoint_wireless_frequency_bands %}
  - name: wifi-iface '{{ zone }}{{ band }}'
    options:
      device: 'radio{{ band }}'
      network: '{{ zone }}'
      mode: 'ap'
      ssid: '{{ accesspoint_zones[zone].ssid }}'
      encryption: '{{ accesspoint_zones[zone].encryption }}'
      key: '{{ accesspoint_zones[zone].key }}'
      disassoc_low_ack: '1'
      rsn_preauth: '1'
  {%     if accesspoint_80211r is defined %}
      ieee80211r: '1'
      mobility_domain: '{{ "%04x" % (accesspoint_80211r.mobility_domain_base + outer_loop.index0) }}'
      ft_over_ds: '1'
  {%     endif %}
  {%     if accesspoint_client_steering is defined %}
      bss_transition: '1'
      wnm_sleep_mode: '1'
      time_advertisement: '2'
      time_zone: 'CET-1CEST,M3.5.0,M10.5.0/3'
      ieee80211k: '1'
      rrm_neighbor_report: '1'
      rrm_beacon_report: '1'
  {%     endif %}
  {%   endfor %}
  {% endfor %}




openwrt_arch: ath79
openwrt_target: generic
openwrt_profile: ubnt_unifiac-lite
openwrt_output_image_suffixes:
  - "{{ openwrt_target }}-{{ openwrt_profile }}-squashfs-sysupgrade.bin"

openwrt_packages_remove:
  - ppp
  - ppp-mod-pppoe
  - dnsmasq
  - firewall
  - firewall4
  - odhcpd
  - odhcpd-ipv6only
  - wpad-basic-wolfssl
openwrt_packages_add:
  - hostapd-wolfssl
  - haveged
  - htop
  - ip
  - nftables
  - less
  - nano
  - tcpdump-mini
  - horst
  - prometheus-node-exporter-lua
  - prometheus-node-exporter-lua-nat_traffic
  - prometheus-node-exporter-lua-netstat
  - prometheus-node-exporter-lua-openwrt
  ## we will install a custom version of these collectors, see below
  #- prometheus-node-exporter-lua-wifi
  #- prometheus-node-exporter-lua-wifi_stations
  ## manually install dependencies for wifi-collectors
  - libiwinfo-lua
  - libubus-lua

_accesspoint_client_steering_packages_extra_:
  none: []
  dawn:
  - dawn
  usteer:
  - usteer

openwrt_packages_extra: "{{ _accesspoint_client_steering_packages_extra_[accesspoint_client_steering.kind | default('none')] }}"


openwrt_mixin:
  /etc/sysctl.conf:
    content: |
      # Defaults are configured in /etc/sysctl.d/* and can be customized in this file
      #
      # disable IP forwarding, we don't need it since we are
      # only an AP that bridges VLANs to Wifi SSIDs
      net.ipv4.conf.default.forwarding=0
      net.ipv4.conf.all.forwarding=0
      net.ipv4.ip_forward=0
      net.ipv6.conf.default.forwarding=0
      net.ipv6.conf.all.forwarding=0

  /etc/dropbear/authorized_keys:
    content: "{{ ssh_keys_root | join('\n') }}\n"

  /etc/htoprc:
    file: "{{ global_files_dir }}/common/htoprc"

  /etc/rc.d/S21nftables:
    link: "../init.d/nftables"

  /etc/rc.d/K89nftables:
    link: "../init.d/nftables"

  /etc/init.d/nftables:
    mode: "0755"
    content: |
      #!/bin/sh /etc/rc.common

      START=21
      STOP=89

      start() {
        nft -f /etc/nftables.conf
      }

      stop() {
        nft flush ruleset
      }

  /etc/nftables.conf:
    content: |
      flush ruleset

      define nic_mgmt = {{ accesspoint_wired_interface }}.{{ network_zones.mgmt.vlan }}

      table inet global {
        chain input {
          type filter hook input priority filter; policy drop;
          ct state vmap { established: accept, related: accept, invalid: drop }
          iifname vmap { lo: accept, $nic_mgmt: accept }
        }

        chain forward {
          type filter hook forward priority filter; policy drop;
        }
      }

  /usr/lib/lua/prometheus-collectors/wifi.lua:
    mode: "0755"
    content: |
      -- This is a custom version of the upstream wifi and wifi_stations collectors. We want
      -- to know the number of stations connected but for privacy and metric cardinality
      -- reasons we don't care for MAC addresses and other details of all connected stations.

      local ubus = require "ubus"
      local iwinfo = require "iwinfo"

      local function scrape()
        local metric_wifi_network_quality = metric("wifi_network_quality","gauge")
        local metric_wifi_network_bitrate = metric("wifi_network_bitrate","gauge")
        local metric_wifi_network_noise = metric("wifi_network_noise_dbm","gauge")
        local metric_wifi_network_signal = metric("wifi_network_signal_dbm","gauge")
        local metric_wifi_stations = metric("wifi_stations", "gauge")

        local u = ubus.connect()
        local status = u:call("network.wireless", "status", {})

        for dev, dev_table in pairs(status) do
          for _, intf in ipairs(dev_table['interfaces']) do
            local ifname = intf['ifname']
            if ifname ~= nil then
              local iw = iwinfo[iwinfo.type(ifname)]
              local labels = {
                channel = iw.channel(ifname),
                ssid = iw.ssid(ifname),
                bssid = string.lower(iw.bssid(ifname)),
                mode = iw.mode(ifname),
                ifname = ifname,
                country = iw.country(ifname),
                frequency = iw.frequency(ifname),
                device = dev,
              }

              local qc = iw.quality(ifname) or 0
              local qm = iw.quality_max(ifname) or 0
              local quality = 0
              if qc > 0 and qm > 0 then
                quality = math.floor((100 / qm) * qc)
              end
              local stations = 0
              local assoclist = iw.assoclist(ifname)
              for _, _ in pairs(assoclist) do
                 stations = stations + 1
              end

              metric_wifi_network_quality(labels, quality)
              metric_wifi_network_noise(labels, iw.noise(ifname) or 0)
              metric_wifi_network_bitrate(labels, iw.bitrate(ifname) or 0)
              metric_wifi_network_signal(labels, iw.signal(ifname) or -255)
              metric_wifi_stations(labels, stations)
            end
          end
        end
      end

      return { scrape = scrape }

  /usr/bin/list-stations:
    mode: "0755"
    file: "{{ global_files_dir }}/common/openwrt/list-stations"


openwrt_uci_base:
  system:
    - name: system
      options:
        hostname: '{{ inventory_hostname }}'
        timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
        ttylogin: '0'
        log_size: '64'
        urandom_seed: '0'

    - name: timeserver 'ntp'
      options:
        enabled: '{{ accesspoint_ntp_servers is defined | ternary("1", "0") }}'
        enable_server: '0'
        server: "{{ accesspoint_ntp_servers | default([]) }}"

    - name: led
      options:
        sysfs: blue:dome
        trigger: none

    - name: led
      options:
        sysfs: white:dome
        trigger: default-on
        default: 0

  dropbear:
    - name: dropbear
      options:
        PasswordAuth: 'off'
        RootPasswordAuth: 'off'
        Port: '{{ ansible_port }}'

  uhttpd:
    - name: uhttpd main
      options:
        enabled: '0'

  prometheus-node-exporter-lua:
    - name: prometheus-node-exporter-lua 'main'
      options:
        listen_interface: 'mgmt'
        listen_port: '9100'

  network: "{{ accesspoint_network_base + accesspoint_network_zones }}"
  wireless: "{{ accesspoint_wireless_devices + accesspoint_wireless_ifaces }}"


_accesspoint_client_steering_options_default_:
  dawn:
    network:
      broadcast_ip: "{{ network_mgmt_zone.prefix | ansible.utils.ipaddr('broadcast') }}"
  usteer:
    network: 'mgmt'
    syslog: '1'
    local_mode: '0'
    ipv6: '0'
    debug_level: '2'

openwrt_uci_client_steering: "{{ openwrt_uci_client_steering_yaml | from_yaml }}"
openwrt_uci_client_steering_yaml: |
  {% if accesspoint_client_steering is defined %}
  {%   if accesspoint_client_steering.kind == 'dawn' %}
  umdns:
    - name: umds
      options:
        jail: '1'
        network:
        - mgmt

  dawn:
  {%     for section, options in (_accesspoint_client_steering_options_default_.dawn | combine(accesspoint_client_steering.options | default({}))).items() %}
    - name: {{ section }}
      options:
  {%       for option, value in options.items() %}
        {{ option }}: {{ value }}
  {%       endfor %}
  {%     endfor %}
  {%   elif accesspoint_client_steering.kind == 'usteer' %}
  usteer:
    - name: usteer
      options:
  {%     for option,value in (_accesspoint_client_steering_options_default_.usteer | combine(accesspoint_client_steering.options | default({}))).items() %}
        {{ option }}: {{ value }}
  {%     endfor %}
  {%   endif %}
  {% endif %}


openwrt_uci: "{{ openwrt_uci_base | combine(accesspoint_client_steering is defined | ternary(openwrt_uci_client_steering, {})) }}"