summaryrefslogtreecommitdiff
path: root/inventory/host_vars/ch-iot.yml
blob: 3772e9a624272fef475a70b06e1b7eea5abd7457 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
---
install_jumphost: ch-jump

install:
  vm:
    memory: 1G
    numcpus: 1
    autostart: yes
  disks:
    primary: /dev/sda
    scsi:
      sda:
        type: zfs
        name: root
        size: 5g
  interfaces:
  - bridge: br-svc
    name: svc0
  - bridge: br-iot
    name: iot0

network:
  nameservers: "{{ network_zones.svc.dns }}"
  domain: "{{ host_domain }}"
  systemd_link:
    interfaces: "{{ install.interfaces }}"
  primary: &_network_primary_
    name: svc0
    address: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets[inventory_hostname]) }}"
    gateway: "{{ network_zones.svc.gateway }}"
    static_routes:
    - destination: "{{ network_zones.lan.prefix }}"
      gateway: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets['ch-gw-lan']) | ansible.utils.ipaddr('address') }}"
  interfaces:
  - *_network_primary_
  - name: iot0
    address: "{{ network_zones.iot.prefix | ansible.utils.ipaddr(network_zones.iot.offsets[inventory_hostname]) }}"


ntp_variant: chrony

ntp_client:
  pools:
  - name: at.pool.ntp.org
    options: iburst

ntp_server:
  allow:
  - "{{ network_zones.iot.prefix }}"


spreadspace_apt_repo_components:
  - prometheus


prometheus_exporters_extra:
  - chrony
  - mosquitto

prometheus_job_multitarget_blackbox__probe:
  ch-mon:
  - instance: "ssh-{{ inventory_hostname }}"
    target: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}:{{ ansible_port | default(22) }}"
    module: ssh_banner
  - instance: "mqtt-mqtt.chaos-at-home.org"
    target: "{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}:1883"
    module: "tcp_tls_connect"
    hostname: "mqtt.chaos-at-home.org"


managed_ca_authorities:
  mqtt:
    key:
      type: RSA
      size: 4096
    cert:
      common_name: chaos-at-home CA for mqtt
      not_before: +0h
      not_after: +2080w # ~40 years


mosquitto_broker_global_config_options:
  per_listener_settings: "true"

mosquitto_broker_listeners:
  iot:
    bind: "1883 {{ network_zones.iot.prefix | ansible.utils.ipaddr(network_zones.iot.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}"
    options:
      allow_anonymous: "false"
      acl_file: /etc/mosquitto/iot.acl
      password_file: /etc/mosquitto/iot.passwd
  svc:
    bind: "1883 {{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}"
    hostnames:
    - mqtt.chaos-at-home.org
    tls:
      certificate_provider: managed-ca
      certificate_config:
        ca:
          host: ch-iot
          name: mqtt
        cert:
          san_extra:
          - "IP:{{ network_zones.svc.prefix | ansible.utils.ipaddr(network_zones.svc.offsets[inventory_hostname]) | ansible.utils.ipaddr('address') }}"
          extended_key_usage:
          - serverAuth
          extended_key_usage_critical: yes
          create_subject_key_identifier: yes
          not_after: +100w
    options:
      allow_anonymous: "false"
      require_certificate: "true"
      cafile: /etc/mosquitto/ca_certificates/svc-ca-crt.pem
      use_identity_as_username: "true"
      # acl_file: /etc/mosquitto/svc.acl

mosquitto_broker_prometheus_listener: true

mosquitto_broker_acl_files:
  iot: |
    user test
    topic write test/+
  # svc: |
  #   user nodered
  #   topic read test/+

mosquitto_broker_password_files:
  iot: |
    test:{{ vault_mosquitto_broker_passwords.iot.test | mosquitto_passwd_hash('admin@mqtt.example.com') }}