path: root/inventory/host_vars/ele-router.yml

---
ssh_users_root:
  - equinox
  - datacop

wireguard_keys:
  gwhetzner:
    pub: "fqaKDJbSj6V0H98d78d/lnFLolefgp6zDPH9bN4+zUY="
    priv: "{{ vault_wireguard_priv_keys.gwhetzner }}"

wireguard_gateway_tunnels:
  wg-emc:
    priv_key: "{{ wireguard_keys.gwhetzner.priv }}"
    addresses:
    - 192.168.254.6/30
    default_gateway:
      inner: 192.168.254.5
    peers:
    - pub_key: "{{ hostvars['ele-gwhetzner'].wireguard_keys.emc.pub }}"
      endpoint:
        host: 178.63.180.138 # TODO: fix this variable "{{ hostvars['ele-gwhetzner'].external_ip }}"
        port: 51821
      keepalive_interval: 15
      allowed_ips:
      - 0.0.0.0/0



network_mgmt_zone: "{{ network_zones.mgmt }}"
network_internal_zone_names__emc:
  - emc
network_internal_zone_names__wan:
  - lan
  - guest
  - mixer
  - infoscreens

network_internal_zone_names: "{{ network_internal_zone_names__wan + network_internal_zone_names__emc }}"


openwrt_network_external:
  - name: switch_vlan
    options:
      device: 'switch0'
      ## for some reason vlan-id 502 does not work. why??
      #vlan: '{{ network_zones.forum_a1.vlan }}'
      vlan: '1'
      ports: '4 6t'

  - name: interface 'wanforum'
    options:
      ## for some reason vlan-id 502 does not work. why??
      #ifname: 'eth0.{{ network_zones.forum_a1.vlan }}'
      ifname: 'eth0.1'
      proto: dhcp
      defaultroute: '0' ## see static route 'forumdefault' below
      accept_ra: 0

  - name: rule
    options:
      priority: 40000
      lookup: 101

  - name: route 'forumdefault'
    options:
      interface: 'wanforum'
      table: 101
      target: '0.0.0.0/0'
      gateway: 192.168.0.254 ## A1 router @ForumStadtpark uses this address


  - name: switch_vlan
    options:
      device: 'switch0'
      ## for some reason vlan-id 502 does not work. why??
      #vlan: '{{ network_zones.funkfeuer.vlan }}'
      vlan: '2'
      ports: '3 6t'

  - name: interface 'wanff'
    options:
      ## for some reason vlan-id 502 does not work. why??
      #ifname: 'eth0.{{ network_zones.funkfeuer.vlan }}'
      ifname: 'eth0.2'
      proto: static
      ipaddr: "{{ network_zones.funkfeuer.prefix | ipaddr(network_zones.funkfeuer.offsets[inventory_hostname]) | ipaddr('address') }}"
      netmask: "{{ network_zones.funkfeuer.prefix | ipaddr('netmask') }}"
      accept_ra: 0

  - name: rule
    options:
      priority: 39000
      src: "{{ network_zones.funkfeuer.prefix | ipaddr(network_zones.funkfeuer.offsets[inventory_hostname]) | ipaddr('address') }}/32"
      lookup: 102

  - name: rule
    options:
      priority: 39001
      mark: 102
      lookup: 102

  - name: route 'ffdefault'
    options:
      interface: 'wanff'
      table: 102
      target: '0.0.0.0/0'
      gateway: "{{ network_zones.funkfeuer.gateway }}"


  - name: switch_vlan
    options:
      device: 'switch0'
      ## for some reason vlan-id 512 does not work. why??
      #vlan: '{{ network_zones.datacop_lte.vlan }}'
      vlan: '3'
      ports: '2 6t'

  - name: interface 'wanlte'
    options:
      ## for some reason vlan-id 512 does not work. why??
      #ifname: 'eth0.{{ network_zones.datacop_lte.vlan }}'
      ifname: 'eth0.3'
      proto: static
      ipaddr: "{{ network_zones.datacop_lte.prefix | ipaddr(network_zones.datacop_lte.offsets[inventory_hostname]) | ipaddr('address') }}"
      netmask: "{{ network_zones.datacop_lte.prefix | ipaddr('netmask') }}"
      accept_ra: 0

  - name: rule
    options:
      priority: 38000
      src: "{{ network_zones.datacop_lte.prefix | ipaddr(network_zones.datacop_lte.offsets[inventory_hostname]) | ipaddr('address') }}/32"
      lookup: 103

  - name: rule
    options:
      priority: 38001
      mark: 103
      lookup: 103

  - name: route 'ltedefault'
    options:
      interface: 'wanlte'
      table: 103
      target: '0.0.0.0/0'
      gateway: "{{ network_zones.datacop_lte.gateway }}"



openwrt_network_internal: "{{ openwrt_network_internal_yaml | from_yaml }}"
openwrt_network_internal_yaml: |
  {% for zone_name in network_internal_zone_names %}
  - name: switch_vlan
    options:
      device: 'switch0'
      vlan: '{{ network_zones[zone_name].vlan }}'
      ports: '0t 6t'

  - name: "interface '{{ zone_name }}'"
    options:
      ifname: "eth0.{{ network_zones[zone_name].vlan }}"
      proto: static
      ipaddr: "{{ network_zones[zone_name].gateway }}"
      netmask: "{{ network_zones[zone_name].prefix | ipaddr('netmask') }}"
      accept_ra: 0
  {%   if zone_name in network_internal_zone_names__emc %}

  - name: rule
    options:
      priority: 33000
      in: "{{ zone_name }}"
      lookup: 200
  {%   endif %}
  {% endfor %}

openwrt_network_base:
  - name: globals 'globals'
    options:
      ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"

  - name: interface 'loopback'
    options:
      ifname: lo
      proto: static
      ipaddr: 127.0.0.1
      netmask: 255.0.0.0

  - name: switch
    options:
      name: 'switch0'
      reset: '1'
      enable_vlan: '1'

  - name: switch_vlan
    options:
      device: 'switch0'
      vlan: '{{ network_mgmt_zone.vlan }}'
      ports: '0t 1 6t'

  - name: interface 'mgmt'
    options:
      ifname: "eth0.{{ network_mgmt_zone.vlan }}"
      proto: static
      ipaddr: "{{ network_mgmt_zone.prefix | ipaddr(network_mgmt_zone.offsets[inventory_hostname]) | ipaddr('address') }}"
      netmask: "{{ network_mgmt_zone.prefix | ipaddr('netmask') }}"
      accept_ra: 0


openwrt_dhcp_external:
  - name: dhcp 'wanforum'
    options:
      interface: 'wanforum'
      ignore: '1'

  - name: dhcp 'wanff'
    options:
      interface: 'wanff'
      ignore: '1'

  - name: dhcp 'wanlte'
    options:
      interface: 'wanlte'
      ignore: '1'

openwrt_dhcp_internal: "{{ openwrt_dhcp_internal_yaml | from_yaml }}"
openwrt_dhcp_internal_yaml: |
  {% for zone_name in network_internal_zone_names %}
  - name: "dhcp '{{ zone_name }}'"
    options:
      interface: "{{ zone_name }}"
  {%  if 'dhcp' in network_zones[zone_name] %}
      start: {{ network_zones[zone_name].dhcp.start }}
      limit: {{ network_zones[zone_name].dhcp.limit }}
      leasetime: {{ network_zones[zone_name].dhcp.leasetime | default('12h') }}
      dhcpv6: 'disabled'
      ra: 'disabled'
  {%  else %}
      ignore: '1'
  {%  endif %}
  {% endfor %}

openwrt_dhcp_base:
  - name: dnsmasq
    options:
      domainneeded: '1'
      boguspriv: '0'
      filterwin2k: '0'
      localise_queries: '1'
      rebind_protection: '0'
      rebind_localhost: '1'
      local: '/lan/'
      domain: 'lan'
      expandhosts: '1'
      nonegcache: '0'
      authoritative: '1'
      readethers: '1'
      leasefile: '/tmp/dhcp.leases'
      resolvfile: '/tmp/resolv.conf.auto'
      localservice: '1'

  - name: odhcpd 'odhcpd'
    options:
      maindhcp: '0'
      leasefile: '/tmp/hosts/odhcpd'
      leasetrigger: '/usr/sbin/odhcpd-update'

  - name: dhcp 'mgmt'
    options:
      interface: 'mgmt'
      ignore: '1'



openwrt_variant: openwrt
openwrt_release: 19.07.1
openwrt_arch: ramips
openwrt_target: mt7621
openwrt_profile: ubnt-erx
openwrt_output_image_suffixes:
  - "{{ openwrt_profile }}-squashfs-sysupgrade.bin"

openwrt_packages_remove:
  - ppp
  - ppp-mod-pppoe
  - firewall
  - odhcpd-ipv6only
openwrt_packages_add:
  - kmod-ipt-nat
  - haveged
  - htop
  - ip
  - less
  - nano
  - tcpdump-mini
  - iperf
  - mtr
  - iptraf-ng
  - qos-scripts
  - wireguard


openwrt_mixin:
  /etc/dropbear/authorized_keys:
    content: "{{ ssh_keys_root | join('\n') }}\n"

  /etc/htoprc:
    file: "{{ global_files_dir }}/common/htoprc"

  /etc/wireguard/wg-emc.priv:
    content: "{{ wireguard_gateway_tunnels['wg-emc'].priv_key }}\n"
    mode: "0600"

  /etc/rc.d/S21network-emc:
    link: "../init.d/network-emc"

  /etc/rc.d/K91network-emc:
    link: "../init.d/network-emc"

  /etc/init.d/network-emc:
    mode: "0755"
    content: |
      #!/bin/sh /etc/rc.common

      START=21
      STOP=91

      start() {
        ip link add dev wg-emc type wireguard
        wg set wg-emc fwmark 102 private-key /etc/wireguard/wg-emc.priv

      {% for peer in wireguard_gateway_tunnels['wg-emc'].peers %}
        wg set wg-emc peer {{ peer.pub_key }} endpoint {{ peer.endpoint.host }}:{{ peer.endpoint.port }} persistent-keepalive {{ peer.keepalive_interval }} allowed-ips {{ peer.allowed_ips | join(',') }}
      {% endfor %}

      {% for addr in wireguard_gateway_tunnels['wg-emc'].addresses %}
        ip addr add dev wg-emc {{ addr }}
      {% endfor %}
        ip link set up dev wg-emc

        ip route add default via {{ wireguard_gateway_tunnels['wg-emc'].default_gateway.inner }} table 200 proto static
      }

      stop() {
        ip link del dev wg-emc
        ip rule del pref 33000
      }

  /etc/rc.d/S22network-fw:
    link: "../init.d/network-fw"

  /etc/rc.d/K92network-fw:
    link: "../init.d/network-fw"

  /etc/init.d/network-fw:
    mode: "0755"
    content: |
      #!/bin/sh /etc/rc.common

      START=22
      STOP=91

      start() {
        WAN_IF=$(uci get network.wanforum.ifname)
        FF_IF=$(uci get network.wanff.ifname)
        LTE_IF=$(uci get network.wanlte.ifname)
        MGMT_IF=$(uci get network.mgmt.ifname)
        MGMT_IPADDR=$(uci get network.mgmt.ipaddr)
        MGMT_NETMASK=$(uci get network.mgmt.netmask)


        iptables -A INPUT -i lo -d 127.0.0.0/8 -s 127.0.0.0/8 -j ACCEPT
        iptables -A INPUT -i "$MGMT_IF" -d "$MGMT_IPADDR" -s "$MGMT_IPADDR/$MGMT_NETMASK" -j ACCEPT

        ### todo: limit the destination address?
        iptables -A INPUT -i "$WAN_IF" -p icmp -j ACCEPT
        iptables -A INPUT -i "$WAN_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT
        iptables -A INPUT -i "$WAN_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

        iptables -A INPUT -i "$FF_IF" -p icmp -j ACCEPT
        iptables -A INPUT -i "$FF_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT
        iptables -A INPUT -i "$FF_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

        iptables -A INPUT -i "$LTE_IF" -p icmp -j ACCEPT
        iptables -A INPUT -i "$LTE_IF" -p tcp --dport {{ ansible_port }} -j ACCEPT
        iptables -A INPUT -i "$LTE_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

        iptables -A INPUT -i "wg-emc" -p icmp -j ACCEPT
        iptables -A INPUT -i "wg-emc" -p tcp --dport {{ ansible_port }} -j ACCEPT
        iptables -A INPUT -i "wg-emc" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        iptables -A FORWARD -o "wg-emc" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

        # all internal zones
        for zone in {{ network_internal_zone_names | join(' ') }}; do
          interface=$(uci get "network.$zone.ifname")
          ipaddr=$(uci get "network.$zone.ipaddr")
          netmask=$(uci get "network.$zone.netmask")

          ### todo: only add this if dhcp is in network_zones[zone]
          iptables -A INPUT -i "$interface" -p udp --dport 67 --sport 68 -j ACCEPT

          ### todo: only do this if dhcp is in network_zones[zone] or $ipaddr is in network_zones[zone].dns
          iptables -A INPUT -i "$interface" -p udp --dport 53 -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT
          iptables -A INPUT -i "$interface" -p tcp --dport 53 -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT

          iptables -A INPUT -i "$interface" -p icmp -d "$ipaddr" -s "$ipaddr/$netmask" -j ACCEPT
          iptables -A INPUT -i "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

          case "$zone" in
            {{ network_internal_zone_names__wan | join('|') }})
              iptables -A FORWARD -i "$interface" -o "$WAN_IF" -s "$ipaddr/$netmask" -j ACCEPT
              iptables -A FORWARD -i "$WAN_IF" -o "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
              iptables -t nat -A POSTROUTING -o "$WAN_IF" -s "$ipaddr/$netmask" -j MASQUERADE
              ;;
            {{ network_internal_zone_names__emc | join('|') }})
              iptables -A FORWARD -i "$interface" -o "wg-emc" -s "$ipaddr/$netmask" -j ACCEPT
              iptables -A FORWARD -i "wg-emc" -o "$interface" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
              iptables -t nat -A POSTROUTING -o "wg-emc" -s "$ipaddr/$netmask" -j MASQUERADE
              ;;
          esac
        done

        iptables -P INPUT DROP
        iptables -P FORWARD DROP
      }

      stop() {
        iptables -P INPUT ACCEPT
        iptables -F INPUT
        iptables -P FORWARD ACCEPT
        iptables -F FORWARD
        iptables -t nat -F POSTROUTING
      }


openwrt_uci:
  system:
    - name: system
      options:
        hostname: '{{ host_name }}'
        timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
        ttylogin: '0'
        log_size: '64'
        urandom_seed: '0'

    - name: timeserver 'ntp'
      options:
        enabled: '1'
        enable_server: '0'
        server:
          - '0.lede.pool.ntp.org'
          - '1.lede.pool.ntp.org'
          - '2.lede.pool.ntp.org'
          - '3.lede.pool.ntp.org'

    - name: gpio_switch 'poe_passthrough'
      options:
        name: 'PoE Passthrough'
        gpio_pin: '0'
        value: '0'

  dropbear:
    - name: dropbear
      options:
        PasswordAuth: 'off'
        RootPasswordAuth: 'off'
        Port: '{{ ansible_port }}'

  dhcp: "{{ openwrt_dhcp_base + openwrt_dhcp_internal + openwrt_dhcp_external }}"
  network: "{{ openwrt_network_base + openwrt_network_internal + openwrt_network_external }}"