Changes

This page describes how to manage the infra. See [https://vtluug.github.io/rtfm.txt rtfm.txt] for a guide to build the infrastructure it from scratch, as well manage it in general.

== Networking Networks ==* Set up physical boxes based on the [[Infrastructure''Further information:Diagram|Diagram]]* Determine the ip addresses based on [[Infrastructure:Network|Network]]=== Router ===Configure /etc/network/interfaces:

<nowiki># v6iface $EXTERNAL_IF inet6 autoiface $INTERNAL_IF inet6 static address $INTERNAL_IPv6 netmask 128 # Enable internal network to access routerWe 's external v6 address pre-up ip route add $EXTERNAL_IPv6 via $INTERNAL_IPv6 # Enable NDP Proxying so internal boxes get SLAAC pre-up echo 1 > /proc/sys/net/ipv6/conf/all/forwarding pre-up echo 2 > /proc/sys/net/ipv6/conf/all/accept_ra'should'' have the following networks in place:

# * [[Infrastructure:Meltdown|meltdown]] and [[Infrastructure:Spectre|spectre]] br0 on eno1 <--> enp4s0 on [[Infrastructure:Joey|joey]]. This is the main LUUG network.** 10.98.0.0/16 for VTLUUG Private Network v4NATiface $INTERNAL_IF inet static** IPv6 via prefix delegation on 607:b400:6:cc80/64 address $INTERNAL_IPv4** Global IPv4s via ARP proxying (See https://github.com/vtluug/scripts). Gateway is 128.173.88.1/22. netmask 255* Static hosts are on 10.98.0.0/24, and DHCP is enabled on 10.25598.2551.0/24. This is mainly just useful for organization and quickly finding new hosts or other hosts on the network.** Static host IPs are assigned via static DHCP leases for IPv4.** Since we can't do this with IPv6, physical host IPs are determined upon first boot and VMs are assigned a specific MAC to pre-determine the SLAAC IP.* "Internet" (a CNS portal) <--> enp2s0 on [[Infrastructure:Joey|joey]]. LUUG only has one of these, and port security is probably enabled.

# Additional IPs'''DNS/DHCP:'''iface $EXTERNAL_IF inet static address $EXTERNAL_IPv4 gateway 128* All DNS entries for services run by VTLUUG are hosted on [https://gandi.173net Gandi].88Ask an officer if you want to change something.1 broadcast 128* jkh and Roddy own ece.173vt.91edu.255 netmask 255DNS updates don't happen.255echarlie can add IPv6-only records if needed to wuvt.252vt.edu so we have PTRs.0 # Nat Settings # TODO this probably doesn't work pre-up tc action nat egress * [[Infrastructure:Joey|joey]] runs DHCP via dnsmasq on enp4s0 (that is, 10.9998.0.0/24 $EXTERNAL_IP # Enable ARP Proxying so internal v4 address are accessible pre-up echo 1 > 16). To change anything, modify it on https:/proc/sysgithub.com/netvtluug/ipv4/conf/all/proxy_arpscripts first then pull that into root's homedir on [[Infrastructure:Joey|joey]]. Please don't just update it on a machine without pushing your updates. pre-up echo 1 > /proc/sys/net/ipv4/ip_forward # Route internal v4 addresses ip route add $JOEY_EXTERNAL_IPv4/24 dev $INTERNAL_IF ip route add $CRASHANDBURN_EXTERNAL_IPv4/24 dev $INTERNAL_IF ip route add $SCZI_EXTERNAL_IPv4/24 dev $INTERNAL_IF ip route add $ACIDBURN_EXTERNAL_IPv4/24 dev $INTERNAL_IF ip route add $ZEROCOOL_EXTERNAL_IPv4/24 dev $INTERNAL_IF ip route add $MIRROR_EXTERNAL_IPv4/24 dev $INTERNAL_IF</nowiki>* By default, hosts are accessible via SSH on ports 22 and 2222.

Next, set up NDP proxying== Adding a VTLUUG Service VM ==Configure /etc/ndppd.conf''VMs in this category are deployed to [[Infrastructure: (May not already exist)Meltdown|meltdown]]''

<nowiki>=== Configure the network ===# Rather than only listenting * Decide on each individual IPv6 a MAC address, we for the host and add it to <code>SCRIPTS/router/lan/local_hosts</code># simply forward all soliciations* Add an entry to <code>SCRIPTS/router/lan/dnsmasq.conf</code> for static DHCP leases. The main advantage is that we# don't have to add any additional routing rules if * If a new internal# device IP in 128.173.88.1/22 is being added, also add it to <code>SCRIPTS/router/proxy/arp_proxy.route-ttl 30000address-ttl 30000sh</code>

# External interface to listen '''Note:''' It is '''not''' recommended that you do the following steps if nobody is onproxy $EXTERNAL_IF { router yes timeout 500 autowire no keepalive yes retries 3 promiscuous no ttl 30000campus in case something breaks.

# Prefix Pull the latest changes to listen on<code>/root/scripts</code>, update the configuration files, and restart the services: rule ::0* Dnsmasq configuration is at <code>/etc/dnsmasq.conf</ { # TODO might change prefix # Internal interface to forward everything to iface $INTERNAL_IF autovia no }}code>* ARP Proxy configuration is in <code>/usr/local/bin</nowikicode>

Now start '''=== Add the VM configuration to ansible ===Edit <code>ANSIBLE_PATH/roles/deploy-vms/defaults/main.yml</code> and''' enable ndppd.serviceadd a new entry, following the existing format.

=== Everything Else '''Note:''' if there are any entries in this file that are '''not run under oVirt ======= Debian ====Configure /etc/network/interfaces:''' present on the VM host, they will also be created. Comment out entries that shouldn't be created. Existing hosts are skipped.

Run <nowikicode># v6iface $INTERFACE inet6 autoauto $INTERFACEiface $INTERFACE inet static address $INTERNAL_IPv4 gateway 10ansible-playbook -v deploy.99yml -i hosts.0cfg -u papatux -k -K -e @VTLUUG_ADMIN_REPO/accounts.1 netmask 255.255.255yml</code>, using the correct vtluug-admin repo path.0

# Additional IPs - Only do this if this box has an external IPiface $INTERFACE inet static address $EXTERNAL_IPv4=== Testing === gateway 128The new host should be accessible by papatux on via SSH port 2222 (and 22) over IPv6 and IPv4 from the internal network.173Check 10.8898.1 netmask 255.255.252.0</nowiki>24 to see if it had any issues getting a static DHCP lease and if the MAC is correct.

==== Centos ==Adding a User VM ==Configure /etc/sysconfig/network-scripts/ifcfg-$INTERFACE''VMs in this category are deployed to [[Infrastructure:Spectre|spectre]]''

Prerequisites:* Clone <nowikicode>ONBOOT="yes"NM_CONTROLLED="no"BOOTPROTO="static"IPADDR0="$INTERNAL_IPv4"GATEWAY0="10https://github.99com/vtluug/scripts</code>.0This is referred to as 'SCRIPTS' in this guide.1"NETMASK0="255* Clone <code>https://github.255com/vtluug/ansible</code> and install ansible.255This repo is referred to as 'ANSIBLE' in this guide.0"# Addition IPs - Only do this if this box has an external IPIPADDR1="$EXTERNAL_IPv4"GATEWAY1="128* Understand the [[Infrastructure:Network|Network]] and [[Infrastructure]].173.88.1"NETMASK1="255.255.252.0"* Have root on [[Infrastructure:Spectre|spectre]]</nowiki>* Put your SSH key on [[Infrastructure:Spectre|spectre]]

== Other stuff =Configure the network ===* Decide on a MAC address for the host and add it to <code>SCRIPTS/router/lan/local_hosts</code>* Add an entry to <code>SCRIPTS/router/lan/dnsmasq.conf</code> for static DHCP leases. (If applicable; you might not care for a test/temp VM). '''Note:''' It is '''not''' recommended that you do the following steps if nobody is on campus in case something breaks. Pull the latest changes to <code>/root/scripts</code>, update the configuration files, and restart the services:* Dnsmasq configuration is at <code>/etc/dnsmasq.conf</code> === Add the VM configuration to ansible ===Edit <code>ANSIBLE_PATH/roles/deploy-vms/defaults/main.yml</code> and add a new entry under <code>new_vms_spectre</code>, following the existing format. '''Note:''' if there are any entries in this file that are '''not''' present on the VM host, they will also be created. Comment out entries that shouldn't be created. Existing hosts are skipped. Run <code>ansible-playbook -v deploy.yml -i hosts.cfg -u papatux -k -K</code>, using the correct vtluug-admin repo path. '''Important:''' A random root password is set during VM creation and printed to stdout. Record this! === Testing ===The new host should be accessible by root on via SSH port 2222 (and 22) over IPv6 and IPv4 from the internal network. Check 10.98.1.0/24 to see if it had any issues getting a static DHCP lease and if the MAC is correct.