sunet-cdn/cdn-ops
2
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
403 commits 1 branch 203 tags 1.4 MiB
Commit graph

91 commits

Author SHA1 Message Date
Patrik Lundin 1164b59747
Install tool for managing ACME provisioner 2024-11-07 12:41:14 +01:00
Patrik Lundin f07e6708e3
Another update of certbot-sync dir 2024-11-05 15:37:05 +01:00
Patrik Lundin 3413446ce4
Less stuttering in variable naming 2024-11-04 11:58:15 +01:00
Patrik Lundin efa269ab33
Add back $clients 
Should not have been removed in last commit
 2024-11-04 11:56:00 +01:00
Patrik Lundin a71a8f5639
mqtt: open local firewall for any clients 2024-11-04 11:52:31 +01:00
Patrik Lundin 9cee243af6
Allow ACME validation from step-ca to cache 2024-11-04 09:39:02 +01:00
Patrik Lundin e5a23593bf
Apply IP-specific certbot command to cache instead 2024-11-04 09:31:50 +01:00
Patrik Lundin 6f2dd2df0f
Revert "Only bind certbot to machine-specific IP" 
Incorrectly applied to MQTT class, was supposed to be done for cache servers.

This reverts commit b4261094a7.
 2024-11-04 09:30:39 +01:00
Patrik Lundin b4261094a7
Only bind certbot to machine-specific IP 
Because there will be haproxy instances running next to this service we
can only listen to the machine-local address not the default of "all addreses":

Error seen:
```
Could not bind TCP port 80 because it is already in use by another process on this system (such as a web server). Please stop the program in question and then try again.
```
 2024-11-04 09:26:42 +01:00
Patrik Lundin d4f938770a
Get internal cert for hostname 
Used for client cert auth to MQTT server
 2024-11-04 09:14:42 +01:00
Patrik Lundin 101f11fdad
Use new synced certbot dir 2024-11-01 14:38:04 +01:00
Patrik Lundin a39f5cdbae
Remove "command" and fix indent 2024-10-31 15:39:11 +01:00
Patrik Lundin ca94d62c62
Make sure root owns sunet-cdnp binary 2024-10-31 15:38:17 +01:00
Patrik Lundin 740c5d29c1
Missing "," 2024-10-31 15:35:44 +01:00
Patrik Lundin 48d9866a7c
Call tar from command to make notify simpler 2024-10-31 15:33:48 +01:00
Patrik Lundin 0ad91d34d1
Missing "," 2024-10-31 15:30:36 +01:00
Patrik Lundin e15225d1b5
Extract sunet-cdnp and create symlink in PATH 
Store files in /var/lib/sunet-cdnp instead of /root
 2024-10-31 15:26:08 +01:00
Patrik Lundin 19aa10dc05
Missing "," 2024-10-31 12:56:33 +01:00
Patrik Lundin 395e67c918
Download CDN purger to cache 2024-10-31 12:55:07 +01:00
Patrik Lundin 196c1403e6
Allow decapsulated ip6ip6 packets 2024-10-30 09:25:12 +01:00
Patrik Lundin 41298df063
Setup interface for ip6ip6 tunneling 
Running into systemd-networkd bugs, don't be fooled by "Local=::1" and
"Remote=::1". This still results in the equivalent of setting them to
'any' or '::' because we are using the default interface name.
 2024-10-29 17:01:46 +01:00
Patrik Lundin 2ad7073858
Fix name 2024-10-29 14:23:34 +01:00
Patrik Lundin 0b3e9c48ff
Add nftables rule for ip6tnl packets 2024-10-29 14:21:34 +01:00
Patrik Lundin bd055b1ac8
Run puppet-lint 2024-10-29 08:30:49 +01:00
Patrik Lundin af96f5e985
Manage bird.conf on l4lb machines 
Currently just add basic template
 2024-10-28 13:18:59 +01:00
Patrik Lundin e2d550bf29
Start managing bird2 
Also give dummy-interface support to sunet-l4lb-namespace tool, used
to hold IPv4/IPv6 service addresses that should be announced via BGP.
 2024-10-25 15:19:21 +02:00
Patrik Lundin 4856be3f06
Rework dir layout to match other hosts 2024-10-22 17:11:58 +02:00
Patrik Lundin f588078b75
Add namespace management files 2024-10-22 17:06:29 +02:00
Patrik Lundin 74c0bf76a1
Fix type name 2024-10-22 15:23:03 +02:00
Patrik Lundin 1ddf93c330
Disable cilium by default 
We will go for IPVS for now which can deal with the l4lb hosts being
multihomed.
 2024-10-22 15:20:09 +02:00
Patrik Lundin ad66745a90
Missing " 2024-10-13 14:32:42 +02:00
Patrik Lundin 4f2428575c
Fix name 2024-10-13 14:31:23 +02:00
Patrik Lundin b018c81f81
cache: initial rules to allow traffic from l4lb 2024-10-13 14:28:50 +02:00
Patrik Lundin 37ad05ca6b
Missing [ 2024-10-11 22:12:05 +02:00
Patrik Lundin ca7fbbe945
Combine networkctl reload command 2024-10-11 22:10:50 +02:00
Patrik Lundin d289ffa656
Add config for ipip interface 
Supplying an empty .network file is weird but without it the tunl0
interface is left in a DOWN state even with Independent=true.

Maybe this is related to "tunl0" being automatically created when the
"ipip" kernel module is loaded.
 2024-10-11 22:05:11 +02:00
Patrik Lundin 44c73b78ae
Prefix files with numbers as recommended by docs 
See "systemd.netdev" docs.
 2024-10-11 21:57:59 +02:00
Patrik Lundin 382214ef2b
Make puppet-lint happy 2024-10-11 20:04:13 +02:00
Patrik Lundin 3e393a62f9
Add '' 2024-10-11 19:05:29 +02:00
Patrik Lundin a82798ead5
Add network reload support 2024-10-11 19:04:17 +02:00
Patrik Lundin 637e2ae307
Add address config for dummy interface 2024-10-11 18:52:53 +02:00
Patrik Lundin 1e8cad6ea0
Add dummy0 interface 
The netplan version we have is too old to do this so handle it manually.
 2024-10-11 18:45:54 +02:00
Patrik Lundin 4d7283e361
Allow haproxy to bind to ports 80/443 
This way we can run haproxy as an unprivileged user and still use what
is normally considered privileged ports.
 2024-10-11 13:49:04 +02:00
Patrik Lundin 7402f8cfc1
More tweaks 2024-10-11 11:51:36 +02:00
Patrik Lundin 5185b62431
Syntax fixes 2024-10-11 11:47:44 +02:00
Patrik Lundin 31d7a3c93a
puppet-lint fixes 2024-10-11 11:46:06 +02:00
Patrik Lundin ca9f7fbe50
Replace "." with "," 
While here fix some variable usage and puppet-lint complaints
 2024-10-11 11:42:12 +02:00
Patrik Lundin 88e3771f6e
Install certificate files 2024-10-11 11:38:58 +02:00
Patrik Lundin ff6376b68d
Add basic varnish VCL for testing 2024-10-10 20:39:35 +02:00
Patrik Lundin bacdb2c90a
Make sure customer conf dir is created 2024-10-10 15:31:54 +02:00