home/hermes
Archived
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

implement

Browse source
This commit is contained in:
Pim Kunis 2023-04-09 13:42:30 +02:00
parent 2c87d22fa2
commit 7f8cb29675
17 changed files with 379 additions and 47 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
hermes.yml Normal file
View file

@ -0,0 +1,42 @@
---
- hosts: all
gather_facts: no
pre_tasks:
- name: Wait for host to come up
wait_for:
state: started
port: 22
host: "192.168.30.7"
timeout: 300
connect_timeout: 300
search_regex: OpenSSH
delegate_to: localhost
- name: Wait for cloud-init to finish
command:
cmd: cloud-init status --wait
register: cloudinit
changed_when: "'..' in cloudinit.stdout"
- name: Gather facts
setup:
- name: Copy resolv.conf
copy:
src: resolv.conf
dest: /etc/resolv.conf
- name: Update repositories
apt:
autoremove: true
upgrade: yes
state: latest
update_cache: yes
cache_valid_time: 86400 # One day
- name: Install packages
apt:
pkg:
- qemu-guest-agent
- dnsutils
roles:
- dnsmasq
- nsd
- ssh

104
main.tf
View file

@ -1,6 +1,7 @@
terraform { terraform {
backend "pg" { backend "pg" {
schema_name = "dmz_dns" schema_name = "dmz_dns"
conn_str = "postgres://terraform@10.42.0.1/terraform_state"
} }
required_providers { required_providers {
@ -14,54 +15,63 @@ terraform {
} }
provider "libvirt" { provider "libvirt" {
uri = var.libvirt_endpoint uri = "qemu+ssh://root@atlas.lan/system"
} }
resource "libvirt_volume" "main_disk" { module "vm" {
name = "${var.name}.iso" source = "git::https://git.pim.kunis.nl/home/tf-modules.git//debian"
pool = "disk" name = "hermes"
size = 1024 * 1024 * 1024 * 15 use_host_cert = false
base_volume_name = "debian-bookworm.qcow2" fixed_address = "192.168.30.7/24"
base_volume_pool = "iso" ansible_command = "ANSIBLE_ROLES_PATH=roles ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u root -i '192.168.30.7,' hermes.yml"
}
resource "libvirt_cloudinit_disk" "cloudinit" {
name = "${var.name}.iso"
pool = "init"
user_data = templatefile("cloud_init.cfg.tftpl", { name = var.name, admin_authorized_keys = var.admin_authorized_keys })
network_config = templatefile("network_config.cfg.tftpl", { internal_ip = var.internal_ip })
}
resource "libvirt_domain" "ubuntu" {
name = var.name
memory = 1024
vcpu = 4
autostart = true
disk {
volume_id = libvirt_volume.main_disk.id
}
network_interface {
bridge = "dmzbr"
hostname = var.name
mac = "CA:FE:C0:FF:EE:07" mac = "CA:FE:C0:FF:EE:07"
}
cloudinit = libvirt_cloudinit_disk.cloudinit.id
provisioner "local-exec" {
command = "ansible-playbook -e internal_ip=${var.internal_ip} -T 60 -u root -i ${var.ansible_inventory} ${var.ansible_playbook}"
environment = {
ANSIBLE_HOST_KEY_CHECKING = "False"
ANSIBLE_CONFIG = "${var.ansible_cfg}"
}
}
lifecycle {
replace_triggered_by = [
libvirt_cloudinit_disk.cloudinit.id
]
}
} }
# resource "libvirt_volume" "main_disk" {
# name = "${var.name}.iso"
# pool = "disk"
# size = 1024 * 1024 * 1024 * 15
# base_volume_name = "debian-bookworm.qcow2"
# base_volume_pool = "iso"
# }
#
# resource "libvirt_cloudinit_disk" "cloudinit" {
# name = "${var.name}.iso"
# pool = "init"
# user_data = templatefile("cloud_init.cfg.tftpl", { name = var.name, admin_authorized_keys = var.admin_authorized_keys })
# network_config = templatefile("network_config.cfg.tftpl", { internal_ip = var.internal_ip })
# }
#
# resource "libvirt_domain" "ubuntu" {
# name = var.name
# memory = 1024
# vcpu = 4
# autostart = true
#
# disk {
# volume_id = libvirt_volume.main_disk.id
# }
#
# network_interface {
# bridge = "dmzbr"
# hostname = var.name
# mac = "CA:FE:C0:FF:EE:07"
# }
#
# cloudinit = libvirt_cloudinit_disk.cloudinit.id
#
# provisioner "local-exec" {
# command = "ansible-playbook -e internal_ip=${var.internal_ip} -T 60 -u root -i ${var.ansible_inventory} ${var.ansible_playbook}"
#
# environment = {
# ANSIBLE_HOST_KEY_CHECKING = "False"
# ANSIBLE_CONFIG = "${var.ansible_cfg}"
# }
# }
#
# lifecycle {
# replace_triggered_by = [
# libvirt_cloudinit_disk.cloudinit.id
# ]
# }
# }

1
resolv.conf Normal file
View file

@ -0,0 +1 @@
nameserver 192.168.30.1

44
roles/dnsmasq/files/dnsmasq.conf Normal file
View file

@ -0,0 +1,44 @@
# Disable /etc/resolv.conf
no-resolv
# Upstream DNS server
server=192.168.30.1
# Always serve .dmz locally
local=/dmz/
# Put all clients in the dmz domain
dhcp-fqdn
# Don't read /etc/hosts
no-hosts
# Domain is automatically added to if missing
expand-hosts
# Domain that is used for DHCP on this network
domain=dmz
# IPv4 DHCP range
dhcp-range=192.168.30.100,192.168.30.200,15m
# Predefined DHCP hosts
dhcp-host=b8:27:eb:b9:ab:e2,esrom
dhcp-host=b4:2e:99:77:1b:da,max,192.168.30.3
dhcp-host=d8:5e:d3:47:33:6e,lewis
# Advertise router
dhcp-option=3,192.168.30.1
# Always send the IPv6 DNS server address (this machine)
dhcp-option=option6:dns-server,[2a02:58:19a:f730::1]
# Advertise SLAAC for the given prefix
dhcp-range=2a02:58:19a:f730::, ra-stateless, ra-names
# Do not advertise default gateway via DHCPv6
ra-param=*,0,0
# Alias public IP address to local
alias=84.245.14.149,192.168.30.3
# Override DNS servers for our domains
server=/pizzapim.nl/192.168.30.7
server=/geokunis2.nl/192.168.30.7
server=/pim.kunis.nl/192.168.30.7
# Enable extended logging
log-dhcp
log-queries
# Resolve dns.dmz to addresses on main NIC
interface-name=hermes.dmz,ens3
# Non-conventional port because we also run nsd on this machine
port=5353
# Override addresses of name servers
address=/ns.pizzapim.nl/ns.geokunis2.nl/ns.pim.kunis.nl/192.168.30.7
address=/ns.pizzapim.nl/ns.geokunis2.nl/ns.pim.kunis.nl/2a02:58:19a:f730:c8fe:c0ff:feff:ee07

18
roles/dnsmasq/tasks/main.yml Normal file
View file

@ -0,0 +1,18 @@
- name: Install dnsmasq
apt:
name: dnsmasq
- name: Disable systemd-resolved
systemd:
name: systemd-resolved
enabled: false
state: stopped
- name: Copy dnsmasq configuration
copy:
src: "{{ role_path }}/files/dnsmasq.conf"
dest: "/etc/dnsmasq.conf"
register: config
- name: Enable dnsmasq
systemd:
name: dnsmasq
enabled: true
state: "{{ 'restarted' if config.changed else 'started' }}"

26
roles/nsd/files/nsd.conf Normal file
View file

@ -0,0 +1,26 @@
server:
ip-address: ens3
port: 53
server-count: 1
verbosity: 1
hide-version: yes
zonesdir: "/etc/nsd/zones"
ip-transparent: yes
ip-freebind: yes
zone:
name: pim.kunis.nl
zonefile: pim.kunis.nl
zone:
name: pizzapim.nl
zonefile: pizzapim.nl
provide-xfr: 87.253.155.96/27 NOKEY
provide-xfr: 157.97.168.160/27 NOKEY
zone:
name: geokunis2.nl
zonefile: geokunis2.nl
provide-xfr: 87.253.155.96/27 NOKEY
provide-xfr: 157.97.168.160/27 NOKEY

28
roles/nsd/files/zones/geokunis2.nl Normal file
View file

@ -0,0 +1,28 @@
$ORIGIN geokunis2.nl.
$TTL 60
geokunis2.nl. IN SOA ns.geokunis2.nl. niels.kunis.nl. 2023031700 1800 3600 1209600 3600
NS ns.geokunis2.nl.
NS ns0.transip.net.
NS ns1.transip.nl.
NS ns2.transip.eu.
A 84.245.14.149
AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
; MX 0 .
; TXT "v=spf1 -all"
CAA 0 issue "letsencrypt.org"
mail IN A 84.245.14.149
MX 10 mail.geokunis2.nl
jenl IN A 217.123.41.225
wg IN A 84.245.14.149
wg IN AAAA 2a02:58:1:e::1afb
wg4 IN A 84.245.14.149
wg6 IN AAAA 2a02:58:1:e::1afb
kms IN A 84.245.14.149
files IN A 84.245.14.149
files IN AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
_dmarc IN TXT "v=DMARC1; p=reject; fo=0; adkim=s; aspf=s; pct=100; rf=afrf; sp=reject"
ns A 84.245.14.149
AAAA 2a02:58:19a:f730:c8fe:c0ff:feff:ee07
cyberchef IN A 84.245.14.149
AAAA 2a02:58:19a:f730:c8fe:c0ff:feff:ee07

22
roles/nsd/files/zones/pim.kunis.nl Normal file
View file

@ -0,0 +1,22 @@
$ORIGIN pim.kunis.nl.
$TTL 60
pim.kunis.nl. IN SOA ns.pim.kunis.nl. pim.kunis.nl. 2023031700 1800 3600 1209600 3600
NS ns.pim.kunis.nl.
A 84.245.14.149
AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
TXT "v=spf1 ~all"
_dmarc IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:wpux1bq8@ag.eu.dmarcian.com;"
www IN A 84.245.14.149
IN AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
ns IN A 84.245.14.149
IN AAAA 2a02:58:19a:f730:c8fe:c0ff:feff:ee07
social IN CNAME www.pim.kunis.nl.
dav IN CNAME www.pim.kunis.nl.
git IN CNAME www.pim.kunis.nl.
meet IN CNAME www.pim.kunis.nl.
rss IN CNAME www.pim.kunis.nl.

19
roles/nsd/files/zones/pizzapim.nl Normal file
View file

@ -0,0 +1,19 @@
$ORIGIN pizzapim.nl.
$TTL 60
pizzapim.nl. IN SOA ns.pizzapim.nl. pim.kunis.nl. 2023031700 1800 3600 1209600 3600
NS ns.pizzapim.nl.
NS ns0.transip.net.
NS ns1.transip.nl.
NS ns2.transip.eu.
A 84.245.14.149
TXT "v=spf1 ~all"
CAA 0 issue "letsencrypt.org"
_dmarc IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:wpux1bq8@ag.eu.dmarcian.com;"
social IN A 84.245.14.149
AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
ns IN A 84.245.14.149
AAAA 2a02:58:19a:f730:c8fe:c0ff:feff:ee07

18
roles/nsd/tasks/main.yml Normal file
View file

@ -0,0 +1,18 @@
- name: Install nsd
apt:
name: nsd
- name: Copy nsd.conf
copy:
src: "{{ role_path }}/files/nsd.conf"
dest: /etc/nsd/nsd.conf
register: config
- name: Copy zone directory
copy:
src: "{{ role_path }}/files/zones"
dest: /etc/nsd
register: zones
- name: Enable nsd
systemd:
name: nsd
enabled: true
state: "{{ 'restarted' if config.changed or zones.changed else 'started' }}"

29
roles/ssh/files/ca.sh Executable file
View file

@ -0,0 +1,29 @@
#!/bin/bash
set -euo pipefail
IFS=$'\n\t'
HOSTCAKEY=/root/.ssh/host_ca_key
USERCAKEY=/root/.ssh/user_ca_key
host() {
PUBKEY="$2"
HOST="$3"
echo "$PUBKEY" > /tmp/"$HOST".pub
ssh-keygen -h -s "$HOSTCAKEY" -I "$HOST" -n "$HOST" /tmp/"$HOST".pub
cat /tmp/"$HOST"-cert.pub
rm /tmp/"$HOST"*.pub
}
user() {
PUBKEY="$2"
HOST="$3"
PRINCIPALS="$4"
echo "$PUBKEY" > /tmp/"$HOST".pub
ssh-keygen -s "$USERCAKEY" -I "$HOST" -n "$HOST","$PRINCIPALS" /tmp/"$HOST".pub
cat /tmp/"$HOST"-cert.pub
rm /tmp/"$HOST"*.pub
}
"$1" "$@"

27
roles/ssh/files/keys/host_ca_key Normal file
View file

@ -0,0 +1,27 @@
$ANSIBLE_VAULT;1.1;AES256
65393830356161326338323139306466316362303835393833383633363431303639393835666538
6639653036666261363236393832343236656531633261360a333664363033356432386439336630
65336333666662633635316565363366353530653831383937616566386165346663393938386530
3233613134343331350a363163383831396265646333336334366664353164386538313031393230
61356239333863366665396131633039663161306536386636336631646238303164303565653331
64353465633235396261333739643635306530333665313330633936643966363539646636376630
32303233303437393662393161313330333331396666613133633964393335393035363536373464
36323334393235626561333262373639353332663337393562356562656662373833633833636466
65373739663764623962323630623866363563626536313436346532643332646238393237396439
35623961336266333037636532663833653466346264326330616135346234643363636662396630
30613132633237333633636361323937643338323738386231383561613237646436333336383562
61316232393864316236616561333139626463373962303134366131653439656638636365633930
33353565373066623763346139663238346237376461613834323839336533653936646532316437
66303565346665303335656233663735333630643963656637363934626336323361356639616430
32323133396165356237613062313864313534323364663232636566373332633461316461346435
32663862353439653764616461646463336639646636333862663832656131356536666233396638
63613439636432306164393737353033383661623733646231313238303863376362376334656262
33336132373139333030333533633032353564336666663237333135376532396165653831663537
32653836373034383965653431646137633638633465626164386638323466636238393665303964
35366432643962613063326338373031393036643437663438356339386662303362333062343730
65646535373833343831633164666563616561633833353739643963633265396561386462336234
66323330363662653235333464623965653635323437613734366231386331363461643262366565
37626536623832323162363862363632666164353138616362386562393530623265303936656364
65633463363935393838333338303239333538393865653338396635393262623636616364323133
66333165616364356235303431316232666330313933386331383435663939386331626635316537
3964323534326563303636616135663137373365663365663931

1
roles/ssh/files/keys/host_ca_key.pub Normal file
View file

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x Host Certficate Authority for DMZ

27
roles/ssh/files/keys/user_ca_key Normal file
View file

@ -0,0 +1,27 @@
$ANSIBLE_VAULT;1.1;AES256
36306261333262396466633565653163323239396630653031343331653337376433356461613064
3333316136343033396131356638666661623464333333310a636264616339363366386633663965
64336437316366333363396162376337653537376365306638316166663437643731613935353137
6138306232396134310a373962653330613331653830343766613435363339343438636665306633
39633061303937313962323839336437653763336164616433353831646663393764373933306565
38633335373863363437313531393530333562336430636261656564306563343537313264366436
32653932356263333938386231333134303633333666343531616332376632343462316335643732
30386465626533363333626162386331626436373935386537393335666437633166303838663264
61353532306161343630303233336463376266366463313039343262656333663936333338373633
31353361356232356637333466316634623739323335613433356362333565646138373838663034
39363734623537633133393836323261353461623562386235646566303162373235623534383238
33363264386438393563613639333336323963363733346665663430626335346334386233396236
34636164653264386266393561303037646464646136313861343438636437626166333361613262
66333333303139653639383963373731613639643837363639353264376230616264313930396434
39303863653939613333323739363263383531333539333334306632323865646131653030356365
38363530656131646431616661616137386161613033643664336661343531333933326339656636
61356337393936623462323039343534656565353466353565653838666336306266313131316435
39333739313262646462663531663234633066333033666461306434313166366533353865313530
31326334383138383332366665383965633838636436646230323931646136336234636631313138
33363062393632393830383231333166373032386163316633613061643166663266396131333838
30316439373834356230633566323966376336363362346338323237343637393765323237373832
61626432653935663230663261343037363037646539623330383235376231303738323132306131
33646237633164356332366664353763623839623738633230613837356330393535346236383165
35376631313332356164636336336439386432326337663436373661613264306135313961623434
37386335663332613435626233333037316466363730623065633336666436343433326564333264
6231373332643633346235663930616439653238396331626564

1
roles/ssh/files/keys/user_ca_key.pub Normal file
View file

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKOClnK6/Hj8INjEgULY/lD2FM/nbiJHqaSXtEw4+Fj User Certificate Authority for DMZ

10
roles/ssh/tasks/main.yml Normal file
View file

@ -0,0 +1,10 @@
- name: Copy ca.sh
copy:
src: "{{ role_path }}/files/ca.sh"
dest: /root/ca.sh
mode: 755
- name: Copy keys
copy:
src: "{{ role_path }}/files/keys/"
dest: /root/.ssh/
mode: preserve

9
util/secret-service-client.sh Executable file
View file

@ -0,0 +1,9 @@
#!/bin/bash
pass=`secret-tool lookup ansible_vault hermes`
retval=$?
if [ $retval -ne 0 ]; then
read -s pass
fi
echo $pass