hermes.yml

@@ -0,0 +1,42 @@
+---
+- hosts: all
+  gather_facts: no
+
+  pre_tasks:
+    - name: Wait for host to come up
+      wait_for:
+        state: started
+        port: 22
+        host: "192.168.30.7"
+        timeout: 300
+        connect_timeout: 300
+        search_regex: OpenSSH
+      delegate_to: localhost
+    - name: Wait for cloud-init to finish
+      command:
+        cmd: cloud-init status --wait
+      register: cloudinit
+      changed_when: "'..' in cloudinit.stdout"
+    - name: Gather facts
+      setup:
+    - name: Copy resolv.conf
+      copy:
+        src: resolv.conf
+        dest: /etc/resolv.conf
+    - name: Update repositories
+      apt:
+        autoremove: true
+        upgrade: yes
+        state: latest
+        update_cache: yes
+        cache_valid_time: 86400 # One day
+    - name: Install packages
+      apt:
+        pkg:
+          - qemu-guest-agent
+          - dnsutils
+
+  roles:
+    - dnsmasq
+    - nsd
+    - ssh

main.tf

@@ -1,6 +1,7 @@
 terraform {
   backend "pg" {
     schema_name = "dmz_dns"
+    conn_str    = "postgres://terraform@10.42.0.1/terraform_state"
   }
 
   required_providers {
@@ -14,54 +15,63 @@ terraform {
 }
 
 provider "libvirt" {
-  uri = var.libvirt_endpoint
+  uri = "qemu+ssh://root@atlas.lan/system"
 }
 
-resource "libvirt_volume" "main_disk" {
+module "vm" {
-  name             = "${var.name}.iso"
+  source          = "git::https://git.pim.kunis.nl/home/tf-modules.git//debian"
-  pool             = "disk"
+  name            = "hermes"
-  size             = 1024 * 1024 * 1024 * 15
+  use_host_cert   = false
-  base_volume_name = "debian-bookworm.qcow2"
+  fixed_address   = "192.168.30.7/24"
-  base_volume_pool = "iso"
+  ansible_command = "ANSIBLE_ROLES_PATH=roles ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u root -i '192.168.30.7,' hermes.yml"
+  mac             = "CA:FE:C0:FF:EE:07"
 }
 
-resource "libvirt_cloudinit_disk" "cloudinit" {
+# resource "libvirt_volume" "main_disk" {
-  name           = "${var.name}.iso"
+#   name             = "${var.name}.iso"
-  pool           = "init"
+#   pool             = "disk"
-  user_data      = templatefile("cloud_init.cfg.tftpl", { name = var.name, admin_authorized_keys = var.admin_authorized_keys })
+#   size             = 1024 * 1024 * 1024 * 15
-  network_config = templatefile("network_config.cfg.tftpl", { internal_ip = var.internal_ip })
+#   base_volume_name = "debian-bookworm.qcow2"
-}
+#   base_volume_pool = "iso"
-
+# }
-resource "libvirt_domain" "ubuntu" {
+# 
-  name      = var.name
+# resource "libvirt_cloudinit_disk" "cloudinit" {
-  memory    = 1024
+#   name           = "${var.name}.iso"
-  vcpu      = 4
+#   pool           = "init"
-  autostart = true
+#   user_data      = templatefile("cloud_init.cfg.tftpl", { name = var.name, admin_authorized_keys = var.admin_authorized_keys })
-
+#   network_config = templatefile("network_config.cfg.tftpl", { internal_ip = var.internal_ip })
-  disk {
+# }
-    volume_id = libvirt_volume.main_disk.id
+# 
-  }
+# resource "libvirt_domain" "ubuntu" {
-
+#   name      = var.name
-  network_interface {
+#   memory    = 1024
-    bridge   = "dmzbr"
+#   vcpu      = 4
-    hostname = var.name
+#   autostart = true
-    mac      = "CA:FE:C0:FF:EE:07"
+# 
-  }
+#   disk {
-
+#     volume_id = libvirt_volume.main_disk.id
-  cloudinit = libvirt_cloudinit_disk.cloudinit.id
+#   }
-
+# 
-  provisioner "local-exec" {
+#   network_interface {
-    command = "ansible-playbook -e internal_ip=${var.internal_ip} -T 60 -u root -i ${var.ansible_inventory} ${var.ansible_playbook}"
+#     bridge   = "dmzbr"
-
+#     hostname = var.name
-    environment = {
+#     mac      = "CA:FE:C0:FF:EE:07"
-      ANSIBLE_HOST_KEY_CHECKING = "False"
+#   }
-      ANSIBLE_CONFIG            = "${var.ansible_cfg}"
+# 
-    }
+#   cloudinit = libvirt_cloudinit_disk.cloudinit.id
-  }
+# 
-
+#   provisioner "local-exec" {
-  lifecycle {
+#     command = "ansible-playbook -e internal_ip=${var.internal_ip} -T 60 -u root -i ${var.ansible_inventory} ${var.ansible_playbook}"
-    replace_triggered_by = [
+# 
-      libvirt_cloudinit_disk.cloudinit.id
+#     environment = {
-    ]
+#       ANSIBLE_HOST_KEY_CHECKING = "False"
-  }
+#       ANSIBLE_CONFIG            = "${var.ansible_cfg}"
-}
+#     }
+#   }
+# 
+#   lifecycle {
+#     replace_triggered_by = [
+#       libvirt_cloudinit_disk.cloudinit.id
+#     ]
+#   }
+# }

resolv.conf

@@ -0,0 +1 @@
+nameserver 192.168.30.1

roles/dnsmasq/files/dnsmasq.conf

@@ -0,0 +1,44 @@
+# Disable /etc/resolv.conf
+no-resolv
+# Upstream DNS server
+server=192.168.30.1
+# Always serve .dmz locally
+local=/dmz/
+# Put all clients in the dmz domain
+dhcp-fqdn
+# Don't read /etc/hosts
+no-hosts
+# Domain is automatically added to if missing
+expand-hosts
+# Domain that is used for DHCP on this network
+domain=dmz
+# IPv4 DHCP range
+dhcp-range=192.168.30.100,192.168.30.200,15m
+# Predefined DHCP hosts
+dhcp-host=b8:27:eb:b9:ab:e2,esrom
+dhcp-host=b4:2e:99:77:1b:da,max,192.168.30.3
+dhcp-host=d8:5e:d3:47:33:6e,lewis
+# Advertise router
+dhcp-option=3,192.168.30.1
+# Always send the IPv6 DNS server address (this machine)
+dhcp-option=option6:dns-server,[2a02:58:19a:f730::1]
+# Advertise SLAAC for the given prefix
+dhcp-range=2a02:58:19a:f730::, ra-stateless, ra-names
+# Do not advertise default gateway via DHCPv6
+ra-param=*,0,0
+# Alias public IP address to local
+alias=84.245.14.149,192.168.30.3
+# Override DNS servers for our domains
+server=/pizzapim.nl/192.168.30.7
+server=/geokunis2.nl/192.168.30.7
+server=/pim.kunis.nl/192.168.30.7
+# Enable extended logging
+log-dhcp
+log-queries
+# Resolve dns.dmz to addresses on main NIC
+interface-name=hermes.dmz,ens3
+# Non-conventional port because we also run nsd on this machine
+port=5353
+# Override addresses of name servers
+address=/ns.pizzapim.nl/ns.geokunis2.nl/ns.pim.kunis.nl/192.168.30.7
+address=/ns.pizzapim.nl/ns.geokunis2.nl/ns.pim.kunis.nl/2a02:58:19a:f730:c8fe:c0ff:feff:ee07

roles/dnsmasq/tasks/main.yml

@@ -0,0 +1,18 @@
+- name: Install dnsmasq
+  apt:
+    name: dnsmasq
+- name: Disable systemd-resolved
+  systemd:
+    name: systemd-resolved
+    enabled: false
+    state: stopped
+- name: Copy dnsmasq configuration
+  copy:
+    src: "{{ role_path }}/files/dnsmasq.conf"
+    dest: "/etc/dnsmasq.conf"
+  register: config
+- name: Enable dnsmasq
+  systemd:
+    name: dnsmasq
+    enabled: true
+    state: "{{ 'restarted' if config.changed else 'started' }}"

roles/nsd/files/nsd.conf

@@ -0,0 +1,26 @@
+server:
+        ip-address: ens3
+	port: 53
+        server-count: 1
+        verbosity: 1
+        hide-version: yes
+        zonesdir: "/etc/nsd/zones"
+        ip-transparent: yes
+        ip-freebind: yes
+
+zone:
+	name: pim.kunis.nl
+	zonefile: pim.kunis.nl
+
+zone:
+	name: pizzapim.nl
+	zonefile: pizzapim.nl
+	provide-xfr: 87.253.155.96/27 NOKEY
+        provide-xfr: 157.97.168.160/27 NOKEY
+
+
+zone:
+	name: geokunis2.nl
+	zonefile: geokunis2.nl
+	provide-xfr: 87.253.155.96/27 NOKEY
+        provide-xfr: 157.97.168.160/27 NOKEY

roles/nsd/files/zones/geokunis2.nl

@@ -0,0 +1,28 @@
+$ORIGIN geokunis2.nl.
+$TTL 60
+
+geokunis2.nl.	IN	SOA	ns.geokunis2.nl. niels.kunis.nl. 2023031700 1800 3600 1209600 3600
+			NS	ns.geokunis2.nl.
+			NS	ns0.transip.net.
+			NS	ns1.transip.nl.
+			NS	ns2.transip.eu.
+			A	84.245.14.149
+			AAAA	2a02:58:19a:f730:b62e:99ff:fe77:1bda
+;			MX	0 .
+;			TXT	"v=spf1 -all"
+			CAA	0 issue "letsencrypt.org"
+mail		IN	A 84.245.14.149
+			MX	10	mail.geokunis2.nl
+jenl		IN	A	217.123.41.225
+wg			IN	A	84.245.14.149
+wg			IN	AAAA	2a02:58:1:e::1afb
+wg4			IN	A	84.245.14.149
+wg6			IN	AAAA	2a02:58:1:e::1afb
+kms			IN	A	84.245.14.149
+files		IN	A	84.245.14.149
+files		IN	AAAA 2a02:58:19a:f730:b62e:99ff:fe77:1bda
+_dmarc		IN	TXT	"v=DMARC1; p=reject; fo=0; adkim=s; aspf=s; pct=100; rf=afrf; sp=reject"
+ns			A	84.245.14.149
+			AAAA	2a02:58:19a:f730:c8fe:c0ff:feff:ee07
+cyberchef	IN	A	84.245.14.149
+			AAAA	2a02:58:19a:f730:c8fe:c0ff:feff:ee07

roles/nsd/files/zones/pim.kunis.nl

@@ -0,0 +1,22 @@
+$ORIGIN pim.kunis.nl.
+$TTL 60
+
+pim.kunis.nl.	IN 	SOA	ns.pim.kunis.nl. pim.kunis.nl. 2023031700 1800 3600 1209600 3600
+
+			NS	ns.pim.kunis.nl.
+			A	84.245.14.149
+			AAAA	2a02:58:19a:f730:b62e:99ff:fe77:1bda
+			TXT	"v=spf1 ~all"
+
+_dmarc		IN	TXT	"v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:wpux1bq8@ag.eu.dmarcian.com;"
+
+www		IN	A	84.245.14.149
+		IN	AAAA	2a02:58:19a:f730:b62e:99ff:fe77:1bda
+ns		IN	A	84.245.14.149
+		IN	AAAA	2a02:58:19a:f730:c8fe:c0ff:feff:ee07
+
+social		IN	CNAME	www.pim.kunis.nl.
+dav		IN	CNAME	www.pim.kunis.nl.
+git		IN	CNAME	www.pim.kunis.nl.
+meet            IN      CNAME   www.pim.kunis.nl.
+rss             IN      CNAME   www.pim.kunis.nl.

roles/nsd/files/zones/pizzapim.nl

@@ -0,0 +1,19 @@
+$ORIGIN pizzapim.nl.
+$TTL 60
+
+pizzapim.nl.	IN 	SOA	ns.pizzapim.nl. pim.kunis.nl. 2023031700 1800 3600 1209600 3600
+
+			NS	ns.pizzapim.nl.
+			NS	ns0.transip.net.
+			NS	ns1.transip.nl.
+			NS	ns2.transip.eu.
+			A	84.245.14.149
+			TXT	"v=spf1 ~all"
+			CAA	0 issue "letsencrypt.org"
+
+_dmarc		IN	TXT	"v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:wpux1bq8@ag.eu.dmarcian.com;"
+
+social		IN	A	84.245.14.149
+			AAAA	2a02:58:19a:f730:b62e:99ff:fe77:1bda
+ns		IN	A	84.245.14.149
+			AAAA	2a02:58:19a:f730:c8fe:c0ff:feff:ee07

roles/nsd/tasks/main.yml

@@ -0,0 +1,18 @@
+- name: Install nsd
+  apt:
+    name: nsd
+- name: Copy nsd.conf
+  copy:
+    src: "{{ role_path }}/files/nsd.conf"
+    dest: /etc/nsd/nsd.conf
+  register: config
+- name: Copy zone directory
+  copy:
+    src: "{{ role_path }}/files/zones"
+    dest: /etc/nsd
+  register: zones
+- name: Enable nsd
+  systemd:
+    name: nsd
+    enabled: true
+    state: "{{ 'restarted' if config.changed or zones.changed else 'started' }}"

roles/ssh/files/ca.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+IFS=$'\n\t'
+
+HOSTCAKEY=/root/.ssh/host_ca_key
+USERCAKEY=/root/.ssh/user_ca_key
+
+host() {
+	PUBKEY="$2"
+	HOST="$3"
+
+	echo "$PUBKEY" > /tmp/"$HOST".pub
+	ssh-keygen -h -s "$HOSTCAKEY" -I "$HOST" -n "$HOST" /tmp/"$HOST".pub
+	cat /tmp/"$HOST"-cert.pub
+	rm /tmp/"$HOST"*.pub
+}
+
+user() {
+	PUBKEY="$2"
+	HOST="$3"
+	PRINCIPALS="$4"
+
+	echo "$PUBKEY" > /tmp/"$HOST".pub
+	ssh-keygen -s "$USERCAKEY" -I "$HOST" -n "$HOST","$PRINCIPALS" /tmp/"$HOST".pub
+	cat /tmp/"$HOST"-cert.pub
+	rm /tmp/"$HOST"*.pub
+}
+
+"$1" "$@"

roles/ssh/files/keys/host_ca_key

@@ -0,0 +1,27 @@
+$ANSIBLE_VAULT;1.1;AES256
+65393830356161326338323139306466316362303835393833383633363431303639393835666538
+6639653036666261363236393832343236656531633261360a333664363033356432386439336630
+65336333666662633635316565363366353530653831383937616566386165346663393938386530
+3233613134343331350a363163383831396265646333336334366664353164386538313031393230
+61356239333863366665396131633039663161306536386636336631646238303164303565653331
+64353465633235396261333739643635306530333665313330633936643966363539646636376630
+32303233303437393662393161313330333331396666613133633964393335393035363536373464
+36323334393235626561333262373639353332663337393562356562656662373833633833636466
+65373739663764623962323630623866363563626536313436346532643332646238393237396439
+35623961336266333037636532663833653466346264326330616135346234643363636662396630
+30613132633237333633636361323937643338323738386231383561613237646436333336383562
+61316232393864316236616561333139626463373962303134366131653439656638636365633930
+33353565373066623763346139663238346237376461613834323839336533653936646532316437
+66303565346665303335656233663735333630643963656637363934626336323361356639616430
+32323133396165356237613062313864313534323364663232636566373332633461316461346435
+32663862353439653764616461646463336639646636333862663832656131356536666233396638
+63613439636432306164393737353033383661623733646231313238303863376362376334656262
+33336132373139333030333533633032353564336666663237333135376532396165653831663537
+32653836373034383965653431646137633638633465626164386638323466636238393665303964
+35366432643962613063326338373031393036643437663438356339386662303362333062343730
+65646535373833343831633164666563616561633833353739643963633265396561386462336234
+66323330363662653235333464623965653635323437613734366231386331363461643262366565
+37626536623832323162363862363632666164353138616362386562393530623265303936656364
+65633463363935393838333338303239333538393865653338396635393262623636616364323133
+66333165616364356235303431316232666330313933386331383435663939386331626635316537
+3964323534326563303636616135663137373365663365663931

roles/ssh/files/keys/host_ca_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x Host Certficate Authority for DMZ

roles/ssh/files/keys/user_ca_key

@@ -0,0 +1,27 @@
+$ANSIBLE_VAULT;1.1;AES256
+36306261333262396466633565653163323239396630653031343331653337376433356461613064
+3333316136343033396131356638666661623464333333310a636264616339363366386633663965
+64336437316366333363396162376337653537376365306638316166663437643731613935353137
+6138306232396134310a373962653330613331653830343766613435363339343438636665306633
+39633061303937313962323839336437653763336164616433353831646663393764373933306565
+38633335373863363437313531393530333562336430636261656564306563343537313264366436
+32653932356263333938386231333134303633333666343531616332376632343462316335643732
+30386465626533363333626162386331626436373935386537393335666437633166303838663264
+61353532306161343630303233336463376266366463313039343262656333663936333338373633
+31353361356232356637333466316634623739323335613433356362333565646138373838663034
+39363734623537633133393836323261353461623562386235646566303162373235623534383238
+33363264386438393563613639333336323963363733346665663430626335346334386233396236
+34636164653264386266393561303037646464646136313861343438636437626166333361613262
+66333333303139653639383963373731613639643837363639353264376230616264313930396434
+39303863653939613333323739363263383531333539333334306632323865646131653030356365
+38363530656131646431616661616137386161613033643664336661343531333933326339656636
+61356337393936623462323039343534656565353466353565653838666336306266313131316435
+39333739313262646462663531663234633066333033666461306434313166366533353865313530
+31326334383138383332366665383965633838636436646230323931646136336234636631313138
+33363062393632393830383231333166373032386163316633613061643166663266396131333838
+30316439373834356230633566323966376336363362346338323237343637393765323237373832
+61626432653935663230663261343037363037646539623330383235376231303738323132306131
+33646237633164356332366664353763623839623738633230613837356330393535346236383165
+35376631313332356164636336336439386432326337663436373661613264306135313961623434
+37386335663332613435626233333037316466363730623065633336666436343433326564333264
+6231373332643633346235663930616439653238396331626564

roles/ssh/files/keys/user_ca_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKOClnK6/Hj8INjEgULY/lD2FM/nbiJHqaSXtEw4+Fj User Certificate Authority for DMZ

roles/ssh/tasks/main.yml

@@ -0,0 +1,10 @@
+- name: Copy ca.sh
+  copy:
+    src: "{{ role_path }}/files/ca.sh"
+    dest: /root/ca.sh
+    mode: 755
+- name: Copy keys
+  copy:
+    src: "{{ role_path }}/files/keys/"
+    dest: /root/.ssh/
+    mode: preserve

util/secret-service-client.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+pass=`secret-tool lookup ansible_vault hermes`
+retval=$?
+
+if [ $retval -ne 0 ]; then
+	read -s pass
+fi
+echo $pass