X-Git-Url: https://git.realraum.at/?a=blobdiff_plain;f=ansible%2Fgroup_vars%2Faccesspoints%2Fmain.yml;h=a58aff2851a418fb390f715353099e1c358a87a5;hb=66e930078474421bc1c8c7296468537c9753f2d6;hp=799238393f5fcaef7fbd5ddbf3205c2a871b2d4d;hpb=630b0f012f1b6a579cffddfcf20f0574e5d21a9f;p=noc.git

diff --git a/ansible/group_vars/accesspoints/main.yml b/ansible/group_vars/accesspoints/main.yml
index 7992383..a58aff2 100644
--- a/ansible/group_vars/accesspoints/main.yml
+++ b/ansible/group_vars/accesspoints/main.yml
@@ -1,4 +1,130 @@
 ---
+ssh_users_root:
+  - equinox
+  - nicoo
+
+accesspoint_wifi_channels:
+  2.4g:
+    ap0: 3
+    ap1: 8
+    ap2: 13
+  5g:
+    ap0: 36
+    ap1: 48
+    ap2: 40
+
+accesspoint_zones:
+  iot:
+    ssid: "realstuff"
+    encryption: "psk2"
+    key: "{{ vault_accesspoint_zones.iot.key }}"
+  guests:
+    ssid: "realraum"
+    encryption: "psk2"
+    key: "{{ vault_accesspoint_zones.guests.key }}"
+  # members:
+  #   ssid: "r3members"
+  #   encryption: "psk2"
+  #   key: "{{ vault_accesspoint_zones.members.key }}"
+
+
+
+accesspoint_wired_interface: eth0
+accesspoint_wireless_device_paths:
+  2.4g: "platform/qca956x_wmac"
+  5g: "pci0000:00/0000:00:00.0"
+
+accesspoint_network_base:
+  - name: globals 'globals'
+    options:
+      ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"
+
+  - name: interface 'loopback'
+    options:
+      ifname: lo
+      proto: static
+      ipaddr: 127.0.0.1
+      netmask: 255.0.0.0
+
+  - name: interface 'raw'
+    options:
+      ifname: "{{ accesspoint_wired_interface }}"
+      proto: none
+      accept_ra: 0
+
+  - name: interface 'mgmt'
+    options:
+      type: bridge
+      ifname: "{{ accesspoint_wired_interface }}.{{ net.mgmt.vlan }}"
+      accept_ra: 0
+      proto: static
+      ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}"
+      netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}"
+      gateway: "{{ net.mgmt.gw }}"
+      dns: "{{ net.mgmt.dns | join(' ') }}"
+      dns_search: realraum.at
+
+accesspoint_network_zones: "{{ accesspoint_network_zones_yaml | from_yaml }}"
+accesspoint_network_zones_yaml: |
+  {% for item in accesspoint_zones.keys() %}
+  - name: interface "{{ item }}"
+    options:
+      type: bridge
+      ifname: "{{ accesspoint_wired_interface }}.{{ net[item].vlan }}"
+      accept_ra: 0
+      proto: none
+  {% endfor %}
+
+
+accesspoint_wireless_devices:
+  - name: wifi-device 'radio5g'
+    options:
+      type: 'mac80211'
+      channel: "{{ accesspoint_wifi_channels['5g'][inventory_hostname] }}"
+      hwmode: '11a'
+      country: AT
+      path: "{{ accesspoint_wireless_device_paths['5g'] }}"
+      htmode: 'VHT80'
+
+  - name: wifi-device 'radio2g4'
+    options:
+      type: 'mac80211'
+      channel: "{{ accesspoint_wifi_channels['2.4g'][inventory_hostname] }}"
+      hwmode: '11g'
+      country: AT
+      path: "{{ accesspoint_wireless_device_paths['2.4g'] }}"
+      htmode: 'HT20'
+
+
+## TODO: set up 802.11r see:
+##        * https://www.reddit.com/r/openwrt/comments/515oea/finally_got_80211r_roaming_working/
+##        * https://gist.github.com/lg/998d3e908d547bd9972a6bb604df377b
+accesspoint_wireless_ifaces: "{{ accesspoint_wireless_ifaces_yaml | from_yaml }}"
+accesspoint_wireless_types:
+  - { name: only, ssid: 2.4, freq: 2g4 }
+  - { name: only, ssid: 5, freq: 5g }
+  - { name: '', ssid: '', freq: 2g4 }
+  - { name: '', ssid: '', freq: 5g }
+accesspoint_wireless_ifaces_yaml: |
+  {% for zone in accesspoint_zones.keys() %}
+  {%   for item in accesspoint_wireless_types %}
+  - name: wifi-iface '{{ zone }}{{ item.freq }}{{ item.name }}'
+    options:
+      device: 'radio{{ item.freq }}'
+      network: '{{ zone }}'
+      mode: 'ap'
+      disassoc_low_ack: '1'
+      rsn_preauth: '1'
+      ssid: '{{ accesspoint_zones[zone].ssid }}{{ item.ssid }}'
+      encryption: '{{ accesspoint_zones[zone].encryption }}'
+      key: '{{ accesspoint_zones[zone].key }}'
+  {%   endfor %}
+  {% endfor %}
+
+
+
+openwrt_variant: openwrt
+openwrt_release: 18.06.1
 openwrt_arch: ar71xx
 openwrt_target: generic
 openwrt_profile: ubnt-unifiac-lite
@@ -6,11 +132,24 @@ openwrt_output_image_suffixes:
   - "generic-{{ openwrt_profile }}-squashfs-sysupgrade.bin"
 
 openwrt_mixin:
+  /etc/sysctl.conf:
+    content: |
+      # Defaults are configured in /etc/sysctl.d/* and can be customized in this file
+      #
+      # disable IP forwarding, we don't need it since we are
+      # only an AP that bridges VLANs to Wifi SSIDs
+      net.ipv4.conf.default.forwarding=0
+      net.ipv4.conf.all.forwarding=0
+      net.ipv4.ip_forward=0
+      net.ipv6.conf.default.forwarding=0
+      net.ipv6.conf.all.forwarding=0
+
   /etc/dropbear/authorized_keys:
-    content: |-
-      {% for key in noc_ssh_keys %}
-      {{ key }}
-      {% endfor %}
+    content: "{{ ssh_users_root | user_ssh_keys(users) | join('\n') }}\n"
+
+  /etc/htoprc:
+    file: "{{ global_files_dir }}/common/htoprc"
+
 
 openwrt_uci:
   system:
@@ -32,40 +171,12 @@ openwrt_uci:
           - '2.lede.pool.ntp.org'
           - '3.lede.pool.ntp.org'
 
-  network:
-    - name: globals 'globals'
+  dropbear:
+    - name: dropbear
       options:
-        ula_prefix: fdc9:e01f:83db::/48
+        PasswordAuth: 'off'
+        RootPasswordAuth: 'off'
+        Port: '22000'
 
-    - name: interface 'loopback'
-      options:
-        ifname: lo
-        proto: static
-        ipaddr: 127.0.0.1
-        netmask: 255.0.0.0
-
-    - name: interface 'mgmt'
-      options:
-        type: bridge
-        ifname: "eth0.{{ net.mgmt.vlan }}"
-        accept_ra: 0
-        proto: static
-        ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}"
-        netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}"
-        gateway: "{{ net.mgmt.gw }}"
-        dns: "{{ net.mgmt.dns | join(' ') }}"
-        dns_search: realraum.at
-
-    - name: interface 'iot'
-      options:
-        type: bridge
-        ifname: "eth0.{{ net.iot.vlan }}"
-        accept_ra: 0
-        proto: none
-
-    - name: interface 'lan'
-      options:
-        type: bridge
-        ifname: "eth0.{{ net.lan.vlan }}"
-        accept_ra: 0
-        proto: none
+  network: "{{ accesspoint_network_base + accesspoint_network_zones }}"
+  wireless: "{{ accesspoint_wireless_devices + accesspoint_wireless_ifaces }}"