X-Git-Url: https://git.realraum.at/?a=blobdiff_plain;f=ansible%2Fgroup_vars%2Faccesspoints%2Fmain.yml;h=aea52eb6ae4166573e27adda71122034365cfd81;hb=8e99a7dbf4bccc89d661780cd98872273b9818a7;hp=799238393f5fcaef7fbd5ddbf3205c2a871b2d4d;hpb=630b0f012f1b6a579cffddfcf20f0574e5d21a9f;p=noc.git diff --git a/ansible/group_vars/accesspoints/main.yml b/ansible/group_vars/accesspoints/main.yml index 7992383..aea52eb 100644 --- a/ansible/group_vars/accesspoints/main.yml +++ b/ansible/group_vars/accesspoints/main.yml @@ -1,4 +1,140 @@ --- +accesspoint_wifi_channels: + 2.4g: + ap0: 3 + ap1: 8 + ap2: 13 + 5g: + ap0: 36 + ap1: 48 + ap2: 40 + +accesspoint_zones: + iot: + ssid: "TEST realstuff" + encryption: "psk2" + key: "{{ vault_accesspoint_zones.iot.key }}" + guests: + ssid: "TEST realraum" + encryption: "psk2" + key: "{{ vault_accesspoint_zones.guests.key }}" + # members: + # ssid: "TEST r3members" + # encryption: "psk2" + # key: "{{ vault_accesspoint_zones.members.key }}" + + + +accesspoint_wired_interface: eth0 +accesspoint_wireless_device_paths: + 2.4g: "platform/qca956x_wmac" + 5g: "pci0000:00/0000:00:00.0" + +accesspoint_network_base: + - name: globals 'globals' + options: + ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48" + + - name: interface 'loopback' + options: + ifname: lo + proto: static + ipaddr: 127.0.0.1 + netmask: 255.0.0.0 + + - name: interface 'raw' + options: + ifname: "{{ accesspoint_wired_interface }}" + proto: none + accept_ra: 0 + + - name: interface 'mgmt' + options: + type: bridge + ifname: "{{ accesspoint_wired_interface }}.{{ net.mgmt.vlan }}" + accept_ra: 0 + proto: static + ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}" + netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}" + gateway: "{{ net.mgmt.gw }}" + dns: "{{ net.mgmt.dns | join(' ') }}" + dns_search: realraum.at + +accesspoint_network_zones: "{{ accesspoint_network_zones_yaml | from_yaml }}" +accesspoint_network_zones_yaml: | + {% for item in accesspoint_zones.keys() %} + - name: interface "{{ item }}" + options: + type: bridge + ifname: "{{ accesspoint_wired_interface }}.{{ net[item].vlan }}" + accept_ra: 0 + proto: none + {% endfor %} + + +accesspoint_wireless_devices: + - name: wifi-device 'radio5g' + options: + type: 'mac80211' + channel: "{{ accesspoint_wifi_channels['5g'][inventory_hostname] }}" + hwmode: '11a' + country: AT + path: "{{ accesspoint_wireless_device_paths['5g'] }}" + htmode: 'VHT80' + + - name: wifi-device 'radio2g4' + options: + type: 'mac80211' + channel: "{{ accesspoint_wifi_channels['2.4g'][inventory_hostname] }}" + hwmode: '11g' + country: AT + path: "{{ accesspoint_wireless_device_paths['2.4g'] }}" + htmode: 'HT20' + +accesspoint_wireless_ifaces: "{{ accesspoint_wireless_ifaces_yaml | from_yaml }}" +accesspoint_wireless_ifaces_yaml: | + {% for item in accesspoint_zones.keys() %} + - name: wifi-iface '{{ item }}2g4only' + options: + device: 'radio2g4' + network: '{{ item }}' + mode: 'ap' + ssid: '{{ accesspoint_zones[item].ssid }}2.4' + encryption: '{{ accesspoint_zones[item].encryption }}' + key: '{{ accesspoint_zones[item].key }}' + + - name: wifi-iface '{{ item }}5gonly' + options: + device: 'radio5g' + network: '{{ item }}' + mode: 'ap' + ssid: '{{ accesspoint_zones[item].ssid }}5' + encryption: '{{ accesspoint_zones[item].encryption }}' + key: '{{ accesspoint_zones[item].key }}' + + - name: wifi-iface '{{ item }}2g4' + options: + device: 'radio2g4' + network: '{{ item }}' + mode: 'ap' + ssid: '{{ accesspoint_zones[item].ssid }}' + encryption: '{{ accesspoint_zones[item].encryption }}' + key: '{{ accesspoint_zones[item].key }}' + + - name: wifi-iface '{{ item }}5g' + options: + device: 'radio5g' + network: '{{ item }}' + mode: 'ap' + ssid: '{{ accesspoint_zones[item].ssid }}' + encryption: '{{ accesspoint_zones[item].encryption }}' + key: '{{ accesspoint_zones[item].key }}' + {% endfor %} + + + +openwrt_variant: openwrt +openwrt_release: 18.06.1 openwrt_arch: ar71xx openwrt_target: generic openwrt_profile: ubnt-unifiac-lite @@ -6,12 +142,54 @@ openwrt_output_image_suffixes: - "generic-{{ openwrt_profile }}-squashfs-sysupgrade.bin" openwrt_mixin: + /etc/sysctl.conf: + content: | + # Defaults are configured in /etc/sysctl.d/* and can be customized in this file + # + # disable IP forwarding, we don't need it since we are + # only an AP that bridges VLANs to Wifi SSIDs + net.ipv4.conf.default.forwarding=0 + net.ipv4.conf.all.forwarding=0 + net.ipv4.ip_forward=0 + net.ipv6.conf.default.forwarding=0 + net.ipv6.conf.all.forwarding=0 + /etc/dropbear/authorized_keys: content: |- {% for key in noc_ssh_keys %} {{ key }} {% endfor %} + /root/.config/htop/htoprc: + content: | + # Beware! This file is rewritten by htop when settings are changed in the interface. + # The parser is also very primitive, and not human-friendly. + fields=0 48 17 18 38 39 40 2 46 47 49 1 + sort_key=46 + sort_direction=1 + hide_threads=0 + hide_kernel_threads=1 + hide_userland_threads=0 + shadow_other_users=0 + show_thread_names=0 + show_program_path=1 + highlight_base_name=1 + highlight_megabytes=1 + highlight_threads=1 + tree_view=1 + header_margin=1 + detailed_cpu_time=0 + cpu_count_from_zero=0 + update_process_names=0 + account_guest_in_cpu_meter=0 + color_scheme=0 + delay=15 + left_meters=AllCPUs Memory Swap + left_meter_modes=1 1 1 + right_meters=Tasks LoadAverage Uptime + right_meter_modes=2 2 2 + + openwrt_uci: system: - name: system @@ -32,40 +210,12 @@ openwrt_uci: - '2.lede.pool.ntp.org' - '3.lede.pool.ntp.org' - network: - - name: globals 'globals' - options: - ula_prefix: fdc9:e01f:83db::/48 - - - name: interface 'loopback' + dropbear: + - name: dropbear options: - ifname: lo - proto: static - ipaddr: 127.0.0.1 - netmask: 255.0.0.0 + PasswordAuth: 'off' + RootPasswordAuth: 'off' + Port: '22000' - - name: interface 'mgmt' - options: - type: bridge - ifname: "eth0.{{ net.mgmt.vlan }}" - accept_ra: 0 - proto: static - ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}" - netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}" - gateway: "{{ net.mgmt.gw }}" - dns: "{{ net.mgmt.dns | join(' ') }}" - dns_search: realraum.at - - - name: interface 'iot' - options: - type: bridge - ifname: "eth0.{{ net.iot.vlan }}" - accept_ra: 0 - proto: none - - - name: interface 'lan' - options: - type: bridge - ifname: "eth0.{{ net.lan.vlan }}" - accept_ra: 0 - proto: none + network: "{{ accesspoint_network_base + accesspoint_network_zones }}" + wireless: "{{ accesspoint_wireless_devices + accesspoint_wireless_ifaces }}"