ansible/group_vars/accesspoints/main.yml

   1 ---
   2 accesspoint_wifi_channels:
   3   2.4g:
   4     ap0: 3
   5     ap1: 8
   6     ap2: 13
   7   5g:
   8     ap0: 36
   9     ap1: 48
  10     ap2: 40
  11
  12 accesspoint_zones:
  13   iot:
  14     ssid: "TEST realstuff"
  15     encryption: "psk2"
  16     key: "{{ vault_accesspoint_zones.iot.key }}"
  17   guests:
  18     ssid: "TEST realraum"
  19     encryption: "psk2"
  20     key: "{{ vault_accesspoint_zones.guests.key }}"
  21   # members:
  22   #   ssid: "TEST r3members"
  23   #   encryption: "psk2"
  24   #   key: "{{ vault_accesspoint_zones.members.key }}"
  25
  26
  27
  28 accesspoint_wired_interface: eth0
  29 accesspoint_wireless_device_paths:
  30   2.4g: "platform/qca956x_wmac"
  31   5g: "pci0000:00/0000:00:00.0"
  32
  33 accesspoint_network_base:
  34   - name: globals 'globals'
  35     options:
  36       ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"
  37
  38   - name: interface 'loopback'
  39     options:
  40       ifname: lo
  41       proto: static
  42       ipaddr: 127.0.0.1
  43       netmask: 255.0.0.0
  44
  45   - name: interface 'raw'
  46     options:
  47       ifname: "{{ accesspoint_wired_interface }}"
  48       proto: none
  49       accept_ra: 0
  50
  51   - name: interface 'mgmt'
  52     options:
  53       type: bridge
  54       ifname: "{{ accesspoint_wired_interface }}.{{ net.mgmt.vlan }}"
  55       accept_ra: 0
  56       proto: static
  57       ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}"
  58       netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}"
  59       gateway: "{{ net.mgmt.gw }}"
  60       dns: "{{ net.mgmt.dns | join(' ') }}"
  61       dns_search: realraum.at
  62
  63 accesspoint_network_zones: "{{ accesspoint_network_zones_yaml | from_yaml }}"
  64 accesspoint_network_zones_yaml: |
  65   {% for item in accesspoint_zones.keys() %}
  66   - name: interface "{{ item }}"
  67     options:
  68       type: bridge
  69       ifname: "{{ accesspoint_wired_interface }}.{{ net[item].vlan }}"
  70       accept_ra: 0
  71       proto: none
  72   {% endfor %}
  73
  74
  75 accesspoint_wireless_devices:
  76   - name: wifi-device 'radio5g'
  77     options:
  78       type: 'mac80211'
  79       channel: "{{ accesspoint_wifi_channels['5g'][inventory_hostname] }}"
  80       hwmode: '11a'
  81       country: AT
  82       path: "{{ accesspoint_wireless_device_paths['5g'] }}"
  83       htmode: 'VHT80'
  84
  85   - name: wifi-device 'radio2g4'
  86     options:
  87       type: 'mac80211'
  88       channel: "{{ accesspoint_wifi_channels['2.4g'][inventory_hostname] }}"
  89       hwmode: '11g'
  90       country: AT
  91       path: "{{ accesspoint_wireless_device_paths['2.4g'] }}"
  92       htmode: 'HT20'
  93
  94
  95 ## TODO: set up 802.11r see:
  96 ##        * https://www.reddit.com/r/openwrt/comments/515oea/finally_got_80211r_roaming_working/
  97 ##        * https://gist.github.com/lg/998d3e908d547bd9972a6bb604df377b
  98 accesspoint_wireless_ifaces: "{{ accesspoint_wireless_ifaces_yaml | from_yaml }}"
  99 accesspoint_wireless_types:
 100   - { name: only, ssid: 2.4, freq: 2g4 }
 101   - { name: only, ssid: 5, freq: 5g }
 102   - { name: '', ssid: '', freq: 2g4 }
 103   - { name: '', ssid: '', freq: 5g }
 104 accesspoint_wireless_ifaces_yaml: |
 105   {% for zone in accesspoint_zones.keys() %}
 106   {%   for item in accesspoint_wireless_types %}
 107   - name: wifi-iface '{{ zone }}{{ item.freq }}{{ item.name }}'
 108     options:
 109       device: 'radio{{ item.freq }}'
 110       network: '{{ zone }}'
 111       mode: 'ap'
 112       disassoc_low_ack: '1'
 113       rsn_preauth: '1'
 114       ssid: '{{ accesspoint_zones[zone].ssid }}{{ item.ssid }}'
 115       encryption: '{{ accesspoint_zones[zone].encryption }}'
 116       key: '{{ accesspoint_zones[zone].key }}'
 117   {%   endfor %}
 118   {% endfor %}
 119
 120
 121
 122 openwrt_variant: openwrt
 123 openwrt_release: 18.06.1
 124 openwrt_arch: ar71xx
 125 openwrt_target: generic
 126 openwrt_profile: ubnt-unifiac-lite
 127 openwrt_output_image_suffixes:
 128   - "generic-{{ openwrt_profile }}-squashfs-sysupgrade.bin"
 129
 130 openwrt_mixin:
 131   /etc/sysctl.conf:
 132     content: |
 133       # Defaults are configured in /etc/sysctl.d/* and can be customized in this file
 134       #
 135       # disable IP forwarding, we don't need it since we are
 136       # only an AP that bridges VLANs to Wifi SSIDs
 137       net.ipv4.conf.default.forwarding=0
 138       net.ipv4.conf.all.forwarding=0
 139       net.ipv4.ip_forward=0
 140       net.ipv6.conf.default.forwarding=0
 141       net.ipv6.conf.all.forwarding=0
 142
 143   /etc/dropbear/authorized_keys:
 144     content: |-
 145       {% for key in noc_ssh_keys %}
 146       {{ key }}
 147       {% endfor %}
 148
 149   /root/.config/htop/htoprc:
 150     content: |
 151       # Beware! This file is rewritten by htop when settings are changed in the interface.
 152       # The parser is also very primitive, and not human-friendly.
 153       fields=0 48 17 18 38 39 40 2 46 47 49 1
 154       sort_key=46
 155       sort_direction=1
 156       hide_threads=0
 157       hide_kernel_threads=1
 158       hide_userland_threads=0
 159       shadow_other_users=0
 160       show_thread_names=0
 161       show_program_path=1
 162       highlight_base_name=1
 163       highlight_megabytes=1
 164       highlight_threads=1
 165       tree_view=1
 166       header_margin=1
 167       detailed_cpu_time=0
 168       cpu_count_from_zero=0
 169       update_process_names=0
 170       account_guest_in_cpu_meter=0
 171       color_scheme=0
 172       delay=15
 173       left_meters=AllCPUs Memory Swap
 174       left_meter_modes=1 1 1
 175       right_meters=Tasks LoadAverage Uptime
 176       right_meter_modes=2 2 2
 177
 178
 179 openwrt_uci:
 180   system:
 181     - name: system
 182       options:
 183         hostname: '{{ inventory_hostname }}'
 184         timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
 185         ttylogin: '0'
 186         log_size: '64'
 187         urandom_seed: '0'
 188
 189     - name: timeserver 'ntp'
 190       options:
 191         enabled: '1'
 192         enable_server: '0'
 193         server:
 194           - '0.lede.pool.ntp.org'
 195           - '1.lede.pool.ntp.org'
 196           - '2.lede.pool.ntp.org'
 197           - '3.lede.pool.ntp.org'
 198
 199   dropbear:
 200     - name: dropbear
 201       options:
 202         PasswordAuth: 'off'
 203         RootPasswordAuth: 'off'
 204         Port: '22000'
 205
 206   network: "{{ accesspoint_network_base + accesspoint_network_zones }}"
 207   wireless: "{{ accesspoint_wireless_devices + accesspoint_wireless_ifaces }}"