ansible/group_vars/accesspoints/main.yml

   1 ---
   2 accesspoint_wifi_channels:
   3   2.4g:
   4     ap0: 3
   5     ap1: 8
   6     ap2: 13
   7   5g:
   8     ap0: 36
   9     ap1: 48
  10     ap2: 40
  11
  12 accesspoint_zones:
  13   iot:
  14     ssid: "TEST realstuff"
  15     encryption: "psk2"
  16     key: "{{ vault_accesspoint_zones.iot.key }}"
  17   guests:
  18     ssid: "TEST realraum"
  19     encryption: "psk2"
  20     key: "{{ vault_accesspoint_zones.guests.key }}"
  21   # members:
  22   #   ssid: "TEST r3members"
  23   #   encryption: "psk2"
  24   #   key: "{{ vault_accesspoint_zones.members.key }}"
  25
  26
  27
  28 accesspoint_wired_interface: eth0
  29 accesspoint_wireless_device_paths:
  30   2.4g: "platform/qca956x_wmac"
  31   5g: "pci0000:00/0000:00:00.0"
  32
  33 accesspoint_network_base:
  34   - name: globals 'globals'
  35     options:
  36       ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"
  37
  38   - name: interface 'loopback'
  39     options:
  40       ifname: lo
  41       proto: static
  42       ipaddr: 127.0.0.1
  43       netmask: 255.0.0.0
  44
  45   - name: interface 'raw'
  46     options:
  47       ifname: "{{ accesspoint_wired_interface }}"
  48       proto: none
  49       accept_ra: 0
  50
  51   - name: interface 'mgmt'
  52     options:
  53       type: bridge
  54       ifname: "{{ accesspoint_wired_interface }}.{{ net.mgmt.vlan }}"
  55       accept_ra: 0
  56       proto: static
  57       ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}"
  58       netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}"
  59       gateway: "{{ net.mgmt.gw }}"
  60       dns: "{{ net.mgmt.dns | join(' ') }}"
  61       dns_search: realraum.at
  62
  63 accesspoint_network_zones: "{{ accesspoint_network_zones_yaml | from_yaml }}"
  64 accesspoint_network_zones_yaml: |
  65   {% for item in accesspoint_zones.keys() %}
  66   - name: interface "{{ item }}"
  67     options:
  68       type: bridge
  69       ifname: "{{ accesspoint_wired_interface }}.{{ net[item].vlan }}"
  70       accept_ra: 0
  71       proto: none
  72   {% endfor %}
  73
  74
  75 accesspoint_wireless_devices:
  76   - name: wifi-device 'radio5g'
  77     options:
  78       type: 'mac80211'
  79       channel: "{{ accesspoint_wifi_channels['5g'][inventory_hostname] }}"
  80       hwmode: '11a'
  81       country: AT
  82       path: "{{ accesspoint_wireless_device_paths['5g'] }}"
  83       htmode: 'VHT80'
  84
  85   - name: wifi-device 'radio2g4'
  86     options:
  87       type: 'mac80211'
  88       channel: "{{ accesspoint_wifi_channels['2.4g'][inventory_hostname] }}"
  89       hwmode: '11g'
  90       country: AT
  91       path: "{{ accesspoint_wireless_device_paths['2.4g'] }}"
  92       htmode: 'HT20'
  93
  94
  95 ## TODO: set up 802.11r see:
  96 ##        * https://www.reddit.com/r/openwrt/comments/515oea/finally_got_80211r_roaming_working/
  97 ##        * https://gist.github.com/lg/998d3e908d547bd9972a6bb604df377b
  98 accesspoint_wireless_ifaces: "{{ accesspoint_wireless_ifaces_yaml | from_yaml }}"
  99 accesspoint_wireless_ifaces_yaml: |
 100   {% for item in accesspoint_zones.keys() %}
 101   - name: wifi-iface '{{ item }}2g4only'
 102     options:
 103       device: 'radio2g4'
 104       network: '{{ item }}'
 105       mode: 'ap'
 106       disassoc_low_ack: '1'
 107       rsn_preauth: '1'
 108       ssid: '{{ accesspoint_zones[item].ssid }}2.4'
 109       encryption: '{{ accesspoint_zones[item].encryption }}'
 110       key: '{{ accesspoint_zones[item].key }}'
 111
 112   - name: wifi-iface '{{ item }}5gonly'
 113     options:
 114       device: 'radio5g'
 115       network: '{{ item }}'
 116       mode: 'ap'
 117       disassoc_low_ack: '1'
 118       rsn_preauth: '1'
 119       ssid: '{{ accesspoint_zones[item].ssid }}5'
 120       encryption: '{{ accesspoint_zones[item].encryption }}'
 121       key: '{{ accesspoint_zones[item].key }}'
 122
 123   - name: wifi-iface '{{ item }}2g4'
 124     options:
 125       device: 'radio2g4'
 126       network: '{{ item }}'
 127       mode: 'ap'
 128       disassoc_low_ack: '1'
 129       rsn_preauth: '1'
 130       ssid: '{{ accesspoint_zones[item].ssid }}'
 131       encryption: '{{ accesspoint_zones[item].encryption }}'
 132       key: '{{ accesspoint_zones[item].key }}'
 133
 134   - name: wifi-iface '{{ item }}5g'
 135     options:
 136       device: 'radio5g'
 137       network: '{{ item }}'
 138       mode: 'ap'
 139       disassoc_low_ack: '1'
 140       rsn_preauth: '1'
 141       ssid: '{{ accesspoint_zones[item].ssid }}'
 142       encryption: '{{ accesspoint_zones[item].encryption }}'
 143       key: '{{ accesspoint_zones[item].key }}'
 144   {% endfor %}
 145
 146
 147
 148 openwrt_variant: openwrt
 149 openwrt_release: 18.06.1
 150 openwrt_arch: ar71xx
 151 openwrt_target: generic
 152 openwrt_profile: ubnt-unifiac-lite
 153 openwrt_output_image_suffixes:
 154   - "generic-{{ openwrt_profile }}-squashfs-sysupgrade.bin"
 155
 156 openwrt_mixin:
 157   /etc/sysctl.conf:
 158     content: |
 159       # Defaults are configured in /etc/sysctl.d/* and can be customized in this file
 160       #
 161       # disable IP forwarding, we don't need it since we are
 162       # only an AP that bridges VLANs to Wifi SSIDs
 163       net.ipv4.conf.default.forwarding=0
 164       net.ipv4.conf.all.forwarding=0
 165       net.ipv4.ip_forward=0
 166       net.ipv6.conf.default.forwarding=0
 167       net.ipv6.conf.all.forwarding=0
 168
 169   /etc/dropbear/authorized_keys:
 170     content: |-
 171       {% for key in noc_ssh_keys %}
 172       {{ key }}
 173       {% endfor %}
 174
 175   /root/.config/htop/htoprc:
 176     content: |
 177       # Beware! This file is rewritten by htop when settings are changed in the interface.
 178       # The parser is also very primitive, and not human-friendly.
 179       fields=0 48 17 18 38 39 40 2 46 47 49 1
 180       sort_key=46
 181       sort_direction=1
 182       hide_threads=0
 183       hide_kernel_threads=1
 184       hide_userland_threads=0
 185       shadow_other_users=0
 186       show_thread_names=0
 187       show_program_path=1
 188       highlight_base_name=1
 189       highlight_megabytes=1
 190       highlight_threads=1
 191       tree_view=1
 192       header_margin=1
 193       detailed_cpu_time=0
 194       cpu_count_from_zero=0
 195       update_process_names=0
 196       account_guest_in_cpu_meter=0
 197       color_scheme=0
 198       delay=15
 199       left_meters=AllCPUs Memory Swap
 200       left_meter_modes=1 1 1
 201       right_meters=Tasks LoadAverage Uptime
 202       right_meter_modes=2 2 2
 203
 204
 205 openwrt_uci:
 206   system:
 207     - name: system
 208       options:
 209         hostname: '{{ inventory_hostname }}'
 210         timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
 211         ttylogin: '0'
 212         log_size: '64'
 213         urandom_seed: '0'
 214
 215     - name: timeserver 'ntp'
 216       options:
 217         enabled: '1'
 218         enable_server: '0'
 219         server:
 220           - '0.lede.pool.ntp.org'
 221           - '1.lede.pool.ntp.org'
 222           - '2.lede.pool.ntp.org'
 223           - '3.lede.pool.ntp.org'
 224
 225   dropbear:
 226     - name: dropbear
 227       options:
 228         PasswordAuth: 'off'
 229         RootPasswordAuth: 'off'
 230         Port: '22000'
 231
 232   network: "{{ accesspoint_network_base + accesspoint_network_zones }}"
 233   wireless: "{{ accesspoint_wireless_devices + accesspoint_wireless_ifaces }}"