ansible/group_vars/accesspoints/main.yml

   1 ---
   2 accesspoint_wifi_channels:
   3   2.4g:
   4     ap0: 3
   5     ap1: 8
   6     ap2: 13
   7   5g:
   8     ap0: 36
   9     ap1: 48
  10     ap2: 40
  11
  12 accesspoint_zones:
  13   iot:
  14     ssid: "TEST realstuff"
  15     encryption: "psk2"
  16     key: "{{ vault_accesspoint_zones.iot.key }}"
  17   guests:
  18     ssid: "TEST realraum"
  19     encryption: "psk2"
  20     key: "{{ vault_accesspoint_zones.guests.key }}"
  21   # members:
  22   #   ssid: "TEST r3members"
  23   #   encryption: "psk2"
  24   #   key: "{{ vault_accesspoint_zones.members.key }}"
  25
  26
  27
  28 accesspoint_wired_interface: eth0
  29 accesspoint_wireless_device_paths:
  30   2.4g: "platform/qca956x_wmac"
  31   5g: "pci0000:00/0000:00:00.0"
  32
  33 accesspoint_network_base:
  34   - name: globals 'globals'
  35     options:
  36       ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"
  37
  38   - name: interface 'loopback'
  39     options:
  40       ifname: lo
  41       proto: static
  42       ipaddr: 127.0.0.1
  43       netmask: 255.0.0.0
  44
  45   - name: interface 'raw'
  46     options:
  47       ifname: "{{ accesspoint_wired_interface }}"
  48       proto: none
  49       accept_ra: 0
  50
  51   - name: interface 'mgmt'
  52     options:
  53       type: bridge
  54       ifname: "{{ accesspoint_wired_interface }}.{{ net.mgmt.vlan }}"
  55       accept_ra: 0
  56       proto: static
  57       ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}"
  58       netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}"
  59       gateway: "{{ net.mgmt.gw }}"
  60       dns: "{{ net.mgmt.dns | join(' ') }}"
  61       dns_search: realraum.at
  62
  63 accesspoint_network_zones: "{{ accesspoint_network_zones_yaml | from_yaml }}"
  64 accesspoint_network_zones_yaml: |
  65   {% for item in accesspoint_zones.keys() %}
  66   - name: interface "{{ item }}"
  67     options:
  68       type: bridge
  69       ifname: "{{ accesspoint_wired_interface }}.{{ net[item].vlan }}"
  70       accept_ra: 0
  71       proto: none
  72   {% endfor %}
  73
  74
  75 accesspoint_wireless_devices:
  76   - name: wifi-device 'radio5g'
  77     options:
  78       type: 'mac80211'
  79       channel: "{{ accesspoint_wifi_channels['5g'][inventory_hostname] }}"
  80       hwmode: '11a'
  81       country: AT
  82       path: "{{ accesspoint_wireless_device_paths['5g'] }}"
  83       htmode: 'VHT80'
  84
  85   - name: wifi-device 'radio2g4'
  86     options:
  87       type: 'mac80211'
  88       channel: "{{ accesspoint_wifi_channels['2.4g'][inventory_hostname] }}"
  89       hwmode: '11g'
  90       country: AT
  91       path: "{{ accesspoint_wireless_device_paths['2.4g'] }}"
  92       htmode: 'HT20'
  93
  94 accesspoint_wireless_ifaces: "{{ accesspoint_wireless_ifaces_yaml | from_yaml }}"
  95 accesspoint_wireless_ifaces_yaml: |
  96   {% for item in accesspoint_zones.keys() %}
  97   - name: wifi-iface '{{ item }}2g4only'
  98     options:
  99       device: 'radio2g4'
 100       network: '{{ item }}'
 101       mode: 'ap'
 102       ssid: '{{ accesspoint_zones[item].ssid }}2.4'
 103       encryption: '{{ accesspoint_zones[item].encryption }}'
 104       key: '{{ accesspoint_zones[item].key }}'
 105
 106   - name: wifi-iface '{{ item }}5gonly'
 107     options:
 108       device: 'radio5g'
 109       network: '{{ item }}'
 110       mode: 'ap'
 111       ssid: '{{ accesspoint_zones[item].ssid }}5'
 112       encryption: '{{ accesspoint_zones[item].encryption }}'
 113       key: '{{ accesspoint_zones[item].key }}'
 114
 115   - name: wifi-iface '{{ item }}2g4'
 116     options:
 117       device: 'radio2g4'
 118       network: '{{ item }}'
 119       mode: 'ap'
 120       ssid: '{{ accesspoint_zones[item].ssid }}'
 121       encryption: '{{ accesspoint_zones[item].encryption }}'
 122       key: '{{ accesspoint_zones[item].key }}'
 123
 124   - name: wifi-iface '{{ item }}5g'
 125     options:
 126       device: 'radio5g'
 127       network: '{{ item }}'
 128       mode: 'ap'
 129       ssid: '{{ accesspoint_zones[item].ssid }}'
 130       encryption: '{{ accesspoint_zones[item].encryption }}'
 131       key: '{{ accesspoint_zones[item].key }}'
 132   {% endfor %}
 133
 134
 135
 136 openwrt_variant: openwrt
 137 openwrt_release: 18.06.1
 138 openwrt_arch: ar71xx
 139 openwrt_target: generic
 140 openwrt_profile: ubnt-unifiac-lite
 141 openwrt_output_image_suffixes:
 142   - "generic-{{ openwrt_profile }}-squashfs-sysupgrade.bin"
 143
 144 openwrt_mixin:
 145   /etc/sysctl.conf:
 146     content: |
 147       # Defaults are configured in /etc/sysctl.d/* and can be customized in this file
 148       #
 149       # disable IP forwarding, we don't need it since we are
 150       # only an AP that bridges VLANs to Wifi SSIDs
 151       net.ipv4.conf.default.forwarding=0
 152       net.ipv4.conf.all.forwarding=0
 153       net.ipv4.ip_forward=0
 154       net.ipv6.conf.default.forwarding=0
 155       net.ipv6.conf.all.forwarding=0
 156
 157   /etc/dropbear/authorized_keys:
 158     content: |-
 159       {% for key in noc_ssh_keys %}
 160       {{ key }}
 161       {% endfor %}
 162
 163   /root/.config/htop/htoprc:
 164     content: |
 165       # Beware! This file is rewritten by htop when settings are changed in the interface.
 166       # The parser is also very primitive, and not human-friendly.
 167       fields=0 48 17 18 38 39 40 2 46 47 49 1
 168       sort_key=46
 169       sort_direction=1
 170       hide_threads=0
 171       hide_kernel_threads=1
 172       hide_userland_threads=0
 173       shadow_other_users=0
 174       show_thread_names=0
 175       show_program_path=1
 176       highlight_base_name=1
 177       highlight_megabytes=1
 178       highlight_threads=1
 179       tree_view=1
 180       header_margin=1
 181       detailed_cpu_time=0
 182       cpu_count_from_zero=0
 183       update_process_names=0
 184       account_guest_in_cpu_meter=0
 185       color_scheme=0
 186       delay=15
 187       left_meters=AllCPUs Memory Swap
 188       left_meter_modes=1 1 1
 189       right_meters=Tasks LoadAverage Uptime
 190       right_meter_modes=2 2 2
 191
 192
 193 openwrt_uci:
 194   system:
 195     - name: system
 196       options:
 197         hostname: '{{ inventory_hostname }}'
 198         timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
 199         ttylogin: '0'
 200         log_size: '64'
 201         urandom_seed: '0'
 202
 203     - name: timeserver 'ntp'
 204       options:
 205         enabled: '1'
 206         enable_server: '0'
 207         server:
 208           - '0.lede.pool.ntp.org'
 209           - '1.lede.pool.ntp.org'
 210           - '2.lede.pool.ntp.org'
 211           - '3.lede.pool.ntp.org'
 212
 213   dropbear:
 214     - name: dropbear
 215       options:
 216         PasswordAuth: 'off'
 217         RootPasswordAuth: 'off'
 218         Port: '22000'
 219
 220   network: "{{ accesspoint_network_base + accesspoint_network_zones }}"
 221   wireless: "{{ accesspoint_wireless_devices + accesspoint_wireless_ifaces }}"