From 6aed40ba9d57601070bbce18483d612680cfc885 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sat, 24 Nov 2018 23:56:33 +0100 Subject: [PATCH] accesspoint role config almost done now --- ansible/group_vars/accesspoints/main.yml | 219 +++++++++++++++++++---- ansible/group_vars/openwrt/main.yml | 1 + ansible/hosts.ini | 2 +- ansible/roles/openwrt-image/README.md | 5 + ansible/roles/openwrt-image/openwrt-keyring.gpg | Bin 1190 -> 2378 bytes 5 files changed, 191 insertions(+), 36 deletions(-) diff --git a/ansible/group_vars/accesspoints/main.yml b/ansible/group_vars/accesspoints/main.yml index 7992383..480ccaa 100644 --- a/ansible/group_vars/accesspoints/main.yml +++ b/ansible/group_vars/accesspoints/main.yml @@ -1,4 +1,139 @@ --- +accesspoint_wifi_channels: + 2.4g: + ap0: 3 + ap1: 8 + ap2: 13 + 5g: + ap0: 36 + ap1: 48 + ap2: 40 + +accesspoint_zones: + iot: + ssid: "realstuff" + encryption: "psk2" + key: "this-should-come-from-vault" + guests: + ssid: "realraum" + encryption: "psk2" + key: "same-here" + members: + ssid: "r3members" + encryption: "psk2" + key: "this-will-probably-use-radius-and-not-even-have-a-key" + + + +accesspoint_wired_interface: eth0 +accesspoint_wireless_device_paths: + 2.4g: "platform/qca956x_wmac" + 5g: "pci0000:00/0000:00:00.0" + +accesspoint_network_base: + - name: globals 'globals' + options: + ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48" + + - name: interface 'loopback' + options: + ifname: lo + proto: static + ipaddr: 127.0.0.1 + netmask: 255.0.0.0 + + - name: interface 'raw' + options: + ifname: "{{ accesspoint_wired_interface }}" + proto: none + accept_ra: 0 + + - name: interface 'mgmt' + options: + type: bridge + ifname: "{{ accesspoint_wired_interface }}.{{ net.mgmt.vlan }}" + accept_ra: 0 + proto: static + ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}" + netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}" + gateway: "{{ net.mgmt.gw }}" + dns: "{{ net.mgmt.dns | join(' ') }}" + dns_search: realraum.at + +accesspoint_network_zones: [] +# accesspoint_network_zone_template: +# - name: interface '{{ item }}' +# options: +# type: bridge +# ifname: "{{ accesspoint_wired_interface }}.{{ net[item].vlan }}" +# accept_ra: 0 +# proto: none + + + +accesspoint_wireless_devices: + - name: wifi-device 'radio5' + options: + type: 'mac80211' + channel: "{{ accesspoint_wifi_channels['5g'][inventory_hostname] }}" + hwmode: '11a' + country: AT + path: "{{ accesspoint_wireless_device_paths['5g'] }}" + htmode: 'VHT80' + + - name: wifi-device 'radio24' + options: + type: 'mac80211' + channel: "{{ accesspoint_wifi_channels['2.4g'][inventory_hostname] }}" + hwmode: '11g' + country: AT + path: "{{ accesspoint_wireless_device_paths['2.4g'] }}" + htmode: 'HT20' + +accesspoint_wireless_ifaces: [] +# accesspoint_wireless_iface_template: +# - name: wifi-iface '{{ item }}24s' +# options: +# device: 'radio24' +# network: '{{ item }}' +# mode: 'ap' +# ssid: '{{ accesspoint_zones[item].ssid }}24' +# encryption: '{{ accesspoint_zones[item].encryption }}' +# key: '{{ accesspoint_zones[item].key }}' + +# - name: wifi-iface '{{ item }}5s' +# options: +# device: 'radio5' +# network: '{{ item }}' +# mode: 'ap' +# ssid: '{{ accesspoint_zones[item].ssid }}5' +# encryption: '{{ accesspoint_zones[item].encryption }}' +# key: '{{ accesspoint_zones[item].key }}' + +# - name: wifi-iface '{{ item }}24' +# options: +# device: 'radio24' +# network: '{{ item }}' +# mode: 'ap' +# ssid: '{{ accesspoint_zones[item].ssid }}' +# encryption: '{{ accesspoint_zones[item].encryption }}' +# key: '{{ accesspoint_zones[item].key }}' + +# - name: wifi-iface '{{ item }}5' +# options: +# device: 'radio5' +# network: '{{ item }}' +# mode: 'ap' +# ssid: '{{ accesspoint_zones[item].ssid }}' +# encryption: '{{ accesspoint_zones[item].encryption }}' +# key: '{{ accesspoint_zones[item].key }}' + + + + + +openwrt_variant: openwrt +openwrt_release: 18.06.1 openwrt_arch: ar71xx openwrt_target: generic openwrt_profile: ubnt-unifiac-lite @@ -6,12 +141,54 @@ openwrt_output_image_suffixes: - "generic-{{ openwrt_profile }}-squashfs-sysupgrade.bin" openwrt_mixin: + /etc/sysctl.conf: + content: | + # Defaults are configured in /etc/sysctl.d/* and can be customized in this file + # + # disable IP forwarding, we don't need it since we are + # only an AP that bridges VLANs to Wifi SSIDs + net.ipv4.conf.default.forwarding=0 + net.ipv4.conf.all.forwarding=0 + net.ipv4.ip_forward=0 + net.ipv6.conf.default.forwarding=0 + net.ipv6.conf.all.forwarding=0 + /etc/dropbear/authorized_keys: content: |- {% for key in noc_ssh_keys %} {{ key }} {% endfor %} + /root/.config/htop/htoprc: + content: | + # Beware! This file is rewritten by htop when settings are changed in the interface. + # The parser is also very primitive, and not human-friendly. + fields=0 48 17 18 38 39 40 2 46 47 49 1 + sort_key=46 + sort_direction=1 + hide_threads=0 + hide_kernel_threads=1 + hide_userland_threads=0 + shadow_other_users=0 + show_thread_names=0 + show_program_path=1 + highlight_base_name=1 + highlight_megabytes=1 + highlight_threads=1 + tree_view=1 + header_margin=1 + detailed_cpu_time=0 + cpu_count_from_zero=0 + update_process_names=0 + account_guest_in_cpu_meter=0 + color_scheme=0 + delay=15 + left_meters=AllCPUs Memory Swap + left_meter_modes=1 1 1 + right_meters=Tasks LoadAverage Uptime + right_meter_modes=2 2 2 + + openwrt_uci: system: - name: system @@ -32,40 +209,12 @@ openwrt_uci: - '2.lede.pool.ntp.org' - '3.lede.pool.ntp.org' - network: - - name: globals 'globals' - options: - ula_prefix: fdc9:e01f:83db::/48 - - - name: interface 'loopback' + dropbear: + - name: dropbear options: - ifname: lo - proto: static - ipaddr: 127.0.0.1 - netmask: 255.0.0.0 + PasswordAuth: 'off' + RootPasswordAuth: 'off' + Port: '22000' - - name: interface 'mgmt' - options: - type: bridge - ifname: "eth0.{{ net.mgmt.vlan }}" - accept_ra: 0 - proto: static - ipaddr: "{{ net.mgmt.prefix | ipaddr(net.mgmt.offsets.accesspoints + groups.accesspoints.index(inventory_hostname)) | ipaddr('address') }}" - netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}" - gateway: "{{ net.mgmt.gw }}" - dns: "{{ net.mgmt.dns | join(' ') }}" - dns_search: realraum.at - - - name: interface 'iot' - options: - type: bridge - ifname: "eth0.{{ net.iot.vlan }}" - accept_ra: 0 - proto: none - - - name: interface 'lan' - options: - type: bridge - ifname: "eth0.{{ net.lan.vlan }}" - accept_ra: 0 - proto: none + network: "{{ accesspoint_network_base + accesspoint_network_zones }}" + wireless: "{{ accesspoint_wireless_devices + accesspoint_wireless_ifaces }}" diff --git a/ansible/group_vars/openwrt/main.yml b/ansible/group_vars/openwrt/main.yml index 2337b9f..2c29b78 100644 --- a/ansible/group_vars/openwrt/main.yml +++ b/ansible/group_vars/openwrt/main.yml @@ -5,6 +5,7 @@ openwrt_packages_remove: - dnsmasq - firewall - odhcpd + - odhcpd-ipv6only openwrt_packages_add: - haveged - htop diff --git a/ansible/hosts.ini b/ansible/hosts.ini index 874f87e..26bb727 100644 --- a/ansible/hosts.ini +++ b/ansible/hosts.ini @@ -66,7 +66,7 @@ virtualservers wuerfel [accesspoints] -ap[0:1] +ap[0:2] [openwrt] torwaechter diff --git a/ansible/roles/openwrt-image/README.md b/ansible/roles/openwrt-image/README.md index d56affe..95d9d10 100644 --- a/ansible/roles/openwrt-image/README.md +++ b/ansible/roles/openwrt-image/README.md @@ -1,3 +1,8 @@ # Build OpenWRT images with Ansible +TODO: add possibility to disable root logins using /etc/shadow + this will also take care of the annoying + "There is no root password defined ..." + message when you log in. + ## Configuration diff --git a/ansible/roles/openwrt-image/openwrt-keyring.gpg b/ansible/roles/openwrt-image/openwrt-keyring.gpg index f4cab0024d6edf286c1e26e31f7258b95000a949..e8a3e8b90e7bf2e4da7ff462657659a4a66d8263 100644 GIT binary patch delta 1184 zcmV;R1Yi563Ca?%rUZYP0u2OO{3sFu5CE=gV54eu=0M)F(|fz|7>!EN$TDDQ%1l`+ zw%a5#2oC`}dkdB?Vc2XmcrMSId>_O|(2v^;P(Z~7iMGOMls>}DXSoOSjjY-Q%c)(l zUuO%u_6+C>*FhLp8&J5>1p=rSNCom10P=Edu*w%K`*9&jkS~9WPubHsvpQMqUrgzk z6P$3FdnFZx6uxPFp7QG-yIGwsqzJ)f+6^@O(W%KX8%LTjgcGP=(7{-!x+tnOR24MT zeVF>?l!f^F2f{tBQ1!;rSagpaV}&Wm6zTmAhot>w< z0Blw2I>eWi4CH^M>L(nB-aT-Kbp)ZD3u<@|BuO!bGMNx><#g%P$I^Mg$XVYmH|V7W zB&1A9&3_huZ}GhH70R#(by6rETOpwQ`q-X8_km}gjN_t)VYUiN-h|%ddz4FP_D+M8`KL3Lb-G{U| zVBQGXi`BxtvIKZ%o~ZS(TQEW^rY@Uevv%33X`1}-wP)cZeX87$)LO=|dKo1YaBG-l z!%j%nZMcxq82HrzX>MmAOJ#W}AUtnyWo~zJbS-3Mc4cfpY-w|Jb1rXiWo~zJbS`gl zXFiDnJ_Hj10strl0$Tomf&v=@1qlPfX8;BZ2?&#c0vUe~ASHAc;m#I2tPlTBIz!~e zloaaUO-i5!Ltp>Sd<>zXJtW?dRNL@dJmAN+%@2t&)t&p zLx-W!+Z|HGQT*WBRTH6>qge`6KX}f@EWjy5d#mUZ9FZkT?Q02(!1sMepMC!i1wS|? z@+Z+e@2Y>e>XZjhzuE&E8Ag$!sb-j_R(*Qb(VVqAZ78f6&Gfhj8>#>MC5KJ!&u|24 z*S9cKn15BQ5-2AG@o(Q#>vV^~w_rF(mJ`<;`hRBd6ri$>&BHY1Lbt`^n2@C&vS5g^ zAgo(I5h{I}fJS$pEOMD+{>f{kmubB$0mEy%0}6k08e$akUmDJ7bTi*Pnc5B(K-+2- zI{dQt+=Tq{kDXn(ffIRrae@l~TIj?m1-?a`CjZd7KX+!n>D$Mj3baQtis|q^9d4&n ziO|0NrzV!3=F9X7>pEVVEtN%06WR;k{tND{YH}s`De7l&7-$Cx2;8Zqw|~Bj0Up!( zL<)aT$g=tYh_{vLTi&CTM_sk6yASe)Sz@d?MaqZ^wnv-kEIEEB(S|Xxf$BX9cBO}G zP^AfmSdLj{(6a#8Dlrozw3vYg-Q@$fiBae6b#}H_I>O%$pq(`($q^P6>0I-*Q_p!T y`e{NzHfLvK_>U}Kv_`s?4OB@t)*}i?cA*pw`%gILICPALN75lpz`(Gu0ssTM#V}t0 delta 7 OcmX>lw2X7ZG8O;~y8`9_ -- 1.7.10.4