From NURDspace

Jump to: navigation, search


Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.

When December 16th 14.00 until.... Next date TBD \o


NURDSpace Wageningen

List of work on the core network

The following parts of the infrastructure need to be well-defined, operational, monitored and documented:

  • Switching (ports, vlans)
  • Routing (both interally and externally)
  • Firewalling (if any, important flows within the network, portforwards, special cases)
  • Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
  • Revisit DNS setup, see what can be/needs to be changed
  • Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
  • Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
  • Make sure that all core services use certificates from the new PKI/CA setup.
  • Define the concept of a 'managed host'
  • Fix all dependencies for working space status (Status and Vinculum and Notapp)

List of work for a managed host

For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:

  • there is an admin account
  • there is ldap authentication
  • there are host certificates for this system
  • all connections are secured using TLS
  • host is defined in and managed by Ansible

Board drawings



Work log dec 16th/17th 2017

Our site is hosted by Site4U
Our connectivity is made available by BIT
To BIT's website