InfraRefresh: Difference between revisions

From NURDspace
(Created page with "== What== Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable. == When == http...")
 
Line 8: Line 8:
NURDSpace Wageningen
NURDSpace Wageningen


== List of work ==
== List of work on the core network ==
The following parts of the infrastructure need to be well-defined, operational, monitored and documented:
The following parts of the infrastructure need to be well-defined, operational, monitored and documented:
- Switching (ports, vlans)
* Switching (ports, vlans)
- Routing (both interally and externally)
* Routing (both interally and externally)
- Firewalling (if any, important flows within the network, portforwards, special cases)
* Firewalling (if any, important flows within the network, portforwards, special cases)
- Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
* Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
- Revisit DNS setup, see what can be/needs to be changed
* Revisit DNS setup, see what can be/needs to be changed
- Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
* Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
- Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
* Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
- Make sure that all core services use certificates from the new PKI/CA setup.
* Make sure that all core services use certificates from the new PKI/CA setup.
- Define the concept of a 'managed host'
* Define the concept of a 'managed host'
- For a manged host, make sure that:
 
== List of work for a managed host ==
For a manged host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
   * there is an admin account
   * there is an admin account
   * there is ldap authentication
   * there is ldap authentication
  * there are host certificates for this system
   * all connections are secured using TLS
   * all connections are secured using TLS
   * host is defined in and managed by ansible
   * host is defined in and managed by ansible
- Rebuild various internal services to the new 'managed host' setup.


== Board drawings
== Board drawings

Revision as of 12:56, 23 November 2017

What

Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.

When

https://doodle.com/poll/xxdquth2k8uwskch

Where

NURDSpace Wageningen

List of work on the core network

The following parts of the infrastructure need to be well-defined, operational, monitored and documented:

  • Switching (ports, vlans)
  • Routing (both interally and externally)
  • Firewalling (if any, important flows within the network, portforwards, special cases)
  • Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
  • Revisit DNS setup, see what can be/needs to be changed
  • Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
  • Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
  • Make sure that all core services use certificates from the new PKI/CA setup.
  • Define the concept of a 'managed host'

List of work for a managed host

For a manged host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:

 * there is an admin account
 * there is ldap authentication
 * there are host certificates for this system
 * all connections are secured using TLS
 * host is defined in and managed by ansible

== Board drawings Nurds-infra-refresh-board-left.jpeg

Nurds-infra-refresh-board-right.jpeg