No edit summary |
|||
| Line 1: | Line 1: | ||
= Summary = | = Summary = | ||
We want our core services (DHCP, DNS) to always work. So, we need to have them redundant. Not only as in multiple processes running the same functionality, but also on different physical systems. | We want our core services (DHCP, DNS, LDAP) to always work. So, we need to have them redundant. Not only as in multiple processes running the same functionality, but also on different physical systems. | ||
= Software to use = | = Software to use = | ||
* BIND for DNS | * BIND for DNS | ||
* ISC-DHCPD or ISC-KEA for DHCP | * ISC-DHCPD or ISC-KEA for DHCP | ||
* OpenLDAP | |||
= Architecture = | = Architecture = | ||
| Line 11: | Line 12: | ||
For DNS, the authoritative zones live in IPAM. On the ipam machine, a powerdns instance is running that notifies two BIND instances running on the two systems. | For DNS, the authoritative zones live in IPAM. On the ipam machine, a powerdns instance is running that notifies two BIND instances running on the two systems. | ||
For DHCP, we will either use a isc-dhcpd cluster or multiple machines running kea combined with JSON based configuration (which can be pushed towards both system). | For DHCP, we will either use a isc-dhcpd cluster or multiple machines running kea combined with JSON based configuration (which can be pushed towards both system). | ||
For LDAP, we run OpenLDAP with the syncprov overlay in a master-master fashion. Optionally, we can deploy slaves for systems that need to run standalone. | |||
Revision as of 11:27, 1 August 2023
Summary
We want our core services (DHCP, DNS, LDAP) to always work. So, we need to have them redundant. Not only as in multiple processes running the same functionality, but also on different physical systems.
Software to use
- BIND for DNS
- ISC-DHCPD or ISC-KEA for DHCP
- OpenLDAP
Architecture
There will be two systems, which can either be a VM or a physical system. Both of these systems should be running (almost) identical configurations, and should not require any further configuration or maintenance. Furthermore, care must be taken to make these machines as robust as possible. Both machines should be able to run by themselves. That is, there should be *no* external dependencies for these systems. If this means that, during an outage, the systems continue to run but their configuration cannot be modified, this is acceptable.
For DNS, the authoritative zones live in IPAM. On the ipam machine, a powerdns instance is running that notifies two BIND instances running on the two systems. For DHCP, we will either use a isc-dhcpd cluster or multiple machines running kea combined with JSON based configuration (which can be pushed towards both system). For LDAP, we run OpenLDAP with the syncprov overlay in a master-master fashion. Optionally, we can deploy slaves for systems that need to run standalone.