(Created page with "== What== Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable. == When == http...") |
|||
| Line 8: | Line 8: | ||
NURDSpace Wageningen | NURDSpace Wageningen | ||
== List of work == | == List of work on the core network == | ||
The following parts of the infrastructure need to be well-defined, operational, monitored and documented: | The following parts of the infrastructure need to be well-defined, operational, monitored and documented: | ||
* Switching (ports, vlans) | |||
* Routing (both interally and externally) | |||
* Firewalling (if any, important flows within the network, portforwards, special cases) | |||
* Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM) | |||
* Revisit DNS setup, see what can be/needs to be changed | |||
* Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth | |||
* Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs | |||
* Make sure that all core services use certificates from the new PKI/CA setup. | |||
* Define the concept of a 'managed host' | |||
== List of work for a managed host == | |||
For a manged host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra: | |||
* there is an admin account | * there is an admin account | ||
* there is ldap authentication | * there is ldap authentication | ||
* there are host certificates for this system | |||
* all connections are secured using TLS | * all connections are secured using TLS | ||
* host is defined in and managed by ansible | * host is defined in and managed by ansible | ||
== Board drawings | == Board drawings | ||
Revision as of 11:56, 23 November 2017
What
Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.
When
Where
NURDSpace Wageningen
List of work on the core network
The following parts of the infrastructure need to be well-defined, operational, monitored and documented:
- Switching (ports, vlans)
- Routing (both interally and externally)
- Firewalling (if any, important flows within the network, portforwards, special cases)
- Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
- Revisit DNS setup, see what can be/needs to be changed
- Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
- Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
- Make sure that all core services use certificates from the new PKI/CA setup.
- Define the concept of a 'managed host'
List of work for a managed host
For a manged host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
* there is an admin account * there is ldap authentication * there are host certificates for this system * all connections are secured using TLS * host is defined in and managed by ansible
== Board drawings
