(→When) |
No edit summary |
||
Line 33: | Line 33: | ||
[[File:Nurds-infra-refresh-board-right.jpeg|400px]] | [[File:Nurds-infra-refresh-board-right.jpeg|400px]] | ||
== Work log == | |||
* Updated [[NURDServices]] from Jessie to Stretch |
Revision as of 17:24, 16 December 2017
What
Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.
When
https://doodle.com/poll/xxdquth2k8uwskch December 16th 14.00 until....
Where
NURDSpace Wageningen
List of work on the core network
The following parts of the infrastructure need to be well-defined, operational, monitored and documented:
- Switching (ports, vlans)
- Routing (both interally and externally)
- Firewalling (if any, important flows within the network, portforwards, special cases)
- Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
- Revisit DNS setup, see what can be/needs to be changed
- Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
- Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
- Make sure that all core services use certificates from the new PKI/CA setup.
- Define the concept of a 'managed host'
List of work for a managed host
For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
- there is an admin account
- there is ldap authentication
- there are host certificates for this system
- all connections are secured using TLS
- host is defined in and managed by Ansible
Board drawings
Work log
- Updated NURDServices from Jessie to Stretch