(Created page with "== What== Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable. == When == http...") |
m (→When) |
||
| (25 intermediate revisions by 3 users not shown) | |||
| Line 4: | Line 4: | ||
== When == | == When == | ||
https://doodle.com/poll/xxdquth2k8uwskch | https://doodle.com/poll/xxdquth2k8uwskch | ||
December 16th 14.00 until.... | |||
Next date TBD \o | |||
== Where == | == Where == | ||
NURDSpace Wageningen | NURDSpace Wageningen | ||
== List of work == | == List of work on the core network == | ||
The following parts of the infrastructure need to be well-defined, operational, monitored and documented: | The following parts of the infrastructure need to be well-defined, operational, monitored and documented: | ||
* Switching (ports, [[InfraRefresh/vlan|vlans]]) | |||
* [[InfraRefresh/routing|Routing]] (both interally and externally) | |||
* [[InfraRefresh/firewall|Firewalling]] (if any, important flows within the network, portforwards, special cases) | |||
* Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM) | |||
* Revisit DNS setup, see what can be/needs to be changed | |||
* Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth | |||
* Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs | |||
* Make sure that all core services use certificates from the new PKI/CA setup. | |||
* Define the concept of a 'managed host' | |||
* Fix all dependencies for working space status ([[Status]] and [[Vinculum]] and [[Notapp]]) | |||
== List of work for a managed host == | |||
For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra: | |||
* there is an admin account | |||
* there is ldap authentication | |||
* there are host certificates for this system | |||
* all connections are secured using TLS | |||
* host is defined in and managed by [[Ansible]] | |||
== Board drawings | == Board drawings == | ||
[[File:Nurds-infra-refresh-board-left.jpeg|400px]] | [[File:Nurds-infra-refresh-board-left.jpeg|400px]] | ||
[[File:Nurds-infra-refresh-board-right.jpeg|400px]] | [[File:Nurds-infra-refresh-board-right.jpeg|400px]] | ||
== Work log dec 16th/17th 2017 == | |||
* Updated [[NURDServices]] from Jessie to Stretch | |||
* Moved DHCPd from [[Arbiter]] back to [[NURDServices]] | |||
* Added new ip to [[NURDServices]] | |||
* Moved [[Postgresql.nurdspace.lan]] to [[Postgresql.vm.nurd.space]] and put it in the right network range | |||
* Removed 192.168.x from everywhere | |||
* Upgraded Proxmox on [[Coherence]] from 4.4 to 5.1 | |||
* Dist-upgraded [[Notapp]], [[Egg]], [[Rollout]], [[Status]] from jessie to stretch | |||
* Dist-upgraded [[Gallery]], [[Postgresql.vm.nurd.space]] and [[Vinculum]] from wheezy to jessie | |||
* Revproxy config changed | |||
* tunnelbroker tunnel moved to DSL | |||
* Put a SATA power splitter on [[Coherence]] so we can get rid of the loose PSU lying around | |||
Latest revision as of 22:43, 29 December 2017
What
Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.
When
https://doodle.com/poll/xxdquth2k8uwskch December 16th 14.00 until.... Next date TBD \o
Where
NURDSpace Wageningen
List of work on the core network
The following parts of the infrastructure need to be well-defined, operational, monitored and documented:
- Switching (ports, vlans)
- Routing (both interally and externally)
- Firewalling (if any, important flows within the network, portforwards, special cases)
- Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
- Revisit DNS setup, see what can be/needs to be changed
- Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
- Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
- Make sure that all core services use certificates from the new PKI/CA setup.
- Define the concept of a 'managed host'
- Fix all dependencies for working space status (Status and Vinculum and Notapp)
List of work for a managed host
For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
- there is an admin account
- there is ldap authentication
- there are host certificates for this system
- all connections are secured using TLS
- host is defined in and managed by Ansible
Board drawings
Work log dec 16th/17th 2017
- Updated NURDServices from Jessie to Stretch
- Moved DHCPd from Arbiter back to NURDServices
- Added new ip to NURDServices
- Moved Postgresql.nurdspace.lan to Postgresql.vm.nurd.space and put it in the right network range
- Removed 192.168.x from everywhere
- Upgraded Proxmox on Coherence from 4.4 to 5.1
- Dist-upgraded Notapp, Egg, Rollout, Status from jessie to stretch
- Dist-upgraded Gallery, Postgresql.vm.nurd.space and Vinculum from wheezy to jessie
- Revproxy config changed
- tunnelbroker tunnel moved to DSL
- Put a SATA power splitter on Coherence so we can get rid of the loose PSU lying around