| (21 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
= Layer 2 overview = | = Layer 2 overview = | ||
Below you can find the structure of the network as of | Below you can find the structure of the network as of 28-07-2023. Fat lines are 2 x 1GE LACP trunks | ||
[[Image:Layer 2 overview | [[Image:Layer 2 overview 28-07-2023.svg|640px]] | ||
[[File:Infra nurdspace in detail (draw.io).png|640px|download the file below to see the whole thing + to make changes in draw.io]] | |||
[[:File:Eis-T Hoe harkt de nurdspace .drawio.xml]] | |||
= Layer 3 overview = | = Layer 3 overview = | ||
| Line 15: | Line 20: | ||
* 10.208.3.x DHCP clients | * 10.208.3.x DHCP clients | ||
If you are unsure which range you should use, stick with DHCP. DHCP clients can set their hostname via dynamic DNS. Clients in statically managed networks must specify a hostname in | If you are unsure which range you should use, stick with DHCP. DHCP clients can set their hostname via dynamic DNS. Clients in statically managed networks must specify a hostname in FreeIPA. If something is to be part of the infrastructure fabric of the space, it should be in the Servers range. Be sure to contact BOFH if you want to place a system in this range. | ||
The default gateway on this network is 10.208.0.1 | The default gateway on this network is 10.208.0.1 | ||
== DNS == | == DNS == | ||
search nurd.space lan.nurd.space vm.nurd.space | search nurd.space lan.nurd.space vm.nurd.space vpn.nurd.space dhcp.nurd.space | ||
nameserver 10.208.1.53 | nameserver 10.208.1.53 | ||
==Rack info== | ==Rack info== | ||
Voorkant Achterkant | Voorkant Achterkant | ||
| Line 49: | Line 55: | ||
= Management = | = Management = | ||
== The team == | |||
The NURDspace infrastructure is managed by [[Network/BOFH|the BOFH team]]. | |||
== Services == | |||
You can find a list of services we manage below: | |||
* [[Network/Services/Wiki|The wiki]] | |||
* [[Network/Services/DNS|Internal and external DNS]] | |||
* [[Network/Services/Authentication|LDAP / Kerberos authentication]] | |||
* [[Network/Services/Freifunk|Hosted AP for Freifunk Chemnitz]] | |||
* [[Network/Services/Switches|Cisco-based switching infrastructure]] | |||
* [[Network/Services/DoorLock|Front doorlock system]] | |||
* [[Network/Services/Cryptpad|Online collaboration tools]] | |||
* [[Network/Services/VPN|Wireguard VPN tunnel]] | |||
== Upcoming features and functionality == | |||
See [[Network/Roadmap|our roadmap]] for a list of upcoming features and functionality. If you think something should be added, add this to either the backlog or ideas, depending on the feature. You are more then welcome to join the bofh team to implement features and functionality yourself! | |||
== Network management administrative interfaces == | == Network management administrative interfaces == | ||
You can manage our devices using the URLs below: | You can manage our devices using the URLs below: | ||
| Line 71: | Line 95: | ||
|- | |- | ||
|Access points | |Access points | ||
|https://10.208. | |https://10.208.3.62:4343 | ||
|admin | |admin | ||
|Virtual controller for WIFI | |Virtual controller for WIFI | ||
| Line 94: | Line 118: | ||
|Has a different password due to pwd requirements. Ask in the bofh channel. | |Has a different password due to pwd requirements. Ask in the bofh channel. | ||
|- | |- | ||
| | |DNS and identity management | ||
|https:// | |https://ipa.nurd.space/ | ||
|ldap | |ldap | ||
| | |DNS / Identity | ||
| | | | ||
|- | |- | ||
| Line 127: | Line 151: | ||
== VPN tunnels == | == VPN tunnels == | ||
We support Roadwarrior and Site-to-Site VPN tunnels, using [[Wireguard | We support Roadwarrior and Site-to-Site VPN tunnels, using [[Network/Services/VPN|Wireguard]]. Contact someone from the BOFH team to discuss the possibilities and get connected. | ||
== Backups == | == Backups == | ||
| Line 172: | Line 196: | ||
iso.3.6.1.2.1.1.6.0 = STRING: "NURDspace,Bar" | iso.3.6.1.2.1.1.6.0 = STRING: "NURDspace,Bar" | ||
... | ... | ||
Latest revision as of 21:03, 6 September 2024
Layer 2 overview
Below you can find the structure of the network as of 28-07-2023. Fat lines are 2 x 1GE LACP trunks
.png)
Layer 3 overview
we have a single-vlan flat network. The following prefix is active on this network:
- 10.208.0.0/22
Within this prefix, we have multiple ranges for multiple purposes:
- 10.208.0.x Network devices
- 10.208.1.x Servers
- 10.208.2.x DHCP clients
- 10.208.3.x DHCP clients
If you are unsure which range you should use, stick with DHCP. DHCP clients can set their hostname via dynamic DNS. Clients in statically managed networks must specify a hostname in FreeIPA. If something is to be part of the infrastructure fabric of the space, it should be in the Servers range. Be sure to contact BOFH if you want to place a system in this range.
The default gateway on this network is 10.208.0.1
DNS
search nurd.space lan.nurd.space vm.nurd.space vpn.nurd.space dhcp.nurd.space nameserver 10.208.1.53
Rack info
Voorkant Achterkant
- Keyboard Keyboard
- Pachtpaneel
- Rangeerrack
- Switch
- Harmony Racklight
- Harmony
- Plank
- Gateway
- Gateway
- Gateway
- Gateway
- Gpubak
- Gpubak
- Gpubak
- Gpubak
- Plank
- Erratic
- Erratic
- Erratic
- Erratic
- Blind Aardlek switch
Management
The team
The NURDspace infrastructure is managed by the BOFH team.
Services
You can find a list of services we manage below:
- The wiki
- Internal and external DNS
- LDAP / Kerberos authentication
- Hosted AP for Freifunk Chemnitz
- Cisco-based switching infrastructure
- Front doorlock system
- Online collaboration tools
- Wireguard VPN tunnel
Upcoming features and functionality
See our roadmap for a list of upcoming features and functionality. If you think something should be added, add this to either the backlog or ideas, depending on the feature. You are more then welcome to join the bofh team to implement features and functionality yourself!
Network management administrative interfaces
You can manage our devices using the URLs below:
| Product | URL | User | Used for | Notes |
| Edgerouter Lite | https://gateway.lan.nurd.space:8443/ | ubnt | Routing and NATting towards internet | |
| Aruba core switch | http://core-sw.lan.nurd.space | admin | Main switch in the space | |
| Access points | https://10.208.3.62:4343 | admin | Virtual controller for WIFI | |
| Proxmox erratic | https://erratic.lan.nurd.space:8006/ | root | Deploy LXC/KVM instances on our hypervisor | |
| Erratic IPMI | https://erratic-bmc.lan.nurd.space/ | ADMIN | Remote management of erratic | |
| Synology | https://harmony.lan.nurd.space:5001/ | nurds | Used for backups and storage | Has a different password due to pwd requirements. Ask in the bofh channel. |
| DNS and identity management | https://ipa.nurd.space/ | ldap | DNS / Identity | |
| LibreNMS | http://librenms.vm.nurd.space/ | nurds | Network device metrics | |
| Weathermap | http://weathermap.vm.nurd.space | Network traffic map | ||
| Smokeping | http://smokeping.vm.nurd.space | Network latency measurements | ||
| Icinga2 | https://monitor.vm.nurd.space/ | admin | Monitoring service |
Virtual machine
We support hosting multiple virtual machines, using both the KVM and the LXC model. These are deployed using proxmox. We have introduced the 'managed vm', which is a vm which adheres to nurdspace standards. For more information, see the ManagedVM and the Ansible pages.
VPN tunnels
We support Roadwarrior and Site-to-Site VPN tunnels, using Wireguard. Contact someone from the BOFH team to discuss the possibilities and get connected.
Backups
We do daily full backups of managed systems. More details can be found on the Backup page.
TLS
All servers have a unique ECDSA certificate which can be used for both client and server authentication. Details about this setup can be found on the TLS page.
Network discovery
In order to make devices available for discovery, a couple of protocols can be enabled. Note that this only applies to physical systems, not VM/LXCs.
LLDP
The first one of these is lldp (Link-Layer Discovery Protocol). This protocol communicates device attributes to connected peers via ethernet frames. Lldp is enabled on all networking devices. Enabling these should only be done for systems that are physically connected to the network (eg, using an ethernet cable or wifi). Under debian, this is done as follows:
apt install lldpd systemctl enable --now lldpd
SNMP
The second protocol to enable is snmp (Simple Network Management Protocol). This protocol allows a device to be queried for various network and host metrics, and allowing us to keep a precise count of per-device traffic rates. But above all, this gives us shiney graphs ^_^
First, install the required daemons and MIBs:
apt install snmp snmpd snmp-mibs-downloader download-mibs
Next, configure snmpd for use. Edit /etc/snmp/snmpd.conf and set the following two administrative fields:
sysLocation NURDspace,MODIFY_LOCATION_WITHIN_NURDSPACE sysContact Admins <bofh@nurdspace.nl>
Next, make sure that snmpd can listen on all ip addresses and can be queried using the default community
#agentaddress 127.0.0.1,[::1] # ADD A HASH IN FRONT OF THIS LINE rocommunity public default rocommunity6 public default
Finally, enable snmpd and perform a testrun to verify if it is working:
systemctl enable --now snmpd root@erratic:~# snmpwalk -v2c -c public localhost iso.3.6.1.2.1.1.1.0 = STRING: "Linux erratic.lan.nurd.space 5.15.30-2-pve #1 SMP PVE 5.15.30-3 (Fri, 22 Apr 2022 18:08:27 +0200) x86_64" iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10 iso.3.6.1.2.1.1.3.0 = Timeticks: (8715381) 1 day, 0:12:33.81 iso.3.6.1.2.1.1.4.0 = STRING: "Admins <bofh@nurdspace.nl>" iso.3.6.1.2.1.1.5.0 = STRING: "erratic.lan.nurd.space" iso.3.6.1.2.1.1.6.0 = STRING: "NURDspace,Bar" ...