m (→When) |
|||
| (3 intermediate revisions by the same user not shown) | |||
| Line 5: | Line 5: | ||
https://doodle.com/poll/xxdquth2k8uwskch | https://doodle.com/poll/xxdquth2k8uwskch | ||
December 16th 14.00 until.... | December 16th 14.00 until.... | ||
Next date TBD \o | |||
== Where == | == Where == | ||
| Line 20: | Line 21: | ||
* Make sure that all core services use certificates from the new PKI/CA setup. | * Make sure that all core services use certificates from the new PKI/CA setup. | ||
* Define the concept of a 'managed host' | * Define the concept of a 'managed host' | ||
* Fix all dependencies for working space status ([[Status]] and [[Vinculum]] and [[Notapp]]) | |||
== List of work for a managed host == | == List of work for a managed host == | ||
| Line 45: | Line 47: | ||
* Revproxy config changed | * Revproxy config changed | ||
* tunnelbroker tunnel moved to DSL | * tunnelbroker tunnel moved to DSL | ||
* Put a SATA power splitter on [[Coherence]] so we can get rid of the loose PSU lying around | |||
Latest revision as of 22:43, 29 December 2017
What
Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.
When
https://doodle.com/poll/xxdquth2k8uwskch December 16th 14.00 until.... Next date TBD \o
Where
NURDSpace Wageningen
List of work on the core network
The following parts of the infrastructure need to be well-defined, operational, monitored and documented:
- Switching (ports, vlans)
- Routing (both interally and externally)
- Firewalling (if any, important flows within the network, portforwards, special cases)
- Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
- Revisit DNS setup, see what can be/needs to be changed
- Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
- Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
- Make sure that all core services use certificates from the new PKI/CA setup.
- Define the concept of a 'managed host'
- Fix all dependencies for working space status (Status and Vinculum and Notapp)
List of work for a managed host
For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
- there is an admin account
- there is ldap authentication
- there are host certificates for this system
- all connections are secured using TLS
- host is defined in and managed by Ansible
Board drawings
Work log dec 16th/17th 2017
- Updated NURDServices from Jessie to Stretch
- Moved DHCPd from Arbiter back to NURDServices
- Added new ip to NURDServices
- Moved Postgresql.nurdspace.lan to Postgresql.vm.nurd.space and put it in the right network range
- Removed 192.168.x from everywhere
- Upgraded Proxmox on Coherence from 4.4 to 5.1
- Dist-upgraded Notapp, Egg, Rollout, Status from jessie to stretch
- Dist-upgraded Gallery, Postgresql.vm.nurd.space and Vinculum from wheezy to jessie
- Revproxy config changed
- tunnelbroker tunnel moved to DSL
- Put a SATA power splitter on Coherence so we can get rid of the loose PSU lying around