InfraRefresh: Difference between revisions
Jump to navigation
Jump to search
(Created page with "== What== Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable. == When == http...") |
|||
Line 8: | Line 8: | ||
NURDSpace Wageningen | NURDSpace Wageningen | ||
== List of work == | == List of work on the core network == | ||
The following parts of the infrastructure need to be well-defined, operational, monitored and documented: | The following parts of the infrastructure need to be well-defined, operational, monitored and documented: | ||
* Switching (ports, vlans) | |||
* Routing (both interally and externally) | |||
* Firewalling (if any, important flows within the network, portforwards, special cases) | |||
* Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM) | |||
* Revisit DNS setup, see what can be/needs to be changed | |||
* Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth | |||
* Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs | |||
* Make sure that all core services use certificates from the new PKI/CA setup. | |||
* Define the concept of a 'managed host' | |||
== List of work for a managed host == | |||
For a manged host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra: | |||
* there is an admin account | * there is an admin account | ||
* there is ldap authentication | * there is ldap authentication | ||
* there are host certificates for this system | |||
* all connections are secured using TLS | * all connections are secured using TLS | ||
* host is defined in and managed by ansible | * host is defined in and managed by ansible | ||
== Board drawings | == Board drawings |
Revision as of 12:56, 23 November 2017
What
Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.
When
https://doodle.com/poll/xxdquth2k8uwskch
Where
NURDSpace Wageningen
List of work on the core network
The following parts of the infrastructure need to be well-defined, operational, monitored and documented:
- Switching (ports, vlans)
- Routing (both interally and externally)
- Firewalling (if any, important flows within the network, portforwards, special cases)
- Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
- Revisit DNS setup, see what can be/needs to be changed
- Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
- Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
- Make sure that all core services use certificates from the new PKI/CA setup.
- Define the concept of a 'managed host'
List of work for a managed host
For a manged host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
* there is an admin account * there is ldap authentication * there are host certificates for this system * all connections are secured using TLS * host is defined in and managed by ansible