InfraRefresh

What

Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.

When

https://doodle.com/poll/xxdquth2k8uwskch December 16th 14.00 until....

Where

NURDSpace Wageningen

List of work on the core network

The following parts of the infrastructure need to be well-defined, operational, monitored and documented:

• Switching (ports, vlans)
• Routing (both interally and externally)
• Firewalling (if any, important flows within the network, portforwards, special cases)
• Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
• Revisit DNS setup, see what can be/needs to be changed
• Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
• Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
• Make sure that all core services use certificates from the new PKI/CA setup.
• Define the concept of a 'managed host'

List of work for a managed host

For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:

• there is an admin account
• there is ldap authentication
• there are host certificates for this system
• all connections are secured using TLS
• host is defined in and managed by Ansible

Board drawings

Work log dec 16th/17th 2017

• Updated NURDServices from Jessie to Stretch
• Moved DHCPd from Arbiter back to NURDServices
• Added new ip to NURDServices
• Moved Postgresql.nurdspace.lan to Postgresql.vm.nurd.space and put it in the right network range
• Removed 192.168.x from everywhere
• Upgraded Proxmox on Coherence from 4.4 to 5.1
• Dist-upgrade Notapp and Egg and Rollout from jessie to stretch
• Dist-upgrade Gallery from wheezy to jessie
• Revproxy config changed
• tunnelbroker tunnel moved to DSL