What
Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.
When
Where
NURDSpace Wageningen
List of work
The following parts of the infrastructure need to be well-defined, operational, monitored and documented: - Switching (ports, vlans) - Routing (both interally and externally) - Firewalling (if any, important flows within the network, portforwards, special cases) - Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM) - Revisit DNS setup, see what can be/needs to be changed - Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth - Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs - Make sure that all core services use certificates from the new PKI/CA setup. - Define the concept of a 'managed host' - For a manged host, make sure that:
* there is an admin account * there is ldap authentication * all connections are secured using TLS * host is defined in and managed by ansible
- Rebuild various internal services to the new 'managed host' setup.
== Board drawings
