What
Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.
When
https://doodle.com/poll/xxdquth2k8uwskch December 16th 14.00 until....
Where
NURDSpace Wageningen
List of work on the core network
The following parts of the infrastructure need to be well-defined, operational, monitored and documented:
- Switching (ports, vlans)
- Routing (both interally and externally)
- Firewalling (if any, important flows within the network, portforwards, special cases)
- Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
- Revisit DNS setup, see what can be/needs to be changed
- Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
- Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
- Make sure that all core services use certificates from the new PKI/CA setup.
- Define the concept of a 'managed host'
List of work for a managed host
For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
- there is an admin account
- there is ldap authentication
- there are host certificates for this system
- all connections are secured using TLS
- host is defined in and managed by Ansible
Board drawings
Work log dec 16th/17th 2017
- Updated NURDServices from Jessie to Stretch
- Moved DHCPd from Arbiter back to NURDServices
- Added new ip to NURDServices
- Moved Postgresql.nurdspace.lan to Postgresql.vm.nurd.space and put it in the right network range
- Removed 192.168.x from everywhere
- Upgraded Proxmox on Coherence from 4.4 to 5.1
- Dist-upgraded Notapp, Egg, Rollout, Status from jessie to stretch
- Dist-upgraded Gallery, Postgresql.vm.nurd.space and Vinculum from wheezy to jessie
- Revproxy config changed
- tunnelbroker tunnel moved to DSL
- Put a SATA splitter on Coherence so we can get rid of the loose PSU lying around