InfraRefresh
What
Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.
When
https://doodle.com/poll/xxdquth2k8uwskch
Where
NURDSpace Wageningen
List of work
The following parts of the infrastructure need to be well-defined, operational, monitored and documented: - Switching (ports, vlans) - Routing (both interally and externally) - Firewalling (if any, important flows within the network, portforwards, special cases) - Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM) - Revisit DNS setup, see what can be/needs to be changed - Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth - Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs - Make sure that all core services use certificates from the new PKI/CA setup. - Define the concept of a 'managed host' - For a manged host, make sure that:
* there is an admin account * there is ldap authentication * all connections are secured using TLS * host is defined in and managed by ansible
- Rebuild various internal services to the new 'managed host' setup.