InfraRefresh: Difference between revisions

From NURDspace
No edit summary
 
(21 intermediate revisions by 2 users not shown)
Line 4: Line 4:
== When ==
== When ==
https://doodle.com/poll/xxdquth2k8uwskch
https://doodle.com/poll/xxdquth2k8uwskch
December 16th 14.00 until....
Next date TBD \o


== Where ==
== Where ==
Line 12: Line 14:
* Switching (ports, [[InfraRefresh/vlan|vlans]])
* Switching (ports, [[InfraRefresh/vlan|vlans]])
* [[InfraRefresh/routing|Routing]] (both interally and externally)
* [[InfraRefresh/routing|Routing]] (both interally and externally)
* Firewalling (if any, important flows within the network, portforwards, special cases)
* [[InfraRefresh/firewall|Firewalling]] (if any, important flows within the network, portforwards, special cases)
* Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
* Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
* Revisit DNS setup, see what can be/needs to be changed
* Revisit DNS setup, see what can be/needs to be changed
Line 19: Line 21:
* Make sure that all core services use certificates from the new PKI/CA setup.
* Make sure that all core services use certificates from the new PKI/CA setup.
* Define the concept of a 'managed host'
* Define the concept of a 'managed host'
* Fix all dependencies for working space status ([[Status]] and [[Vinculum]] and [[Notapp]])


== List of work for a managed host ==
== List of work for a managed host ==
For a manged host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:
* there is an admin account
* there is an admin account
* there is ldap authentication
* there is ldap authentication
* there are host certificates for this system
* there are host certificates for this system
* all connections are secured using TLS
* all connections are secured using TLS
* host is defined in and managed by ansible
* host is defined in and managed by [[Ansible]]


== Board drawings ==
== Board drawings ==
Line 32: Line 35:


[[File:Nurds-infra-refresh-board-right.jpeg|400px]]
[[File:Nurds-infra-refresh-board-right.jpeg|400px]]
== Work log dec 16th/17th 2017 ==
* Updated [[NURDServices]] from Jessie to Stretch
* Moved DHCPd from [[Arbiter]] back to [[NURDServices]]
* Added new ip to [[NURDServices]]
* Moved [[Postgresql.nurdspace.lan]] to [[Postgresql.vm.nurd.space]] and put it in the right network range
* Removed 192.168.x from everywhere
* Upgraded Proxmox on [[Coherence]] from 4.4 to 5.1
* Dist-upgraded [[Notapp]], [[Egg]], [[Rollout]], [[Status]]  from jessie to stretch
* Dist-upgraded [[Gallery]], [[Postgresql.vm.nurd.space]] and [[Vinculum]] from wheezy to jessie
* Revproxy config changed
* tunnelbroker tunnel moved to DSL
* Put a SATA power splitter on [[Coherence]] so we can get rid of the loose PSU lying around

Latest revision as of 23:43, 29 December 2017

What

Refresh the server / network infrastructure of NURDSpace. Goal is to make the infrastructure clear, simple, documented, rebuildable and predictable.

When

https://doodle.com/poll/xxdquth2k8uwskch December 16th 14.00 until.... Next date TBD \o

Where

NURDSpace Wageningen

List of work on the core network

The following parts of the infrastructure need to be well-defined, operational, monitored and documented:

  • Switching (ports, vlans)
  • Routing (both interally and externally)
  • Firewalling (if any, important flows within the network, portforwards, special cases)
  • Coupling of IPAM to various network devices / ACL's (make sure we can automate the network based on IPAM)
  • Revisit DNS setup, see what can be/needs to be changed
  • Revisit DHCP setup. Make sure we can do DHCP requests from everywhere in the network. Use static allocations for servers, using IPAM as source-of-thruth
  • Introduce PKI/CA based on cfssl. Make sure all systems in the network request host certificates + automagically upgrade the certs
  • Make sure that all core services use certificates from the new PKI/CA setup.
  • Define the concept of a 'managed host'
  • Fix all dependencies for working space status (Status and Vinculum and Notapp)

List of work for a managed host

For a managed host, the following actions need to take place. Do note, this is dependent on the refresh of the core infra:

  • there is an admin account
  • there is ldap authentication
  • there are host certificates for this system
  • all connections are secured using TLS
  • host is defined in and managed by Ansible

Board drawings

Nurds-infra-refresh-board-left.jpeg

Nurds-infra-refresh-board-right.jpeg

Work log dec 16th/17th 2017