fix ip

bundles/grafana/items.py

@@ -26,7 +26,10 @@ actions['reset_grafana_admin_password'] = {
 
 directories = {
     '/etc/grafana': {},
-    '/etc/grafana/provisioning': {},
+    '/etc/grafana/provisioning': {
+        'owner': 'grafana',
+        'group': 'grafana',
+    },
     '/etc/grafana/provisioning/datasources': {
         'purge': True,
     },

bundles/icinga2/files/conf.d/notifications.conf

@@ -13,9 +13,9 @@ apply Notification "mail-icingaadmin" to Host {
   user_groups = host.vars.notification.mail.groups
   users = host.vars.notification.mail.users
 
-  //interval = 2h
 
-  //vars.notification_logtosyslog = true
+
+
 
   assign where host.vars.notification.mail
 }
@@ -25,9 +25,9 @@ apply Notification "mail-icingaadmin" to Service {
   user_groups = host.vars.notification.mail.groups
   users = host.vars.notification.mail.users
 
-  //interval = 2h
 
-  //vars.notification_logtosyslog = true
+
+
 
   assign where host.vars.notification.mail
 }

bundles/kea-dhcpd/items.py

@@ -0,0 +1,20 @@
+from json import dumps
+from bundlewrap.metadata import MetadataJSONEncoder
+
+files = {
+    '/etc/kea/kea-dhcp4.conf': {
+        'content': dumps(node.metadata.get('kea'), indent=4, sort_keys=True, cls=MetadataJSONEncoder),
+        'triggers': [
+            'svc_systemd:kea-dhcp4-server:restart',
+        ],
+    },
+}
+
+svc_systemd = {
+    'kea-dhcp4-server': {
+        'needs': [
+            'pkg_apt:kea-dhcp4-server',
+            'file:/etc/kea/kea-dhcp4.conf',
+        ],
+    },
+}

bundles/kea-dhcpd/metadata.py

@@ -0,0 +1,96 @@
+from ipaddress import ip_interface, ip_network
+
+hashable = repo.libs.hashable.hashable
+
+
+defaults = {
+    'apt': {
+        'packages': {
+            'kea-dhcp4-server': {},
+        },
+    },
+    'kea': {
+        'Dhcp4': {
+            'interfaces-config': {
+                'interfaces': set(),
+            },
+            'lease-database': {
+                'type': 'memfile',
+                'lfc-interval': 3600
+            },
+            'subnet4': set(),
+            'loggers': set([
+                hashable({
+                    'name': 'kea-dhcp4',
+                    'output_options': [
+                        {
+                            'output': 'syslog',
+                        }
+                    ],
+                    'severity': 'INFO',
+                }),
+            ]),
+        },
+    },
+}
+
+
+@metadata_reactor.provides(
+    'kea/Dhcp4/interfaces-config/interfaces',
+    'kea/Dhcp4/subnet4',
+)
+def subnets(metadata):
+    subnet4 = set()
+    interfaces = set()
+    reservations = set(
+        hashable({
+            'hw-address': network_conf['mac'],
+            'ip-address': str(ip_interface(network_conf['ipv4']).ip),
+        })
+            for other_node in repo.nodes
+            for network_conf in other_node.metadata.get('network', {}).values()
+            if 'mac' in network_conf
+    )
+
+    for network_name, network_conf in metadata.get('network').items():
+        dhcp_server_config = network_conf.get('dhcp_server_config', None)
+
+        if dhcp_server_config:
+            _network = ip_network(dhcp_server_config['subnet'])
+
+            subnet4.add(hashable({
+                'subnet': dhcp_server_config['subnet'],
+                'pools': [
+                    {
+                        'pool': f'{dhcp_server_config['pool_from']} - {dhcp_server_config['pool_to']}',
+                    },
+                ],
+                'option-data': [
+                    {
+                        'name': 'routers',
+                        'data': dhcp_server_config['router'],
+                    },
+                    {
+                        'name': 'domain-name-servers',
+                        'data': '10.0.10.2',
+                    },
+                ],
+                'reservations': set(
+                    reservation
+                        for reservation in reservations
+                        if ip_interface(reservation['ip-address']).ip in _network
+                ),
+            }))
+
+            interfaces.add(network_conf.get('interface', network_name))
+
+    return {
+        'kea': {
+            'Dhcp4': {
+                'interfaces-config': {
+                    'interfaces': interfaces,
+                },
+                'subnet4': subnet4,
+            },
+        },
+    }

bundles/left4dead2/files/server.cfg

@@ -1,36 +1,36 @@
 hostname "CroneKorkN : ${name}"
 sv_contact "admin@sublimity.de"
 
-// assign serevr to steam group
+
 sv_steamgroup "${','.join(steamgroups)}"
 
 rcon_password "${rcon_password}"
 
-// no annoying message of the day
+
 motd_enabled 0
 
-// enable cheats
+
 sv_cheats 1
 
-// allow inconsistent files on clients (weapon mods for example)
+
 sv_consistency 0
 
-// connect from internet
+
 sv_lan 0
 
-// join game at any point
+
 sv_allow_lobby_connect_only 0
 
-// allowed modes
+
 sv_gametypes "coop,realism,survival,versus,teamversus,scavenge,teamscavenge"
 
-// network
+
 sv_minrate 30000
 sv_maxrate 60000
 sv_mincmdrate 66
 sv_maxcmdrate 101
 
-// logging
+
 sv_logsdir "logs-${name}"        //Folder in the game directory where server logs will be stored.
 log on            //Creates a logfile (on | off)
 sv_logecho 0            //default 0; Echo log information to the console.

bundles/letsencrypt/items.py

@@ -56,6 +56,7 @@ for domain in node.metadata.get('letsencrypt/domains').keys():
         'unless': f'/etc/dehydrated/letsencrypt-ensure-some-certificate {domain} true',
         'needs': {
             'file:/etc/dehydrated/letsencrypt-ensure-some-certificate',
+            'pkg_apt:dehydrated',
         },
         'needed_by': {
             'svc_systemd:nginx',

bundles/linux/items.py

@@ -0,0 +1,41 @@
+from shlex import quote
+
+def generate_sysctl_key_value_pairs_from_json(json_data, parents=[]):
+    if isinstance(json_data, dict):
+        for key, value in json_data.items():
+            yield from generate_sysctl_key_value_pairs_from_json(value, [*parents, key])
+    elif isinstance(json_data, list):
+        raise ValueError(f"List not supported: '{json_data}'")
+    else:
+        # If it's a leaf node, yield the path
+        yield (parents, json_data)
+
+key_value_pairs = generate_sysctl_key_value_pairs_from_json(node.metadata.get('sysctl'))
+
+
+files= {
+    '/etc/sysctl.conf': {
+        'content': '\n'.join(
+            sorted(
+                f"{'.'.join(path)}={value}"
+                    for path, value in key_value_pairs
+            ),
+        ),
+        'triggers': [
+            'svc_systemd:systemd-sysctl.service:restart',
+        ],
+    },
+}
+
+svc_systemd = {
+    'systemd-sysctl.service': {},
+}
+
+for path, value in key_value_pairs:
+    actions[f'reload_sysctl.conf_{path}'] = {
+        'command': f"sysctl --values {'.'.join(path)}  | grep -q {quote('^'+value+'$')}",
+        'needs': [
+            f'action:systemd-sysctl.service',
+            f'action:systemd-sysctl.service:restart',
+        ],
+    }

bundles/linux/metadata.py

@@ -0,0 +1,3 @@
+defaults = {
+    'sysctl': {},
+}

bundles/macbook/files/macbook-update

@@ -18,7 +18,7 @@ git -C ~/.zsh/oh-my-zsh pull
 brew upgrade
 brew upgrade --cask --greedy
 
-pyenv install --keep-existing
+pyenv install --skip-existing
 
 sudo softwareupdate -ia --verbose
 

bundles/mailserver-autoconfig/files/autodiscover.php

@@ -1,6 +1,6 @@
 <?php
 
-// https://raw.githubusercontent.com/Radiergummi/autodiscover/master/autodiscover/autodiscover.php
+
 
 /********************************
  * Autodiscover responder
@@ -8,45 +8,45 @@
  * This PHP script is intended to respond to any request to http(s)://mydomain.com/autodiscover/autodiscover.xml.
  * If configured properly, it will send a spec-complient autodiscover XML response, pointing mail clients to the
  * appropriate mail services.
- * If you use MAPI or ActiveSync, stick with the Autodiscover service your mail server provides for you. But if 
+ * If you use MAPI or ActiveSync, stick with the Autodiscover service your mail server provides for you. But if
  * you use POP/IMAP servers, this will provide autoconfiguration to Outlook, Apple Mail and mobile devices.
  *
- * To work properly, you'll need to set the service (sub)domains below in the settings section to the correct 
+ * To work properly, you'll need to set the service (sub)domains below in the settings section to the correct
  * domain names, adjust ports and SSL.
  */
 
-//get raw POST data so we can extract the email address
+
 $request = file_get_contents("php://input");
 
-// optional debug log
+
 # file_put_contents( 'request.log', $request, FILE_APPEND );
 
-// retrieve email address from client request
+
 preg_match( "/\<EMailAddress\>(.*?)\<\/EMailAddress\>/", $request, $email );
 
-// check for invalid mail, to prevent XSS
+
 if (filter_var($email[1], FILTER_VALIDATE_EMAIL) === false) {
 	throw new Exception('Invalid E-Mail provided');
 }
 
-// get domain from email address
+
 $domain = substr( strrchr( $email[1], "@" ), 1 );
 
 /**************************************
  *   Port and server settings below   *
  **************************************/
 
-// IMAP settings
+
 $imapServer = 'imap.' . $domain; // imap.example.com
 $imapPort   = 993;
 $imapSSL    = true;
 
-// SMTP settings
+
 $smtpServer = 'smtp.' . $domain; // smtp.example.com
 $smtpPort   = 587;
 $smtpSSL    = true;
 
-//set Content-Type
+
 header( 'Content-Type: application/xml' );
 ?>
 <?php echo '<?xml version="1.0" encoding="utf-8" ?>'; ?>

bundles/mariadb/items.py

@@ -13,6 +13,7 @@ directories = {
         ],
         'needed_by': [
             'pkg_apt:mariadb-server',
+            'pkg_apt:mariadb-client',
         ],
     },
 }
@@ -30,6 +31,7 @@ svc_systemd = {
     'mariadb.service': {
         'needs': [
             'pkg_apt:mariadb-server',
+            'pkg_apt:mariadb-client',
         ],
     },
 }

bundles/mariadb/metadata.py

@@ -1,7 +1,16 @@
 defaults = {
     'apt': {
         'packages': {
-            'mariadb-server': {},
+            'mariadb-server': {
+                'needs': {
+                    'zfs_dataset:tank/mariadb',
+                },
+            },
+            'mariadb-client': {
+                'needs': {
+                    'zfs_dataset:tank/mariadb',
+                },
+            },
         },
     },
     'mariadb': {

bundles/network/metadata.py

@@ -5,38 +5,89 @@ defaults = {
 }
 
 
+@metadata_reactor.provides(
+    'network',
+)
+def dhcp(metadata):
+    networks = {}
+
+    for network_name, network_conf in metadata.get('network').items():
+        _interface = ip_interface(network_conf['ipv4'])
+        _ip = _interface.ip
+        _network = _interface.network
+        _hosts = list(_network.hosts())
+
+        if network_conf.get('dhcp_server', False):
+            networks[network_name] = {
+                'dhcp_server_config': {
+                    'subnet': str(_network),
+                    'pool_from': str(_hosts[len(_hosts)//2]),
+                    'pool_to': str(_hosts[-3]),
+                    'router': str(_ip),
+                    'domain-name-servers': str(_ip),
+                }
+            }
+    return {
+        'network': networks,
+    }
+
+
 @metadata_reactor.provides(
     'systemd/units',
 )
 def units(metadata):
     units = {}
 
-    for type, network in metadata.get('network').items():
+    for network_name, network_conf in metadata.get('network').items():
-        units[f'{type}.network'] = {
+        interface_type = network_conf.get('type', None)
+
+        # network
+
+        units[f'{network_name}.network'] = {
             'Match': {
-                'Name': network['interface'],
+                'Name': network_name if interface_type == 'vlan' else network_conf['interface'],
             },
             'Network': {
-                'DHCP': network.get('dhcp', 'no'),
+                'DHCP': network_conf.get('dhcp', 'no'),
-                'IPv6AcceptRA': network.get('dhcp', 'no'),
+                'IPv6AcceptRA': network_conf.get('dhcp', 'no'),
+                'VLAN': set(network_conf.get('vlans', set()))
             }
         }
 
+        # type
+
+        if interface_type:
+            units[f'{network_name}.network']['Match']['Type'] = interface_type
+
+        # ips
+
         for i in [4, 6]:
-            if network.get(f'ipv{i}', None):
+            if network_conf.get(f'ipv{i}', None):
-                units[f'{type}.network'].update({
+                units[f'{network_name}.network'].update({
                     f'Address#ipv{i}': {
-                        'Address': network[f'ipv{i}'],
+                        'Address': network_conf[f'ipv{i}'],
                     },
                 })
-                if f'gateway{i}' in network:
+                if f'gateway{i}' in network_conf:
-                    units[f'{type}.network'].update({
+                    units[f'{network_name}.network'].update({
                         f'Route#ipv{i}': {
-                            'Gateway': network[f'gateway{i}'],
+                            'Gateway': network_conf[f'gateway{i}'],
                             'GatewayOnlink': 'yes',
                         }
                     })
 
+        # as vlan
+
+        if interface_type == 'vlan':
+            units[f"{network_name}.netdev"] = {
+                'NetDev': {
+                    'Name': network_name,
+                    'Kind': 'vlan',
+                },
+                'VLAN': {
+                    'Id': network_conf['id'],
+                }
+            }
 
     return {
         'systemd': {

bundles/nginx/files/nginx.conf

@@ -1,6 +1,6 @@
 pid /var/run/nginx.pid;
 user www-data;
-worker_processes 10;
+worker_processes ${worker_processes};
 
 % for module in sorted(modules):
 load_module modules/ngx_${module}_module.so;
@@ -22,6 +22,8 @@ http {
     tcp_nopush on;
     client_max_body_size 32G;
     ssl_dhparam "/etc/ssl/certs/dhparam.pem";
+    # dont show nginx version
+    server_tokens off;
 
     % if node.has_bundle('php'):
     upstream php-handler {

bundles/nginx/items.py

@@ -32,6 +32,7 @@ files = {
         'content_type': 'mako',
         'context': {
             'modules': node.metadata.get('nginx/modules'),
+            'worker_processes': node.metadata.get('vm/cores'),
         },
         'triggers': {
             'svc_systemd:nginx:restart',

bundles/postfix/items.py

@@ -86,6 +86,8 @@ if node.has_bundle('telegraf'):
         'needs': [
             'pkg_apt:acl',
             'svc_systemd:postfix',
+            'svc_systemd:postfix:reload',
+            'svc_systemd:postfix:restart',
         ],
     }
     actions['postfix_setfacl_default_telegraf'] = {
@@ -94,5 +96,7 @@ if node.has_bundle('telegraf'):
         'needs': [
             'pkg_apt:acl',
             'svc_systemd:postfix',
+            'svc_systemd:postfix:reload',
+            'svc_systemd:postfix:restart',
         ],
     }

bundles/postgresql/metadata.py

@@ -6,7 +6,11 @@ root_password = repo.vault.password_for(f'{node.name} postgresql root')
 defaults = {
     'apt': {
         'packages': {
-            'postgresql': {},
+            'postgresql': {
+                'needs': {
+                    'zfs_dataset:tank/postgresql',
+                },
+            },
         },
     },
     'backup': {

bundles/roundcube/files/config.inc.php

@@ -6,80 +6,16 @@ $config['enable_installer'] = true;
 
 /* Local configuration for Roundcube Webmail */
 
-// ----------------------------------
-// SQL DATABASE
-// ----------------------------------
-// Database connection string (DSN) for read+write operations
-// Format (compatible with PEAR MDB2): db_provider://user:password@host/database
-// Currently supported db_providers: mysql, pgsql, sqlite, mssql or sqlsrv
-// For examples see http://pear.php.net/manual/en/package.database.mdb2.intro-dsn.php
-// NOTE: for SQLite use absolute path: 'sqlite:////full/path/to/sqlite.db?mode=0646'
 $config['db_dsnw'] = '${database['provider']}://${database['user']}:${database['password']}@${database['host']}/${database['name']}';
-
-// ----------------------------------
-// IMAP
-// ----------------------------------
-// The mail host chosen to perform the log-in.
-// Leave blank to show a textbox at login, give a list of hosts
-// to display a pulldown menu or set one host as string.
-// To use SSL/TLS connection, enter hostname with prefix ssl:// or tls://
-// Supported replacement variables:
-// %n - hostname ($_SERVER['SERVER_NAME'])
-// %t - hostname without the first part
-// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
-// %s - domain name after the '@' from e-mail address provided at login screen
-// For example %n = mail.domain.tld, %t = domain.tld
-// WARNING: After hostname change update of mail_host column in users table is
-//          required to match old user data records with the new host.
 $config['imap_host'] = 'localhost';
-
-// ----------------------------------
-// SMTP
-// ----------------------------------
-// SMTP server host (for sending mails).
-// To use SSL/TLS connection, enter hostname with prefix ssl:// or tls://
-// If left blank, the PHP mail() function is used
-// Supported replacement variables:
-// %h - user's IMAP hostname
-// %n - hostname ($_SERVER['SERVER_NAME'])
-// %t - hostname without the first part
-// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
-// %z - IMAP domain (IMAP hostname without the first part)
-// For example %n = mail.domain.tld, %t = domain.tld
 $config['smtp_host'] = 'tls://localhost';
-
-// SMTP username (if required) if you use %u as the username Roundcube
-// will use the current username for login
 $config['smtp_user'] = '%u';
-
-// SMTP password (if required) if you use %p as the password Roundcube
-// will use the current user's password for login
 $config['smtp_pass'] = '%p';
-
-// provide an URL where a user can get support for this Roundcube installation
-// PLEASE DO NOT LINK TO THE ROUNDCUBE.NET WEBSITE HERE!
 $config['support_url'] = '';
-
-// this key is used to encrypt the users imap password which is stored
-// in the session record (and the client cookie if remember password is enabled).
-// please provide a string of exactly 24 chars.
 $config['des_key'] = '${des_key}';
-
-// Name your service. This is displayed on the login screen and in the window title
 $config['product_name'] = '${product_name}';
-
-// ----------------------------------
-// PLUGINS
-// ----------------------------------
-// List of active plugins (in plugins/ directory)
 $config['plugins'] = array(${', '.join(f'"{plugin}"' for plugin in plugins)});
-
-// the default locale setting (leave empty for auto-detection)
-// RFC1766 formatted language name like en_US, de_DE, de_CH, fr_FR, pt_BR
 $config['language'] = 'de_DE';
-
-
-// https://serverfault.com/a/991304
 $config['smtp_conn_options'] = array(
    'ssl' => array(
    'verify_peer' => false,

bundles/roundcube/files/password.config.inc.php

@@ -1,7 +1,5 @@
 <?php
 
-// https://github.com/roundcube/roundcubemail/blob/357cc90001f997fd223fb48fcede6040f527c2f4/plugins/password/config.inc.php.dist
-
 $config['password_driver'] = 'sql';
 $config['password_strength_driver'] = null;
 $config['password_confirm_current'] = true;

bundles/roundcube/items.py

@@ -1,7 +1,8 @@
 assert node.has_bundle('php')
 assert node.has_bundle('mailserver')
 
-version = node.metadata.get('roundcube/version')
+roundcube_version = node.metadata.get('roundcube/version')
+php_version = node.metadata.get('php/version')
 
 directories = {
     '/opt/roundcube': {
@@ -22,9 +23,9 @@ directories = {
 }
 
 
-files[f'/tmp/roundcube-{version}.tar.gz'] = {
+files[f'/tmp/roundcube-{roundcube_version}.tar.gz'] = {
     'content_type': 'download',
-    'source': f'https://github.com/roundcube/roundcubemail/releases/download/{version}/roundcubemail-{version}-complete.tar.gz',
+    'source': f'https://github.com/roundcube/roundcubemail/releases/download/{roundcube_version}/roundcubemail-{roundcube_version}-complete.tar.gz',
     'triggered': True,
 }
 actions['delete_roundcube'] = {
@@ -32,11 +33,11 @@ actions['delete_roundcube'] = {
     'triggered': True,
 }
 actions['extract_roundcube'] = {
-    'command': f'tar xfvz /tmp/roundcube-{version}.tar.gz --strip 1 -C /opt/roundcube',
+    'command': f'tar xfvz /tmp/roundcube-{roundcube_version}.tar.gz --strip 1 -C /opt/roundcube',
-    'unless': f'grep -q "Version {version}" /opt/roundcube/index.php',
+    'unless': f'grep -q "Version {roundcube_version}" /opt/roundcube/index.php',
     'preceded_by': [
         'action:delete_roundcube',
-        f'file:/tmp/roundcube-{version}.tar.gz',
+        f'file:/tmp/roundcube-{roundcube_version}.tar.gz',
     ],
     'needs': [
         'directory:/opt/roundcube',
@@ -64,6 +65,9 @@ files['/opt/roundcube/config/config.inc.php'] = {
     'needs': [
         'action:chown_roundcube',
     ],
+    'triggers': [
+        f'svc_systemd:php{php_version}-fpm.service:restart',
+    ],
 }
 files['/opt/roundcube/plugins/password/config.inc.php'] = {
     'source': 'password.config.inc.php',

bundles/telegraf/items.py

@@ -9,7 +9,7 @@ files = {
                 node.metadata.get('telegraf/config'),
                 cls=MetadataJSONEncoder,
             )),
-            sort_keys=True
+            sort_keys=True,
         ),
         'triggers': [
             'svc_systemd:telegraf:restart',

groups/os/linux.py

@@ -6,6 +6,7 @@
         'hostname',
         'hosts',
         'htop',
+        'linux',
         'locale',
         'network',
         'ssh',
@@ -22,16 +23,16 @@
     'metadata': {
         'dns': {},
         'hosts': {
-            '10.0.11.3': [
+            '10.0.10.2': [
                 'resolver.name',
                 'secondary.resolver.name',
             ],
         },
         'letsencrypt': {
-            'acme_node': 'netcup.mails',
+            'acme_node': 'htz.mails',
         },
         'nameservers': {
-            '10.0.11.3',
+            '10.0.10.2',
         },
         'systemd-timers': {
             'trim': {

items/download.py

@@ -3,7 +3,7 @@ from bundlewrap.exceptions import BundleError
 from bundlewrap.utils.text import force_text, mark_for_translation as _
 from bundlewrap.utils.remote import PathInfo
 import types
-from pipes import quote
+from shlex import quote
 
 # Downloaded from https://github.com/bundlewrap/plugins/blob/master/item_download/items/download.py
 # No, we can't use plugins here, because bw4 won't support them anymore.
@@ -101,16 +101,16 @@ class Download(Item):
             elif self.attributes.get('gpg_signature_url'):
                 full_signature_url = self.attributes['gpg_signature_url'].format(url=self.attributes['url'])
                 signature_path = f'{self.name}.signature'
-                
+
                 self.node.run(f"curl -sSL {self.attributes['gpg_pubkey_url']} | gpg --import -")
                 self.node.run(f"curl -L {full_signature_url} -o {quote(signature_path)}")
                 gpg_output = self.node.run(f"gpg --verify {quote(signature_path)} {quote(self.name)}").stderr
-                
+
                 if b'Good signature' in gpg_output:
                     sdict['verified'] = True
                 else:
                     sdict['verified'] = False
-                    
+
         return sdict
 
     @classmethod

libs/tools.py

@@ -92,3 +92,4 @@ from shlex import quote
 
 def run_as(user, command):
     return f'sudo su - {user} -s /bin/bash -c {quote(command)}'
+

nodes/home.homeassistant.py

@@ -29,6 +29,7 @@
             'internal': {
                 'interface': 'eth0',
                 'ipv4': '10.0.0.16/24',
+                'mac': 'd8:3a:dd:16:fc:9d',
                 'gateway4': '10.0.0.1',
             },
         },
@@ -68,20 +69,20 @@
             },
         },
         'hosts': {
-            '10.0.11.3': [
+            '10.0.10.2': [
                 'resolver.name',
                 'secondary.resolver.name',
             ],
         },
         'letsencrypt': {
-            'acme_node': 'netcup.mails',
+            'acme_node': 'htz.mails',
         },
         'homeassistant': {
             'domain': 'homeassistant.ckn.li',
             'os_agent_version': '1.6.0',
         },
         'nameservers': {
-            '10.0.11.3',
+            '10.0.10.2',
         },
         'users': {
             'ckn': {

nodes/home.homematic.py

@@ -14,6 +14,7 @@
         'network': {
             'internal': {
                 'ipv4': '10.0.2.8/24',
+                'mac': 'b8:27:eb:15:30:86',
             },
         },
         'dns': {

nodes/home.hue.py

@@ -5,7 +5,13 @@
         'home',
     ],
     'metadata': {
-        'id': '',
+        'id': '87879bc1-130f-4fca-a8d2-e1d93a794df4',
+        'network': {
+            'internal': {
+                'ipv4': '10.0.2.100/24',
+                'mac': '00:17:88:67:e7:f2',
+            },
+        },
         'dns': {
             'hue.ckn.li': {
                 'A': {'10.0.2.100'},

nodes/home.router.py

@@ -1,25 +1,77 @@
 {
-    'hostname': '10.0.0.120',
+    'hostname': '10.0.0.1',
-    'dummy': True,
     'groups': [
         'autologin',
-        'debian-11',
+        'debian-12',
         'hardware',
         'home',
         'monitored',
     ],
+    'bundles': [
+        'kea-dhcpd',
+        'wireguard',
+    ],
     'metadata': {
         'id': '1d6a43e5-858c-42f9-9c40-ab63d61c787c',
         'network': {
             'internal': {
                 'interface': 'eno1',
-                'ipv4': '10.0.0.120/24',
+                'ipv4': '10.0.0.1/24',
-                'gateway4': '10.0.0.1',
+                'vlans': {'iot', 'internet', 'guest'},
+                'dhcp_server': True,
             },
-            'external': {
+            'temp': {
-                'interface': 'enx00e04c00135b',
+                'interface': 'enx00e04c220682',
-                'mac': '00:e0:4c:00:13:5b',
+                'ipv4': '10.0.99.126/24',
-                'dhcp': 'yes',
+                'gateway4': '10.0.99.1',
+            },
+            'iot': {
+                'type': 'vlan',
+                'id': 2,
+                'ipv4': '10.0.2.1/24',
+                'dhcp_server': True,
+            },
+            'internet': {
+                'type': 'vlan',
+                'id': 3,
+                'ipv4': '10.0.3.1/24',
+            },
+            'guest': {
+                'type': 'vlan',
+                'id': 9,
+                'ipv4': '10.0.9.1/24',
+                'dhcp_server': True,
+            },
+        },
+        # 'nftables': {
+        #     'forward': {
+        #         # Drop DHCP client requests (UDP port 68)
+        #         'udp sport 68 drop',
+        #         'udp dport 68 drop',
+
+        #         # Drop DHCP server responses (UDP port 67)
+        #         'udp sport 67 drop',
+        #         'udp dport 67 drop',
+        #     },
+        # },
+        'sysctl': {
+            'net': {
+                'ipv4': {
+                    'ip_forward': 1,
+                },
+            },
+        },
+        'wireguard': {
+            'my_ip': '172.30.0.2/32',
+            's2s': {
+                'htz.mails': {
+                    'allowed_ips': [
+                        '10.0.10.0/24',
+                        '10.0.10.0/24',
+                        '192.168.179.0/24',
+                        '10.0.227.0/24', # mseibert.freescout
+                    ],
+                },
             },
         },
     },

nodes/home.server.py

@@ -33,7 +33,6 @@
         'twitch-clip-download',
         'raspberrymatic-cert',
         'tasmota-charge',
-        'wireguard',
         'wol-waker',
         'zfs',
     ],
@@ -63,10 +62,10 @@
                     'target': 'aarch64-unknown-linux-gnu',
                 },
             },
-            'download_server': 'netcup.mails',
+            'download_server': 'htz.mails',
         },
         'gitea': {
-            'version': '7.0.1',
+            'version': '8.0.3',
             'domain': 'git.sublimity.de',
             'conf': {
                 'mailer': {
@@ -111,7 +110,7 @@
         },
         'nextcloud': {
             'hostname': 'cloud.sublimity.de',
-            'version': '29.0.3',
+            'version': '29.0.7',
             'config': {
                 'instanceid': 'oci6dw1woodz',
                 'secret': '!decrypt:encrypt$gAAAAABj96CFynVtEgsje7173zjQAcY7xQG3uyf5cxE-sJAvhyPh_KUykTKdwnExc8NTDJ8RIGUmVfgC6or5crnYaggARPIEg5-Cb0xVdEPPZ3oZ01ImLmynLu3qXT9O8kVM-H21--OKeztMRn7bySsbXdWEGtETFQ==',
@@ -145,6 +144,13 @@
         'steam-chat-viewer': {
             'hostname': 'steam-chats.ckn.li',
         },
+        'sysctl': {
+            'net': {
+                'ipv4': {
+                    'ip_forward': 1,
+                },
+            },
+        },
         'systemd-swap': 4_000_000_000,
         'tasmota-charge': {
             'phone': {
@@ -166,19 +172,6 @@
             'threads': 32,
             'ram':  49152,
         },
-        'wireguard': {
-            'my_ip': '172.30.0.2/32',
-            's2s': {
-                'netcup.mails': {
-                    'allowed_ips': [
-                        '10.0.10.0/24',
-                        '10.0.11.0/24',
-                        '192.168.179.0/24',
-                        '10.0.227.0/24', # mseibert.freescout
-                    ],
-                },
-            },
-        },
         'zfs': {
             'zfs_arc_max_percent': 80,
             'storage_classes': {

nodes/htz.games.py

@@ -37,7 +37,7 @@
         'network': {
             'internal': {
                 'interface': 'ens10',
-                'ipv4': '10.0.10.3/32',
+                'ipv4': '10.0.10.2/32',
             },
             'external': {
                 'interface': 'eth0',

nodes/htz.mails.py

@@ -1,8 +1,9 @@
 {
-    'hostname': '202.61.255.108',
+    'hostname': '49.12.184.229',
     'groups': [
         'backup',
         'debian-12',
+        'hetzner-cloud',
         'mailserver',
         'monitored',
         'webserver',
@@ -15,7 +16,7 @@
         'build-ci',
         'download-server',
         'islamicstate.eu',
-        'nginx-rtmps',
+        #'nginx-rtmps',
         #'steam',
         'wireguard',
         'zfs',
@@ -24,14 +25,14 @@
         'id': 'ea29bdf0-0b47-4bf4-8346-67d60c9dc4ae',
         'network': {
             'internal': {
-                'interface': 'eth1',
+                'interface': 'enp7s0',
-                'ipv4': '10.0.11.3/24',
+                'ipv4': '10.0.10.2/24',
             },
             'external': {
                 'interface': 'eth0',
-                'ipv4': '202.61.255.108/22',
+                'ipv4': '49.12.184.229/32',
-                'gateway4': '202.61.252.1',
+                'gateway4': '172.31.1.1',
-                'ipv6': '2a03:4000:55:a89::1/64',
+                'ipv6': '2a01:4f8:c013:51f2::1',
                 'gateway6': 'fe80::1',
             }
         },
@@ -58,20 +59,20 @@
         },
         'dns': {
             'ckn.li': {
-                'A': ['202.61.255.108'],
+                'A': ['49.12.184.229'],
-                'AAAA': ['2a01:4f8:1c1c:4121::1'],
+                'AAAA': ['2a01:4f8:c013:51f2::1'],
             },
             'sublimity.de': {
-                'A': ['202.61.255.108'],
+                'A': ['49.12.184.229'],
-                'AAAA': ['2a01:4f8:1c1c:4121::1'],
+                'AAAA': ['2a01:4f8:c013:51f2::1'],
             },
             'freibrief.net': {
-                'A': ['202.61.255.108'],
+                'A': ['49.12.184.229'],
-                'AAAA': ['2a01:4f8:1c1c:4121::1'],
+                'AAAA': ['2a01:4f8:c013:51f2::1'],
             },
             'left4.me': {
-                'A': ['202.61.255.108'],
+                'A': ['49.12.184.229'],
-                'AAAA': ['2a01:4f8:1c1c:4121::1'],
+                'AAAA': ['2a01:4f8:c013:51f2::1'],
             },
             'elimu-kwanza.de': {
                 'TXT': ['google-site-verification=JwgcfXQ6nIXKxjMqUGHVBDISgMCQXgzMryPBsP2ZXnE'],
@@ -195,21 +196,22 @@
         },
         'vm': {
             'cores': 4,
-            'ram': 16384,
+            'ram': 8192,
         },
         'wireguard': {
             'my_ip': '172.30.0.1/24',
             's2s': {
-                'home.server': {
+                'home.router': {
                     'allowed_ips': [
                         '10.0.0.0/24',
                         '10.0.2.0/24',
                         '10.0.9.0/24',
+                        '10.0.99.0/24',
                     ],
                 },
                 'ovh.secondary': {
                     'allowed_ips': [
-                        '10.0.11.0/24',
+                        '10.0.10.0/24',
                     ],
                 },
                 'wb.offsite-backups': {
@@ -239,7 +241,7 @@
             'pools': {
                 'tank': {
                     'devices': [
-                        '/dev/sda4',
+                        '/dev/disk/by-id/scsi-0HC_Volume_101332312',
                     ],
                 },
             },

nodes/mseibert.freescout.py

@@ -37,13 +37,13 @@
         'wireguard': {
             'my_ip': '172.30.0.238/32',
             's2s': {
-                'netcup.mails': {
+                'htz.mails': {
                     'allowed_ips': [
                         '10.0.0.0/24',
                         '10.0.2.0/24',
                         '10.0.9.0/24',
                         '10.0.10.0/24',
-                        '10.0.11.0/24',
+                        '10.0.10.0/24',
                     ],
                 },
             },

nodes/ovh.secondary.py

@@ -20,22 +20,22 @@
             },
         },
         'bind': {
-            'master_node': 'netcup.mails',
+            'master_node': 'htz.mails',
             'hostname': 'secondary.resolver.name',
         },
         # 'postfix': {
-        #     'master_node': 'netcup.mails',
+        #     'master_node': 'htz.mails',
         #     'hostname': 'mail2.sublimity.de',
         # },
         'wireguard': {
             'my_ip': '172.30.0.3/32',
             's2s': {
-                'netcup.mails': {
+                'htz.mails': {
                     'allowed_ips': [
                         '10.0.0.0/24',
                         '10.0.2.0/24',
                         '10.0.9.0/24',
-                        '10.0.11.0/24',
+                        '10.0.10.0/24',
                     ],
                 },
             },

nodes/wb.offsite-backups.py

@@ -1,4 +1,5 @@
 {
+    'dummy': True,
     'hostname': '192.168.179.20',
     'groups': [
         'debian-11',
@@ -43,13 +44,13 @@
         'wireguard': {
             'my_ip': '172.30.0.4/32',
             's2s': {
-                'netcup.mails': {
+                'htz.mails': {
                     'allowed_ips': [
                         '10.0.0.0/24',
                         '10.0.2.0/24',
                         '10.0.9.0/24',
                         '10.0.10.0/24',
-                        '10.0.11.0/24',
+                        '10.0.10.0/24',
                     ],
                 },
             },