gadmin/vagrant
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Ajout Vagarntfile et playbooks pour kea dhcp HA

Browse Source
This commit is contained in:
phil 2024-01-09 21:50:55 +01:00
parent a00d01c8da
commit a74a0f89d2
7 changed files with 536 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

84
kea-dhcp-ha/Vagrantfile vendored Normal file
View File

@ -0,0 +1,84 @@
# -*- mode: ruby -*-
# vi: set ft=ruby :
Vagrant.configure("2") do |config|
# Base VM OS configuration.
config.vm.box = "debian/bookworm64"
config.ssh.insert_key = false
config.vm.synced_folder '.', '/vagrant', disabled: true
# General VirtualBox VM configuration.
config.vm.provider :virtualbox do |v|
v.memory = 1024
v.cpus = 1
v.linked_clone = true
v.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
v.customize ["modifyvm", :id, "--ioapic", "on"]
end
# lb HAproxy.
config.vm.define "lb" do |lb|
lb.vm.hostname = "lb.test"
lb.vm.network :private_network, ip: "192.168.56.2"
lb.vm.provision "shell",
inline: "sudo apt-get update ; sudo apt-get install -y vim curl wget"
lb.vm.provision "ansible" do |ansible|
ansible.playbook = "provision/setup-lb.yml"
end
end
# NFS.
config.vm.define "nfs" do |nfs|
nfs.vm.hostname = "nfs.test"
nfs.vm.network :private_network, ip: "192.168.56.6"
nfs.vm.provision "shell",
inline: "sudo apt-get update ; sudo apt-get install -y vim curl wget"
nfs.vm.provision "ansible" do |ansible|
ansible.playbook = "provision/setup-nfs.yml"
end
end
# MySQL.
config.vm.define "db" do |db|
db.vm.hostname = "db.test"
db.vm.network :private_network, ip: "192.168.56.5"
db.vm.provision "shell",
inline: "sudo apt-get update ; sudo apt-get install -y vim curl wget"
db.vm.provision "ansible" do |ansible|
ansible.playbook = "provision/setup-db.yml"
end
end
# Kea DHCP server 1.
config.vm.define "kea1" do |kea1|
web1.vm.hostname = "kea1"
web1.vm.network :private_network, ip: "192.168.56.2"
web1.vm.provider :virtualbox do |v|
v.customize ["modifyvm", :id, "--memory", 512]
end
web1.vm.provision "shell",
inline: "sudo apt-get update ; sudo apt-get install -y vim curl wget"
web1.vm.provision "ansible" do |ansible|
ansible.extra_vars = {
srv_ip: "192.168.56.2",
}
ansible.playbook = "provision/setup-kea.yml"
end
end
# Kea DHCP server 2.
config.vm.define "web2" do |kea2|
web2.vm.hostname = "kea2"
web2.vm.network :private_network, ip: "192.168.56.3"
web2.vm.provider :virtualbox do |v|
v.customize ["modifyvm", :id, "--memory", 512]
end
web2.vm.provision "shell",
inline: "sudo apt-get update ; sudo apt-get install -y vim curl wget"
web2.vm.provision "ansible" do |ansible|
ansible.playbook = "provision/setup-kea.yml"
end
end
end

62
kea-dhcp-ha/provision/ca.cnf.j2 Normal file
View File

@ -0,0 +1,62 @@
// This is an example of a configuration for Control-Agent (CA) listening
// for incoming HTTP traffic. This is necessary for handling API commands,
// in particular lease update commands needed for HA setup.
{
"Control-agent":
{
// We need to specify where the agent should listen to incoming HTTP
// queries.
"http-host": "{{ srv_ip }}",
// This specifies the port CA will listen on.
"http-port": 8000,
"control-sockets":
{
// This is how the Agent can communicate with the DHCPv4 server.
"dhcp4":
{
"comment": "socket to DHCPv4 server",
"socket-type": "unix",
"socket-name": "/tmp/kea4-ctrl-socket"
},
// Location of the DHCPv6 command channel socket.
"dhcp6":
{
"socket-type": "unix",
"socket-name": "/tmp/kea6-ctrl-socket"
},
// Location of the D2 command channel socket.
"d2":
{
"socket-type": "unix",
"socket-name": "/tmp/kea-ddns-ctrl-socket",
"user-context": { "in-use": false }
}
},
// Similar to other Kea components, CA also uses logging.
"loggers": [
{
"name": "kea-ctrl-agent",
"output-options": [
{
"output": "/var/log/kea-ctrl-agent.log",
// Several additional parameters are possible in addition
// to the typical output. Flush determines whether logger
// flushes output to a file. Maxsize determines maximum
// filesize before the file is rotated. maxver
// specifies the maximum number of rotated files being
// kept.
"flush": true,
"maxsize": 204800,
"maxver": 4,
// We use pattern to specify custom log message layout
"pattern": "%d{%y.%m.%d %H:%M:%S.%q} %-5p [%c/%i] %m\n"
}
],
"severity": "INFO",
"debuglevel": 0 // debug level only applies when severity is set to DEBUG.
}
]
}
}

213
kea-dhcp-ha/provision/kea-dhcp2.j2 Normal file
View File

@ -0,0 +1,213 @@
// This is an example configuration of the Kea DHCPv4 server 1:
//
// - uses High Availability hook library and Lease Commands hook library
// to enable High Availability function for the DHCP server. This config
// file is for the primary (the active) server.
// - uses memfile, which stores lease data in a local CSV file
// - it assumes a single /24 addressing over a link that is directly reachable
// (no DHCP relays)
// - there is a handful of IP reservations
//
// It is expected to run with a standby (the passive) server, which has a very similar
// configuration. The only difference is that "this-server-name" must be set to "server2" on the
// other server. Also, the interface configuration depends on the network settings of the
// particular machine.
{
"Dhcp4": {
// Add names of your network interfaces to listen on.
"interfaces-config": {
// The DHCPv4 server listens on this interface. When changing this to
// the actual name of your interface, make sure to also update the
// interface parameter in the subnet definition below.
"interfaces": [ "enp0s8" ]
},
// Control socket is required for communication between the Control
// Agent and the DHCP server. High Availability requires Control Agent
// to be running because lease updates are sent over the RESTful
// API between the HA peers.
"control-socket": {
"socket-type": "unix",
"socket-name": "/tmp/kea4-ctrl-socket"
},
// Use Memfile lease database backend to store leases in a CSV file.
// Depending on how Kea was compiled, it may also support SQL databases
// (MySQL and/or PostgreSQL). Those database backends require more
// parameters, like name, host and possibly user and password.
// There are dedicated examples for each backend. See Section 7.2.2 "Lease
// Storage" for details.
"lease-database": {
// Memfile is the simplest and easiest backend to use. It's an in-memory
// database with data being written to a CSV file. It is very similar to
// what ISC DHCP does.
"type": "memfile"
},
// Let's configure some global parameters. The home network is not very dynamic
// and there's no shortage of addresses, so no need to recycle aggressively.
"valid-lifetime": 43200, // leases will be valid for 12h
"renew-timer": 21600, // clients should renew every 6h
"rebind-timer": 32400, // clients should start looking for other servers after 9h
// Kea will clean up its database of expired leases once per hour. However, it
// will keep the leases in expired state for 2 days. This greatly increases the
// chances for returning devices to get the same address again. To guarantee that,
// use host reservation.
// If both "flush-reclaimed-timer-wait-time" and "hold-reclaimed-time" are
// not 0, when the client sends a release message the lease is expired
// instead of being deleted from lease storage.
"expired-leases-processing": {
"reclaim-timer-wait-time": 3600,
"hold-reclaimed-time": 172800,
"max-reclaim-leases": 0,
"max-reclaim-time": 0
},
// HA requires two hook libraries to be loaded: libdhcp_lease_cmds.so and
// libdhcp_ha.so. The former handles incoming lease updates from the HA peers.
// The latter implements high availability feature for Kea. Note the library name
// should be the same, but the path is OS specific.
"hooks-libraries": [
// The lease_cmds library must be loaded because HA makes use of it to
// deliver lease updates to the server as well as synchronize the
// lease database after failure.
{
"library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_lease_cmds.so"
},
{
// The HA hook library should be loaded.
"library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_ha.so",
"parameters": {
// Each server should have the same HA configuration, except for the
// "this-server-name" parameter.
"high-availability": [ {
// This parameter points to this server instance. The respective
// HA peers must have this parameter set to their own names.
"this-server-name": "server1",
// The HA mode is set to hot-standby. In this mode, the active server handles
// all the traffic. The standby takes over if the primary becomes unavailable.
"mode": "hot-standby",
// Heartbeat is to be sent every 10 seconds if no other control
// commands are transmitted.
"heartbeat-delay": 10000,
// Maximum time for partner's response to a heartbeat, after which
// failure detection is started. This is specified in milliseconds.
// If we don't hear from the partner in 60 seconds, it's time to
// start worrying.
"max-response-delay": 60000,
// The following parameters control how the server detects the
// partner's failure. The ACK delay sets the threshold for the
// 'secs' field of the received discovers. This is specified in
// milliseconds.
"max-ack-delay": 5000,
// This specifies the number of clients which send messages to
// the partner but appear to not receive any response.
"max-unacked-clients": 5,
// This specifies the maximum timeout (in milliseconds) for the server
// to complete sync. If you have a large deployment (high tens or
// hundreds of thousands of clients), you may need to increase it
// further. The default value is 60000ms (60 seconds).
"sync-timeout": 60000,
"peers": [
// This is the configuration of this server instance.
{
"name": "kea1",
// This specifies the URL of this server instance. The
// Control Agent must run along with this DHCPv4 server
// instance and the "http-host" and "http-port" must be
// set to the corresponding values.
"url": "http://192.168.1.2:8000/",
// This server is primary. The other one must be
// secondary.
"role": "primary"
},
// This is the configuration of the secondary server.
{
"name": "kea2",
// Specifies the URL on which the partner's control
// channel can be reached. The Control Agent is required
// to run on the partner's machine with "http-host" and
// "http-port" values set to the corresponding values.
"url": "http://192.168.1.3:8000/",
// The other server is secondary. This one must be
// primary.
"role": "standby"
}
]
} ]
}
}
],
// This example contains a single subnet declaration.
"subnet4": [
{
// Subnet prefix.
"subnet": "192.168.1.0/24",
// There are no relays in this network, so we need to tell Kea that this subnet
// is reachable directly via the specified interface.
"interface": "enp0s8",
// Specify a dynamic address pool.
"pools": [
{
"pool": "192.168.1.120-192.168.1.150"
}
],
// These are options that are subnet specific. In most cases, you need to define at
// least routers option, as without this option your clients will not be able to reach
// their default gateway and will not have Internet connectivity. If you have many
// subnets and they share the same options (e.g. DNS servers typically is the same
// everywhere), you may define options at the global scope, so you don't repeat them
// for every network.
"option-data": [
{
// For each IPv4 subnet you typically need to specify at least one router.
"name": "routers",
"data": "192.168.1.1"
},
{
// Using cloudflare or Quad9 is a reasonable option. Change this
// to your own DNS servers is you have them. Another popular
// choice is 8.8.8.8, owned by Google. Using third party DNS
// service raises some privacy concerns.
"name": "domain-name-servers",
"data": "1.1.1.1,9.9.9.9"
}
],
// Some devices should get a static address. Since the .100 - .199 range is dynamic,
// let's use the lower address space for this. There are many ways how reservation
// can be defined, but using MAC address (hw-address) is by far the most popular one.
// You can use client-id, duid and even custom defined flex-id that may use whatever
// parts of the packet you want to use as identifiers. Also, there are many more things
// you can specify in addition to just an IP address: extra options, next-server, hostname,
// assign device to client classes etc. See the Kea ARM, Section 8.3 for details.
// The reservations are subnet specific.
"reservations": [
{
"hw-address": "1a:1b:1c:1d:1e:1f",
"ip-address": "192.168.1.10"
},
{
"client-id": "01:11:22:33:44:55:66",
"ip-address": "192.168.1.11"
}
]
}
],
// Logging configuration starts here.
"loggers": [
{
// This section affects kea-dhcp4, which is the base logger for DHCPv4 component. It tells
// DHCPv4 server to write all log messages (on severity INFO or higher) to a file. The file
// will be rotated once it grows to 2MB and up to 4 files will be kept. The debuglevel
// (range 0 to 99) is used only when logging on DEBUG level.
"name": "kea-dhcp4",
"output_options": [
{
"output": "/var/log/kea-dhcp4.log",
"maxsize": 2048000,
"maxver": 4
}
],
"severity": "INFO",
"debuglevel": 0
}
]
}
}

43
kea-dhcp-ha/provision/setup-db.yml Normal file
View File

@ -0,0 +1,43 @@
---
- hosts: all
become: true
tasks:
- name: modules python pour
apt:
name: python3-pymysql
state: present
- name: install mariadb-server
apt:
name: mariadb-server
state: present
- name: Cree Bd wordpress
mysql_db:
db: wordpressdb
login_unix_socket: /var/run/mysqld/mysqld.sock
state: present
- name: Ouvre port 3306 mariadb-server
replace:
path: /etc/mysql/mariadb.conf.d/50-server.cnf
regexp: '^bind-address.*'
replace: '#bind-adress = 127.0.0.1'
backup: yes
notify: restart mariadb
- name: Create MySQL user for wordpress.
mysql_user:
name: wordpressuser
password: wordpresspasswd
priv: "wordpressdb.*:ALL"
host: '%'
state: present
login_unix_socket: /var/run/mysqld/mysqld.sock
handlers:
- name: restart mariadb
ansible.builtin.service:
name: mariadb
state: restarted

17
kea-dhcp-ha/provision/setup-kea.yml Normal file
View File

@ -0,0 +1,17 @@
---
- hosts: all
become: true
tasks:
- name: kea-dhcp4-server et kea-ctrl-agent ...
apt:
name:
- kea-dhcp4-server
- kea-dhcp6-server
- kea-ctrl-agent
state: present
- name: genere ca.cnf dasn /etc/kea-ctrl-agent
template:
src: ca.j2
dest: present

29
kea-dhcp-ha/provision/setup-lb.yml Normal file
View File

@ -0,0 +1,29 @@
---
- hosts: all
become: true
tasks:
- name: install haproxy
apt:
name: haproxy
state: present
- name: parametre backend et fontend
blockinfile:
path: /etc/haproxy/haproxy.cfg
block: |
frontend proxypublic
bind 192.168.56.2:80
default_backend fermeweb
backend fermeweb
balance roundrobin
option httpclose
#option httpchk HEAD / HTTP/1.0
server web1.test 192.168.56.3:80 check
#server web2.test 192.168.56.4:80 check
- name: redemarre haproxy
service:
name: haproxy
state: restarted
enabled: yes

88
kea-dhcp-ha/provision/setup-nfs.yml Normal file
View File

@ -0,0 +1,88 @@
---
- hosts: all
become: true
tasks:
- name: 00 - cree repertoire wordpress pour export nfs
file:
path: /exports/wordpress
state: directory
- name: 05 - Install nfs-server
apt:
name: nfs-server
state: present
- name: 10 - creation fichier exports nfs
ansible.builtin.blockinfile:
path: /etc/exports
block: |
/exports/wordpress 192.168.56.0/255.255.255.0 (rw,no_root_squash,subtree_check)
- name: 15 - Recupere wordpress.tar.gz
get_url:
url: "https://fr.wordpress.org/latest-fr_FR.tar.gz"
dest: /tmp/wordpress-6.1.1-fr_FR.tar.gz
- name: 20 - decompresse wordpress
unarchive:
src: /tmp/wordpress-6.1.1-fr_FR.tar.gz
dest: /exports/
remote_src: yes
- name: 22 - change owner et group pour repertoire wordpress
file:
path: /exports/wordpress
state: directory
recurse: yes
owner: www-data
group: www-data
- name: 25 - genere fichier de config wordpress
copy:
src: /exports/wordpress/wp-config-sample.php
dest: /exports/wordpress/wp-config.php
remote_src: yes
- name: 30 - genere fichier de config wordpress
copy:
src: /exports/wordpress/wp-config-sample.php
dest: /exports/wordpress/wp-config.php
remote_src: yes
- name: 35 - ajuste variable dbname dans fichier de config wp-config.php
replace:
path: /exports/wordpress/wp-config.php
regexp: "votre_nom_de_bdd"
replace: "wordpressdb"
backup: yes
- name: 40 ajuste variable dbusername dans fichier de config wp-config.php
replace:
path: /exports/wordpress/wp-config.php
regexp: "votre_utilisateur_de_bdd"
replace: "wordpressuser"
backup: yes
- name: 45 - ajuste variable mdp dans fichier de config wp-config.php
replace:
path: /exports/wordpress/wp-config.php
regexp: "votre_mdp_de_bdd"
replace: "wordpresspasswd"
backup: yes
- name: 50 - ajuste hostname fichier wp-config.php
replace:
path: /exports/wordpress/wp-config.php
regexp: "localhost"
replace: "192.168.56.5"
backup: yes
- name: 55 - relance nfs
service:
name: nfs-server
state: restarted
enabled: yes