Compare commits
14
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
  claude-botandClaude Opus 5.5
|
41efcd9f91 | ||
 k.renner
|
30704634b3 | ||
|
k.renner
|
43861d34c1 | ||
|
k.renner
|
3252a6f9ee | ||
|
k.renner
|
cf80a096a6 | ||
|
k.renner
|
41e272f188 | ||
|
k.renner
|
8dc0986d1d | ||
|
k.renner
|
edb4aa804c | ||
|
claude-botandClaude Opus 5.5
|
9777e147e8 | ||
|
claude-botandClaude Opus 5.5
|
37dc17065d | ||
|
claude-botandClaude Opus 5.5
|
570c93559b | ||
|
claude-botandClaude Opus 5.5
|
71ab916ff7 | ||
|
claude-botandClaude Opus 5.5
|
9aecaacbb2 | ||
|
claude-botandClaude Opus 5.5
|
c4f32c7a97 |
@@ -1,70 +0,0 @@
|
||||
---
|
||||
# Configure VMs to use host time sync via kvm-clock
|
||||
# Disables systemd-timesyncd to prevent NTP conflicts
|
||||
#
|
||||
# VMs get time from Proxmox host via kvm-clock paravirtualized clock
|
||||
# This is more accurate and reliable than network NTP for VMs
|
||||
|
||||
- name: Configure VM time synchronization from host
|
||||
hosts: all
|
||||
become: yes
|
||||
gather_facts: yes
|
||||
|
||||
tasks:
|
||||
- name: Check if running as VM (not LXC)
|
||||
stat:
|
||||
path: /sys/devices/system/clocksource/clocksource0/current_clocksource
|
||||
register: clocksource_file
|
||||
|
||||
- name: Get current clock source
|
||||
slurp:
|
||||
src: /sys/devices/system/clocksource/clocksource0/current_clocksource
|
||||
register: clocksource
|
||||
when: clocksource_file.stat.exists
|
||||
|
||||
- name: Display clock source
|
||||
debug:
|
||||
msg: "Clock source: {{ (clocksource.content | b64decode | trim) if clocksource_file.stat.exists else 'N/A (LXC)' }}"
|
||||
|
||||
- name: Check if systemd-timesyncd is installed
|
||||
command: systemctl list-unit-files systemd-timesyncd.service
|
||||
register: timesyncd_installed
|
||||
check_mode: false
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: Stop and disable systemd-timesyncd on VMs using kvm-clock
|
||||
systemd:
|
||||
name: systemd-timesyncd
|
||||
state: stopped
|
||||
enabled: no
|
||||
when:
|
||||
- clocksource_file.stat.exists
|
||||
- clocksource.content is defined
|
||||
- "'kvm-clock' in (clocksource.content | b64decode)"
|
||||
- "'systemd-timesyncd.service' in timesyncd_installed.stdout"
|
||||
|
||||
- name: Mask systemd-timesyncd to prevent re-enabling
|
||||
systemd:
|
||||
name: systemd-timesyncd
|
||||
masked: yes
|
||||
when:
|
||||
- clocksource_file.stat.exists
|
||||
- clocksource.content is defined
|
||||
- "'kvm-clock' in (clocksource.content | b64decode)"
|
||||
- "'systemd-timesyncd.service' in timesyncd_installed.stdout"
|
||||
|
||||
- name: Verify time sync status
|
||||
command: timedatectl show --property=NTPSynchronized
|
||||
register: timesync_status
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Display final status
|
||||
debug:
|
||||
msg: |
|
||||
Host: {{ inventory_hostname }}
|
||||
Type: {{ 'VM (kvm-clock)' if (clocksource_file.stat.exists and 'kvm-clock' in (clocksource.content | b64decode | default(''))) else 'LXC/Other' }}
|
||||
Time sync: {{ timesync_status.stdout | default('unknown') }}
|
||||
Note: VMs sync time from Proxmox host, LXCs inherit host time automatically
|
||||
@@ -22,6 +22,7 @@
|
||||
become: true
|
||||
roles:
|
||||
- common
|
||||
- timesyncd
|
||||
- docker-install
|
||||
- netbird-proxy
|
||||
- netbird-proxy-watchdog
|
||||
|
||||
@@ -16,5 +16,6 @@
|
||||
become: true
|
||||
roles:
|
||||
- common
|
||||
- timesyncd
|
||||
- docker-install
|
||||
- netbird-server
|
||||
|
||||
@@ -54,18 +54,9 @@
|
||||
# via plays/configure-ssh-ca.yml.
|
||||
|
||||
# -------------------------------------------------------
|
||||
# 5. Disable NTP on VMs/LXC (use host time)
|
||||
# 5. Time sync
|
||||
# -------------------------------------------------------
|
||||
- name: Stop and disable systemd-timesyncd on VMs/LXC
|
||||
systemd:
|
||||
name: systemd-timesyncd
|
||||
state: stopped
|
||||
enabled: no
|
||||
masked: yes
|
||||
when:
|
||||
- ansible_facts['virtualization_role'] == 'guest'
|
||||
- ansible_facts['virtualization_type'] in ['kvm', 'lxc']
|
||||
ignore_errors: yes
|
||||
# Moved to separate roles: timesyncd (internet VPS), chrony-ntp-server (edge).
|
||||
|
||||
# -------------------------------------------------------
|
||||
# 6. Certificates
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
# Keep the system clock on NTP with systemd-timesyncd, on hosts that run no
|
||||
# chrony. A KVM guest's clocksource does not steer wall-clock time; without an
|
||||
# NTP client the clock drifts until JWT iat/exp checks fail.
|
||||
|
||||
- name: Install systemd-timesyncd
|
||||
ansible.builtin.apt:
|
||||
name: systemd-timesyncd
|
||||
state: present
|
||||
when: ansible_facts['os_family'] == 'Debian'
|
||||
|
||||
- name: Run systemd-timesyncd
|
||||
ansible.builtin.systemd_service:
|
||||
name: systemd-timesyncd
|
||||
masked: false
|
||||
enabled: true
|
||||
state: started
|
||||
|
||||
- name: Wait for the clock to synchronize
|
||||
ansible.builtin.command:
|
||||
argv: [timedatectl, show, --property=NTPSynchronized, --value]
|
||||
register: timesyncd_synchronized
|
||||
changed_when: false
|
||||
until: timesyncd_synchronized.stdout == "yes"
|
||||
retries: 12
|
||||
delay: 5
|
||||
@@ -12,8 +12,6 @@
|
||||
ansible.builtin.import_playbook: plays/configure-synology-python.yml
|
||||
- name: Base system
|
||||
ansible.builtin.import_playbook: plays/common.yml
|
||||
- name: VM time sync
|
||||
ansible.builtin.import_playbook: plays/configure-vm-time-sync.yml
|
||||
|
||||
- name: SSH user CA
|
||||
ansible.builtin.import_playbook: plays/configure-ssh-ca.yml
|
||||
|
||||
@@ -156,13 +156,39 @@ spec:
|
||||
k8sServicePort: 7445
|
||||
# Hubble itself is on in every agent (chart default); the relay aggregates
|
||||
# the three nodes' flow buffers behind one gRPC endpoint so `hubble observe`
|
||||
# works without exec into kube-system (REN-487). Renders no change to
|
||||
# cilium-config or the agent DaemonSet, so the reloader annotation above
|
||||
# does not roll the CNI. The relay has no client auth; who may reach it is
|
||||
# network-policies/kube-system-hubble-relay.yaml.
|
||||
# works without exec into kube-system (REN-487). The relay has no client
|
||||
# auth; who may reach it is network-policies/kube-system-hubble-relay.yaml.
|
||||
hubble:
|
||||
relay:
|
||||
enabled: true
|
||||
# Every policy drop goes to the agent's stdout and from there to Loki
|
||||
# ({namespace="kube-system", container="cilium-agent"} |= "POLICY_DENIED"),
|
||||
# so denied traffic can be reviewed after the fact. Changes cilium-config,
|
||||
# so the reloader rolls the agents.
|
||||
export:
|
||||
static:
|
||||
enabled: true
|
||||
filePath: stdout
|
||||
allowList:
|
||||
- '{"verdict":["DROPPED"],"drop_reason_desc":["POLICY_DENIED"],"event_type":[{"type":1}]}'
|
||||
fieldMask:
|
||||
- time
|
||||
- node_name
|
||||
- verdict
|
||||
- drop_reason_desc
|
||||
- traffic_direction
|
||||
- IP
|
||||
- l4
|
||||
- source.namespace
|
||||
- source.pod_name
|
||||
- source.identity
|
||||
- source.workloads
|
||||
- source_names
|
||||
- destination.namespace
|
||||
- destination.pod_name
|
||||
- destination.identity
|
||||
- destination.workloads
|
||||
- destination_names
|
||||
l2announcements:
|
||||
enabled: true
|
||||
externalIPs:
|
||||
|
||||
@@ -205,8 +205,11 @@ spec:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: home-assistant
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- world
|
||||
- fromCIDRSet:
|
||||
- cidrGroupRef: net-privat
|
||||
- cidrGroupRef: net-vpn
|
||||
- cidrGroupRef: net-iot
|
||||
- cidrGroupRef: net-server
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8123"
|
||||
@@ -225,8 +228,8 @@ spec:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: shelly-manager
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- world
|
||||
- fromCIDRSet:
|
||||
- cidrGroupRef: net-iot
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8082"
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# CoreDNS is reachable from the LAN through the kube-dns-lb LoadBalancer
|
||||
# (ETP=Local, client address reaches the pod). Selecting the pods makes
|
||||
# them default-deny for ingress, so the whole cluster (pods, nodes, kubelet
|
||||
# probes, Prometheus) is allowed on every port; LAN clients only on 53.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: coredns-ingress
|
||||
namespace: kube-system
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- cluster
|
||||
- fromCIDRSet:
|
||||
- cidrGroupRef: net-default
|
||||
- cidrGroupRef: net-management
|
||||
- cidrGroupRef: net-radius
|
||||
- cidrGroupRef: net-video
|
||||
- cidrGroupRef: net-iot
|
||||
- cidrGroupRef: net-server
|
||||
- cidrGroupRef: net-k8s-node
|
||||
- cidrGroupRef: net-k8s-ingress
|
||||
- cidrGroupRef: net-k8s-pod
|
||||
- cidrGroupRef: net-privat
|
||||
- cidrGroupRef: net-phone
|
||||
- cidrGroupRef: net-access
|
||||
- cidrGroupRef: net-vpn
|
||||
- cidrGroupRef: net-guest
|
||||
- cidrGroupRef: net-multi-transfer
|
||||
- cidrGroupRef: net-multi-lan
|
||||
- cidrGroupRef: net-mutti
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
- port: "53"
|
||||
protocol: TCP
|
||||
@@ -41,3 +41,4 @@ resources:
|
||||
- allow-cilium-health.yaml
|
||||
- cnpg-barman-s3.yaml
|
||||
- kube-system-hubble-relay.yaml
|
||||
- kube-system-coredns.yaml
|
||||
|
||||
@@ -1,13 +1,6 @@
|
||||
# Targeted carve-out: alloy-syslog needs world ingress on the syslog
|
||||
# ports specifically. The Service is ETP=Cluster, so external syslog
|
||||
# senders (Proxmox, LXC hosts, network gear) hit the LB IP, get DNAT'd
|
||||
# to an alloy pod, and get SNAT'd to the receiving node's cilium_host
|
||||
# address. Cilium then sees the source as `world-ipv4` identity (the
|
||||
# cilium_host IP isn't a known endpoint), NOT `host` — so the broad
|
||||
# monitoring CNP's `fromEntities: host` rule doesn't catch it.
|
||||
#
|
||||
# Scoped via endpointSelector so this only widens ingress on the
|
||||
# alloy-syslog pod, not the whole namespace.
|
||||
# Syslog senders reaching the alloy-syslog LB (ETP=Local, client address
|
||||
# reaches the pod): network gear on Management, the SLZB coordinators on
|
||||
# IoT, and the UDM itself, which sources from its k8s-ingress address.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
@@ -19,8 +12,10 @@ spec:
|
||||
app.kubernetes.io/instance: alloy-syslog
|
||||
app.kubernetes.io/name: alloy
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- world
|
||||
- fromCIDRSet:
|
||||
- cidrGroupRef: net-management
|
||||
- cidrGroupRef: net-iot
|
||||
- cidrGroupRef: net-k8s-ingress
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "514"
|
||||
|
||||
@@ -112,7 +112,7 @@ spec:
|
||||
- { type: 136, family: IPv6 }
|
||||
- { type: 143, family: IPv6 }
|
||||
---
|
||||
# Allow FTP access (from scanners on the LAN) to the ftp-scanner pod.
|
||||
# FTP from the scanners (IoT and Privat) to the ftp-scanner pod.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
@@ -123,8 +123,24 @@ spec:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: ftp-scanner
|
||||
ingress:
|
||||
- fromCIDRSet:
|
||||
- cidrGroupRef: net-iot
|
||||
- cidrGroupRef: net-privat
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "21"
|
||||
protocol: TCP
|
||||
- port: "21100"
|
||||
protocol: TCP
|
||||
- port: "21101"
|
||||
protocol: TCP
|
||||
- port: "21102"
|
||||
protocol: TCP
|
||||
- port: "21103"
|
||||
protocol: TCP
|
||||
- port: "21104"
|
||||
protocol: TCP
|
||||
- fromEntities:
|
||||
- world
|
||||
- host
|
||||
- remote-node
|
||||
toPorts:
|
||||
@@ -142,7 +158,7 @@ spec:
|
||||
- port: "21104"
|
||||
protocol: TCP
|
||||
---
|
||||
# Allow Syncthing peer-to-peer sync from the LAN/world.
|
||||
# Allow Syncthing peer-to-peer sync from Privat and VPN.
|
||||
# - 22000 TCP+QUIC: actual sync traffic between peers.
|
||||
# - 21027 UDP: local-discovery broadcast packets from peers on the LAN.
|
||||
# UI (8384) is intentionally NOT listed — authentik-gate-sync generates the
|
||||
@@ -157,8 +173,18 @@ spec:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: syncthing
|
||||
ingress:
|
||||
- fromCIDRSet:
|
||||
- cidrGroupRef: net-privat
|
||||
- cidrGroupRef: net-vpn
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "22000"
|
||||
protocol: TCP
|
||||
- port: "22000"
|
||||
protocol: UDP
|
||||
- port: "21027"
|
||||
protocol: UDP
|
||||
- fromEntities:
|
||||
- world
|
||||
- host
|
||||
- remote-node
|
||||
toPorts:
|
||||
|
||||
Reference in New Issue
Block a user