README
¶
megarepo
Mega repo for General Programming business operations.
Folders
- automation/ - Ansible playbooks for automating deployments and managements to core systems and disposable fleet.
- common/ - Files shared between automation playbooks and other scripts.
- infrastructure/ - Dockerfiles and Ansible playbooks to setup "important" services
- nix/ - NixOS flake configs for physical/VM machines.
- serverless/ - Various webhooks that handle events fired by other services.
Points of Presence
We have many points of presence in our space.
- SEA420 - A single server colocated installed at Wobscale's (AS64241) colocation.
- SEA69 - @nepeat home network infrastructure.
- SEA4 - Komo Plaza, Seattle.
- FMT2 - Partnership with Lasagna, Ltd (AS208590) and many others with shared management of many resources.
- IAD2 - Oracle Cloud, Ashburn
- ORD1 - Oracle Cloud, Chicago
Vault setup
# Enable SSH secret engine and generate CA
vault secrets enable -path=ssh-client-signer ssh
vault write ssh-client-signer/config/ca generate_signing_key=true
# Create PKI engines.
vault secrets enable -path=pki_internal pki
vault secrets enable -path=pki_nomad pki
# Set PKI engine variables.
vault secrets tune -max-lease-ttl=43800h pki_internal
vault secrets tune -max-lease-ttl=43800h pki_nomad
# Create CSRs.
vault write -format=json pki_nomad/intermediate/generate/internal common_name="General Programming Nomad Intermediate Authority" ttl="43800h" | jq -r '.data.csr' > pki_nomad.csr
vault write -format=json pki_internal/intermediate/generate/internal common_name="General Programming Internal Services Intermediate Authority" ttl="43800h" | jq -r '.data.csr' > pki_internal.csr
# Create an internal root CA and sign the CSRs if no HSM.
vault secrets enable pki
vault secrets tune -max-lease-ttl=87600h pki
vault write -format=json pki/root/sign-intermediate csr=@pki_nomad.csr format=pem_bundle ttl="43800h" | jq -r '.data.certificate' > pki_nomad.cert.pem
vault write -format=json pki/root/sign-intermediate csr=@pki_internal.csr format=pem_bundle ttl="43800h" | jq -r '.data.certificate' > pki_internal.cert.pem
# Install the certificates.
vault write pki_nomad/intermediate/set-signed certificate=@pki_nomad.cert.pem
vault write pki_internal/intermediate/set-signed certificate=@pki_internal.cert.pem
# Setup roles
vault write pki_nomad/roles/nomad-cluster allowed_domains=global.nomad allow_subdomains=true max_ttl=86400s require_cn=false generate_lease=true
vault write pki_internal/roles/consul-fmt2-vault \
allowed_domains="fmt2-vault.consul" \
allow_subdomains=true \
generate_lease=true \
max_ttl="8766h"
vault write pki_internal/roles/genprog \
allowed_domains="generalprogramming.org" \
allow_subdomains=true \
generate_lease=true \
max_ttl="8766h"
# sops setup
vault secrets enable -path=sops transit
vault write sops/keys/firstkey type=rsa-4096
Directories
¶
| Path | Synopsis |
|---|---|
|
clients
|
|
|
infra_network_tunneler
module
|
|
|
go
|
|
|
client/netbox
Package netbox is a small read-only client for the NetBox GraphQL API.
|
Package netbox is a small read-only client for the NetBox GraphQL API. |
|
client/vault
Package vault is a read-only KV v2 secret reader over github.com/hashicorp/vault/api, honouring the standard environment plus the ~/.vault-token fallback and caching reads per process.
|
Package vault is a read-only KV v2 secret reader over github.com/hashicorp/vault/api, honouring the standard environment plus the ~/.vault-token fallback and caching reads per process. |
|
cmd/barf
command
Command barf is the read-only network config tool: it renders device configs from network.yml and compares them against what the fleet is running.
|
Command barf is the read-only network config tool: it renders device configs from network.yml and compares them against what the fleet is running. |
|
common/pytext
Package pytext provides Go equivalents of Python stdlib text primitives, each differentially validated against CPython: not "a line splitter" but *Python's*, byte-for-byte.
|
Package pytext provides Go equivalents of Python stdlib text primitives, each differentially validated against CPython: not "a line splitter" but *Python's*, byte-for-byte. |
|
pkg/barf/cli
Package cli is the barf command surface: a cobra tree over the model, render and device packages.
|
Package cli is the barf command surface: a cobra tree over the model, render and device packages. |
|
pkg/barf/device
Package device provides transports to network devices, split into a read surface (the default) and a separate, opt-in write surface.
|
Package device provides transports to network devices, split into a read surface (the default) and a separate, opt-in write surface. |
|
pkg/barf/firmware
Package firmware ports barf's image provider and firmware mirror (projects/barf/barf/util/images.py, .../firmware.py): the newest image for a device type, and where a device downloads it from.
|
Package firmware ports barf's image provider and firmware mirror (projects/barf/barf/util/images.py, .../firmware.py): the newest image for a device type, and where a device downloads it from. |
|
pkg/barf/lifecycle
Package lifecycle implements `barf device update` and `barf device cleanup`: image install, BGP drain, reboot, post-reboot routing verification, and old-image cleanup.
|
Package lifecycle implements `barf device update` and `barf device cleanup`: image install, BGP drain, reboot, post-reboot routing verification, and old-image cleanup. |
|
pkg/barf/model
Package model holds the network.yml fabric description: hosts, interfaces, the wireguard links between them, and global metadata.
|
Package model holds the network.yml fabric description: hosts, interfaces, the wireguard links between them, and global metadata. |
|
pkg/barf/prefetch
Package prefetch warms the secret cache before a fleet render, porting barf.util.render.prefetch_link_keys: a host needs the WireGuard keypairs of BOTH sides of each link, and fetching them serially dominates render time.
|
Package prefetch warms the secret cache before a fleet render, porting barf.util.render.prefetch_link_keys: a host needs the WireGuard keypairs of BOTH sides of each link, and fetching them serially dominates render time. |
|
pkg/barf/progress
Package progress renders live byte-transfer progress for the long, silent steps of `barf device update`: the ~700MB firmware download and the mirror upload of the same bytes.
|
Package progress renders live byte-transfer progress for the long, silent steps of `barf device update`: the ~700MB firmware download and the mirror upload of the same bytes. |
|
pkg/barf/render
Package render turns a parsed network.yml host into device config text.
|
Package render turns a parsed network.yml host into device config text. |
|
pkg/barf/scope
Package scope compares a device against ONLY the slice of its config that barf manages.
|
Package scope compares a device against ONLY the slice of its config that barf manages. |
|
pkg/barf/sshx
Package sshx is the SSH transport the device-lifecycle commands run on, porting barf/util/ssh.py and barf/util/vyos_scripts.py.
|
Package sshx is the SSH transport the device-lifecycle commands run on, porting barf/util/ssh.py and barf/util/vyos_scripts.py. |
|
pkg/barf/tui
Package tui holds the Bubble Tea interfaces for the read-only barf commands.
|
Package tui holds the Bubble Tea interfaces for the read-only barf commands. |
|
pkg/barf/vendor
Package vendor says what barf can do to each kind of device: one table, one row per devicetype, composing render/device/scope rather than replacing them.
|
Package vendor says what barf can do to each kind of device: one table, one row per devicetype, composing render/device/scope rather than replacing them. |
|
pkg/barf/vyosconfig
Package vyosconfig parses and diffs VyOS configuration as path sets, a port of barf/util/vyos_config.py.
|
Package vyosconfig parses and diffs VyOS configuration as path sets, a port of barf/util/vyos_config.py. |
|
pkg/barf/vyoswire
Package vyoswire is the VyOS HTTPS API wire protocol and nothing else: a form-POST of `data` (a JSON op) plus `key`, answered by a {success, data, error} envelope.
|
Package vyoswire is the VyOS HTTPS API wire protocol and nothing else: a form-POST of `data` (a JSON op) plus `key`, answered by a {success, data, error} envelope. |
|
libs
|
|
|
gocommon
module
|
|
|
projects
|
|
|
go-at-logstream
module
|
|
|
services
|
|
|
archiveteam/go-at-logstream
module
|
|
|
infra_network_tunneler
module
|
Click to show internal directories.
Click to hide internal directories.