86 lines
5.3 KiB
Django/Jinja
86 lines
5.3 KiB
Django/Jinja
{# Desired VyOS config as `set` lines. vyos_config diffs these against the
|
|
running config, so only differences are applied. Written for VyOS 2025.11
|
|
syntax explicitly -- see defaults/main.yml for why we do not use the
|
|
collection's resource modules. #}
|
|
set system host-name {{ vyos_router_hostname }}
|
|
set system name-server {{ vyos_nameserver }}
|
|
|
|
{# --- LAN leg: OSPF peer with the NEC IX --- #}
|
|
set interfaces ethernet {{ vyos_lan_interface }} address {{ vyos_lan_address }}
|
|
set interfaces ethernet {{ vyos_lan_interface }} description 'LAN / OSPF to NEC IX'
|
|
|
|
{# --- SDN legs: gateways for the PVE VNets --- #}
|
|
{% for i in vyos_sdn_interfaces %}
|
|
set interfaces ethernet {{ i.iface }} address {{ i.address }}
|
|
set interfaces ethernet {{ i.iface }} description '{{ i.description }}'
|
|
{% endfor %}
|
|
|
|
{# OpenSandbox stays on a NodePort; VyOS owns the stable routed frontend. #}
|
|
set load-balancing haproxy service opensandbox-api listen-address {{ vyos_sandbox_k3s_api_address }}
|
|
set load-balancing haproxy service opensandbox-api port {{ vyos_opensandbox_api_port }}
|
|
set load-balancing haproxy service opensandbox-api mode 'tcp'
|
|
set load-balancing haproxy service opensandbox-api backend 'opensandbox-api'
|
|
set load-balancing haproxy backend opensandbox-api mode 'tcp'
|
|
{% for server in vyos_sandbox_k3s_servers %}
|
|
set load-balancing haproxy backend opensandbox-api server {{ server.name }} address {{ server.address }}
|
|
set load-balancing haproxy backend opensandbox-api server {{ server.name }} port {{ vyos_opensandbox_node_port }}
|
|
set load-balancing haproxy backend opensandbox-api server {{ server.name }} check
|
|
{% endfor %}
|
|
|
|
{# --- default route out; OSPF carries the rest --- #}
|
|
set protocols static route 0.0.0.0/0 next-hop {{ vyos_lan_gateway }}
|
|
|
|
{# --- OSPF: intra-area, NOT redistribute connected --- #}
|
|
set protocols ospf parameters router-id {{ vyos_ospf_router_id }}
|
|
{% for n in vyos_ospf_networks %}
|
|
set protocols ospf area {{ vyos_ospf_area }} network {{ n }}
|
|
{% endfor %}
|
|
{% for i in vyos_sdn_interfaces %}
|
|
set protocols ospf area {{ vyos_ospf_area }} network {{ i.network }}
|
|
{# passive: advertise the subnet, but never try to peer with guests on it #}
|
|
set protocols ospf interface {{ i.iface }} passive
|
|
{% endfor %}
|
|
|
|
{# --- K3s PostgreSQL datastore: fixed endpoint, explicitly selected primary --- #}
|
|
set load-balancing haproxy service sandbox-postgresql listen-address {{ vyos_postgresql_listen_address }}
|
|
set load-balancing haproxy service sandbox-postgresql port {{ vyos_postgresql_port }}
|
|
set load-balancing haproxy service sandbox-postgresql mode 'tcp'
|
|
set load-balancing haproxy service sandbox-postgresql backend 'sandbox-postgresql-primary'
|
|
set load-balancing haproxy backend sandbox-postgresql-primary mode 'tcp'
|
|
set load-balancing haproxy backend sandbox-postgresql-primary server primary address {{ vyos_postgresql_primary_address }}
|
|
set load-balancing haproxy backend sandbox-postgresql-primary server primary port {{ vyos_postgresql_port }}
|
|
set load-balancing haproxy backend sandbox-postgresql-primary server primary check
|
|
|
|
{# --- Sandbox K3s API: stable address with both control-plane nodes --- #}
|
|
set interfaces ethernet {{ vyos_sandbox_k3s_api_interface }} address '{{ vyos_sandbox_k3s_api_address }}/32'
|
|
set load-balancing haproxy service sandbox-k3s-api listen-address {{ vyos_sandbox_k3s_api_address }}
|
|
set load-balancing haproxy service sandbox-k3s-api port {{ vyos_sandbox_k3s_api_port }}
|
|
set load-balancing haproxy service sandbox-k3s-api mode 'tcp'
|
|
set load-balancing haproxy service sandbox-k3s-api backend 'sandbox-k3s-api'
|
|
set load-balancing haproxy backend sandbox-k3s-api mode 'tcp'
|
|
{% for server in vyos_sandbox_k3s_servers %}
|
|
set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} address {{ server.address }}
|
|
set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} port {{ vyos_sandbox_k3s_api_port }}
|
|
set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} check
|
|
{% endfor %}
|
|
|
|
{# --- management --- #}
|
|
set service ssh port 22
|
|
|
|
{# --- DHCP for the SDN VNets --- #}
|
|
{% for i in vyos_sdn_interfaces if i.dhcp is defined %}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} subnet-id {{ i.dhcp.subnet_id }}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} option default-router {{ i.address.split('/')[0] }}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} option name-server {{ vyos_dhcp_nameserver }}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} option domain-name {{ i.dhcp.domain }}
|
|
{% if i.dhcp.wins is defined %}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} option wins-server {{ i.dhcp.wins }}
|
|
{% endif %}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} range 0 start {{ i.dhcp.start }}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} range 0 stop {{ i.dhcp.stop }}
|
|
{% for r in i.dhcp.reservations | default([]) %}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} static-mapping {{ r.name }} mac {{ r.mac }}
|
|
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} static-mapping {{ r.name }} ip-address {{ r.address }}
|
|
{% endfor %}
|
|
{% endfor %}
|