Differences

This shows you the differences between two versions of the page.

--- infrastructure:servers:chaosknoten [2023-08-10 23:09 UTC] – julian
+++ infrastructure:servers:chaosknoten [2025-05-20 17:26 UTC] (current) – fix SSH jump-host config jtbx
@@ Line 2: / Line 2: @@
 ---- dataentry server ----
-hostname:     chaosknoten
+hostname    : chaosknoten
-location:     IRZ42
+location    : IRZ42
-maintainers:  @@Maintainers@@
+maintainers : Infra-Team
-netbox_url:   https://netbox.ccchh.net/dcim/devices/40/
+netbox_url  : https://netbox.hamburg.ccc.de/dcim/devices/40/
 ----
 <WRAP column half>
@@ Line 56: / Line 57: @@
     * von hinten gesehen rechter Port
     * rotes Patchkabel zu Switchport 18
-  * IPMI-iDRAC-Interface:
-    * 1G Kupfer
-    * verbunden mit IRZ42-Netz VLAN 512 (aber bei uns ungetaggt)
-    * Switchport 17, aber kein Patchkabel gesteckt, weil (noch) keine Firewall
 ''eno3'' und ''eno4'' sind jeweils auf ''vmbr3'' und ''vmbr4'' gebridged.
@@ Line 66: / Line 63: @@
 DIe VMs haben Adressen aus verschiedenen Netzen. Siehe [[https://netbox.ccchh.net/ipam/prefixes/?site_id=2|Netbox Prefixes IRZ42]]
+==== IPMI-iDRAC-Interface ====
+  * 1G Kupfer
+  * verbunden mit ''ipmi-vpn.zs64.net'', ein EdgeRouter X mit OpenWrt, der 6 HE höher hängt (hinter lokschuppen und jachthafen)
+  * Wireguard-Config liegt in Pass unter ''noc/server/chaosknoten-ipmi/wireguard''
+  * Zugang zum Router liegt in Pass unter ''noc/server/zs64-ipmi/root''
+  * Hostname ''chaosknoten-ipmi.hamburg.ccc.de'' / 44.128.124.4
+==== IPv4 ====
+=== Public IPv4s ===
+We have the following public IPv4 subnets/ranges available:
+  * ''212.12.50.208/29'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/13/|NetBox-Link]])
+  * ''212.12.51.128/28'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/15/|NetBox-Link]])
+  * ''212.12.48.122-126/24'' ([[https://netbox.hamburg.ccc.de/ipam/ip-ranges/7/|NetBox-Link]]), part of ''212.12.48.0/24'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/12/|NetBox-Link]])
+=== Private IPv4s ===
+We use the following private IPv4 ranges:
+  * ''172.31.17.128/25'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/37/|NetBox-Link]])
+  * ''172.31.17.0/25'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/16/|NetBox-Link]])
+==== IPv6 ====
+We have 2 IPv6-64-Prefixes, which map to corresponding IPv4-Prefixes/-Ranges.
+=== 2a00:14b0:4200:3000::/64 ===
+''2a00:14b0:4200:3000::/64'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/36/|NetBox-Link]])\\
+This subnet corresponds to the following IPv4-Subnets:
+  * ''212.12.48.0/24'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/12/|NetBox-Link]])
+To generate an IPv6 corresponding to an IPv4, we use the following convention: Take the last octet of the IPv4-address in decimal and use it for the first two bytes of the localpart, but with the digits as hex.\\
+So e.g.: ''212.12.48.125'' -> ''2a00:14b0:4200:3000:125::1''
+=== 2a00:14b0:f000:23::/64 ===
+''2a00:14b0:f000:23::/64'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/35/|NetBox-Link]])\\
+This subnet corresponds to the following IPv4-Subnets:
+  * ''212.12.50.208/29'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/13/|NetBox-Link]])
+  * ''212.12.51.128/28'' ([[https://netbox.hamburg.ccc.de/ipam/prefixes/15/|NetBox-Link]])
+To generate an IPv6 corresponding to an IPv4 from either ''212.12.50.208/29'' or ''212.12.51.128/28'', we use the following convention: Take the 3rd octet of the IPv4-address in decimal and use it for the first two bytes of the localpart, but with the digits in hex. Then take the last octet of the IPv4-address in decimal and use it for the third and fourth bytes of the localpart, but with the digits as hex.\\
+So e.g.:
+  * ''212.12.50.212'' -> ''2a00:14b0:f000:23:50:212:0:1''
+  * ''212.12.51.133'' -> ''2a00:14b0:f000:23:51:133:0:1''
+To generate an IPv6 corresponding to an IPv4 from ''172.31.17.0/25'', we use the following convention: Take the last octet of the IPv4-address in decimal and use it for the last two bytes of the localpart, but with the digits in hex.\\
+So e.g.:
+  * ''172.31.17.53'' -> ''2a00:14b0:f000:23::53''
 ===== Konfiguration =====
@@ Line 76: / Line 128: @@
 <code>
+Host ccchh-jumphost
+    User chaos
+    Hostname public-reverse-proxy.hamburg.ccc.de
+Host *-intern.hamburg.ccc.de
+    User chaos
+    ProxyJump ccchh-jumphost
 Host turing
     HostName turing.hamburg.ccc.de
@@ Line 85: / Line 145: @@
     Port 42666
     User chaos
+</code>
-Host ns-intern
-    HostName ns-intern.hamburg.ccc.de
-    User chaos
-    ProxyJump turing
-Host rproxy-intern
+===== HOWTO Chaosknoten-Reboot =====
-    HostName rproxy-intern.hamburg.ccc.de
-    User chaos
+==== Vor dem Reboot ====
-    ProxyJump turing
-</code>
+=== VMs hibernaten ===
+Eine Reihe von VMs brauchen beim Booten ein Secret über die Konsole, z. B. für LUKS. Wenn man das nicht machen will, kann mann die betreffenden VMs in den Winterschlaf schicken. Wir haben alle VMs, für die das notwendig ist, mit dem Tag "luks" markiert.
+  # ./suspend-luks-vms.sh
+==== Nach dem Reboot ====
+Was nach einem reboot alles passieren muss, damit alle services wieder hochkommen.
+=== ZFS encrypted Dataset entsperren ===
+Key liegt im pass unter ''noc/server/chaosknoten/zfs/rust0-encrypted-passphrase''
+  zfs load-key rust0/encrypted
 ===== Assigned Services =====