Update workstation installation guide

Fix typos in Init script
FIx to work in WSL
2025-09-04 05:43:21 +00:00 · 2025-09-01 16:30:51 +03:00 · 2025-09-01 15:56:52 +03:00 · 2025-09-01 15:49:37 +03:00 · 2025-09-01 15:39:42 +03:00 · 2025-09-01 15:33:12 +03:00
25 changed files with 973 additions and 799 deletions
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,6 +1,5 @@
 {
    "files.trimTrailingWhitespace": true,
    "files.insertFinalNewline": true,
-    "files.trimFinalNewlines": true,
    "editor.renderFinalNewline": false
 }
--- a/INSTRUCTIONS.md
+++ b/INSTRUCTIONS.md
@@ -1,7 +1,28 @@
 # Tietojärjestelmäasentajien Infra
-## PVJJK 1.VOS TJAS - Infra
+## PVJJK 1.VOS Niinisalo
 ### Ylläpitäjän ohjeet

+**Työaseman asennus**
+1. Asenna Windows Subsystem for Linux vaihtoehtoisista järjestelmäominaisuuksista.
+2. Käynnistä työasema uudelleen
+3. Asenna Debian käyttöjärjestelmä
+    1. Avaa Powershell järjestelmänvalvojana
+    2. Suorita asennuskomento – `wsl --install -d Debian`
+    3. Aseta käyttäjätunnukseksi `asentaja` ja salasanaksi sama kuin työaseman Windows käyttäjän salasana.
+    4. Vaihda isännän nimi
+        1. Lisää Network kohtaan tai luo Network kohta – `echo "[network]" > /etc/wsl.conf`
+        2. Lisää isännän nimi – `echo "hostname = argo.aito.tjas" > /etc/wsl.conf`
+        3. Lisää Hosts tiedoston generointi – `echo "generateHosts = true" > /etc/wsl.conf`
+    5. Sulje ikkuna
+4. Aseta Debian oletusarvoiseksi käyttöjärjestelmäksi ja käynnistä se uudelleen
+    1. Avaa Powershell järjestelmänvalvojana
+    2. Vaihda oletusarvoinen käyttöjärjestelmä – `wsl --set-default Debian`
+    3. Käynnistä uudelleen käyttöjärjestelmä – `wsl -t Debian`
+    4. Sulje ikkuna
+6. Avaa Debian käynnistävalikosta tai suorita Powershellissä komento järjestelmänvalvojana `wsl -d Debian`
+7. Asenna curl-paketti käyttämällä APT-paketinhallintaa – `sudo apt update && sudo apt install curl`
+8. Lataa ja suorita Init.sh skripti – `bash <(curl https://raw.githubusercontent.com/cwchristerw/tjas-infra/refs/heads/master/init.sh)`
+
 **Palvelimen asennus**
 1. Asenna Debian-käyttöjärjestelmä
 2. Asenna curl-paketti käyttämällä APT-paketinhallintaa – `apt update && apt install curl`
@@ -14,12 +35,12 @@

 r1.net.tjas
 ```
+!
 version 12.4
 service timestamps debug datetime msec
 service timestamps log datetime msec
 no service password-encryption
 !
-!
 hostname r1.net.tjas
 !
 boot-start-marker
@@ -62,27 +83,35 @@ interface FastEthernet0/1.10
 description "TINU - INTERNET"
 encapsulation dot1Q 10
 ip address 192.168.1.1 255.255.255.224
+ ip access-group 10 out
 ip helper-address 192.168.2.10
+ ip nat inside
 no snmp trap link-status
 !
 interface FastEthernet0/1.20
 description "JUVA - INTRA"
 encapsulation dot1Q 20
 ip address 192.168.2.1 255.255.255.224
+ ip access-group 20 out
 ip helper-address 192.168.2.10
+ ip nat inside
 no snmp trap link-status
 !
 interface FastEthernet0/1.30
 description "AITO - TOIMISTO"
 encapsulation dot1Q 30
 ip address 192.168.3.1 255.255.255.224
+ ip access-group 30 out
 ip helper-address 192.168.2.10
+ ip nat inside
 no snmp trap link-status
 !
 interface FastEthernet0/1.69
 description "SIVE - HALLINTA"
 encapsulation dot1Q 69
 ip address 192.168.69.1 255.255.255.192
+ ip access-group 69 in
+ ip access-group 69 out
 ip helper-address 192.168.69.20
 no snmp trap link-status
 !
@@ -94,10 +123,43 @@ interface GigabitEthernet0/0/0
 ip classless
 !
 ip http server
+ip nat inside source list 1 interface FastEthernet0/0 overload
 !
+access-list 1 permit 192.168.1.0 0.0.0.31
+access-list 1 permit 192.168.2.0 0.0.0.31
+access-list 1 permit 192.168.3.0 0.0.0.31
+access-list 10 deny   192.168.0.0 0.0.255.255
+access-list 10 permit any
+access-list 20 permit 192.168.2.0 0.0.0.31
+access-list 20 deny   192.168.0.0 0.0.255.255
+access-list 20 permit any
+access-list 30 permit 192.168.2.10
+access-list 30 permit 192.168.3.0 0.0.0.31
+access-list 30 deny   192.168.0.0 0.0.255.255
+access-list 30 permit any
+access-list 69 permit 192.168.69.0 0.0.0.63
 !
 control-plane
 !
+banner motd ^C
+
+
+
+  .-') _               ('-.      .-')
+ (  OO) )             ( OO ).-. ( OO ).
+ /     '._      ,--.  / . --. /(_)---\_)
+ |'--...__) .-')| ,|  | \-.  \ /    _ |
+ '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
+    |  |   | `-'|  | \| |_.'  | '..`''.)
+    |  |   ,--. |  |  |  .-.  |.-._)   \
+    |  |   |  '-'  /  |  | |  |\       /
+    `--'    `-----'   `--' `--' `-----'
+
+
+ PVJJK 1.VOS NIINISALO
+ r1.net.tjas
+
+^C
 !
 line con 0
 line aux 0
@@ -113,11 +175,13 @@ end
 s1.net.tjas
 ```
 hostname "s1.net.tjas"
+ip default-gateway 192.168.1.1
 snmp-server community "public" Unrestricted
 vlan 1
   name "DEFAULT_VLAN"
-   untagged 1-52
+   untagged 4-52
   ip address dhcp-bootp
+   no untagged 1-3
   exit
 vlan 10
   name "TINU"
@@ -140,6 +204,24 @@ vlan 69
   tagged 1-3
   exit
 ip authorized-managers 192.168.69.20 255.255.255.255
+banner motd "
+
+
+  .-') _               ('-.      .-')
+ (  OO) )             ( OO ).-. ( OO ).
+ /     '._      ,--.  / . --. /(_)---\_)
+ |'--...__) .-')| ,|  | \-.  \ /    _ |
+ '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
+    |  |   | `-'|  | \| |_.'  | '..`''.)
+    |  |   ,--. |  |  |  .-.  |.-._)   \
+    |  |   |  '-'  /  |  | |  |\       /
+    `--'    `-----'   `--' `--' `-----'
+
+
+ PVJJK 1.VOS NIINISALO
+ s1.net.tjas
+
+"
 ip ssh
 password manager
 ```
@@ -147,16 +229,83 @@ password manager
 s2.net.tjas
 ```
 hostname "s2.net.tjas"
+interface 3
+   disable
+exit
+interface 4
+   disable
+exit
+interface 5
+   disable
+exit
+interface 6
+   disable
+exit
+interface 7
+   disable
+exit
+interface 8
+   disable
+exit
+interface 9
+   disable
+exit
+interface 10
+   disable
+exit
+interface 11
+   disable
+exit
+interface 12
+   disable
+exit
+interface 13
+   disable
+exit
+interface 14
+   disable
+exit
+interface 15
+   disable
+exit
+interface 16
+   disable
+exit
+interface 17
+   disable
+exit
+interface 18
+   disable
+exit
+interface 19
+   disable
+exit
+interface 20
+   disable
+exit
+interface 21
+   disable
+exit
+interface 22
+   disable
+exit
+interface 23
+   disable
+exit
+interface 24
+   disable
+exit
+ip default-gateway 192.168.2.1
 snmp-server community "public" Unrestricted
 vlan 1
   name "DEFAULT_VLAN"
-   untagged 25-28
+   untagged 3-28
   ip address dhcp-bootp
-   no untagged 1-24
+   no untagged 1-2
   exit
 vlan 20
   name "JUVA"
-   untagged 2-24
+   untagged 3-24
   ip address 192.168.2.2 255.255.255.224
   tagged 1-2
   exit
@@ -165,7 +314,25 @@ vlan 69
   ip address 192.168.69.12 255.255.255.192
   tagged 1-2
   exit
-ip authorized-managers 192.168.69.20 255.255.255.255
+ip authorized-managers 192.168.69.20
+banner motd "
+
+
+  .-') _               ('-.      .-')
+ (  OO) )             ( OO ).-. ( OO ).
+ /     '._      ,--.  / . --. /(_)---\_)
+ |'--...__) .-')| ,|  | \-.  \ /    _ |
+ '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
+    |  |   | `-'|  | \| |_.'  | '..`''.)
+    |  |   ,--. |  |  |  .-.  |.-._)   \
+    |  |   |  '-'  /  |  | |  |\       /
+    `--'    `-----'   `--' `--' `-----'
+
+
+ PVJJK 1.VOS NIINISALO
+ s2.net.tjas
+
+"
 ip ssh
 password manager
 ```
@@ -173,6 +340,40 @@ password manager
 s3.net.tjas
 ```
 hostname "s3.net.tjas"
+interface 2
+   disable
+exit
+interface 3
+   disable
+exit
+interface 4
+   disable
+exit
+interface 5
+   disable
+exit
+interface 6
+   disable
+exit
+interface 7
+   disable
+exit
+interface 8
+   disable
+exit
+interface 9
+   disable
+exit
+interface 10
+   disable
+exit
+interface 11
+   disable
+exit
+interface 12
+   disable
+exit
+ip default-gateway 192.168.3.1
 snmp-server community "public" Unrestricted
 vlan 1
   name "DEFAULT_VLAN"
@@ -182,9 +383,9 @@ vlan 1
   exit
 vlan 30
   name "AITO"
+   untagged 13-24
   ip address 192.168.3.2 255.255.255.224
-   tagged 1,13-24
-   untagged
+   tagged 1
   exit
 vlan 69
   name "SIVE"
@@ -192,7 +393,31 @@ vlan 69
   ip address 192.168.69.13 255.255.255.192
   tagged 1
   exit
-ip authorized-managers 192.168.69.20 255.255.255.255
+ip authorized-managers 192.168.69.20
+banner motd "
+
+
+  .-') _               ('-.      .-')
+ (  OO) )             ( OO ).-. ( OO ).
+ /     '._      ,--.  / . --. /(_)---\_)
+ |'--...__) .-')| ,|  | \-.  \ /    _ |
+ '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
+    |  |   | `-'|  | \| |_.'  | '..`''.)
+    |  |   ,--. |  |  |  .-.  |.-._)   \
+    |  |   |  '-'  /  |  | |  |\       /
+    `--'    `-----'   `--' `--' `-----'
+
+
+ PVJJK 1.VOS NIINISALO
+ s3.net.tjas
+
+"
 ip ssh
 password manager
 ```
+
+# LÄHTEET
+
+## ISSUE - ASCII ART
+ASCII Art Generator
+https://www.textmods.com/ascii-art
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 # Tietojärjestelmäasentajien Infra
-## PVJJK 1.VOS TJAS - Infra
+## PVJJK 1.VOS NIINISALO

 Infran toteutus aloitettiin vuonna 2025 ja sen on suunnitellut [Jääkäri Warén](https://christerwaren.fi).

--- a/ansible.cfg
+++ b/ansible.cfg
@@ -1,5 +1,5 @@
 [defaults]
-inventory = inventories/pvjjk-1vos-tjas
+inventory = inventories/pvjjk-1vos-niinisalo
 hash_behaviour = merge
 gathering = smart
 display_skipped_hosts = false
--- a/files/dhcp/dhcpd.conf
+++ b/files/dhcp/dhcpd.conf
@@ -1,190 +0,0 @@
-# dhcpd.conf
-#
-# Sample configuration file for ISC dhcpd
-#
-
-# option definitions common to all supported networks...
-option domain-name "intra.tjas";
-option domain-name-servers 192.168.2.10;
-
-default-lease-time 600;
-max-lease-time 7200;
-
-# The ddns-updates-style parameter controls whether or not the server will
-# attempt to do a DNS update when a lease is confirmed. We default to the
-# behavior of the version 2 packages ('none', since DHCP v2 didn't
-# have support for DDNS.)
-ddns-update-style none;
-
-# If this DHCP server is the official DHCP server for the local
-# network, the authoritative directive should be uncommented.
-authoritative;
-
-# Use this to send dhcp log messages to a different log file (you also
-# have to hack syslog.conf to complete the redirection).
-#log-facility local7;
-
-# No service will be given on this subnet, but declaring it helps the
-# DHCP server to understand the network topology.
-
-#subnet 10.152.187.0 netmask 255.255.255.0 {
-#}
-
-# This is a very basic subnet declaration.
-
-#subnet 10.254.239.0 netmask 255.255.255.224 {
-#  range 10.254.239.10 10.254.239.20;
-#  option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
-#}
-
-# This declaration allows BOOTP clients to get dynamic addresses,
-# which we don't really recommend.
-
-#subnet 10.254.239.32 netmask 255.255.255.224 {
-#  range dynamic-bootp 10.254.239.40 10.254.239.60;
-#  option broadcast-address 10.254.239.31;
-#  option routers rtr-239-32-1.example.org;
-#}
-
-# A slightly different configuration for an internal subnet.
-#subnet 10.5.5.0 netmask 255.255.255.224 {
-#  range 10.5.5.26 10.5.5.30;
-#  option domain-name-servers ns1.internal.example.org;
-#  option domain-name "internal.example.org";
-#  option routers 10.5.5.1;
-#  option broadcast-address 10.5.5.31;
-#  default-lease-time 600;
-#  max-lease-time 7200;
-#}
-
-# Hosts which require special configuration options can be listed in
-# host statements.   If no address is specified, the address will be
-# allocated dynamically (if possible), but the host-specific information
-# will still come from the host declaration.
-
-#host passacaglia {
-#  hardware ethernet 0:0:c0:5d:bd:95;
-#  filename "vmunix.passacaglia";
-#  server-name "toccata.example.com";
-#}
-
-# Fixed IP addresses can also be specified for hosts.   These addresses
-# should not also be listed as being available for dynamic assignment.
-# Hosts for which fixed IP addresses have been specified can boot using
-# BOOTP or DHCP.   Hosts for which no fixed address is specified can only
-# be booted with DHCP, unless there is an address range on the subnet
-# to which a BOOTP client is connected which has the dynamic-bootp flag
-# set.
-#host fantasia {
-#  hardware ethernet 08:00:07:26:c0:a5;
-#  fixed-address fantasia.example.com;
-#}
-
-# You can declare a class of clients and then do address allocation
-# based on that.   The example below shows a case where all clients
-# in a certain class get addresses on the 10.17.224/24 subnet, and all
-# other clients get addresses on the 10.0.29/24 subnet.
-
-#class "foo" {
-#  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
-#}
-
-#shared-network 224-29 {
-#  subnet 10.17.224.0 netmask 255.255.255.0 {
-#    option routers rtr-224.example.org;
-#  }
-#  subnet 10.0.29.0 netmask 255.255.255.0 {
-#    option routers rtr-29.example.org;
-#  }
-#  pool {
-#    allow members of "foo";
-#    range 10.17.224.10 10.17.224.250;
-#  }
-#  pool {
-#    deny members of "foo";
-#    range 10.0.29.10 10.0.29.230;
-#  }
-#}
-
-subnet 192.168.1.0 netmask 255.255.255.240 {
-    range 192.168.1.2 192.168.1.14;
-    option routers 192.168.1.1;
-    option broadcast-address 192.168.1.15;
-
-    host r1.net.tjas {
-        hardware ethernet 00:1d:46:dc:80:09;
-        fixed-address 192.168.1.1;
-    }
-
-    host s1.net.tjas {
-        hardware ethernet 9c:8e:99:9b:c3:80;
-        fixed-address 192.168.1.2;
-    }
-}
-
-subnet 192.168.2.0 netmask 255.255.255.224 {
-    range 192.168.2.2 192.168.2.30;
-    option routers 192.168.2.1;
-    option broadcast-address 192.168.2.31;
-
-    host r1.net.tjas {
-        hardware ethernet 00:1d:46:dc:80:09;
-        fixed-address 192.168.2.1;
-    }
-
-    host s2.net.tjas {
-        hardware ethernet 00:24:a8:f1:c7:40;
-        fixed-address 192.168.2.2;
-    }
-
-    host olympus.intra.tjas {
-        hardware ethernet 90:1b:0e:5b:18:fa;
-        fixed-address 192.168.2.10;
-    }
-}
-
-subnet 192.168.3.0 netmask 255.255.255.224 {
-    range 192.168.3.2 192.168.3.30;
-    option routers 192.168.3.1;
-    option broadcast-address 192.168.3.31;
-
-    host r1.net.tjas {
-        hardware ethernet 00:1d:46:dc:80:09;
-        fixed-address 192.168.3.1;
-    }
-
-    host s3.net.tjas {
-        hardware ethernet 00:1f:fe:ab:9e:c0;
-        fixed-address 192.168.3.2;
-    }
-}
-
-subnet 192.168.69.0 netmask 255.255.255.192 {
-    range 192.168.69.2 192.168.69.62;
-    option broadcast-address 192.168.69.63;
-
-    host r1.net.tjas {
-        hardware ethernet 00:1d:46:dc:80:09;
-        fixed-address 192.168.69.1;
-    }
-
-    host s1.net.tjas {
-        hardware ethernet 9c:8e.99:9b:c3:80;
-        fixed-address 192.168.3.11;
-    }
-
-    host s2.net.tjas {
-        hardware ethernet 00:24:a8:f1:c7:40;
-        fixed-address 192.168.3.12;
-    }
-
-    host s3.net.tjas {
-        hardware ethernet 00:1f:fe:ab:9e:c0;
-        fixed-address 192.168.3.13;
-    }
-
-    host olympus.intra.tjas {
-        hardware ethernet 90:1b:0e:5b:18:fa;
-        fixed-address 192.168.69.20;
-    }
-}
--- a/files/dnsdist/config.conf
+++ b/files/dnsdist/config.conf
@@ -0,0 +1,12 @@
+setLocal('0.0.0.0:53')
+addLocal('[::]:53')
+setACL({'0.0.0.0/0', '::/0'})
+setECSOverride(true)
+setECSSourcePrefixV4(32)
+setECSSourcePrefixV6(128)
+newServer({address='127.0.0.1:531', useClientSubnet=true, pool='authorative'})
+newServer({ address='127.0.0.1:532', useClientSubnet=true, pool='recursor' })
+addAction('tjas', PoolAction('authorative'))
+addAction(AllRule(), PoolAction('recursor'))
+setSecurityPollSuffix("")
+setServFailWhenNoServer(true)
--- a/files/issue
+++ b/files/issue
@@ -0,0 +1,25 @@
+
+
+
+ .-') _               ('-.      .-')
+(  OO) )             ( OO ).-. ( OO ).
+/     '._      ,--.  / . --. /(_)---\_)
+|'--...__) .-')| ,|  | \-.  \ /    _ |
+'--.  .--'( OO |(_|.-'-'  |  |\  :` `.
+   |  |   | `-'|  | \| |_.'  | '..`''.)
+   |  |   ,--. |  |  |  .-.  |.-._)   \
+   |  |   |  '-'  /  |  | |  |\       /
+   `--'    `-----'   `--' `--' `-----'
+
+
+PVJJK 1.VOS NIINISALO
+TIETOJÄRJESTELMÄASENTAJIEN INTRA
+olympus.juva.tjas
+
+Made by
+Jääkäri Warén
+https://christerwaren.fi
+
+
+
+
--- a/files/kea/kea-dhcp4.conf
+++ b/files/kea/kea-dhcp4.conf
@@ -1,91 +1,20 @@
-// This is a basic configuration for the Kea DHCPv4 server. Subnet declarations
-// are mostly commented out and no interfaces are listed. Therefore, the servers
-// will not listen or respond to any queries.
-// The basic configuration must be extended to specify interfaces on which
-// the servers should listen. There are a number of example options defined.
-// These probably don't make any sense in your network. Make sure you at least
-// update the following, before running this example in your network:
-// - change the network interface names
-// - change the subnets to match your actual network
-// - change the option values to match your network
-//
-// This is just a very basic configuration. Kea comes with large suite (over 30)
-// of configuration examples and extensive Kea User's Guide. Please refer to
-// those materials to get better understanding of what this software is able to
-// do. Comments in this configuration file sometimes refer to sections for more
-// details. These are section numbers in Kea User's Guide. The version matching
-// your software should come with your Kea package, but it is also available
-// in ISC's Knowledgebase (https://kea.readthedocs.io; the direct link for
-// the stable version is https://kea.readthedocs.io/).
-//
-// This configuration file contains only DHCPv4 server's configuration.
-// If configurations for other Kea services are also included in this file they
-// are ignored by the DHCPv4 server.
 {
-
-// DHCPv4 configuration starts here. This section will be read by DHCPv4 server
-// and will be ignored by other components.
    "Dhcp4": {
-    // Add names of your network interfaces to listen on.
        "interfaces-config": {
-        // See section 8.2.4 for more details. You probably want to add just
-        // interface name (e.g. "eth0" or specific IPv4 address on that
-        // interface name (e.g. "eth0/192.0.2.1").
-        "interfaces": [ ]
-
-        // Kea DHCPv4 server by default listens using raw sockets. This ensures
-        // all packets, including those sent by directly connected clients
-        // that don't have IPv4 address yet, are received. However, if your
-        // traffic is always relayed, it is often better to use regular
-        // UDP sockets. If you want to do that, uncomment this line:
-        // "dhcp-socket-type": "udp"
+            "interfaces": [ "enp0s25.20" ]
        },
-
-    // Kea supports control channel, which is a way to receive management
-    // commands while the server is running. This is a Unix domain socket that
-    // receives commands formatted in JSON, e.g. config-set (which sets new
-    // configuration), config-reload (which tells Kea to reload its
-    // configuration from file), statistic-get (to retrieve statistics) and many
-    // more. For detailed description, see Sections 8.8, 16 and 15.
        "control-socket": {
            "socket-type": "unix",
            "socket-name": "/run/kea/kea4-ctrl-socket"
        },
-
-    // Use Memfile lease database backend to store leases in a CSV file.
-    // Depending on how Kea was compiled, it may also support SQL databases
-    // (MySQL and/or PostgreSQL). Those database backends require more
-    // parameters, like name, host and possibly user and password.
-    // There are dedicated examples for each backend. See Section 7.2.2 "Lease
-    // Storage" for details.
        "lease-database": {
-        // Memfile is the simplest and easiest backend to use. It's an in-memory
-        // C++ database that stores its state in CSV file.
-        "type": "memfile",
-        "lfc-interval": 3600
+            "type": "mysql",
+            "name": "{{ config.mariadb.users['kea'].database }}",
+            "user": "{{ config.mariadb.users['kea'].username }}",
+            "password": "{{ config.mariadb.users['kea'].password }}",
+            "host": "127.0.0.1",
+            "port": 3306
        },
-
-    // Kea allows storing host reservations in a database. If your network is
-    // small or you have few reservations, it's probably easier to keep them
-    // in the configuration file. If your network is large, it's usually better
-    // to use database for it. To enable it, uncomment the following:
-    // "hosts-database": {
-    //     "type": "mysql",
-    //     "name": "kea",
-    //     "user": "kea",
-    //     "password": "kea",
-    //     "host": "localhost",
-    //     "port": 3306
-    // },
-    // See Section 7.2.3 "Hosts storage" for details.
-
-    // Setup reclamation of the expired leases and leases affinity.
-    // Expired leases will be reclaimed every 10 seconds. Every 25
-    // seconds reclaimed leases, which have expired more than 3600
-    // seconds ago, will be removed. The limits for leases reclamation
-    // are 100 leases or 250 ms for a single cycle. A warning message
-    // will be logged if there are still expired leases in the
-    // database after 5 consecutive reclamation cycles.
        "expired-leases-processing": {
            "reclaim-timer-wait-time": 10,
            "flush-reclaimed-timer-wait-time": 25,
@@ -94,366 +23,208 @@
            "max-reclaim-time": 250,
            "unwarned-reclaim-cycles": 5
        },
-
-    // Global timers specified here apply to all subnets, unless there are
-    // subnet specific values defined in particular subnets.
        "renew-timer": 900,
        "rebind-timer": 1800,
        "valid-lifetime": 3600,
-
-    // Many additional parameters can be specified here:
-    // - option definitions (if you want to define vendor options, your own
-    //                       custom options or perhaps handle standard options
-    //                       that Kea does not support out of the box yet)
-    // - client classes
-    // - hooks
-    // - ddns information (how the DHCPv4 component can reach a DDNS daemon)
-    //
-    // Some of them have examples below, but there are other parameters.
-    // Consult Kea User's Guide to find out about them.
-
-    // These are global options. They are going to be sent when a client
-    // requests them, unless overwritten with values in more specific scopes.
-    // The scope hierarchy is:
-    // - global (most generic, can be overwritten by class, subnet or host)
-    // - class (can be overwritten by subnet or host)
-    // - subnet (can be overwritten by host)
-    // - host (most specific, overwrites any other scopes)
-    //
-    // Not all of those options make sense. Please configure only those that
-    // are actually useful in your network.
-    //
-    // For a complete list of options currently supported by Kea, see
-    // Section 7.2.8 "Standard DHCPv4 Options". Kea also supports
-    // vendor options (see Section 7.2.10) and allows users to define their
-    // own custom options (see Section 7.2.9).
-    "option-data": [
-        // When specifying options, you typically need to specify
-        // one of (name or code) and data. The full option specification
-        // covers name, code, space, csv-format and data.
-        // space defaults to "dhcp4" which is usually correct, unless you
-        // use encapsulate options. csv-format defaults to "true", so
-        // this is also correct, unless you want to specify the whole
-        // option value as long hex string. For example, to specify
-        // domain-name-servers you could do this:
-        // {
-        //     "name": "domain-name-servers",
-        //     "code": 6,
-        //     "csv-format": "true",
-        //     "space": "dhcp4",
-        //     "data": "192.0.2.1, 192.0.2.2"
-        // }
-        // but it's a lot of writing, so it's easier to do this instead:
-        {
-            "name": "domain-name-servers",
-            "data": "192.0.2.1, 192.0.2.2"
-        },
-
-        // Typically people prefer to refer to options by their names, so they
-        // don't need to remember the code names. However, some people like
-        // to use numerical values. For example, option "domain-name" uses
-        // option code 15, so you can reference to it either by
-        // "name": "domain-name" or "code": 15.
-        {
-            "code": 15,
-            "data": "example.org"
-        },
-
-        // Domain search is also a popular option. It tells the client to
-        // attempt to resolve names within those specified domains. For
-        // example, name "foo" would be attempted to be resolved as
-        // foo.mydomain.example.com and if it fails, then as foo.example.com
-        {
-            "name": "domain-search",
-            "data": "mydomain.example.com, example.com"
-        },
-
-        // String options that have a comma in their values need to have
-        // it escaped (i.e. each comma is preceded by two backslashes).
-        // That's because commas are reserved for separating fields in
-        // compound options. At the same time, we need to be conformant
-        // with JSON spec, that does not allow "\,". Therefore the
-        // slightly uncommon double backslashes notation is needed.
-
-        // Legal JSON escapes are \ followed by "\/bfnrt character
-        // or \u followed by 4 hexadecimal numbers (currently Kea
-        // supports only \u0000 to \u00ff code points).
-        // CSV processing translates '\\' into '\' and '\,' into ','
-        // only so for instance '\x' is translated into '\x'. But
-        // as it works on a JSON string value each of these '\'
-        // characters must be doubled on JSON input.
-        {
-            "name": "boot-file-name",
-            "data": "EST5EDT4\\,M3.2.0/02:00\\,M11.1.0/02:00"
-        },
-
-        // Options that take integer values can either be specified in
-        // dec or hex format. Hex format could be either plain (e.g. abcd)
-        // or prefixed with 0x (e.g. 0xabcd).
-        {
-            "name": "default-ip-ttl",
-            "data": "0xf0"
-        }
-
-        // Note that Kea provides some of the options on its own. In particular,
-        // it sends IP Address lease type (code 51, based on valid-lifetime
-        // parameter, Subnet mask (code 1, based on subnet definition), Renewal
-        // time (code 58, based on renew-timer parameter), Rebind time (code 59,
-        // based on rebind-timer parameter).
-    ],
-
-    // Other global parameters that can be defined here are option definitions
-    // (this is useful if you want to use vendor options, your own custom
-    // options or perhaps handle options that Kea does not handle out of the box
-    // yet).
-
-    // You can also define classes. If classes are defined, incoming packets
-    // may be assigned to specific classes. A client class can represent any
-    // group of devices that share some common characteristic, e.g. Windows
-    // devices, iphones, broken printers that require special options, etc.
-    // Based on the class information, you can then allow or reject clients
-    // to use certain subnets, add special options for them or change values
-    // of some fixed fields.
-    "client-classes": [
-        {
-            // This specifies a name of this class. It's useful if you need to
-            // reference this class.
-            "name": "voip",
-
-            // This is a test. It is an expression that is being evaluated on
-            // each incoming packet. It is supposed to evaluate to either
-            // true or false. If it's true, the packet is added to specified
-            // class. See Section 12 for a list of available expressions. There
-            // are several dozens. Section 8.2.14 for more details for DHCPv4
-            // classification and Section 9.2.19 for DHCPv6.
-            "test": "substring(option[60].hex,0,6) == 'Aastra'",
-
-            // If a client belongs to this class, you can define extra behavior.
-            // For example, certain fields in DHCPv4 packet will be set to
-            // certain values.
-            "next-server": "192.0.2.254",
-            "server-hostname": "hal9000",
-            "boot-file-name": "/dev/null"
-
-            // You can also define option values here if you want devices from
-            // this class to receive special options.
-        }
-    ],
-
-    // Another thing possible here are hooks. Kea supports a powerful mechanism
-    // that allows loading external libraries that can extract information and
-    // even influence how the server processes packets. Those libraries include
-    // additional forensic logging capabilities, ability to reserve hosts in
-    // more flexible ways, and even add extra commands. For a list of available
-    // hook libraries, see https://gitlab.isc.org/isc-projects/kea/wikis/Hooks-available.
-    // "hooks-libraries": [
-    //   {
-    //       // Forensic Logging library generates forensic type of audit trail
-    //       // of all devices serviced by Kea, including their identifiers
-    //       // (like MAC address), their location in the network, times
-    //       // when they were active etc.
-    //       "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_legal_log.so",
-    //       "parameters": {
-    //           "path": "/var/lib/kea",
-    //           "base-name": "kea-forensic4"
-    //       }
-    //   },
-    //   {
-    //       // Flexible identifier (flex-id). Kea software provides a way to
-    //       // handle host reservations that include addresses, prefixes,
-    //       // options, client classes and other features. The reservation can
-    //       // be based on hardware address, DUID, circuit-id or client-id in
-    //       // DHCPv4 and using hardware address or DUID in DHCPv6. However,
-    //       // there are sometimes scenario where the reservation is more
-    //       // complex, e.g. uses other options that mentioned above, uses part
-    //       // of specific options or perhaps even a combination of several
-    //       // options and fields to uniquely identify a client. Those scenarios
-    //       // are addressed by the Flexible Identifiers hook application.
-    //       "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_flex_id.so",
-    //       "parameters": {
-    //           "identifier-expression": "relay4[2].hex"
-    //       }
-    //   }
-    // ],
-
-    // Below an example of a simple IPv4 subnet declaration. Uncomment to enable
-    // it. This is a list, denoted with [ ], of structures, each denoted with
-    // { }. Each structure describes a single subnet and may have several
-    // parameters. One of those parameters is "pools" that is also a list of
-    // structures.
        "subnet4": [
            {
-            // This defines the whole subnet. Kea will use this information to
-            // determine where the clients are connected. This is the whole
-            // subnet in your network. This is mandatory parameter for each
-            // subnet.
-            "subnet": "192.0.2.0/24",
-
-            // Pools define the actual part of your subnet that is governed
-            // by Kea. Technically this is optional parameter, but it's
-            // almost always needed for DHCP to do its job. If you omit it,
-            // clients won't be able to get addresses, unless there are
-            // host reservations defined for them.
-            "pools": [ { "pool": "192.0.2.1 - 192.0.2.200" } ],
-
-            // These are options that are subnet specific. In most cases,
-            // you need to define at least routers option, as without this
-            // option your clients will not be able to reach their default
-            // gateway and will not have Internet connectivity.
+                "id": 1,
+                "subnet": "192.168.1.0/27",
+                "pools": [
+                    {
+                        "pool": "192.168.1.1 - 192.168.1.30"
+                    }
+                ],
                "option-data": [
                    {
-                    // For each IPv4 subnet you most likely need to specify at
-                    // least one router.
                        "name": "routers",
-                    "data": "192.0.2.1"
+                        "data": "192.168.1.1"
+                    },
+                    {
+                        "name": "domain-name-servers",
+                        "data": "1.1.1.1"
+                    },
+                    {
+                        "name": "domain-search",
+                        "data": "puolustusvoimat.fi"
                    }
                ],
-
-            // Kea offers host reservations mechanism. Kea supports reservations
-            // by several different types of identifiers: hw-address
-            // (hardware/MAC address of the client), duid (DUID inserted by the
-            // client), client-id (client identifier inserted by the client) and
-            // circuit-id (circuit identifier inserted by the relay agent).
-            //
-            // Kea also support flexible identifier (flex-id), which lets you
-            // specify an expression that is evaluated for each incoming packet.
-            // Resulting value is then used for as an identifier.
-            //
-            // Note that reservations are subnet-specific in Kea. This is
-            // different than ISC DHCP. Keep that in mind when migrating
-            // your configurations.
+                "user-context": {
+                    "name": "Tinu",
+                    "purpose": "Internet"
+                },
                "reservations": [
-
-                // This is a reservation for a specific hardware/MAC address.
-                // It's a rather simple reservation: just an address and nothing
-                // else.
                    {
-                    "hw-address": "1a:1b:1c:1d:1e:1f",
-                    "ip-address": "192.0.2.201"
+                        "hw-address": "00:1d:46:dc:80:09",
+                        "ip-address": "192.168.1.1",
+                        "hostname": "r1.net.tjas"
                    },
-
-                // This is a reservation for a specific client-id. It also shows
-                // the this client will get a reserved hostname. A hostname can
-                // be defined for any identifier type, not just client-id.
                    {
-                    "client-id": "01:11:22:33:44:55:66",
-                    "ip-address": "192.0.2.202",
-                    "hostname": "special-snowflake"
+                        "hw-address": "9c:8e:99:9b:c3:80",
+                        "ip-address": "192.168.1.2",
+                        "hostname": "s1.net.tjas"
+                    }
+                ]
            },
-
-                // The third reservation is based on DUID. This reservation defines
-                // a special option values for this particular client. If the
-                // domain-name-servers option would have been defined on a global,
-                // subnet or class level, the host specific values take preference.
            {
-                    "duid": "01:02:03:04:05",
-                    "ip-address": "192.0.2.203",
-                    "option-data": [ {
-                        "name": "domain-name-servers",
-                        "data": "10.1.1.202, 10.1.1.203"
-                    } ]
-                },
-
-                // The fourth reservation is based on circuit-id. This is an option
-                // inserted by the relay agent that forwards the packet from client
-                // to the server.  In this example the host is also assigned vendor
-                // specific options.
-                //
-                // When using reservations, it is useful to configure
-                // reservations-global, reservations-in-subnet,
-                // reservations-out-of-pool (subnet specific parameters)
-                // and host-reservation-identifiers (global parameter).
+                "id": 2,
+                "subnet": "192.168.2.0/27",
+                "interface": "enp0s25.20",
+                "pools": [
                    {
-                    "client-id": "01:12:23:34:45:56:67",
-                    "ip-address": "192.0.2.204",
+                        "pool": "192.168.2.1 - 192.168.2.30"
+                    }
+                ],
                "option-data": [
                    {
-                            "name": "vivso-suboptions",
-                            "data": "4491"
+                        "name": "routers",
+                        "data": "192.168.2.1"
                    },
                    {
-                            "name": "tftp-servers",
-                            "space": "vendor-4491",
-                            "data": "10.1.1.202, 10.1.1.203"
+                        "name": "domain-name-servers",
+                        "data": "192.168.2.10, 1.1.1.1"
+                    },
+                    {
+                        "name": "domain-name",
+                        "data": "juva.tjas"
+                    },
+                    {
+                        "name": "domain-search",
+                        "data": "juva.tjas, tjas"
+                    }
+                ],
+                "user-context": {
+                    "name": "Juva",
+                    "purpose": "Intra"
+                },
+                "reservations": [
+                    {
+                        "hw-address": "00:1d:46:dc:80:09",
+                        "ip-address": "192.168.2.1",
+                        "hostname": "r1.net.tjas"
+                    },
+                    {
+                        "hw-address": "00:24:a8:f1:c7:40",
+                        "ip-address": "192.168.2.2",
+                        "hostname": "s2.net.tjas"
+                    },
+                    {
+                        "hw-address": "90:1b:0e:5b:18:fb",
+                        "ip-address": "192.168.2.10",
+                        "hostname": "olympus.juva.tjas"
                    }
                ]
            },
-                // This reservation is for a client that needs specific DHCPv4
-                // fields to be set. Three supported fields are next-server,
-                // server-hostname and boot-file-name
            {
-                    "client-id": "01:0a:0b:0c:0d:0e:0f",
-                    "ip-address": "192.0.2.205",
-                    "next-server": "192.0.2.1",
-                    "server-hostname": "hal9000",
-                    "boot-file-name": "/dev/null"
-                },
-                // This reservation is using flexible identifier. Instead of
-                // relying on specific field, sysadmin can define an expression
-                // similar to what is used for client classification,
-                // e.g. substring(relay[0].option[17],0,6). Then, based on the
-                // value of that expression for incoming packet, the reservation
-                // is matched. Expression can be specified either as hex or
-                // plain text using single quotes.
-                //
-                // Note: flexible identifier requires flex_id hook library to be
-                // loaded to work.
+                "id": 3,
+                "subnet": "192.168.3.0/27",
+                "pools": [
                    {
-                    "flex-id": "'s0mEVaLue'",
-                    "ip-address": "192.0.2.206"
+                        "pool": "192.168.3.1 - 192.168.3.30"
+                    }
+                ],
+                "option-data": [
+                    {
+                        "name": "routers",
+                        "data": "192.168.3.1"
+                    },
+                    {
+                        "name": "domain-name-servers",
+                        "data": "192.168.2.10"
+                    },
+                    {
+                        "name": "domain-name",
+                        "data": "aito.tjas"
+                    },
+                    {
+                        "name": "domain-search",
+                        "data": "aito.tjas, tjas"
+                    }
+                ],
+                "user-context": {
+                    "name": "Aito",
+                    "purpose": "Toimisto"
+                },
+                "reservations": [
+                    {
+                        "hw-address": "00:1d:46:dc:80:09",
+                        "ip-address": "192.168.3.1",
+                        "hostname": "r1.net.tjas"
+                    },
+                    {
+                        "hw-address": "00:1f:fe:ab:9e:c0",
+                        "ip-address": "192.168.3.2",
+                        "hostname": "s3.net.tjas"
+                    }
+                ]
+            },
+            {
+                "id": 69,
+                "subnet": "192.168.69.0/26",
+                "interface": "enp0s25.69",
+                "pools": [
+                    {
+                        "pool": "192.168.69.1 - 192.168.69.62"
+                    }
+                ],
+                "option-data": [
+                    {
+                        "name": "domain-name-servers",
+                        "data": "192.168.69.20"
+                    },
+                    {
+                        "name": "domain-name",
+                        "data": "sive.tjas"
+                    },
+                    {
+                        "name": "domain-search",
+                        "data": "sive.tjas"
+                    }
+                ],
+                "user-context": {
+                    "name": "Sive",
+                    "purpose": "Hallinta"
+                },
+                "reservations": [
+                    {
+                        "hw-address": "00:1d:46:dc:80:09",
+                        "ip-address": "192.168.69.1",
+                        "hostname": "r1.net.tjas"
+                    },
+                    {
+                        "hw-address": "9c:8e:99:9b:c3:80",
+                        "ip-address": "192.168.69.11",
+                        "hostname": "s1.net.tjas"
+                    },
+                    {
+                        "hw-address": "00:24:a8:f1:c7:40",
+                        "ip-address": "192.168.69.12",
+                        "hostname": "s2.net.tjas"
+                    },
+                    {
+                        "hw-address": "00:1f:fe:ab:9e:c0",
+                        "ip-address": "192.168.69.13",
+                        "hostname": "s3.net.tjas"
+                    },
+                    {
+                        "hw-address": "90:1b:0e:5b:18:fc",
+                        "ip-address": "192.168.69.20",
+                        "hostname": "olympus.juva.tjas"
                    }
-                // You can add more reservations here.
                ]
-            // You can add more subnets there.
            }
        ],

-    // There are many, many more parameters that DHCPv4 server is able to use.
-    // They were not added here to not overwhelm people with too much
-    // information at once.
-
-    // Logging configuration starts here. Kea uses different loggers to log various
-    // activities. For details (e.g. names of loggers), see Chapter 18.
        "loggers": [
            {
-        // This section affects kea-dhcp4, which is the base logger for DHCPv4
-        // component. It tells DHCPv4 server to write all log messages (on
-        // severity INFO or more) to a file.
                "name": "kea-dhcp4",
                "output_options": [
                    {
-                // Specifies the output file. There are several special values
-                // supported:
-                // - stdout (prints on standard output)
-                // - stderr (prints on standard error)
-                // - syslog (logs to syslog)
-                // - syslog:name (logs to syslog using specified name)
-                // Any other value is considered a name of the file
                        "output": "stdout",
-
-                // Shorter log pattern suitable for use with systemd,
-                // avoids redundant information
-                "pattern": "%-5p %m\n",
-
-                // This governs whether the log output is flushed to disk after
-                // every write.
-                // "flush": false,
-
-                // This specifies the maximum size of the file before it is
-                // rotated.
-                // "maxsize": 1048576,
-
-                // This specifies the maximum number of rotated files to keep.
-                // "maxver": 8
+                        "pattern": "%-5p %m\n"
                    }
                ],
-        // This specifies the severity of log messages to keep. Supported values
-        // are: FATAL, ERROR, WARN, INFO, DEBUG
                "severity": "ERROR",
-
-        // If DEBUG level is specified, this value is used. 0 is least verbose,
-        // 99 is most verbose. Be cautious, Kea can generate lots and lots
-        // of logs if told to do so.
                "debuglevel": 0
            }
        ]
--- a/files/motd
+++ b/files/motd
@@ -0,0 +1,29 @@
+
+
+
+
+  _____                             _       _ _      _
+ |_   _|_ _ _ __   __ _  ___       | |_   _| (_) ___| |_
+   | |/ _` | '_ \ / _` |/ _ \   _  | | | | | | |/ _ \ __|
+   | | (_| | | | | (_| | (_) | | |_| | |_| | | |  __/ |_
+   |_|\__,_|_| |_|\__, |\___/   \___/ \__,_|_|_|\___|\__|
+     _    _       |___/         ____  _
+    / \  | |_ __ | |__   __ _  / ___|(_) ___ _ __ _ __ __ _
+   / _ \ | | '_ \| '_ \ / _` | \___ \| |/ _ \ '__| '__/ _` |
+  / ___ \| | |_) | | | | (_| |  ___) | |  __/ |  | | | (_| |
+ /_/   \_\_| .__/|_| |_|\__,_| |____/|_|\___|_|  |_|  \__,_|
+           |_|
+
+
+PVJJK 1.VOS NIINISALO
+TIETOJÄRJESTELMÄASENTAJIEN INTRA
+olympus.juva.tjas
+
+Palvelimen hallinta on automatisoitu. Manuaaliset muutokset saatetaan
+ylikirjoittaa automatisoidusti.
+
+https://github.com/cwchristerw/tjas-intra
+
+
+
+
--- a/files/networking/interfaces
+++ b/files/networking/interfaces
@@ -12,7 +12,12 @@ allow-hotplug enp0s25
 iface enp0s25 inet dhcp

 auto enp0s25.20
-iface enp0s25.20 inet dhcp
+iface enp0s25.20 inet static
+  address 192.168.2.10/27
+  gateway 192.168.2.1
+  hwaddress 90:1b:0e:5b:18:fb

 auto enp0s25.69
-iface enp0s25.69 inet dhcp
+iface enp0s25.69 inet static
+  address 192.168.69.20/26
+  hwaddress 90:1b:0e:5b:18:fc
--- a/files/nginx/conf/000-default.conf
+++ b/files/nginx/conf/000-default.conf
@@ -37,8 +37,8 @@ server {

 #     http2 on;

-#     ssl_certificate /etc/nginx/certs/pvjjk-1vos-tjas/fullchain.pem;
-#     ssl_certificate_key /etc/nginx/certs/pvjjk-1vos-tjas/privkey.pem;
+#     ssl_certificate /etc/nginx/certs/pvjjk-1vos-niinisalo/fullchain.pem;
+#     ssl_certificate_key /etc/nginx/certs/pvjjk-1vos-niinisalo/privkey.pem;
 #     ssl_protocols TLSv1.2 TLSv1.3;
 #     ssl_ecdh_curve X25519:prime256v1:secp384r1;
 #     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
@@ -46,7 +46,7 @@ server {
 #     ssl_session_cache shared:SSL:20m;
 #     ssl_session_timeout 180m;

-#     ssl_trusted_certificate /etc/nginx/certs/pvjjk-1vos-tjas/chain.pem;
+#     ssl_trusted_certificate /etc/nginx/certs/pvjjk-1vos-niinisalo/chain.pem;

 #     expires off;
 #     etag off;
--- a/files/powerdns-authorative/config.conf
+++ b/files/powerdns-authorative/config.conf
@@ -1,6 +1,6 @@
 local-address=0.0.0.0,::
-local-port=53
-default-soa-content=s1.intra.tjas no-reply.intra.tjas 0 10800 3600 604800 3600
+local-port=531
+default-soa-content=olympus.juva.tjas no-reply.intra.tjas 0 10800 3600 604800 3600
 launch=gmysql
 gmysql-host=127.0.0.1
 gmysql-port=3306
--- a/files/powerdns-recursor/config.conf
+++ b/files/powerdns-recursor/config.conf
@@ -0,0 +1,9 @@
+incoming:
+  listen:
+    - 127.0.0.1:532
+recursor:
+  forward_zones:
+    - zone: tjas
+      recurse: false
+      forwarders:
+        - 127.0.0.1:531
--- a/files/ssh/authorized_keys
+++ b/files/ssh/authorized_keys
@@ -1,2 +1,2 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClWZxHhmgV2LD3mrbLU2VxPXGMx02WaB5MU9t8XJsqAmsIKwUZSqHTrlR20dXPGlZhe5Rx4vf+ZKx0kuNKJMvswEkvpP0la9WSsawWHxhOTrqDr0yZMV1/CncdARw1vse3zJCQVbOflbKYsKgpdJHbMzk5SfSZijSscrgxRTa8qX/ndnmlGrgm4MxezgFBEJrzC4vCTZLK5LPkAva+2A6fwElgR7V1Dkg5p5l0/nvKbBje+ugaiTw7RPy42oC/hHrsvsnTQ4KheD1phRJFCSEnj6l7gxVetVBznZ/K697MrK4aNUFLDV29uiPALj+1fWAYTIO3WPNU/QkH7OEP8JO3 l1.office.tjas
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClWZxHhmgV2LD3mrbLU2VxPXGMx02WaB5MU9t8XJsqAmsIKwUZSqHTrlR20dXPGlZhe5Rx4vf+ZKx0kuNKJMvswEkvpP0la9WSsawWHxhOTrqDr0yZMV1/CncdARw1vse3zJCQVbOflbKYsKgpdJHbMzk5SfSZijSscrgxRTa8qX/ndnmlGrgm4MxezgFBEJrzC4vCTZLK5LPkAva+2A6fwElgR7V1Dkg5p5l0/nvKbBje+ugaiTw7RPy42oC/hHrsvsnTQ4KheD1phRJFCSEnj6l7gxVetVBznZ/K697MrK4aNUFLDV29uiPALj+1fWAYTIO3WPNU/QkH7OEP8JO3 argo.aito.tjas
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPW5phGhwAG8dmT+sR0uF1gRc0X9xXZiiFxvKUEsPk1N cwchristerw
--- a/files/yggdrasil/config.conf
+++ b/files/yggdrasil/config.conf
@@ -6,11 +6,17 @@
    # use this section when you may connect via different interfaces.

    Peers: [
-        #TRUSTED PEERS - Waren Group
-        #aurora.devices.waren.io
-        #201:361f:bbfb:7210:c5b8:3f74:a285:adb9
-        "tls://[2a01:4f9:2a:60c::2]:18836",
-        "tls://95.216.5.243:18836",
+{% if config.yggdrasil.peers is defined %}
+        #TRUSTED PEERS
+{% for peer in config.yggdrasil.peers %}
+{% if peer.name is defined and peer.address is defined and peer.address is defined %}
+
+        #{{ peer.name }}
+        "{{ peer.address }}"{% if not loop.last %},{% endif %}
+{% endif %}
+{% endfor %}
+{% endif %}
+
    ]

    # List of connection strings for static peers in URI format, arranged
--- a/init.sh
+++ b/init.sh
@@ -4,63 +4,74 @@ if [ ! "$BASH_VERSION" ] ; then
    exit 1
 fi

+underline=`tput smul`
+nounderline=`tput rmul`
+bold=$(tput bold)
+normal=$(tput sgr0)
+
 ti-header(){
-    echo $(tput bold)$1$(tput sgr0)
+    echo ${bold}$1${normal}
 }

+echo "${bold}"
 echo "
-==============================
-
-PVJJK 1.VOS TJAS - Infra
-Init Script
-
------------------------------
+ .-') _               ('-.      .-')
+(  OO) )             ( OO ).-. ( OO ).
+/     '._      ,--.  / . --. /(_)---\_)
+|'--...__) .-')| ,|  | \-.  \ /    _ |
+'--.  .--'( OO |(_|.-'-'  |  |\  :\` \`.
+   |  |   | \`-'|  | \| |_.'  | '..\`''.)
+   |  |   ,--. |  |  |  .-.  |.-._)   \\
+   |  |   |  '-'  /  |  | |  |\       /
+   \`--'    \`-----'   \`--' \`--' \`-----'
 "
+echo "
+PVJJK 1.VOS NIINISALO
+TIETOJÄRJESTELMÄASENTAJIEN INTRA
+INIT SCRIPT
+"
+echo -n "${normal}"

 stop () {

-echo "
-==============================
-"
-
 exit 1

 }

 ti-header "Haetaan pakettien tiedot..."
-apt update
+sudo apt update
 echo -e "\n\n"

 ti-header "Asennetaan PVJJK 1.VOS TJAS Infran riippuvuudet APT-paketinhallinnalla..."
-apt-get install -y python3-pip python3-venv jq git curl lsb-release
+sudo apt-get install -y python3-pip python3-venv jq git curl lsb-release
 echo -e "\n\n"

-mkdir -p /root/.ssh/keys/pvjjk-1vos-tjas &> /dev/null
-if [[ ! -f /root/.ssh/keys/pvjjk-1vos-tjas/infra ]]
+mkdir -p $HOME/.ssh/keys/pvjjk-1vos-niinisalo &> /dev/null
+if [[ ! -f $HOME/.ssh/keys/pvjjk-1vos-niinisalo/infra ]]
 then
    ti-header "Generoidaan SSH-avain Infra-repon käyttöön..."
-    ssh-keygen -f /root/.ssh/keys/pvjjk-1vos-tjas/infra -t ed25519 -N '' -C $(hostname --fqdn)
+    ssh-keygen -f $HOME/.ssh/keys/pvjjk-1vos-niinisalo/infra -t ed25519 -N '' -C $(hostname --fqdn)
    echo -e "\n\n"
 fi

 ti-header "Luodaan Ansiblelle virtuaalinen ympäristö..."
-python3 -m venv /root/.venv/ansible
+python3 -m venv $HOME/.venv/ansible
 echo -e "\n\n"

 ti-header "Asennetaan Ansiblen riippuvuudet..."
-/root/.venv/ansible/bin/pip3 install cryptography dnspython hvac jmespath netaddr pexpect
+$HOME/.venv/ansible/bin/pip3 install cryptography dnspython hvac jmespath netaddr pexpect
 echo -e "\n\n"

 ti-header "Asennetaan Ansible..."
-/root/.venv/ansible/bin/pip3 install ansible
+$HOME/.venv/ansible/bin/pip3 install ansible
 echo -e "\n\n"

 ti-header "Asennetaan Ansible kokoelmat..."
-/root/.venv/ansible/bin/ansible-galaxy collection install ansible.posix containers.podman --upgrade
+$HOME/.venv/ansible/bin/ansible-galaxy collection install ansible.posix containers.podman --upgrade
 echo -e "\n\n"

 ti-header "Lisää SSH-avain Infra-repon käyttöön..."
-cat /root/.ssh/keys/pvjjk-1vos-tjas/infra.pub
+cat $HOME/.ssh/keys/pvjjk-1vos-niinisalo/infra.pub

 echo -n "Onko avain lisätty Github-repoon? [K/E]"
 while [[ -z $SSHKEY_QUESTION || ! -z $SSHKEY_QUESTION && $SSHKEY_QUESTION != "K" ]]
@@ -69,8 +80,8 @@ do
 done
 echo -e "\n\n"

-mkdir -p /root/.ansible/vault &> /dev/null
-if [[ ! -f /root/.ansible/vault/pvjjk-1vos-tjas ]]
+mkdir -p $HOME/.ansible/vault &> /dev/null
+if [[ ! -f $HOME/.ansible/vault/pvjjk-1vos-niinisalo ]]
 then
    ti-header "Syötä Ansible Vaultin salasana..."
    echo -n "Salasana: "
@@ -80,14 +91,14 @@ then

        if [[ ! -z $VAULT_PASSWORD ]]
        then
-            echo "$VAULT_PASSWORD" > /root/.ansible/vault/pvjjk-1vos-tjas
+            echo "$VAULT_PASSWORD" > $HOME/.ansible/vault/pvjjk-1vos-niinisalo
        fi
    done
    echo -e "\n\n"
 fi

 ti-header "Suoritetaan Infran asennus..."
-/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-tjas/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-tjas/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-tjas tasks.yml -t installer
+$HOME/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d $HOME/.ansible/pull/pvjjk-1vos-niinisalo/infra --accept-host-key --private-key $HOME/.ssh/keys/pvjjk-1vos-niinisalo/infra --vault-password-file $HOME/.ansible/vault/pvjjk-1vos-niinisalo tasks.yml -t installer
 echo -e "\n\n"

 echo "
--- a/inventories/pvjjk-1vos-niinisalo/group_vars/pvjjk_1vos_niinisalo
+++ b/inventories/pvjjk-1vos-niinisalo/group_vars/pvjjk_1vos_niinisalo
@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.2;AES256;pvjjk-1vos-niinisalo
+30383633646132396336336135366264386137643166376336666261316465346632353333616361
+3134623361333633653666313035633536396662613234320a386239373636623061383331663438
+64366431613763376239613036633365346266643163396331653237313662346231623731373530
+6630653939373762380a363939383862623336666361303032653431356139383766663331656335
+3438
--- a/inventories/pvjjk-1vos-niinisalo/host_vars/argo.aito.tjas
+++ b/inventories/pvjjk-1vos-niinisalo/host_vars/argo.aito.tjas
@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.2;AES256;pvjjk-1vos-niinisalo
+37353031396164353032396635313539613734613432323435383137303835383439663439363337
+6230323066313361383061633932616230363465326239640a333739323064653263336337633639
+64343833623362323734363239653866383037313331613738653133636364623237326637313232
+3462636261386230380a313634313965343733616137663532623965393835306562633635633831
+3166
--- a/inventories/pvjjk-1vos-niinisalo/host_vars/olympus.juva.tjas
+++ b/inventories/pvjjk-1vos-niinisalo/host_vars/olympus.juva.tjas
@@ -0,0 +1,51 @@
+$ANSIBLE_VAULT;1.2;AES256;pvjjk-1vos-niinisalo
+30386163316331336461633036653363613064366361653938616138353736366463643664393933
+6533383232616130626431353164663738346630616465300a393062663634356566656562646137
+36623535313932316262663064366535616565386436653761336463323163646439656563303262
+6531373030393264310a623933386234306532643664363335386231626664643531656433323731
+30373237626531336431343965313239616339356162383262313363363262613463303236643734
+62303636646232383235316137393634626235386662616339343231626661376331396138343361
+31663630306431653532666463326536636365663163663162643136366363333638333930373234
+36306166366533636562363063336436333465393231316363343864373335646437373561353538
+31613162643664633435363831326230373635313165633566323135303263323034636265393163
+62373234613334393261356464643262616132343963383165303534346335373634396161383532
+31623330373935613866336135323038343030353865373863633562303134613662353762376134
+61653035313965316134666534366435663333386235636266376164663731646365626135613166
+39333934653563623966366466613436313635313537363337386133356433356336303938333366
+66653735636462383666396332656333666234333435333062356338383034656637323438316134
+62386136663962336232623663666438333931376561303964636563306664313134373338303339
+32313635643136396365383834343438633463366262366330653034333332653038356331346566
+30336164393136383434646636376239656162643734643735306436303961326565346566333461
+33383861356537656262646131386134303165636632343134383264353466316633663732396334
+33373664633239396234366534636365346631643063373836666233626565626234363433313866
+31663464346264393731623364373035616134376430333764383836353132386339636537326637
+36366662333336373633653330353939396239623037653862393932373932353834373339373934
+61663338666164663235653337336238626462653336313532643131383638336535376232303465
+64363530393065383639663731383036613338343436313937663162643434323835353363653738
+62613139343934656135313832323532623263653038353166313531643036303538613436323664
+33356434623633643462326564383263323833376165366536633264656366353137316265653534
+36656561353634626330636363636133356265306336623737643961663061343630383330386538
+63636434303066646261636338323563373663323835386563393539616663636139356536393462
+37363766356138616232333162666562333261626661646538613862306264336636396562313665
+35373266366134623263663363376630343263623335666663396438663238636534393130623134
+36653465383763646563386361636530393366323538336532393661306362346333353661303334
+32633966303964383861653365626332316135373731393935313262383164346233353765396561
+33323864306336353732623937386235646366663764653965633764643864366331666262386639
+66326335326562646630346435663533313335373034663565333839323961383366643263356133
+64303030366263356231343530343566623935306431653866613165393633643835653330666436
+38663535373666333763386436646337656133303262396237663931323864336630646466306462
+65656536336533343065316637613034626333343837616363376263636635363866383638393234
+39373030663230383865396131363638376537363362666439636235626461303930396464313532
+63306136613265636438333764646465306565333435666233656534656538646465636263363433
+37356131353530363665336564386264616235613564363065356234336537363561313666653637
+35336638623730633735643465316164323739316636353762653965633831626561313532626139
+62303933376637376334666362306133383035376561333361326338663762363230303533363632
+62383539626263363636636164366139306666333165636130323765643532363338656261396135
+36336664656335383561643637383066653531303236323765356666343765616134343036313538
+34623935616531323536383565313238333564613635343332303238626534613337353430303864
+30383131346163636335363563656465316263316439646530663665386636393261386536306265
+34656230643662653665383730396335646562306161663233353835666131633730663237336434
+62643631653738633638366133396364623837343138613765616362633262333333646639396637
+36386533386439623866346335376164336439366133643266663938643333383836346538636536
+35376335306435616236323163616163656366366630656535393233643966313166346530383365
+3630646439643335393964313862363134396566636661643666
--- a/inventories/pvjjk-1vos-niinisalo/hosts.yml
+++ b/inventories/pvjjk-1vos-niinisalo/hosts.yml
@@ -1,6 +1,7 @@
 ---
-pvjjk_1vos_tjas:
+pvjjk_1vos_niinisalo:
  hosts:
+    argo.aito.tjas:
    olympus.juva.tjas:
  vars:
    ansible_python_interpreter: /usr/bin/python3
--- a/inventories/pvjjk-1vos-tjas/host_vars/olympus.juva.tjas
+++ b/inventories/pvjjk-1vos-tjas/host_vars/olympus.juva.tjas
@@ -1,42 +0,0 @@
-$ANSIBLE_VAULT;1.2;AES256;pvjjk-1vos-tjas
-36333262326535303062303034316566616661393864633434306135396637383732353833306434
-6538373638316233346562343231656236646633366337650a613433663364363865343465653665
-36303832626265373666333336366565393164373339326464376432663337643537373561343435
-3832356131373466390a656566396365363931363062353564386163643335343165303264383265
-31653738613561616164633130653736313037653165623261383662313262373937386262343562
-62356330363261303039386231646265366264666633626662386332323461343565333661383433
-35366430303931316631363331346237616230313664316138373239313138626639393831373965
-38643763393832363763323331316538326337383965323962363563626165653064326434376563
-63383763333630366662636663386365343731303366363030366634613339633863393137356634
-65396332323234653439303966316230323634356139636666643635323237313365373361363831
-61636238323530613164303965653931393337383139653630653761643039626332313462643064
-65346637623264396462646662656534313861633162663665643164366330343134353633383462
-62333433636635626330363438343766316263616235643833623165376265376330363832616664
-31636265396431616335373934393661353835306162633262636362393165316537383631616637
-35666362353731663264376364343162386466303462336261333734313665353034646430393030
-36333665613264633464326133316333386561323532623966396434636135313531306366313539
-33316533313437343534623133663866393832383633343664626239366335623964656339313666
-39363530316333663665633638333830383037393731376463653630376133316532666462333430
-37643364636534383036346666346666636439366365363830653664356138313330356334626632
-33353363613735333138326231396562633437353730383063353663396437396532643961373565
-63313831376666643263343235663666666331313734326465306330633464343038383038336531
-32636261373532303835653536396163643030626138616566613033623336363237646534333266
-39373665383338343965616231346331303939306330323239333130363839653839386131616561
-64373865303338333530623763306664323738393535393737623364316439373232393636376438
-65366330303663653332653835646237346134323062393362333361663732363261383066303266
-32396166326633343338663136646633613164653238376463653962376163323333616630616362
-33313330663233363764316539316538633636653461623534386537653531353337356233303934
-62393136393566363239383963633530626237353133633332383537616537326233396438393335
-33323430643235313138393533653230373631336636303063343136346237646530666561353636
-63333739363364623130356333386362303663303863313236313631373332346237653865636263
-61663166663131626666646531633039306336353339356638316336626137616238646231316434
-35616536323633363732313236303134353431363937633466383463363738633863396436333966
-62363833323530383634643635643435396164343762363366663435343765633534313166323331
-38333733313437316537353866353635303633373934326436396138373232343831323162363163
-62333634306161353434616563336439336137356130616562646338616436623865396664633633
-35366231666338303139646136316539373738626536383639633632626166326431386239653339
-64613162653731643230613330623861313630393562306439653837316439383634396331613332
-62326533363239616338613234343032386663396563313831353166636663363535363636626465
-65323933623538653133303137323765383164333238623963633330313939646435646133633838
-39376438323966313566613733306562666439373639633430323933373162313438336464656232
-6434
--- a/protect.sh
+++ b/protect.sh
@@ -5,23 +5,37 @@ nounderline=`tput rmul`
 bold=$(tput bold)
 normal=$(tput sgr0)

-echo "${bold}PVJJK 1.VOS TJAS / Infra / Protect${normal}"
+echo "${bold}"
+echo "
+ .-') _               ('-.      .-')
+(  OO) )             ( OO ).-. ( OO ).
+/     '._      ,--.  / . --. /(_)---\_)
+|'--...__) .-')| ,|  | \-.  \ /    _ |
+'--.  .--'( OO |(_|.-'-'  |  |\  :\` \`.
+   |  |   | \`-'|  | \| |_.'  | '..\`''.)
+   |  |   ,--. |  |  |  .-.  |.-._)   \\
+   |  |   |  '-'  /  |  | |  |\       /
+   \`--'    \`-----'   \`--' \`--' \`-----'
+"
+echo "
+PVJJK 1.VOS NIINISALO
+TIETOJÄRJESTELMÄASENTAJIEN INTRA
+PROTECT SCRIPT
+"
+echo -n "${normal}"
 action=$1

 encrypt() {
-    echo "${underline}Encrypting...${nounderline}"
-    execute "ansible-vault encrypt --vault-id pvjjk-1vos-tjas@vault/pvjjk-1vos-tjas"
+    execute "ansible-vault encrypt --vault-id $1@vault/$1" $1
 }

 decrypt() {
-    echo "${underline}Decrypting...${nounderline}"
-    execute "ansible-vault decrypt --vault-id pvjjk-1vos-tjas@vault/pvjjk-1vos-tjas"
+    execute "ansible-vault decrypt --vault-id $1@vault/$1" $1
 }

 list() {
-    echo "${underline}Listing...${nounderline}"
    i=0
-    for file in inventories/*/group_vars/* inventories/*/host_vars/*;
+    for file in inventories/$1/group_vars/* inventories/$1/host_vars/*;
    do
        i=$((i + 1))
        echo $i")"$file
@@ -29,7 +43,8 @@ list() {
 }

 execute() {
-for file in inventories/*/group_vars/* inventories/*/host_vars/*;
+i=0
+for file in inventories/$2/group_vars/* inventories/$2/host_vars/*;
    do
        i=$((i + 1))
        echo $i")"$file
@@ -40,18 +55,23 @@ for file in inventories/*/group_vars/* inventories/*/host_vars/*;

 case $action in
    encrypt)
-        encrypt
+        echo "${underline}Encrypting...${nounderline}"
+        encrypt pvjjk-1vos-niinisalo
        ;;
    decrypt)
-        decrypt
+        echo "${underline}Decrypting...${nounderline}"
+        decrypt pvjjk-1vos-niinisalo
        ;;
    list)
-        list
-        ;;
-    help)
-        echo "encrypt, decrypt, list"
+        echo "${underline}Listing...${nounderline}"
+        list pvjjk-1vos-niinisalo
        ;;
    *)
-        echo "..."
+        echo "${underline}HELP${nounderline}"
+        echo "encrypt - Encrypt Files"
+        echo "decrypt - Decrypt Files"
+        echo "list - List Files"
        ;;
 esac
+
+echo -e "\n\n\n"
--- a/tasks.yml
+++ b/tasks.yml
@@ -10,6 +10,8 @@
      import_tasks: tasks/installer.yml
      vars:
        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
+      when:
+        - inventory_hostname == "olympus.juva.tjas"
      tags:
        - installer
        - never
@@ -18,6 +20,8 @@
      import_tasks: tasks/maintenance.yml
      vars:
        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
+      when:
+        - inventory_hostname == "olympus.juva.tjas"
      tags:
        - maintenance
        - never
@@ -26,6 +30,8 @@
      import_tasks: tasks/deployer.yml
      vars:
        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
+      when:
+        - inventory_hostname == "olympus.juva.tjas"
      tags:
        - deployer
        - never
--- a/tasks/deployer.yml
+++ b/tasks/deployer.yml
@@ -58,7 +58,6 @@
  containers.podman.podman_image:
    name: docker.io/library/golang
    tag: alpine
-#    force: true
  register: deployerTaskY2

 - name: "Deployer - Yggdrasil - Clone Repository"
@@ -69,7 +68,7 @@

 - name: "Deployer - Yggdrasil - Build Image"
  containers.podman.podman_image:
-    name: pvjjk-1vos-tjas/yggdrasil
+    name: pvjjk-1vos-niinisalo/yggdrasil
    tag: latest
    path: "/root/data/yggdrasil"
    build:
@@ -80,7 +79,7 @@
 - name: "Deployer - Yggdrasil - Run Container"
  containers.podman.podman_container:
    name: yggdrasil
-    image: pvjjk-1vos-tjas/yggdrasil:latest
+    image: pvjjk-1vos-niinisalo/yggdrasil:latest
    state: started
    recreate: on
    network: host
@@ -102,12 +101,12 @@
    state: directory
  tags:
    - mariadb
+    - database

 - name: "Deployer - MariaDB - Pull Image"
  containers.podman.podman_image:
    name: docker.io/library/mariadb
    tag: latest
-#    force: true
  register: deployerTaskM1

 - name: "Deployer - MariaDB - Run Container"
@@ -127,6 +126,7 @@
    - (deployerTaskM1 is defined and deployerTaskM1.changed) or deployerTaskM1 is undefined
  tags:
    - mariadb
+    - database

 - name: "Deployer - MariaDB - Wait"
  ansible.builtin.wait_for:
@@ -137,6 +137,7 @@
    - (deployerTaskM2 is defined and deployerTaskM2.changed) or deployerTaskM2 is undefined
  tags:
    - mariadb
+    - database

 - name: "Deployer - MariaDB - Upgrade"
  containers.podman.podman_container_exec:
@@ -149,6 +150,7 @@
    - (deployerTaskM2 is defined and deployerTaskM2.changed) or deployerTaskM2 is undefined
  tags:
    - mariadb
+    - database

 - name: "Deployer - MariaDB - Create Users"
  community.mysql.mysql_user:
@@ -172,6 +174,7 @@
    - config.mariadb.users[user].database is defined
  tags:
    - mariadb
+    - database

 - name: "Deployer - MariaDB - Create Database"
  community.mysql.mysql_db:
@@ -192,6 +195,7 @@
    - config.mariadb.users[user].database is defined
  tags:
    - mariadb
+    - database

 - name: "Deployer - Kea - Install"
  ansible.builtin.apt:
@@ -199,75 +203,233 @@
      - kea
    state: latest

-# - name: "Deployer - DHCP - Config"
-#   ansible.builtin.template:
-#     src: './files/dhcp/dhcpd.conf'
-#     dest: '/etc/dhcp/dhcpd.conf'
-#   register: deployerTaskD1
-#   tags:
-#     - dhcp
+- name: "Deployer - Kea - Configure - DHCP4"
+  ansible.builtin.template:
+    src: './files/kea/kea-dhcp4.conf'
+    dest: '/etc/kea/kea-dhcp4.conf'
+  register: deployerTaskK1
+  tags:
+    - kea
+    - dhcp

-# - name: "Deployer : DHCP : Restart"
-#   ansible.builtin.systemd_service:
-#     name: isc-dhcp-server
-#     state: restarted
-#     enabled: true
-#   when:
-#     - (deployerTaskD1 is defined and deployerTaskD1.changed) or deployerTaskD1 is undefined
+- name: "Deployer - Kea - Configure - Database : Init"
+  ansible.builtin.command:
+    cmd: "/usr/sbin/kea-admin db-init mysql -h 127.0.0.1 -n {{ config.mariadb.users['kea'].database }} -u {{ config.mariadb.users['kea'].username }} -p {{ config.mariadb.users['kea'].password }}"
+  register: deployerTaskK2
+  changed_when:
+    - deployerTaskK2.stdout.find('Initializing database') != -1
+  failed_when:
+    - deployerTaskK2.stdout.find('ERROR') != -1
+    - deployerTaskK2.stdout.find('Expected empty database kea.') == -1
+  tags:
+    - kea
+    - dhcp

- name: "Deployer - PowerDNS - Configure - Create Folder"
+- name: "Deployer - Kea - Configure - Database : Upgrade"
+  ansible.builtin.command:
+    cmd: "/usr/sbin/kea-admin db-upgrade mysql -h 127.0.0.1 -n {{ config.mariadb.users['kea'].database }} -u {{ config.mariadb.users['kea'].username }} -p {{ config.mariadb.users['kea'].password }}"
+  tags:
+    - kea
+    - dhcp
+
+- name: "Deployer : Kea : Restart"
+  ansible.builtin.systemd_service:
+    name: kea-dhcp4-server
+    state: restarted
+  when:
+    - (deployerTaskK1 is defined and deployerTaskK1.changed) or deployerTaskK1 is undefined or (deployerTaskK2 is defined and deployerTaskK2.changed) or deployerTaskK2 is undefined
+  tags:
+    - kea
+    - dhcp
+
+- name: "Deployer : Kea : Start"
+  ansible.builtin.systemd_service:
+    name: kea-dhcp4-server
+    state: started
+  tags:
+    - kea
+    - dhcp
+
+
+- name: "Deployer - dnsdist - Configure - Create Folder"
  ansible.builtin.file:
-    path: "/root/data/powerdns/"
+    path: "/root/data/dnsdist/"
    state: directory
  tags:
-    - powerdns
+    - dnsdist
+    - dns

- name: "Deployer - PowerDNS - Configure - Create Subfolders"
+- name: "Deployer - dnsdist - Configure - Create Subfolders"
  ansible.builtin.file:
-    dest: '/root/data/powerdns/{{ item.path }}'
+    dest: '/root/data/dnsdist/{{ item.path }}'
    state: directory
-  with_filetree: './files/powerdns/'
+  with_filetree: './files/dnsdist/'
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.state == 'directory'
  tags:
-    - powerdns
+    - dnsdist
+    - dns

- name: "Deployer - PowerDNS - Configure - Generating & Transferring Files"
+- name: "Deployer - dnsdist - Configure - Generating & Transferring Files"
  ansible.builtin.template:
    src: '{{ item.src }}'
-    dest: '/root/data/powerdns/{{ item.path }}'
-  register: deployerTaskP1
-  with_filetree: './files/powerdns/'
+    dest: '/root/data/dnsdist/{{ item.path }}'
+  register: deployerTaskD1
+  with_filetree: './files/dnsdist/'
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.state == 'file'
  tags:
-    - powerdns
+    - dnsdist
+    - dns

- name: "Deployer - PowerDNS - Pull Image"
+- name: "Deployer - dnsdist - Pull Image"
  containers.podman.podman_image:
-    name: docker.io/powerdns/pdns-auth-49
+    name: docker.io/powerdns/dnsdist-20
    tag: latest
-#    force: true
-  register: deployerTaskP2
+  register: deployerTaskD2

- name: "Deployer - PowerDNS - Run Container"
+- name: "Deployer - dnsdist - Run Container"
  containers.podman.podman_container:
-    name: powerdns
-    image: docker.io/powerdns/pdns-auth-49:latest
+    name: dnsdist
+    image: docker.io/powerdns/dnsdist-20:latest
    state: started
    recreate: on
    network: host
    restart_policy: always
    volumes:
-      - "/root/data/powerdns/config.conf:/etc/powerdns/pdns.conf:ro"
+      - "/root/data/dnsdist/config.conf:/etc/dnsdist/dnsdist.conf:ro"
+    tty: yes
+    interactive: yes
+    capabilities:
+      - NET_BIND_SERVICE
  when:
-    - (deployerTaskP1 is defined and deployerTaskP1.changed) or deployerTaskP1 is undefined or (deployerTaskP2 is defined and deployerTaskP2.changed) or deployerTaskP2 is undefined
+    - (deployerTaskD1 is defined and deployerTaskD1.changed) or deployerTaskD1 is undefined or (deployerTaskD2 is defined and deployerTaskD2.changed) or deployerTaskD2 is undefined
  tags:
-    - powerdns
+    - dnsdist
+    - dns
+
+- name: "Deployer - PowerDNS Authorative - Configure - Create Folder"
+  ansible.builtin.file:
+    path: "/root/data/powerdns-authorative/"
+    state: directory
+  tags:
+    - powerdns-authorative
+    - dns
+
+- name: "Deployer - PowerDNS Authorative - Configure - Create Subfolders"
+  ansible.builtin.file:
+    dest: '/root/data/powerdns-authorative/{{ item.path }}'
+    state: directory
+  with_filetree: './files/powerdns-authorative/'
+  loop_control:
+    label: "{{ item.path }}"
+  when:
+    - item.state == 'directory'
+  tags:
+    - powerdns-authorative
+    - dns
+
+- name: "Deployer - PowerDNS Authorative - Configure - Generating & Transferring Files"
+  ansible.builtin.template:
+    src: '{{ item.src }}'
+    dest: '/root/data/powerdns-authorative/{{ item.path }}'
+  register: deployerTaskPA1
+  with_filetree: './files/powerdns-authorative/'
+  loop_control:
+    label: "{{ item.path }}"
+  when:
+    - item.state == 'file'
+  tags:
+    - powerdns-authorative
+    - dns
+
+- name: "Deployer - PowerDNS Authorative - Pull Image"
+  containers.podman.podman_image:
+    name: docker.io/powerdns/pdns-auth-50
+    tag: latest
+  register: deployerTaskPA2
+
+- name: "Deployer - PowerDNS Authorative - Run Container"
+  containers.podman.podman_container:
+    name: powerdns-authorative
+    image: docker.io/powerdns/pdns-auth-50:latest
+    state: started
+    recreate: on
+    network: host
+    restart_policy: always
+    volumes:
+      - "/root/data/powerdns-authorative/config.conf:/etc/powerdns/pdns.conf:ro"
+    capabilities:
+      - NET_BIND_SERVICE
+  when:
+    - (deployerTaskPA1 is defined and deployerTaskPA1.changed) or deployerTaskPA1 is undefined or (deployerTaskPA2 is defined and deployerTaskPA2.changed) or deployerTaskPA2 is undefined
+  tags:
+    - powerdns-authorative
+    - dns
+
+
+- name: "Deployer - PowerDNS Recursor - Configure - Create Folder"
+  ansible.builtin.file:
+    path: "/root/data/powerdns-recursor/"
+    state: directory
+  tags:
+    - powerdns-recursor
+    - dns
+
+- name: "Deployer - PowerDNS Recursor - Configure - Create Subfolders"
+  ansible.builtin.file:
+    dest: '/root/data/powerdns-recursor/{{ item.path }}'
+    state: directory
+  with_filetree: './files/powerdns-recursor/'
+  loop_control:
+    label: "{{ item.path }}"
+  when:
+    - item.state == 'directory'
+  tags:
+    - powerdns-recursor
+    - dns
+
+- name: "Deployer - PowerDNS Recursor - Configure - Generating & Transferring Files"
+  ansible.builtin.template:
+    src: '{{ item.src }}'
+    dest: '/root/data/powerdns-recursor/{{ item.path }}'
+  register: deployerTaskPR1
+  with_filetree: './files/powerdns-recursor/'
+  loop_control:
+    label: "{{ item.path }}"
+  when:
+    - item.state == 'file'
+  tags:
+    - powerdns-recursor
+    - dns
+
+- name: "Deployer - PowerDNS Recursor - Pull Image"
+  containers.podman.podman_image:
+    name: docker.io/powerdns/pdns-recursor-52
+    tag: latest
+  register: deployerTaskPR2
+
+- name: "Deployer - PowerDNS Recursor - Run Container"
+  containers.podman.podman_container:
+    name: powerdns-recursor
+    image: docker.io/powerdns/pdns-recursor-52:latest
+    state: started
+    recreate: on
+    network: host
+    restart_policy: always
+    volumes:
+      - "/root/data/powerdns-recursor/config.conf:/etc/powerdns/recursor.conf:ro"
+    capabilities:
+      - NET_BIND_SERVICE
+  when:
+    - (deployerTaskPR1 is defined and deployerTaskPR1.changed) or deployerTaskPR1 is undefined or (deployerTaskPR2 is defined and deployerTaskPR2.changed) or deployerTaskPR2 is undefined
+  tags:
+    - powerdns-recursor
+    - dns

 - name: "Deployer - Nginx - Configure - Create Folder"
  ansible.builtin.file:
@@ -275,6 +437,7 @@
    state: directory
  tags:
    - nginx
+    - www

 - name: "Deployer - Nginx - Configure - Create Subfolders"
  ansible.builtin.file:
@@ -287,6 +450,7 @@
    - item.state == 'directory'
  tags:
    - nginx
+    - www

 - name: "Deployer - Nginx - Configure - Generating & Transferring Files"
  ansible.builtin.template:
@@ -300,12 +464,12 @@
    - item.state == 'file'
  tags:
    - nginx
+    - www

 - name: "Deployer - Nginx - Pull Image"
  containers.podman.podman_image:
    name: docker.io/library/nginx
    tag: latest
-#    force: true
  register: deployerTaskN2

 - name: "Deployer - Nginx - Run Container"
@@ -325,3 +489,4 @@
    - (deployerTaskN1 is defined and deployerTaskN1.changed) or deployerTaskN1 is undefined or (deployerTaskN2 is defined and deployerTaskN2.changed) or deployerTaskN2 is undefined
  tags:
    - nginx
+    - www
--- a/tasks/installer.yml
+++ b/tasks/installer.yml
@@ -50,15 +50,49 @@
      - pkg-config
      - etckeeper
      - picocom
+      - vlan
  loop: "{{ packages }}"
  loop_control:
    label: "{{ package }}"
    loop_var: "package"

- name: "Installer : Network : Configure"
+- name: "Installer : Issue : Configure - Copy File"
  ansible.builtin.template:
-    src: './files/network/interfaces'
+    src: './files/issue'
+    dest: '/etc/{{ file }}'
+  vars:
+    files:
+      - "issue"
+      - "issue.net"
+  loop: "{{ files }}"
+  loop_control:
+    label: "{{ file }}"
+    loop_var: "file"
+  tags:
+    - issue
+
+- name: "Installer : Motd : Configure - Copy File"
+  ansible.builtin.template:
+    src: './files/motd'
+    dest: '/etc/motd'
+  tags:
+    - motd
+
+- name: "Installer : Networking : Configure - Copy Configuration"
+  ansible.builtin.template:
+    src: './files/networking/interfaces'
    dest: '/etc/network/interfaces'
+  tags:
+    - networking
+    - network
+
+- name: "Installer : Networking : Start - Restart Service"
+  ansible.builtin.systemd_service:
+    name: networking
+    state: restarted
+  tags:
+    - networking
+    - network

 - name: "Installer : FirewallD : Dependencies - Packages"
  ansible.builtin.apt:
@@ -66,17 +100,26 @@
      - python3-firewall
      - iptables
    state: latest
+  tags:
+    - firewalld
+    - firewall

 - name: "Installer : FirewallD : Install"
  ansible.builtin.apt:
    name: "firewalld"
    state: latest
+  tags:
+    - firewalld
+    - firewall

 - name: "Installer : FirewallD : Start"
  ansible.builtin.systemd_service:
    name: firewalld
    state: started
    enabled: true
+  tags:
+    - firewalld
+    - firewall

 - name: "Installer : FirewallD : Rules"
  ansible.posix.firewalld:
@@ -90,12 +133,15 @@
      - http
      - https
      - ssh
+      - dhcp
+      - dns
  loop: "{{ services }}"
  loop_control:
    label: "{{ service }}"
    loop_var: "service"
-
-
+  tags:
+    - firewalld
+    - firewall

 - name: "Installer - Ansible - Python Library"
  ansible.builtin.pip:
@@ -139,7 +185,7 @@
  tags:
    - ansible

- name: "Installer - Ansible - Dependencies / Python Libraries"
+- name: "Installer - Ansible - Dependencies - Python Libraries"
  ansible.builtin.pip:
    name: "{{ library }}"
    state: latest
@@ -158,8 +204,10 @@
  loop_control:
    label: "{{ library }}"
    loop_var: "library"
+  tags:
+    - ansible

- name: "Installer : MariaDB : Dependencies / Python Library : pymysql"
+- name: "Installer : MariaDB : Dependencies - Python Library : pymysql"
  ansible.builtin.pip:
    name: pymysql
    state: latest
@@ -168,6 +216,15 @@
    virtualenv_command: "python3 -m venv"
  tags:
    - mariadb
+    - database
+
+- name: "Installer : MariaDB : Dependencies - Package : mariadb-client"
+  ansible.builtin.apt:
+    name: "mariadb-client"
+    state: latest
+  tags:
+    - mariadb
+    - database

 - name: "Installer : Podman : Install"
  ansible.builtin.apt:
@@ -178,13 +235,15 @@
      - buildah
      - slirp4netns
    state: latest
+  tags:
+    - podman

 - name: "Installer : Schedule : Maintenance"
  ansible.builtin.cron:
    name: "PVJJK 1.VOS TJAS - Infra - Maintenance"
    hour: "*/3"
    minute: "0"
-    job: "/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-tjas/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-tjas/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-tjas tasks.yml -t maintenance"
+    job: "/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-niinisalo/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-niinisalo/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-niinisalo tasks.yml -t maintenance"
  tags:
    - cron

@@ -192,6 +251,6 @@
  ansible.builtin.cron:
    name: "PVJJK 1.VOS TJAS - Infra - Deployer"
    minute: "*/5"
-    job: "/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-tjas/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-tjas/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-tjas tasks.yml -t deployer"
+    job: "/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-niinisalo/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-niinisalo/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-niinisalo tasks.yml -t deployer"
  tags:
    - cron
Author	SHA1	Message	Date
Christer Warén	cf65e1ac85	Update workstation installation guide	2025-09-01 16:30:51 +03:00
Christer Warén	177bafaa93	Fix typos in Init script	2025-09-01 15:56:52 +03:00
Christer Warén	89c5cc2437	FIx to work in WSL	2025-09-01 15:49:37 +03:00
Christer Warén	586ea6bd0e	Fix missing sudo in INSTRUCTIONS.md	2025-09-01 15:39:42 +03:00
Christer Warén	13d07913ef	Add workstation installation guide to INSTRUCTIONS.md	2025-09-01 15:33:12 +03:00
Christer Warén	718874a63d	Beautification of Protect script	2025-09-01 15:21:41 +03:00
Christer Warén	859b96eb88	Beautification of Init script	2025-09-01 15:21:19 +03:00
Christer Warén	e149ba3db0	Inventories Update	2025-09-01 15:20:42 +03:00
Christer Warén	2224e2c596	Inventories Update	2025-09-01 10:25:36 +03:00
Christer Warén	2b6921e9f3	Fix typo in Yggdrasil configuration	2025-09-01 10:12:30 +03:00
Christer Warén	b895ac02b9	Yggdrasil Configuration	2025-09-01 09:03:41 +03:00
Christer Warén	edbf3f6191	Inventories Update	2025-09-01 09:03:27 +03:00
Christer Warén	79e45822c1	Protect Update	2025-09-01 09:03:04 +03:00
Christer Warén	a4e7218050	Fix Kea configuration commands in Deployer tasks	2025-08-30 18:52:23 +03:00
Christer Warén	f1a5f0caa5	Add NET_BIND_SERVICE capability to PowerDNS containers	2025-08-28 12:43:16 +03:00
Christer Warén	7f8b4a1e13	Add NET_BIND_SERVICE capability to dnsdist container	2025-08-28 11:55:16 +03:00
Christer Warén	e1a1e4889a	Add parameters to dnsdist in Deployer tasks	2025-08-28 10:44:11 +03:00
Christer Warén	d5b99d3146	FIx PowerDNS container names in Deployer tasks	2025-08-27 14:03:04 +03:00
Christer Warén	be900d5785	Add useClientSubnet to dnsdist configuration	2025-08-27 13:55:05 +03:00
Christer Warén	84884d9015	Add PowerDNS Recursor to Deployer	2025-08-26 19:42:00 +03:00
Christer Warén	5589d94f11	Update Issue & MOTD	2025-08-26 13:37:04 +03:00
Christer Warén	491ad0aba8	Update VSCode settings	2025-08-26 13:36:48 +03:00
Christer Warén	dec30dd66b	Fix typo in server network configuration	2025-08-26 13:04:54 +03:00
Christer Warén	5008c1be97	Allow DHCP & DNS from FirewallD	2025-08-26 12:49:41 +03:00
Christer Warén	56b53fdc5b	Update network device configurations to INSTRUCTIONS.md	2025-08-26 12:49:22 +03:00
Christer Warén	2b671f8a6d	Add interfaces to subnets to restrict them to specific vlan	2025-08-26 09:08:10 +03:00
Christer Warén	ada1aa726d	Start Kea server in Deployer tasks	2025-08-26 08:31:00 +03:00
Christer Warén	89d03c5141	Set statiic IPs for interfaces	2025-08-26 08:11:46 +03:00
Christer Warén	b889bd2054	Update Kea tasks	2025-08-25 14:58:22 +03:00
Christer Warén	877cbc1005	Restore unique MAC addresses to interfaces	2025-08-25 14:05:25 +03:00
Christer Warén	6b83b10523	Remove static IPs from network interfaces	2025-08-25 13:59:24 +03:00
Christer Warén	21fcb394cd	Update Issue & MOTD	2025-08-25 12:23:01 +03:00
Christer Warén	aab33c9c21	Change name of office laptop	2025-08-25 12:11:40 +03:00
Christer Warén	742e77a1fc	Update	2025-08-25 12:10:41 +03:00
Christer Warén	63f6266f2c	Update	2025-08-25 12:02:51 +03:00
Christer Warén	c89ab05b1a	Add Issue and MOTD to Installer tasks	2025-08-25 12:02:23 +03:00
Christer Warén	41d961ce6b	Restart Networking during Installer tasks	2025-08-25 10:59:00 +03:00
Christer Warén	f81480af87	Network Changes	2025-08-25 10:26:26 +03:00
Christer Warén	76e57329ce	Fix typo in interfaces file	2025-08-16 14:57:18 +03:00
Christer Warén	c6b2c2cd25	Add vlan to packages to install in Installer tasks	2025-08-16 14:27:18 +03:00
Christer Warén	37114a0f8d	Update network interfaces	2025-08-16 14:20:32 +03:00
Christer Warén	47e7f0415b	Update Kea configuration	2025-08-16 14:20:23 +03:00
Christer Warén	296b3b5502	Add Kea database upgrade task to Deployer tasks	2025-08-16 14:04:20 +03:00
Christer Warén	681999d4e2	Deployer Tasks - Uodate	2025-08-16 13:54:33 +03:00
Christer Warén	41008ed852	Add database configuration task for Kea in Deployer tasks	2025-08-16 13:45:18 +03:00
Christer Warén	79c6ee8af8	Adding more tags to Installer tasks	2025-08-16 13:25:30 +03:00
Christer Warén	5339d47d11	Installer Tasks: Add mariadb-client package to dependencies for MariaDB	2025-08-16 13:17:40 +03:00
Christer Warén	8d1a7820c9	Fix syntax in Kea configuration	2025-08-16 13:01:14 +03:00
Christer Warén	b9d58a6822	Change database server address in Kea configuration	2025-08-16 12:41:46 +03:00
Christer Warén	4cfaf5f0a4	Fix wrong mac address of s3 switch in Kea configuration	2025-08-16 12:38:41 +03:00
Christer Warén	9e898bd5e3	Remove unnecessary hooks-libraries from Kea configuration	2025-08-16 12:29:18 +03:00
Christer Warén	669fdcc6a6	Fix typos in Kea configuration	2025-08-16 11:05:50 +03:00
Christer Warén	ffd215d9f8	Fix typo in Deployer tasks	2025-08-13 14:44:01 +03:00
Christer Warén	19fb89cfb2	Add interfaces to Kea configuration	2025-08-13 14:39:26 +03:00
Christer Warén	f17f1bfb7b	Update Deployer tasks: Add tags and replace DHCPD with Kea	2025-08-13 13:39:33 +03:00
Christer Warén	ee486ad369	Remove DHCPD configuration and update Kea configuration	2025-08-13 13:38:25 +03:00