Update workstation installation guide

Fix typos in Init script
FIx to work in WSL
2025-09-04 03:43:23 +00:00 · 2025-09-01 16:30:51 +03:00 · 2025-09-01 15:56:52 +03:00 · 2025-09-01 15:49:37 +03:00 · 2025-09-01 15:39:42 +03:00 · 2025-09-01 15:33:12 +03:00
25 changed files with 984 additions and 799 deletions
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,6 +1,5 @@
 {
    "files.trimTrailingWhitespace": true,
    "files.insertFinalNewline": true,
    "files.trimFinalNewlines": true,
    "editor.renderFinalNewline": false
 }
--- a/INSTRUCTIONS.md
+++ b/INSTRUCTIONS.md
@@ -1,7 +1,28 @@
-#Tietojärjestelmäasentajien Infra
+# Tietojärjestelmäasentajien Infra
-## PVJJK 1.VOS TJAS - Infra
+## PVJJK 1.VOS Niinisalo
 ### Ylläpitäjän ohjeet
 **Työaseman asennus**
 1. Asenna Windows Subsystem for Linux vaihtoehtoisista järjestelmäominaisuuksista.
 2. Käynnistä työasema uudelleen
 3. Asenna Debian käyttöjärjestelmä
    1. Avaa Powershell järjestelmänvalvojana
    2. Suorita asennuskomento – `wsl --install -d Debian`
    3. Aseta käyttäjätunnukseksi `asentaja` ja salasanaksi sama kuin työaseman Windows käyttäjän salasana.
    4. Vaihda isännän nimi
        1. Lisää Network kohtaan tai luo Network kohta – `echo "[network]" > /etc/wsl.conf`
        2. Lisää isännän nimi – `echo "hostname = argo.aito.tjas" > /etc/wsl.conf`
        3. Lisää Hosts tiedoston generointi – `echo "generateHosts = true" > /etc/wsl.conf`
    5. Sulje ikkuna
 4. Aseta Debian oletusarvoiseksi käyttöjärjestelmäksi ja käynnistä se uudelleen
    1. Avaa Powershell järjestelmänvalvojana
    2. Vaihda oletusarvoinen käyttöjärjestelmä – `wsl --set-default Debian`
    3. Käynnistä uudelleen käyttöjärjestelmä – `wsl -t Debian`
    4. Sulje ikkuna
 6. Avaa Debian käynnistävalikosta tai suorita Powershellissä komento järjestelmänvalvojana `wsl -d Debian`
 7. Asenna curl-paketti käyttämällä APT-paketinhallintaa – `sudo apt update && sudo apt install curl`
 8. Lataa ja suorita Init.sh skripti – `bash <(curl https://raw.githubusercontent.com/cwchristerw/tjas-infra/refs/heads/master/init.sh)`
 **Palvelimen asennus**
 1. Asenna Debian-käyttöjärjestelmä
 2. Asenna curl-paketti käyttämällä APT-paketinhallintaa – `apt update && apt install curl`
@@ -14,12 +35,12 @@
 r1.net.tjas
 ```
 !
 version 12.4
 service timestamps debug datetime msec
 service timestamps log datetime msec
 no service password-encryption
 !
 !
 hostname r1.net.tjas
 !
 boot-start-marker
@@ -62,27 +83,35 @@ interface FastEthernet0/1.10
 description "TINU - INTERNET"
 encapsulation dot1Q 10
 ip address 192.168.1.1 255.255.255.224
 ip access-group 10 out
 ip helper-address 192.168.2.10
 ip nat inside
 no snmp trap link-status
 !
 interface FastEthernet0/1.20
 description "JUVA - INTRA"
 encapsulation dot1Q 20
 ip address 192.168.2.1 255.255.255.224
 ip access-group 20 out
 ip helper-address 192.168.2.10
 ip nat inside
 no snmp trap link-status
 !
 interface FastEthernet0/1.30
 description "AITO - TOIMISTO"
 encapsulation dot1Q 30
 ip address 192.168.3.1 255.255.255.224
 ip access-group 30 out
 ip helper-address 192.168.2.10
 ip nat inside
 no snmp trap link-status
 !
 interface FastEthernet0/1.69
 description "SIVE - HALLINTA"
 encapsulation dot1Q 69
 ip address 192.168.69.1 255.255.255.192
 ip access-group 69 in
 ip access-group 69 out
 ip helper-address 192.168.69.20
 no snmp trap link-status
 !
@@ -94,10 +123,43 @@ interface GigabitEthernet0/0/0
 ip classless
 !
 ip http server
 ip nat inside source list 1 interface FastEthernet0/0 overload
 !
 access-list 1 permit 192.168.1.0 0.0.0.31
 access-list 1 permit 192.168.2.0 0.0.0.31
 access-list 1 permit 192.168.3.0 0.0.0.31
 access-list 10 deny   192.168.0.0 0.0.255.255
 access-list 10 permit any
 access-list 20 permit 192.168.2.0 0.0.0.31
 access-list 20 deny   192.168.0.0 0.0.255.255
 access-list 20 permit any
 access-list 30 permit 192.168.2.10
 access-list 30 permit 192.168.3.0 0.0.0.31
 access-list 30 deny   192.168.0.0 0.0.255.255
 access-list 30 permit any
 access-list 69 permit 192.168.69.0 0.0.0.63
 !
 control-plane
 !
 banner motd ^C
  .-') _               ('-.      .-')
 (  OO) )             ( OO ).-. ( OO ).
 /     '._      ,--.  / . --. /(_)---\_)
 |'--...__) .-')| ,|  | \-.  \ /    _ |
 '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
    |  |   | `-'|  | \| |_.'  | '..`''.)
    |  |   ,--. |  |  |  .-.  |.-._)   \
    |  |   |  '-'  /  |  | |  |\       /
    `--'    `-----'   `--' `--' `-----'
 PVJJK 1.VOS NIINISALO
 r1.net.tjas
 ^C
 !
 line con 0
 line aux 0
@@ -113,11 +175,13 @@ end
 s1.net.tjas
 ```
 hostname "s1.net.tjas"
 ip default-gateway 192.168.1.1
 snmp-server community "public" Unrestricted
 vlan 1
   name "DEFAULT_VLAN"
-   untagged 1-52
+   untagged 4-52
   ip address dhcp-bootp
   no untagged 1-3
   exit
 vlan 10
   name "TINU"
@@ -140,6 +204,24 @@ vlan 69
   tagged 1-3
   exit
 ip authorized-managers 192.168.69.20 255.255.255.255
 banner motd "
  .-') _               ('-.      .-')
 (  OO) )             ( OO ).-. ( OO ).
 /     '._      ,--.  / . --. /(_)---\_)
 |'--...__) .-')| ,|  | \-.  \ /    _ |
 '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
    |  |   | `-'|  | \| |_.'  | '..`''.)
    |  |   ,--. |  |  |  .-.  |.-._)   \
    |  |   |  '-'  /  |  | |  |\       /
    `--'    `-----'   `--' `--' `-----'
 PVJJK 1.VOS NIINISALO
 s1.net.tjas
 "
 ip ssh
 password manager
 ```
@@ -147,16 +229,83 @@ password manager
 s2.net.tjas
 ```
 hostname "s2.net.tjas"
 interface 3
   disable
 exit
 interface 4
   disable
 exit
 interface 5
   disable
 exit
 interface 6
   disable
 exit
 interface 7
   disable
 exit
 interface 8
   disable
 exit
 interface 9
   disable
 exit
 interface 10
   disable
 exit
 interface 11
   disable
 exit
 interface 12
   disable
 exit
 interface 13
   disable
 exit
 interface 14
   disable
 exit
 interface 15
   disable
 exit
 interface 16
   disable
 exit
 interface 17
   disable
 exit
 interface 18
   disable
 exit
 interface 19
   disable
 exit
 interface 20
   disable
 exit
 interface 21
   disable
 exit
 interface 22
   disable
 exit
 interface 23
   disable
 exit
 interface 24
   disable
 exit
 ip default-gateway 192.168.2.1
 snmp-server community "public" Unrestricted
 vlan 1
   name "DEFAULT_VLAN"
-   untagged 25-28
+   untagged 3-28
   ip address dhcp-bootp
-   no untagged 1-24
+   no untagged 1-2
   exit
 vlan 20
   name "JUVA"
-   untagged 2-24
+   untagged 3-24
   ip address 192.168.2.2 255.255.255.224
   tagged 1-2
   exit
@@ -165,7 +314,25 @@ vlan 69
   ip address 192.168.69.12 255.255.255.192
   tagged 1-2
   exit
-ip authorized-managers 192.168.69.20 255.255.255.255
+ip authorized-managers 192.168.69.20
 banner motd "
  .-') _               ('-.      .-')
 (  OO) )             ( OO ).-. ( OO ).
 /     '._      ,--.  / . --. /(_)---\_)
 |'--...__) .-')| ,|  | \-.  \ /    _ |
 '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
    |  |   | `-'|  | \| |_.'  | '..`''.)
    |  |   ,--. |  |  |  .-.  |.-._)   \
    |  |   |  '-'  /  |  | |  |\       /
    `--'    `-----'   `--' `--' `-----'
 PVJJK 1.VOS NIINISALO
 s2.net.tjas
 "
 ip ssh
 password manager
 ```
@@ -173,6 +340,40 @@ password manager
 s3.net.tjas
 ```
 hostname "s3.net.tjas"
 interface 2
   disable
 exit
 interface 3
   disable
 exit
 interface 4
   disable
 exit
 interface 5
   disable
 exit
 interface 6
   disable
 exit
 interface 7
   disable
 exit
 interface 8
   disable
 exit
 interface 9
   disable
 exit
 interface 10
   disable
 exit
 interface 11
   disable
 exit
 interface 12
   disable
 exit
 ip default-gateway 192.168.3.1
 snmp-server community "public" Unrestricted
 vlan 1
   name "DEFAULT_VLAN"
@@ -182,9 +383,9 @@ vlan 1
   exit
 vlan 30
   name "AITO"
   untagged 13-24
   ip address 192.168.3.2 255.255.255.224
-   tagged 1,13-24
+   tagged 1
   untagged
   exit
 vlan 69
   name "SIVE"
@@ -192,7 +393,31 @@ vlan 69
   ip address 192.168.69.13 255.255.255.192
   tagged 1
   exit
-ip authorized-managers 192.168.69.20 255.255.255.255
+ip authorized-managers 192.168.69.20
 banner motd "
  .-') _               ('-.      .-')
 (  OO) )             ( OO ).-. ( OO ).
 /     '._      ,--.  / . --. /(_)---\_)
 |'--...__) .-')| ,|  | \-.  \ /    _ |
 '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
    |  |   | `-'|  | \| |_.'  | '..`''.)
    |  |   ,--. |  |  |  .-.  |.-._)   \
    |  |   |  '-'  /  |  | |  |\       /
    `--'    `-----'   `--' `--' `-----'
 PVJJK 1.VOS NIINISALO
 s3.net.tjas
 "
 ip ssh
 password manager
 ```
 # LÄHTEET
 ## ISSUE - ASCII ART
 ASCII Art Generator
 https://www.textmods.com/ascii-art
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 # Tietojärjestelmäasentajien Infra
-## PVJJK 1.VOS TJAS - Infra
+## PVJJK 1.VOS NIINISALO
 Infran toteutus aloitettiin vuonna 2025 ja sen on suunnitellut [Jääkäri Warén](https://christerwaren.fi).
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -1,5 +1,5 @@
 [defaults]
-inventory = inventories/pvjjk-1vos-tjas
+inventory = inventories/pvjjk-1vos-niinisalo
 hash_behaviour = merge
 gathering = smart
 display_skipped_hosts = false
--- a/files/dhcp/dhcpd.conf
+++ b/files/dhcp/dhcpd.conf
@@ -1,190 +0,0 @@
 # dhcpd.conf
 #
 # Sample configuration file for ISC dhcpd
 #
 # option definitions common to all supported networks...
 option domain-name "intra.tjas";
 option domain-name-servers 192.168.2.10;
 default-lease-time 600;
 max-lease-time 7200;
 # The ddns-updates-style parameter controls whether or not the server will
 # attempt to do a DNS update when a lease is confirmed. We default to the
 # behavior of the version 2 packages ('none', since DHCP v2 didn't
 # have support for DDNS.)
 ddns-update-style none;
 # If this DHCP server is the official DHCP server for the local
 # network, the authoritative directive should be uncommented.
 authoritative;
 # Use this to send dhcp log messages to a different log file (you also
 # have to hack syslog.conf to complete the redirection).
 #log-facility local7;
 # No service will be given on this subnet, but declaring it helps the
 # DHCP server to understand the network topology.
 #subnet 10.152.187.0 netmask 255.255.255.0 {
 #}
 # This is a very basic subnet declaration.
 #subnet 10.254.239.0 netmask 255.255.255.224 {
 #  range 10.254.239.10 10.254.239.20;
 #  option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
 #}
 # This declaration allows BOOTP clients to get dynamic addresses,
 # which we don't really recommend.
 #subnet 10.254.239.32 netmask 255.255.255.224 {
 #  range dynamic-bootp 10.254.239.40 10.254.239.60;
 #  option broadcast-address 10.254.239.31;
 #  option routers rtr-239-32-1.example.org;
 #}
 # A slightly different configuration for an internal subnet.
 #subnet 10.5.5.0 netmask 255.255.255.224 {
 #  range 10.5.5.26 10.5.5.30;
 #  option domain-name-servers ns1.internal.example.org;
 #  option domain-name "internal.example.org";
 #  option routers 10.5.5.1;
 #  option broadcast-address 10.5.5.31;
 #  default-lease-time 600;
 #  max-lease-time 7200;
 #}
 # Hosts which require special configuration options can be listed in
 # host statements.   If no address is specified, the address will be
 # allocated dynamically (if possible), but the host-specific information
 # will still come from the host declaration.
 #host passacaglia {
 #  hardware ethernet 0:0:c0:5d:bd:95;
 #  filename "vmunix.passacaglia";
 #  server-name "toccata.example.com";
 #}
 # Fixed IP addresses can also be specified for hosts.   These addresses
 # should not also be listed as being available for dynamic assignment.
 # Hosts for which fixed IP addresses have been specified can boot using
 # BOOTP or DHCP.   Hosts for which no fixed address is specified can only
 # be booted with DHCP, unless there is an address range on the subnet
 # to which a BOOTP client is connected which has the dynamic-bootp flag
 # set.
 #host fantasia {
 #  hardware ethernet 08:00:07:26:c0:a5;
 #  fixed-address fantasia.example.com;
 #}
 # You can declare a class of clients and then do address allocation
 # based on that.   The example below shows a case where all clients
 # in a certain class get addresses on the 10.17.224/24 subnet, and all
 # other clients get addresses on the 10.0.29/24 subnet.
 #class "foo" {
 #  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
 #}
 #shared-network 224-29 {
 #  subnet 10.17.224.0 netmask 255.255.255.0 {
 #    option routers rtr-224.example.org;
 #  }
 #  subnet 10.0.29.0 netmask 255.255.255.0 {
 #    option routers rtr-29.example.org;
 #  }
 #  pool {
 #    allow members of "foo";
 #    range 10.17.224.10 10.17.224.250;
 #  }
 #  pool {
 #    deny members of "foo";
 #    range 10.0.29.10 10.0.29.230;
 #  }
 #}
 subnet 192.168.1.0 netmask 255.255.255.240 {
    range 192.168.1.2 192.168.1.14;
    option routers 192.168.1.1;
    option broadcast-address 192.168.1.15;
    host r1.net.tjas {
        hardware ethernet 00:1d:46:dc:80:09;
        fixed-address 192.168.1.1;
    }
    host s1.net.tjas {
        hardware ethernet 9c:8e:99:9b:c3:80;
        fixed-address 192.168.1.2;
    }
 }
 subnet 192.168.2.0 netmask 255.255.255.224 {
    range 192.168.2.2 192.168.2.30;
    option routers 192.168.2.1;
    option broadcast-address 192.168.2.31;
    host r1.net.tjas {
        hardware ethernet 00:1d:46:dc:80:09;
        fixed-address 192.168.2.1;
    }
    host s2.net.tjas {
        hardware ethernet 00:24:a8:f1:c7:40;
        fixed-address 192.168.2.2;
    }
    host olympus.intra.tjas {
        hardware ethernet 90:1b:0e:5b:18:fa;
        fixed-address 192.168.2.10;
    }
 }
 subnet 192.168.3.0 netmask 255.255.255.224 {
    range 192.168.3.2 192.168.3.30;
    option routers 192.168.3.1;
    option broadcast-address 192.168.3.31;
    host r1.net.tjas {
        hardware ethernet 00:1d:46:dc:80:09;
        fixed-address 192.168.3.1;
    }
    host s3.net.tjas {
        hardware ethernet 00:1f:fe:ab:9e:c0;
        fixed-address 192.168.3.2;
    }
 }
 subnet 192.168.69.0 netmask 255.255.255.192 {
    range 192.168.69.2 192.168.69.62;
    option broadcast-address 192.168.69.63;
    host r1.net.tjas {
        hardware ethernet 00:1d:46:dc:80:09;
        fixed-address 192.168.69.1;
    }
    host s1.net.tjas {
        hardware ethernet 9c:8e.99:9b:c3:80;
        fixed-address 192.168.3.11;
    }
    host s2.net.tjas {
        hardware ethernet 00:24:a8:f1:c7:40;
        fixed-address 192.168.3.12;
    }
    host s3.net.tjas {
        hardware ethernet 00:1f:fe:ab:9e:c0;
        fixed-address 192.168.3.13;
    }
    host olympus.intra.tjas {
        hardware ethernet 90:1b:0e:5b:18:fa;
        fixed-address 192.168.69.20;
    }
 }
--- a/files/dnsdist/config.conf
+++ b/files/dnsdist/config.conf
@@ -0,0 +1,12 @@
 setLocal('0.0.0.0:53')
 addLocal('[::]:53')
 setACL({'0.0.0.0/0', '::/0'})
 setECSOverride(true)
 setECSSourcePrefixV4(32)
 setECSSourcePrefixV6(128)
 newServer({address='127.0.0.1:531', useClientSubnet=true, pool='authorative'})
 newServer({ address='127.0.0.1:532', useClientSubnet=true, pool='recursor' })
 addAction('tjas', PoolAction('authorative'))
 addAction(AllRule(), PoolAction('recursor'))
 setSecurityPollSuffix("")
 setServFailWhenNoServer(true)
--- a/files/issue
+++ b/files/issue
@@ -0,0 +1,25 @@
 .-') _               ('-.      .-')
 (  OO) )             ( OO ).-. ( OO ).
 /     '._      ,--.  / . --. /(_)---\_)
 |'--...__) .-')| ,|  | \-.  \ /    _ |
 '--.  .--'( OO |(_|.-'-'  |  |\  :` `.
   |  |   | `-'|  | \| |_.'  | '..`''.)
   |  |   ,--. |  |  |  .-.  |.-._)   \
   |  |   |  '-'  /  |  | |  |\       /
   `--'    `-----'   `--' `--' `-----'
 PVJJK 1.VOS NIINISALO
 TIETOJÄRJESTELMÄASENTAJIEN INTRA
 olympus.juva.tjas
 Made by
 Jääkäri Warén
 https://christerwaren.fi
--- a/files/kea/kea-dhcp4.conf
+++ b/files/kea/kea-dhcp4.conf
@@ -1,461 +1,232 @@
 // This is a basic configuration for the Kea DHCPv4 server. Subnet declarations
 // are mostly commented out and no interfaces are listed. Therefore, the servers
 // will not listen or respond to any queries.
 // The basic configuration must be extended to specify interfaces on which
 // the servers should listen. There are a number of example options defined.
 // These probably don't make any sense in your network. Make sure you at least
 // update the following, before running this example in your network:
 // - change the network interface names
 // - change the subnets to match your actual network
 // - change the option values to match your network
 //
 // This is just a very basic configuration. Kea comes with large suite (over 30)
 // of configuration examples and extensive Kea User's Guide. Please refer to
 // those materials to get better understanding of what this software is able to
 // do. Comments in this configuration file sometimes refer to sections for more
 // details. These are section numbers in Kea User's Guide. The version matching
 // your software should come with your Kea package, but it is also available
 // in ISC's Knowledgebase (https://kea.readthedocs.io; the direct link for
 // the stable version is https://kea.readthedocs.io/).
 //
 // This configuration file contains only DHCPv4 server's configuration.
 // If configurations for other Kea services are also included in this file they
 // are ignored by the DHCPv4 server.
 {
-
+    "Dhcp4": {
-// DHCPv4 configuration starts here. This section will be read by DHCPv4 server
+        "interfaces-config": {
-// and will be ignored by other components.
+            "interfaces": [ "enp0s25.20" ]
 "Dhcp4": {
    // Add names of your network interfaces to listen on.
    "interfaces-config": {
        // See section 8.2.4 for more details. You probably want to add just
        // interface name (e.g. "eth0" or specific IPv4 address on that
        // interface name (e.g. "eth0/192.0.2.1").
        "interfaces": [ ]
        // Kea DHCPv4 server by default listens using raw sockets. This ensures
        // all packets, including those sent by directly connected clients
        // that don't have IPv4 address yet, are received. However, if your
        // traffic is always relayed, it is often better to use regular
        // UDP sockets. If you want to do that, uncomment this line:
        // "dhcp-socket-type": "udp"
    },
    // Kea supports control channel, which is a way to receive management
    // commands while the server is running. This is a Unix domain socket that
    // receives commands formatted in JSON, e.g. config-set (which sets new
    // configuration), config-reload (which tells Kea to reload its
    // configuration from file), statistic-get (to retrieve statistics) and many
    // more. For detailed description, see Sections 8.8, 16 and 15.
    "control-socket": {
        "socket-type": "unix",
        "socket-name": "/run/kea/kea4-ctrl-socket"
    },
    // Use Memfile lease database backend to store leases in a CSV file.
    // Depending on how Kea was compiled, it may also support SQL databases
    // (MySQL and/or PostgreSQL). Those database backends require more
    // parameters, like name, host and possibly user and password.
    // There are dedicated examples for each backend. See Section 7.2.2 "Lease
    // Storage" for details.
    "lease-database": {
        // Memfile is the simplest and easiest backend to use. It's an in-memory
        // C++ database that stores its state in CSV file.
        "type": "memfile",
        "lfc-interval": 3600
    },
    // Kea allows storing host reservations in a database. If your network is
    // small or you have few reservations, it's probably easier to keep them
    // in the configuration file. If your network is large, it's usually better
    // to use database for it. To enable it, uncomment the following:
    // "hosts-database": {
    //     "type": "mysql",
    //     "name": "kea",
    //     "user": "kea",
    //     "password": "kea",
    //     "host": "localhost",
    //     "port": 3306
    // },
    // See Section 7.2.3 "Hosts storage" for details.
    // Setup reclamation of the expired leases and leases affinity.
    // Expired leases will be reclaimed every 10 seconds. Every 25
    // seconds reclaimed leases, which have expired more than 3600
    // seconds ago, will be removed. The limits for leases reclamation
    // are 100 leases or 250 ms for a single cycle. A warning message
    // will be logged if there are still expired leases in the
    // database after 5 consecutive reclamation cycles.
    "expired-leases-processing": {
        "reclaim-timer-wait-time": 10,
        "flush-reclaimed-timer-wait-time": 25,
        "hold-reclaimed-time": 3600,
        "max-reclaim-leases": 100,
        "max-reclaim-time": 250,
        "unwarned-reclaim-cycles": 5
    },
    // Global timers specified here apply to all subnets, unless there are
    // subnet specific values defined in particular subnets.
    "renew-timer": 900,
    "rebind-timer": 1800,
    "valid-lifetime": 3600,
    // Many additional parameters can be specified here:
    // - option definitions (if you want to define vendor options, your own
    //                       custom options or perhaps handle standard options
    //                       that Kea does not support out of the box yet)
    // - client classes
    // - hooks
    // - ddns information (how the DHCPv4 component can reach a DDNS daemon)
    //
    // Some of them have examples below, but there are other parameters.
    // Consult Kea User's Guide to find out about them.
    // These are global options. They are going to be sent when a client
    // requests them, unless overwritten with values in more specific scopes.
    // The scope hierarchy is:
    // - global (most generic, can be overwritten by class, subnet or host)
    // - class (can be overwritten by subnet or host)
    // - subnet (can be overwritten by host)
    // - host (most specific, overwrites any other scopes)
    //
    // Not all of those options make sense. Please configure only those that
    // are actually useful in your network.
    //
    // For a complete list of options currently supported by Kea, see
    // Section 7.2.8 "Standard DHCPv4 Options". Kea also supports
    // vendor options (see Section 7.2.10) and allows users to define their
    // own custom options (see Section 7.2.9).
    "option-data": [
        // When specifying options, you typically need to specify
        // one of (name or code) and data. The full option specification
        // covers name, code, space, csv-format and data.
        // space defaults to "dhcp4" which is usually correct, unless you
        // use encapsulate options. csv-format defaults to "true", so
        // this is also correct, unless you want to specify the whole
        // option value as long hex string. For example, to specify
        // domain-name-servers you could do this:
        // {
        //     "name": "domain-name-servers",
        //     "code": 6,
        //     "csv-format": "true",
        //     "space": "dhcp4",
        //     "data": "192.0.2.1, 192.0.2.2"
        // }
        // but it's a lot of writing, so it's easier to do this instead:
        {
            "name": "domain-name-servers",
            "data": "192.0.2.1, 192.0.2.2"
        },
-
+        "control-socket": {
-        // Typically people prefer to refer to options by their names, so they
+            "socket-type": "unix",
-        // don't need to remember the code names. However, some people like
+            "socket-name": "/run/kea/kea4-ctrl-socket"
        // to use numerical values. For example, option "domain-name" uses
        // option code 15, so you can reference to it either by
        // "name": "domain-name" or "code": 15.
        {
            "code": 15,
            "data": "example.org"
        },
-
+        "lease-database": {
-        // Domain search is also a popular option. It tells the client to
+            "type": "mysql",
-        // attempt to resolve names within those specified domains. For
+            "name": "{{ config.mariadb.users['kea'].database }}",
-        // example, name "foo" would be attempted to be resolved as
+            "user": "{{ config.mariadb.users['kea'].username }}",
-        // foo.mydomain.example.com and if it fails, then as foo.example.com
+            "password": "{{ config.mariadb.users['kea'].password }}",
-        {
+            "host": "127.0.0.1",
-            "name": "domain-search",
+            "port": 3306
            "data": "mydomain.example.com, example.com"
        },
-
+        "expired-leases-processing": {
-        // String options that have a comma in their values need to have
+            "reclaim-timer-wait-time": 10,
-        // it escaped (i.e. each comma is preceded by two backslashes).
+            "flush-reclaimed-timer-wait-time": 25,
-        // That's because commas are reserved for separating fields in
+            "hold-reclaimed-time": 3600,
-        // compound options. At the same time, we need to be conformant
+            "max-reclaim-leases": 100,
-        // with JSON spec, that does not allow "\,". Therefore the
+            "max-reclaim-time": 250,
-        // slightly uncommon double backslashes notation is needed.
+            "unwarned-reclaim-cycles": 5
        // Legal JSON escapes are \ followed by "\/bfnrt character
        // or \u followed by 4 hexadecimal numbers (currently Kea
        // supports only \u0000 to \u00ff code points).
        // CSV processing translates '\\' into '\' and '\,' into ','
        // only so for instance '\x' is translated into '\x'. But
        // as it works on a JSON string value each of these '\'
        // characters must be doubled on JSON input.
        {
            "name": "boot-file-name",
            "data": "EST5EDT4\\,M3.2.0/02:00\\,M11.1.0/02:00"
        },
-
+        "renew-timer": 900,
-        // Options that take integer values can either be specified in
+        "rebind-timer": 1800,
-        // dec or hex format. Hex format could be either plain (e.g. abcd)
+        "valid-lifetime": 3600,
-        // or prefixed with 0x (e.g. 0xabcd).
+        "subnet4": [
        {
            "name": "default-ip-ttl",
            "data": "0xf0"
        }
        // Note that Kea provides some of the options on its own. In particular,
        // it sends IP Address lease type (code 51, based on valid-lifetime
        // parameter, Subnet mask (code 1, based on subnet definition), Renewal
        // time (code 58, based on renew-timer parameter), Rebind time (code 59,
        // based on rebind-timer parameter).
    ],
    // Other global parameters that can be defined here are option definitions
    // (this is useful if you want to use vendor options, your own custom
    // options or perhaps handle options that Kea does not handle out of the box
    // yet).
    // You can also define classes. If classes are defined, incoming packets
    // may be assigned to specific classes. A client class can represent any
    // group of devices that share some common characteristic, e.g. Windows
    // devices, iphones, broken printers that require special options, etc.
    // Based on the class information, you can then allow or reject clients
    // to use certain subnets, add special options for them or change values
    // of some fixed fields.
    "client-classes": [
        {
            // This specifies a name of this class. It's useful if you need to
            // reference this class.
            "name": "voip",
            // This is a test. It is an expression that is being evaluated on
            // each incoming packet. It is supposed to evaluate to either
            // true or false. If it's true, the packet is added to specified
            // class. See Section 12 for a list of available expressions. There
            // are several dozens. Section 8.2.14 for more details for DHCPv4
            // classification and Section 9.2.19 for DHCPv6.
            "test": "substring(option[60].hex,0,6) == 'Aastra'",
            // If a client belongs to this class, you can define extra behavior.
            // For example, certain fields in DHCPv4 packet will be set to
            // certain values.
            "next-server": "192.0.2.254",
            "server-hostname": "hal9000",
            "boot-file-name": "/dev/null"
            // You can also define option values here if you want devices from
            // this class to receive special options.
        }
    ],
    // Another thing possible here are hooks. Kea supports a powerful mechanism
    // that allows loading external libraries that can extract information and
    // even influence how the server processes packets. Those libraries include
    // additional forensic logging capabilities, ability to reserve hosts in
    // more flexible ways, and even add extra commands. For a list of available
    // hook libraries, see https://gitlab.isc.org/isc-projects/kea/wikis/Hooks-available.
    // "hooks-libraries": [
    //   {
    //       // Forensic Logging library generates forensic type of audit trail
    //       // of all devices serviced by Kea, including their identifiers
    //       // (like MAC address), their location in the network, times
    //       // when they were active etc.
    //       "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_legal_log.so",
    //       "parameters": {
    //           "path": "/var/lib/kea",
    //           "base-name": "kea-forensic4"
    //       }
    //   },
    //   {
    //       // Flexible identifier (flex-id). Kea software provides a way to
    //       // handle host reservations that include addresses, prefixes,
    //       // options, client classes and other features. The reservation can
    //       // be based on hardware address, DUID, circuit-id or client-id in
    //       // DHCPv4 and using hardware address or DUID in DHCPv6. However,
    //       // there are sometimes scenario where the reservation is more
    //       // complex, e.g. uses other options that mentioned above, uses part
    //       // of specific options or perhaps even a combination of several
    //       // options and fields to uniquely identify a client. Those scenarios
    //       // are addressed by the Flexible Identifiers hook application.
    //       "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_flex_id.so",
    //       "parameters": {
    //           "identifier-expression": "relay4[2].hex"
    //       }
    //   }
    // ],
    // Below an example of a simple IPv4 subnet declaration. Uncomment to enable
    // it. This is a list, denoted with [ ], of structures, each denoted with
    // { }. Each structure describes a single subnet and may have several
    // parameters. One of those parameters is "pools" that is also a list of
    // structures.
    "subnet4": [
        {
            // This defines the whole subnet. Kea will use this information to
            // determine where the clients are connected. This is the whole
            // subnet in your network. This is mandatory parameter for each
            // subnet.
            "subnet": "192.0.2.0/24",
            // Pools define the actual part of your subnet that is governed
            // by Kea. Technically this is optional parameter, but it's
            // almost always needed for DHCP to do its job. If you omit it,
            // clients won't be able to get addresses, unless there are
            // host reservations defined for them.
            "pools": [ { "pool": "192.0.2.1 - 192.0.2.200" } ],
            // These are options that are subnet specific. In most cases,
            // you need to define at least routers option, as without this
            // option your clients will not be able to reach their default
            // gateway and will not have Internet connectivity.
            "option-data": [
                {
                    // For each IPv4 subnet you most likely need to specify at
                    // least one router.
                    "name": "routers",
                    "data": "192.0.2.1"
                }
            ],
            // Kea offers host reservations mechanism. Kea supports reservations
            // by several different types of identifiers: hw-address
            // (hardware/MAC address of the client), duid (DUID inserted by the
            // client), client-id (client identifier inserted by the client) and
            // circuit-id (circuit identifier inserted by the relay agent).
            //
            // Kea also support flexible identifier (flex-id), which lets you
            // specify an expression that is evaluated for each incoming packet.
            // Resulting value is then used for as an identifier.
            //
            // Note that reservations are subnet-specific in Kea. This is
            // different than ISC DHCP. Keep that in mind when migrating
            // your configurations.
            "reservations": [
                // This is a reservation for a specific hardware/MAC address.
                // It's a rather simple reservation: just an address and nothing
                // else.
                {
                    "hw-address": "1a:1b:1c:1d:1e:1f",
                    "ip-address": "192.0.2.201"
                },
                // This is a reservation for a specific client-id. It also shows
                // the this client will get a reserved hostname. A hostname can
                // be defined for any identifier type, not just client-id.
                {
                    "client-id": "01:11:22:33:44:55:66",
                    "ip-address": "192.0.2.202",
                    "hostname": "special-snowflake"
                },
                // The third reservation is based on DUID. This reservation defines
                // a special option values for this particular client. If the
                // domain-name-servers option would have been defined on a global,
                // subnet or class level, the host specific values take preference.
                {
                    "duid": "01:02:03:04:05",
                    "ip-address": "192.0.2.203",
                    "option-data": [ {
                        "name": "domain-name-servers",
                        "data": "10.1.1.202, 10.1.1.203"
                    } ]
                },
                // The fourth reservation is based on circuit-id. This is an option
                // inserted by the relay agent that forwards the packet from client
                // to the server.  In this example the host is also assigned vendor
                // specific options.
                //
                // When using reservations, it is useful to configure
                // reservations-global, reservations-in-subnet,
                // reservations-out-of-pool (subnet specific parameters)
                // and host-reservation-identifiers (global parameter).
                {
                    "client-id": "01:12:23:34:45:56:67",
                    "ip-address": "192.0.2.204",
                    "option-data": [
                        {
                            "name": "vivso-suboptions",
                            "data": "4491"
                        },
                        {
                            "name": "tftp-servers",
                            "space": "vendor-4491",
                            "data": "10.1.1.202, 10.1.1.203"
                        }
                    ]
                },
                // This reservation is for a client that needs specific DHCPv4
                // fields to be set. Three supported fields are next-server,
                // server-hostname and boot-file-name
                {
                    "client-id": "01:0a:0b:0c:0d:0e:0f",
                    "ip-address": "192.0.2.205",
                    "next-server": "192.0.2.1",
                    "server-hostname": "hal9000",
                    "boot-file-name": "/dev/null"
                },
                // This reservation is using flexible identifier. Instead of
                // relying on specific field, sysadmin can define an expression
                // similar to what is used for client classification,
                // e.g. substring(relay[0].option[17],0,6). Then, based on the
                // value of that expression for incoming packet, the reservation
                // is matched. Expression can be specified either as hex or
                // plain text using single quotes.
                //
                // Note: flexible identifier requires flex_id hook library to be
                // loaded to work.
                {
                    "flex-id": "'s0mEVaLue'",
                    "ip-address": "192.0.2.206"
                }
                // You can add more reservations here.
            ]
            // You can add more subnets there.
        }
    ],
    // There are many, many more parameters that DHCPv4 server is able to use.
    // They were not added here to not overwhelm people with too much
    // information at once.
    // Logging configuration starts here. Kea uses different loggers to log various
    // activities. For details (e.g. names of loggers), see Chapter 18.
    "loggers": [
    {
        // This section affects kea-dhcp4, which is the base logger for DHCPv4
        // component. It tells DHCPv4 server to write all log messages (on
        // severity INFO or more) to a file.
        "name": "kea-dhcp4",
        "output_options": [
            {
-                // Specifies the output file. There are several special values
+                "id": 1,
-                // supported:
+                "subnet": "192.168.1.0/27",
-                // - stdout (prints on standard output)
+                "pools": [
-                // - stderr (prints on standard error)
+                    {
-                // - syslog (logs to syslog)
+                        "pool": "192.168.1.1 - 192.168.1.30"
-                // - syslog:name (logs to syslog using specified name)
+                    }
-                // Any other value is considered a name of the file
+                ],
-                "output": "stdout",
+                "option-data": [
-
+                    {
-                // Shorter log pattern suitable for use with systemd,
+                        "name": "routers",
-                // avoids redundant information
+                        "data": "192.168.1.1"
-                "pattern": "%-5p %m\n",
+                    },
-
+                    {
-                // This governs whether the log output is flushed to disk after
+                        "name": "domain-name-servers",
-                // every write.
+                        "data": "1.1.1.1"
-                // "flush": false,
+                    },
-
+                    {
-                // This specifies the maximum size of the file before it is
+                        "name": "domain-search",
-                // rotated.
+                        "data": "puolustusvoimat.fi"
-                // "maxsize": 1048576,
+                    }
-
+                ],
-                // This specifies the maximum number of rotated files to keep.
+                "user-context": {
-                // "maxver": 8
+                    "name": "Tinu",
                    "purpose": "Internet"
                },
                "reservations": [
                    {
                        "hw-address": "00:1d:46:dc:80:09",
                        "ip-address": "192.168.1.1",
                        "hostname": "r1.net.tjas"
                    },
                    {
                        "hw-address": "9c:8e:99:9b:c3:80",
                        "ip-address": "192.168.1.2",
                        "hostname": "s1.net.tjas"
                    }
                ]
            },
            {
                "id": 2,
                "subnet": "192.168.2.0/27",
                "interface": "enp0s25.20",
                "pools": [
                    {
                        "pool": "192.168.2.1 - 192.168.2.30"
                    }
                ],
                "option-data": [
                    {
                        "name": "routers",
                        "data": "192.168.2.1"
                    },
                    {
                        "name": "domain-name-servers",
                        "data": "192.168.2.10, 1.1.1.1"
                    },
                    {
                        "name": "domain-name",
                        "data": "juva.tjas"
                    },
                    {
                        "name": "domain-search",
                        "data": "juva.tjas, tjas"
                    }
                ],
                "user-context": {
                    "name": "Juva",
                    "purpose": "Intra"
                },
                "reservations": [
                    {
                        "hw-address": "00:1d:46:dc:80:09",
                        "ip-address": "192.168.2.1",
                        "hostname": "r1.net.tjas"
                    },
                    {
                        "hw-address": "00:24:a8:f1:c7:40",
                        "ip-address": "192.168.2.2",
                        "hostname": "s2.net.tjas"
                    },
                    {
                        "hw-address": "90:1b:0e:5b:18:fb",
                        "ip-address": "192.168.2.10",
                        "hostname": "olympus.juva.tjas"
                    }
                ]
            },
            {
                "id": 3,
                "subnet": "192.168.3.0/27",
                "pools": [
                    {
                        "pool": "192.168.3.1 - 192.168.3.30"
                    }
                ],
                "option-data": [
                    {
                        "name": "routers",
                        "data": "192.168.3.1"
                    },
                    {
                        "name": "domain-name-servers",
                        "data": "192.168.2.10"
                    },
                    {
                        "name": "domain-name",
                        "data": "aito.tjas"
                    },
                    {
                        "name": "domain-search",
                        "data": "aito.tjas, tjas"
                    }
                ],
                "user-context": {
                    "name": "Aito",
                    "purpose": "Toimisto"
                },
                "reservations": [
                    {
                        "hw-address": "00:1d:46:dc:80:09",
                        "ip-address": "192.168.3.1",
                        "hostname": "r1.net.tjas"
                    },
                    {
                        "hw-address": "00:1f:fe:ab:9e:c0",
                        "ip-address": "192.168.3.2",
                        "hostname": "s3.net.tjas"
                    }
                ]
            },
            {
                "id": 69,
                "subnet": "192.168.69.0/26",
                "interface": "enp0s25.69",
                "pools": [
                    {
                        "pool": "192.168.69.1 - 192.168.69.62"
                    }
                ],
                "option-data": [
                    {
                        "name": "domain-name-servers",
                        "data": "192.168.69.20"
                    },
                    {
                        "name": "domain-name",
                        "data": "sive.tjas"
                    },
                    {
                        "name": "domain-search",
                        "data": "sive.tjas"
                    }
                ],
                "user-context": {
                    "name": "Sive",
                    "purpose": "Hallinta"
                },
                "reservations": [
                    {
                        "hw-address": "00:1d:46:dc:80:09",
                        "ip-address": "192.168.69.1",
                        "hostname": "r1.net.tjas"
                    },
                    {
                        "hw-address": "9c:8e:99:9b:c3:80",
                        "ip-address": "192.168.69.11",
                        "hostname": "s1.net.tjas"
                    },
                    {
                        "hw-address": "00:24:a8:f1:c7:40",
                        "ip-address": "192.168.69.12",
                        "hostname": "s2.net.tjas"
                    },
                    {
                        "hw-address": "00:1f:fe:ab:9e:c0",
                        "ip-address": "192.168.69.13",
                        "hostname": "s3.net.tjas"
                    },
                    {
                        "hw-address": "90:1b:0e:5b:18:fc",
                        "ip-address": "192.168.69.20",
                        "hostname": "olympus.juva.tjas"
                    }
                ]
            }
        ],
        // This specifies the severity of log messages to keep. Supported values
        // are: FATAL, ERROR, WARN, INFO, DEBUG
        "severity": "ERROR",
-        // If DEBUG level is specified, this value is used. 0 is least verbose,
+        "loggers": [
-        // 99 is most verbose. Be cautious, Kea can generate lots and lots
+            {
-        // of logs if told to do so.
+                "name": "kea-dhcp4",
-        "debuglevel": 0
+                "output_options": [
                    {
                        "output": "stdout",
                        "pattern": "%-5p %m\n"
                    }
                ],
                "severity": "ERROR",
                "debuglevel": 0
            }
        ]
    }
  ]
 }
 }
--- a/files/motd
+++ b/files/motd
@@ -0,0 +1,29 @@
  _____                             _       _ _      _
 |_   _|_ _ _ __   __ _  ___       | |_   _| (_) ___| |_
   | |/ _` | '_ \ / _` |/ _ \   _  | | | | | | |/ _ \ __|
   | | (_| | | | | (_| | (_) | | |_| | |_| | | |  __/ |_
   |_|\__,_|_| |_|\__, |\___/   \___/ \__,_|_|_|\___|\__|
     _    _       |___/         ____  _
    / \  | |_ __ | |__   __ _  / ___|(_) ___ _ __ _ __ __ _
   / _ \ | | '_ \| '_ \ / _` | \___ \| |/ _ \ '__| '__/ _` |
  / ___ \| | |_) | | | | (_| |  ___) | |  __/ |  | | | (_| |
 /_/   \_\_| .__/|_| |_|\__,_| |____/|_|\___|_|  |_|  \__,_|
           |_|
 PVJJK 1.VOS NIINISALO
 TIETOJÄRJESTELMÄASENTAJIEN INTRA
 olympus.juva.tjas
 Palvelimen hallinta on automatisoitu. Manuaaliset muutokset saatetaan
 ylikirjoittaa automatisoidusti.
 https://github.com/cwchristerw/tjas-intra
--- a/files/networking/interfaces
+++ b/files/networking/interfaces
@@ -12,7 +12,12 @@ allow-hotplug enp0s25
 iface enp0s25 inet dhcp
 auto enp0s25.20
-iface enp0s25.20 inet dhcp
+iface enp0s25.20 inet static
  address 192.168.2.10/27
  gateway 192.168.2.1
  hwaddress 90:1b:0e:5b:18:fb
 auto enp0s25.69
-iface enp0s25.69 inet dhcp
+iface enp0s25.69 inet static
  address 192.168.69.20/26
  hwaddress 90:1b:0e:5b:18:fc
--- a/files/nginx/conf/000-default.conf
+++ b/files/nginx/conf/000-default.conf
@@ -37,8 +37,8 @@ server {
 #     http2 on;
-#     ssl_certificate /etc/nginx/certs/pvjjk-1vos-tjas/fullchain.pem;
+#     ssl_certificate /etc/nginx/certs/pvjjk-1vos-niinisalo/fullchain.pem;
-#     ssl_certificate_key /etc/nginx/certs/pvjjk-1vos-tjas/privkey.pem;
+#     ssl_certificate_key /etc/nginx/certs/pvjjk-1vos-niinisalo/privkey.pem;
 #     ssl_protocols TLSv1.2 TLSv1.3;
 #     ssl_ecdh_curve X25519:prime256v1:secp384r1;
 #     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
@@ -46,7 +46,7 @@ server {
 #     ssl_session_cache shared:SSL:20m;
 #     ssl_session_timeout 180m;
-#     ssl_trusted_certificate /etc/nginx/certs/pvjjk-1vos-tjas/chain.pem;
+#     ssl_trusted_certificate /etc/nginx/certs/pvjjk-1vos-niinisalo/chain.pem;
 #     expires off;
 #     etag off;
--- a/files/powerdns-authorative/config.conf
+++ b/files/powerdns-authorative/config.conf
@@ -1,6 +1,6 @@
 local-address=0.0.0.0,::
-local-port=53
+local-port=531
-default-soa-content=s1.intra.tjas no-reply.intra.tjas 0 10800 3600 604800 3600
+default-soa-content=olympus.juva.tjas no-reply.intra.tjas 0 10800 3600 604800 3600
 launch=gmysql
 gmysql-host=127.0.0.1
 gmysql-port=3306
--- a/files/powerdns-recursor/config.conf
+++ b/files/powerdns-recursor/config.conf
@@ -0,0 +1,9 @@
 incoming:
  listen:
    - 127.0.0.1:532
 recursor:
  forward_zones:
    - zone: tjas
      recurse: false
      forwarders:
        - 127.0.0.1:531
--- a/files/ssh/authorized_keys
+++ b/files/ssh/authorized_keys
@@ -1,2 +1,2 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClWZxHhmgV2LD3mrbLU2VxPXGMx02WaB5MU9t8XJsqAmsIKwUZSqHTrlR20dXPGlZhe5Rx4vf+ZKx0kuNKJMvswEkvpP0la9WSsawWHxhOTrqDr0yZMV1/CncdARw1vse3zJCQVbOflbKYsKgpdJHbMzk5SfSZijSscrgxRTa8qX/ndnmlGrgm4MxezgFBEJrzC4vCTZLK5LPkAva+2A6fwElgR7V1Dkg5p5l0/nvKbBje+ugaiTw7RPy42oC/hHrsvsnTQ4KheD1phRJFCSEnj6l7gxVetVBznZ/K697MrK4aNUFLDV29uiPALj+1fWAYTIO3WPNU/QkH7OEP8JO3 l1.office.tjas
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClWZxHhmgV2LD3mrbLU2VxPXGMx02WaB5MU9t8XJsqAmsIKwUZSqHTrlR20dXPGlZhe5Rx4vf+ZKx0kuNKJMvswEkvpP0la9WSsawWHxhOTrqDr0yZMV1/CncdARw1vse3zJCQVbOflbKYsKgpdJHbMzk5SfSZijSscrgxRTa8qX/ndnmlGrgm4MxezgFBEJrzC4vCTZLK5LPkAva+2A6fwElgR7V1Dkg5p5l0/nvKbBje+ugaiTw7RPy42oC/hHrsvsnTQ4KheD1phRJFCSEnj6l7gxVetVBznZ/K697MrK4aNUFLDV29uiPALj+1fWAYTIO3WPNU/QkH7OEP8JO3 argo.aito.tjas
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPW5phGhwAG8dmT+sR0uF1gRc0X9xXZiiFxvKUEsPk1N cwchristerw
--- a/files/yggdrasil/config.conf
+++ b/files/yggdrasil/config.conf
@@ -6,11 +6,17 @@
    # use this section when you may connect via different interfaces.
    Peers: [
-        #TRUSTED PEERS - Waren Group
+{% if config.yggdrasil.peers is defined %}
-        #aurora.devices.waren.io
+        #TRUSTED PEERS
-        #201:361f:bbfb:7210:c5b8:3f74:a285:adb9
+{% for peer in config.yggdrasil.peers %}
-        "tls://[2a01:4f9:2a:60c::2]:18836",
+{% if peer.name is defined and peer.address is defined and peer.address is defined %}
-        "tls://95.216.5.243:18836",
+
        #{{ peer.name }}
        "{{ peer.address }}"{% if not loop.last %},{% endif %}
 {% endif %}
 {% endfor %}
 {% endif %}
    ]
    # List of connection strings for static peers in URI format, arranged
--- a/init.sh
+++ b/init.sh
@@ -4,63 +4,74 @@ if [ ! "$BASH_VERSION" ] ; then
    exit 1
 fi
 underline=`tput smul`
 nounderline=`tput rmul`
 bold=$(tput bold)
 normal=$(tput sgr0)
 ti-header(){
-    echo $(tput bold)$1$(tput sgr0)
+    echo ${bold}$1${normal}
 }
 echo "${bold}"
 echo "
-==============================
+ .-') _               ('-.      .-')
-
+(  OO) )             ( OO ).-. ( OO ).
-PVJJK 1.VOS TJAS - Infra
+/     '._      ,--.  / . --. /(_)---\_)
-Init Script
+|'--...__) .-')| ,|  | \-.  \ /    _ |
-
+'--.  .--'( OO |(_|.-'-'  |  |\  :\` \`.
------------------------------
+   |  |   | \`-'|  | \| |_.'  | '..\`''.)
   |  |   ,--. |  |  |  .-.  |.-._)   \\
   |  |   |  '-'  /  |  | |  |\       /
   \`--'    \`-----'   \`--' \`--' \`-----'
 "
 echo "
 PVJJK 1.VOS NIINISALO
 TIETOJÄRJESTELMÄASENTAJIEN INTRA
 INIT SCRIPT
 "
 echo -n "${normal}"
 stop () {
 echo "
 ==============================
 "
 exit 1
 }
 ti-header "Haetaan pakettien tiedot..."
-apt update
+sudo apt update
 echo -e "\n\n"
 ti-header "Asennetaan PVJJK 1.VOS TJAS Infran riippuvuudet APT-paketinhallinnalla..."
-apt-get install -y python3-pip python3-venv jq git curl lsb-release
+sudo apt-get install -y python3-pip python3-venv jq git curl lsb-release
 echo -e "\n\n"
-mkdir -p /root/.ssh/keys/pvjjk-1vos-tjas &> /dev/null
+mkdir -p $HOME/.ssh/keys/pvjjk-1vos-niinisalo &> /dev/null
-if [[ ! -f /root/.ssh/keys/pvjjk-1vos-tjas/infra ]]
+if [[ ! -f $HOME/.ssh/keys/pvjjk-1vos-niinisalo/infra ]]
 then
    ti-header "Generoidaan SSH-avain Infra-repon käyttöön..."
-    ssh-keygen -f /root/.ssh/keys/pvjjk-1vos-tjas/infra -t ed25519 -N '' -C $(hostname --fqdn)
+    ssh-keygen -f $HOME/.ssh/keys/pvjjk-1vos-niinisalo/infra -t ed25519 -N '' -C $(hostname --fqdn)
    echo -e "\n\n"
 fi
 ti-header "Luodaan Ansiblelle virtuaalinen ympäristö..."
-python3 -m venv /root/.venv/ansible
+python3 -m venv $HOME/.venv/ansible
 echo -e "\n\n"
 ti-header "Asennetaan Ansiblen riippuvuudet..."
-/root/.venv/ansible/bin/pip3 install cryptography dnspython hvac jmespath netaddr pexpect
+$HOME/.venv/ansible/bin/pip3 install cryptography dnspython hvac jmespath netaddr pexpect
 echo -e "\n\n"
 ti-header "Asennetaan Ansible..."
-/root/.venv/ansible/bin/pip3 install ansible
+$HOME/.venv/ansible/bin/pip3 install ansible
 echo -e "\n\n"
 ti-header "Asennetaan Ansible kokoelmat..."
-/root/.venv/ansible/bin/ansible-galaxy collection install ansible.posix containers.podman --upgrade
+$HOME/.venv/ansible/bin/ansible-galaxy collection install ansible.posix containers.podman --upgrade
 echo -e "\n\n"
 ti-header "Lisää SSH-avain Infra-repon käyttöön..."
-cat /root/.ssh/keys/pvjjk-1vos-tjas/infra.pub
+cat $HOME/.ssh/keys/pvjjk-1vos-niinisalo/infra.pub
 echo -n "Onko avain lisätty Github-repoon? [K/E]"
 while [[ -z $SSHKEY_QUESTION || ! -z $SSHKEY_QUESTION && $SSHKEY_QUESTION != "K" ]]
@@ -69,8 +80,8 @@ do
 done
 echo -e "\n\n"
-mkdir -p /root/.ansible/vault &> /dev/null
+mkdir -p $HOME/.ansible/vault &> /dev/null
-if [[ ! -f /root/.ansible/vault/pvjjk-1vos-tjas ]]
+if [[ ! -f $HOME/.ansible/vault/pvjjk-1vos-niinisalo ]]
 then
    ti-header "Syötä Ansible Vaultin salasana..."
    echo -n "Salasana: "
@@ -80,14 +91,14 @@ then
        if [[ ! -z $VAULT_PASSWORD ]]
        then
-            echo "$VAULT_PASSWORD" > /root/.ansible/vault/pvjjk-1vos-tjas
+            echo "$VAULT_PASSWORD" > $HOME/.ansible/vault/pvjjk-1vos-niinisalo
        fi
    done
    echo -e "\n\n"
 fi
 ti-header "Suoritetaan Infran asennus..."
-/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-tjas/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-tjas/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-tjas tasks.yml -t installer
+$HOME/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d $HOME/.ansible/pull/pvjjk-1vos-niinisalo/infra --accept-host-key --private-key $HOME/.ssh/keys/pvjjk-1vos-niinisalo/infra --vault-password-file $HOME/.ansible/vault/pvjjk-1vos-niinisalo tasks.yml -t installer
 echo -e "\n\n"
 echo "
--- a/inventories/pvjjk-1vos-niinisalo/group_vars/pvjjk_1vos_niinisalo
+++ b/inventories/pvjjk-1vos-niinisalo/group_vars/pvjjk_1vos_niinisalo
@@ -0,0 +1,6 @@
 $ANSIBLE_VAULT;1.2;AES256;pvjjk-1vos-niinisalo
 30383633646132396336336135366264386137643166376336666261316465346632353333616361
 3134623361333633653666313035633536396662613234320a386239373636623061383331663438
 64366431613763376239613036633365346266643163396331653237313662346231623731373530
 6630653939373762380a363939383862623336666361303032653431356139383766663331656335
 3438
--- a/inventories/pvjjk-1vos-niinisalo/host_vars/argo.aito.tjas
+++ b/inventories/pvjjk-1vos-niinisalo/host_vars/argo.aito.tjas
@@ -0,0 +1,6 @@
 $ANSIBLE_VAULT;1.2;AES256;pvjjk-1vos-niinisalo
 37353031396164353032396635313539613734613432323435383137303835383439663439363337
 6230323066313361383061633932616230363465326239640a333739323064653263336337633639
 64343833623362323734363239653866383037313331613738653133636364623237326637313232
 3462636261386230380a313634313965343733616137663532623965393835306562633635633831
 3166
--- a/inventories/pvjjk-1vos-niinisalo/host_vars/olympus.juva.tjas
+++ b/inventories/pvjjk-1vos-niinisalo/host_vars/olympus.juva.tjas
@@ -0,0 +1,51 @@
 $ANSIBLE_VAULT;1.2;AES256;pvjjk-1vos-niinisalo
 30386163316331336461633036653363613064366361653938616138353736366463643664393933
 6533383232616130626431353164663738346630616465300a393062663634356566656562646137
 36623535313932316262663064366535616565386436653761336463323163646439656563303262
 6531373030393264310a623933386234306532643664363335386231626664643531656433323731
 30373237626531336431343965313239616339356162383262313363363262613463303236643734
 62303636646232383235316137393634626235386662616339343231626661376331396138343361
 31663630306431653532666463326536636365663163663162643136366363333638333930373234
 36306166366533636562363063336436333465393231316363343864373335646437373561353538
 31613162643664633435363831326230373635313165633566323135303263323034636265393163
 62373234613334393261356464643262616132343963383165303534346335373634396161383532
 31623330373935613866336135323038343030353865373863633562303134613662353762376134
 61653035313965316134666534366435663333386235636266376164663731646365626135613166
 39333934653563623966366466613436313635313537363337386133356433356336303938333366
 66653735636462383666396332656333666234333435333062356338383034656637323438316134
 62386136663962336232623663666438333931376561303964636563306664313134373338303339
 32313635643136396365383834343438633463366262366330653034333332653038356331346566
 30336164393136383434646636376239656162643734643735306436303961326565346566333461
 33383861356537656262646131386134303165636632343134383264353466316633663732396334
 33373664633239396234366534636365346631643063373836666233626565626234363433313866
 31663464346264393731623364373035616134376430333764383836353132386339636537326637
 36366662333336373633653330353939396239623037653862393932373932353834373339373934
 61663338666164663235653337336238626462653336313532643131383638336535376232303465
 64363530393065383639663731383036613338343436313937663162643434323835353363653738
 62613139343934656135313832323532623263653038353166313531643036303538613436323664
 33356434623633643462326564383263323833376165366536633264656366353137316265653534
 36656561353634626330636363636133356265306336623737643961663061343630383330386538
 63636434303066646261636338323563373663323835386563393539616663636139356536393462
 37363766356138616232333162666562333261626661646538613862306264336636396562313665
 35373266366134623263663363376630343263623335666663396438663238636534393130623134
 36653465383763646563386361636530393366323538336532393661306362346333353661303334
 32633966303964383861653365626332316135373731393935313262383164346233353765396561
 33323864306336353732623937386235646366663764653965633764643864366331666262386639
 66326335326562646630346435663533313335373034663565333839323961383366643263356133
 64303030366263356231343530343566623935306431653866613165393633643835653330666436
 38663535373666333763386436646337656133303262396237663931323864336630646466306462
 65656536336533343065316637613034626333343837616363376263636635363866383638393234
 39373030663230383865396131363638376537363362666439636235626461303930396464313532
 63306136613265636438333764646465306565333435666233656534656538646465636263363433
 37356131353530363665336564386264616235613564363065356234336537363561313666653637
 35336638623730633735643465316164323739316636353762653965633831626561313532626139
 62303933376637376334666362306133383035376561333361326338663762363230303533363632
 62383539626263363636636164366139306666333165636130323765643532363338656261396135
 36336664656335383561643637383066653531303236323765356666343765616134343036313538
 34623935616531323536383565313238333564613635343332303238626534613337353430303864
 30383131346163636335363563656465316263316439646530663665386636393261386536306265
 34656230643662653665383730396335646562306161663233353835666131633730663237336434
 62643631653738633638366133396364623837343138613765616362633262333333646639396637
 36386533386439623866346335376164336439366133643266663938643333383836346538636536
 35376335306435616236323163616163656366366630656535393233643966313166346530383365
 3630646439643335393964313862363134396566636661643666
--- a/inventories/pvjjk-1vos-niinisalo/hosts.yml
+++ b/inventories/pvjjk-1vos-niinisalo/hosts.yml
@@ -1,6 +1,7 @@
 ---
-pvjjk_1vos_tjas:
+pvjjk_1vos_niinisalo:
  hosts:
    argo.aito.tjas:
    olympus.juva.tjas:
  vars:
    ansible_python_interpreter: /usr/bin/python3
--- a/inventories/pvjjk-1vos-tjas/host_vars/olympus.juva.tjas
+++ b/inventories/pvjjk-1vos-tjas/host_vars/olympus.juva.tjas
@@ -1,41 +0,0 @@
 $ANSIBLE_VAULT;1.2;AES256;pvjjk-1vos-tjas
 32353036303137643762623464643039333838656134613535633764316264623731656663323435
 6431613031346665633266366338373135393265303933340a613665656364346562636230383130
 34316235316631646161346636383634666137636336396664656337633764643438383565656434
 3465656532396265640a643435346535653665656263346564366238316333363536646563623033
 34363530373732613561623830663832643237613230323136373635343434366361626435623061
 61343832336661656366646564633464306237326330386533633965366631636431666162666134
 31306631363131343962663962643432383965303931346238313663623539336535353930323538
 36643164623537663531393039643437623833366135643862666237303961663132643762346235
 66376662623838636361383436366562393462313430303163653664316162316339356333653936
 63353365326166643463306139306134363932646465343634633465333634373033623561643130
 32333566353562336534663134336234383663663464333430333962383836323539323031363166
 38343632626237636337386362633630383934303437623461316539386235323231663564613233
 33383532313738613762633532646266623431376164663864386237346130316530613161373337
 62323764383161663234626639326638316334346236353836356463376239353033616636636636
 37376265656432353262393966636230363265353236643638343465623365343639313030336236
 36363163373366376232393961613231373730616564363630383336613266303238386133316533
 62373766666333613461353430316664663364333266363761333339356561303637396164663565
 62636261303233353235383632623132636533616264346463396566386462656135383534666333
 38656439323732383534343632353161393364393537626262383465666462323336633764393866
 33623639373138636233646335623630613533386565326363323830313036616635343133656638
 35323862353338653637663863643031643765313236666664656162356166663663656366306134
 64613138623464353839316163653239356238313834616661336130306539393039393439653466
 34316664356166376665333031666164356239623332383330346332613364643561313731653336
 30613864316665366533316263356561343030346535623764313264323765633035663237633530
 30383566303661613332353631663163363334336436333665363965383963356265613731616231
 38613632633430346531326134396333363533626466616565623432383031313037656161313764
 33656230343539316464336533613864373332343231396134396161653137393338396361336330
 34333265333738663330636161333035313831626134633062363265373734303733313131636164
 34616435633965356263346633326135333865393565316138633337323635323164343338653566
 35373366633432666131366436336633323039653466313338326362636262323735393865663939
 62353963656539366662336666353635626135653166633630333937363634343534626465626463
 61616632643131323237353362373766323663633936623334336231653037323539303533656439
 30343133623436626630343462363861336630386664303362646338663630396131393461323931
 30373432643235636136396661326439616434363563333334343534346465663538623936326636
 36393636323438366639306262386437363936313064616534326633353439646137316337313061
 39326239653434313438386331613631393063376433646531383361363434613934306633323230
 39393965643762623330373661333032326363636134653838336162623564653933353265613233
 37623632633437356365366265303937356139623237353964646166373036393864613935303233
 36323665316664333362356132653235663035303135313733613632616134316365656662333839
 65653162663265626438
--- a/protect.sh
+++ b/protect.sh
@@ -5,23 +5,37 @@ nounderline=`tput rmul`
 bold=$(tput bold)
 normal=$(tput sgr0)
-echo "${bold}PVJJK 1.VOS TJAS / Infra / Protect${normal}"
+echo "${bold}"
 echo "
 .-') _               ('-.      .-')
 (  OO) )             ( OO ).-. ( OO ).
 /     '._      ,--.  / . --. /(_)---\_)
 |'--...__) .-')| ,|  | \-.  \ /    _ |
 '--.  .--'( OO |(_|.-'-'  |  |\  :\` \`.
   |  |   | \`-'|  | \| |_.'  | '..\`''.)
   |  |   ,--. |  |  |  .-.  |.-._)   \\
   |  |   |  '-'  /  |  | |  |\       /
   \`--'    \`-----'   \`--' \`--' \`-----'
 "
 echo "
 PVJJK 1.VOS NIINISALO
 TIETOJÄRJESTELMÄASENTAJIEN INTRA
 PROTECT SCRIPT
 "
 echo -n "${normal}"
 action=$1
 encrypt() {
-    echo "${underline}Encrypting...${nounderline}"
+    execute "ansible-vault encrypt --vault-id $1@vault/$1" $1
    execute "ansible-vault encrypt --vault-id pvjjk-1vos-tjas@vault/pvjjk-1vos-tjas"
 }
 decrypt() {
-    echo "${underline}Decrypting...${nounderline}"
+    execute "ansible-vault decrypt --vault-id $1@vault/$1" $1
    execute "ansible-vault decrypt --vault-id pvjjk-1vos-tjas@vault/pvjjk-1vos-tjas"
 }
 list() {
    echo "${underline}Listing...${nounderline}"
    i=0
-    for file in inventories/*/group_vars/* inventories/*/host_vars/*;
+    for file in inventories/$1/group_vars/* inventories/$1/host_vars/*;
    do
        i=$((i + 1))
        echo $i")"$file
@@ -29,7 +43,8 @@ list() {
 }
 execute() {
-for file in inventories/*/group_vars/* inventories/*/host_vars/*;
+i=0
 for file in inventories/$2/group_vars/* inventories/$2/host_vars/*;
    do
        i=$((i + 1))
        echo $i")"$file
@@ -40,18 +55,23 @@ for file in inventories/*/group_vars/* inventories/*/host_vars/*;
 case $action in
    encrypt)
-        encrypt
+        echo "${underline}Encrypting...${nounderline}"
        encrypt pvjjk-1vos-niinisalo
        ;;
    decrypt)
-        decrypt
+        echo "${underline}Decrypting...${nounderline}"
        decrypt pvjjk-1vos-niinisalo
        ;;
    list)
-        list
+        echo "${underline}Listing...${nounderline}"
-        ;;
+        list pvjjk-1vos-niinisalo
    help)
        echo "encrypt, decrypt, list"
        ;;
    *)
-        echo "..."
+        echo "${underline}HELP${nounderline}"
        echo "encrypt - Encrypt Files"
        echo "decrypt - Decrypt Files"
        echo "list - List Files"
        ;;
 esac
 echo -e "\n\n\n"
--- a/tasks.yml
+++ b/tasks.yml
@@ -10,6 +10,8 @@
      import_tasks: tasks/installer.yml
      vars:
        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
      when:
        - inventory_hostname == "olympus.juva.tjas"
      tags:
        - installer
        - never
@@ -18,6 +20,8 @@
      import_tasks: tasks/maintenance.yml
      vars:
        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
      when:
        - inventory_hostname == "olympus.juva.tjas"
      tags:
        - maintenance
        - never
@@ -26,6 +30,8 @@
      import_tasks: tasks/deployer.yml
      vars:
        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
      when:
        - inventory_hostname == "olympus.juva.tjas"
      tags:
        - deployer
        - never
--- a/tasks/deployer.yml
+++ b/tasks/deployer.yml
@@ -58,7 +58,6 @@
  containers.podman.podman_image:
    name: docker.io/library/golang
    tag: alpine
    force: true
  register: deployerTaskY2
 - name: "Deployer - Yggdrasil - Clone Repository"
@@ -67,9 +66,9 @@
    dest: ".cache/git/yggdrasil"
  register: deployerTaskY3
- name: "Deployer - Yggdrasil - Pull Image"
+- name: "Deployer - Yggdrasil - Build Image"
  containers.podman.podman_image:
-    name: pvjjk-1vos-tjas/yggdrasil
+    name: pvjjk-1vos-niinisalo/yggdrasil
    tag: latest
    path: "/root/data/yggdrasil"
    build:
@@ -80,7 +79,7 @@
 - name: "Deployer - Yggdrasil - Run Container"
  containers.podman.podman_container:
    name: yggdrasil
-    image: pvjjk-1vos-tjas/yggdrasil:latest
+    image: pvjjk-1vos-niinisalo/yggdrasil:latest
    state: started
    recreate: on
    network: host
@@ -102,12 +101,12 @@
    state: directory
  tags:
    - mariadb
    - database
 - name: "Deployer - MariaDB - Pull Image"
  containers.podman.podman_image:
    name: docker.io/library/mariadb
    tag: latest
    force: true
  register: deployerTaskM1
 - name: "Deployer - MariaDB - Run Container"
@@ -127,6 +126,7 @@
    - (deployerTaskM1 is defined and deployerTaskM1.changed) or deployerTaskM1 is undefined
  tags:
    - mariadb
    - database
 - name: "Deployer - MariaDB - Wait"
  ansible.builtin.wait_for:
@@ -137,6 +137,7 @@
    - (deployerTaskM2 is defined and deployerTaskM2.changed) or deployerTaskM2 is undefined
  tags:
    - mariadb
    - database
 - name: "Deployer - MariaDB - Upgrade"
  containers.podman.podman_container_exec:
@@ -149,6 +150,7 @@
    - (deployerTaskM2 is defined and deployerTaskM2.changed) or deployerTaskM2 is undefined
  tags:
    - mariadb
    - database
 - name: "Deployer - MariaDB - Create Users"
  community.mysql.mysql_user:
@@ -165,8 +167,14 @@
    loop_var: "user"
  when:
    - (deployerTaskM2 is defined and deployerTaskM2.changed) or deployerTaskM2 is undefined
    - config.mariadb.users is defined
    - config.mariadb.users[user] is defined
    - config.mariadb.users[user].username is defined
    - config.mariadb.users[user].password is defined
    - config.mariadb.users[user].database is defined
  tags:
    - mariadb
    - database
 - name: "Deployer - MariaDB - Create Database"
  community.mysql.mysql_db:
@@ -180,8 +188,14 @@
    loop_var: "user"
  when:
    - (deployerTaskM2 is defined and deployerTaskM2.changed) or deployerTaskM2 is undefined
    - config.mariadb.users is defined
    - config.mariadb.users[user] is defined
    - config.mariadb.users[user].username is defined
    - config.mariadb.users[user].password is defined
    - config.mariadb.users[user].database is defined
  tags:
    - mariadb
    - database
 - name: "Deployer - Kea - Install"
  ansible.builtin.apt:
@@ -189,75 +203,233 @@
      - kea
    state: latest
-# - name: "Deployer - DHCP - Config"
+- name: "Deployer - Kea - Configure - DHCP4"
-#   ansible.builtin.template:
+  ansible.builtin.template:
-#     src: './files/dhcp/dhcpd.conf'
+    src: './files/kea/kea-dhcp4.conf'
-#     dest: '/etc/dhcp/dhcpd.conf'
+    dest: '/etc/kea/kea-dhcp4.conf'
-#   register: deployerTaskD1
+  register: deployerTaskK1
-#   tags:
+  tags:
-#     - dhcp
+    - kea
    - dhcp
-# - name: "Deployer : DHCP : Restart"
+- name: "Deployer - Kea - Configure - Database : Init"
-#   ansible.builtin.systemd_service:
+  ansible.builtin.command:
-#     name: isc-dhcp-server
+    cmd: "/usr/sbin/kea-admin db-init mysql -h 127.0.0.1 -n {{ config.mariadb.users['kea'].database }} -u {{ config.mariadb.users['kea'].username }} -p {{ config.mariadb.users['kea'].password }}"
-#     state: restarted
+  register: deployerTaskK2
-#     enabled: true
+  changed_when:
-#   when:
+    - deployerTaskK2.stdout.find('Initializing database') != -1
-#     - (deployerTaskD1 is defined and deployerTaskD1.changed) or deployerTaskD1 is undefined
+  failed_when:
    - deployerTaskK2.stdout.find('ERROR') != -1
    - deployerTaskK2.stdout.find('Expected empty database kea.') == -1
  tags:
    - kea
    - dhcp
- name: "Deployer - PowerDNS - Configure - Create Folder"
+- name: "Deployer - Kea - Configure - Database : Upgrade"
  ansible.builtin.command:
    cmd: "/usr/sbin/kea-admin db-upgrade mysql -h 127.0.0.1 -n {{ config.mariadb.users['kea'].database }} -u {{ config.mariadb.users['kea'].username }} -p {{ config.mariadb.users['kea'].password }}"
  tags:
    - kea
    - dhcp
 - name: "Deployer : Kea : Restart"
  ansible.builtin.systemd_service:
    name: kea-dhcp4-server
    state: restarted
  when:
    - (deployerTaskK1 is defined and deployerTaskK1.changed) or deployerTaskK1 is undefined or (deployerTaskK2 is defined and deployerTaskK2.changed) or deployerTaskK2 is undefined
  tags:
    - kea
    - dhcp
 - name: "Deployer : Kea : Start"
  ansible.builtin.systemd_service:
    name: kea-dhcp4-server
    state: started
  tags:
    - kea
    - dhcp
 - name: "Deployer - dnsdist - Configure - Create Folder"
  ansible.builtin.file:
-    path: "/root/data/powerdns/"
+    path: "/root/data/dnsdist/"
    state: directory
  tags:
-    - powerdns
+    - dnsdist
    - dns
- name: "Deployer - PowerDNS - Configure - Create Subfolders"
+- name: "Deployer - dnsdist - Configure - Create Subfolders"
  ansible.builtin.file:
-    dest: '/root/data/powerdns/{{ item.path }}'
+    dest: '/root/data/dnsdist/{{ item.path }}'
    state: directory
-  with_filetree: './files/powerdns/'
+  with_filetree: './files/dnsdist/'
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.state == 'directory'
  tags:
-    - powerdns
+    - dnsdist
    - dns
- name: "Deployer - PowerDNS - Configure - Generating & Transferring Files"
+- name: "Deployer - dnsdist - Configure - Generating & Transferring Files"
  ansible.builtin.template:
    src: '{{ item.src }}'
-    dest: '/root/data/powerdns/{{ item.path }}'
+    dest: '/root/data/dnsdist/{{ item.path }}'
-  register: deployerTaskP1
+  register: deployerTaskD1
-  with_filetree: './files/powerdns/'
+  with_filetree: './files/dnsdist/'
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.state == 'file'
  tags:
-    - powerdns
+    - dnsdist
    - dns
- name: "Deployer - PowerDNS - Pull Image"
+- name: "Deployer - dnsdist - Pull Image"
  containers.podman.podman_image:
-    name: docker.io/powerdns/pdns-auth-49
+    name: docker.io/powerdns/dnsdist-20
    tag: latest
-    force: true
+  register: deployerTaskD2
  register: deployerTaskP2
- name: "Deployer - PowerDNS - Run Container"
+- name: "Deployer - dnsdist - Run Container"
  containers.podman.podman_container:
-    name: powerdns
+    name: dnsdist
-    image: docker.io/powerdns/pdns-auth-49:latest
+    image: docker.io/powerdns/dnsdist-20:latest
    state: started
    recreate: on
    network: host
    restart_policy: always
    volumes:
-      - /root/data/powerdns/config.conf:/etc/powerdns/pdns.conf:ro"
+      - "/root/data/dnsdist/config.conf:/etc/dnsdist/dnsdist.conf:ro"
    tty: yes
    interactive: yes
    capabilities:
      - NET_BIND_SERVICE
  when:
-    - (deployerTaskP1 is defined and deployerTaskP1.changed) or deployerTaskP1 is undefined or (deployerTaskP2 is defined and deployerTaskP2.changed) or deployerTaskP2 is undefined
+    - (deployerTaskD1 is defined and deployerTaskD1.changed) or deployerTaskD1 is undefined or (deployerTaskD2 is defined and deployerTaskD2.changed) or deployerTaskD2 is undefined
  tags:
-    - powerdns
+    - dnsdist
    - dns
 - name: "Deployer - PowerDNS Authorative - Configure - Create Folder"
  ansible.builtin.file:
    path: "/root/data/powerdns-authorative/"
    state: directory
  tags:
    - powerdns-authorative
    - dns
 - name: "Deployer - PowerDNS Authorative - Configure - Create Subfolders"
  ansible.builtin.file:
    dest: '/root/data/powerdns-authorative/{{ item.path }}'
    state: directory
  with_filetree: './files/powerdns-authorative/'
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.state == 'directory'
  tags:
    - powerdns-authorative
    - dns
 - name: "Deployer - PowerDNS Authorative - Configure - Generating & Transferring Files"
  ansible.builtin.template:
    src: '{{ item.src }}'
    dest: '/root/data/powerdns-authorative/{{ item.path }}'
  register: deployerTaskPA1
  with_filetree: './files/powerdns-authorative/'
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.state == 'file'
  tags:
    - powerdns-authorative
    - dns
 - name: "Deployer - PowerDNS Authorative - Pull Image"
  containers.podman.podman_image:
    name: docker.io/powerdns/pdns-auth-50
    tag: latest
  register: deployerTaskPA2
 - name: "Deployer - PowerDNS Authorative - Run Container"
  containers.podman.podman_container:
    name: powerdns-authorative
    image: docker.io/powerdns/pdns-auth-50:latest
    state: started
    recreate: on
    network: host
    restart_policy: always
    volumes:
      - "/root/data/powerdns-authorative/config.conf:/etc/powerdns/pdns.conf:ro"
    capabilities:
      - NET_BIND_SERVICE
  when:
    - (deployerTaskPA1 is defined and deployerTaskPA1.changed) or deployerTaskPA1 is undefined or (deployerTaskPA2 is defined and deployerTaskPA2.changed) or deployerTaskPA2 is undefined
  tags:
    - powerdns-authorative
    - dns
 - name: "Deployer - PowerDNS Recursor - Configure - Create Folder"
  ansible.builtin.file:
    path: "/root/data/powerdns-recursor/"
    state: directory
  tags:
    - powerdns-recursor
    - dns
 - name: "Deployer - PowerDNS Recursor - Configure - Create Subfolders"
  ansible.builtin.file:
    dest: '/root/data/powerdns-recursor/{{ item.path }}'
    state: directory
  with_filetree: './files/powerdns-recursor/'
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.state == 'directory'
  tags:
    - powerdns-recursor
    - dns
 - name: "Deployer - PowerDNS Recursor - Configure - Generating & Transferring Files"
  ansible.builtin.template:
    src: '{{ item.src }}'
    dest: '/root/data/powerdns-recursor/{{ item.path }}'
  register: deployerTaskPR1
  with_filetree: './files/powerdns-recursor/'
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.state == 'file'
  tags:
    - powerdns-recursor
    - dns
 - name: "Deployer - PowerDNS Recursor - Pull Image"
  containers.podman.podman_image:
    name: docker.io/powerdns/pdns-recursor-52
    tag: latest
  register: deployerTaskPR2
 - name: "Deployer - PowerDNS Recursor - Run Container"
  containers.podman.podman_container:
    name: powerdns-recursor
    image: docker.io/powerdns/pdns-recursor-52:latest
    state: started
    recreate: on
    network: host
    restart_policy: always
    volumes:
      - "/root/data/powerdns-recursor/config.conf:/etc/powerdns/recursor.conf:ro"
    capabilities:
      - NET_BIND_SERVICE
  when:
    - (deployerTaskPR1 is defined and deployerTaskPR1.changed) or deployerTaskPR1 is undefined or (deployerTaskPR2 is defined and deployerTaskPR2.changed) or deployerTaskPR2 is undefined
  tags:
    - powerdns-recursor
    - dns
 - name: "Deployer - Nginx - Configure - Create Folder"
  ansible.builtin.file:
@@ -265,6 +437,7 @@
    state: directory
  tags:
    - nginx
    - www
 - name: "Deployer - Nginx - Configure - Create Subfolders"
  ansible.builtin.file:
@@ -277,6 +450,7 @@
    - item.state == 'directory'
  tags:
    - nginx
    - www
 - name: "Deployer - Nginx - Configure - Generating & Transferring Files"
  ansible.builtin.template:
@@ -290,12 +464,12 @@
    - item.state == 'file'
  tags:
    - nginx
    - www
 - name: "Deployer - Nginx - Pull Image"
  containers.podman.podman_image:
    name: docker.io/library/nginx
    tag: latest
    force: true
  register: deployerTaskN2
 - name: "Deployer - Nginx - Run Container"
@@ -315,3 +489,4 @@
    - (deployerTaskN1 is defined and deployerTaskN1.changed) or deployerTaskN1 is undefined or (deployerTaskN2 is defined and deployerTaskN2.changed) or deployerTaskN2 is undefined
  tags:
    - nginx
    - www
--- a/tasks/installer.yml
+++ b/tasks/installer.yml
@@ -50,15 +50,49 @@
      - pkg-config
      - etckeeper
      - picocom
      - vlan
  loop: "{{ packages }}"
  loop_control:
    label: "{{ package }}"
    loop_var: "package"
- name: "Installer : Network : Configure"
+- name: "Installer : Issue : Configure - Copy File"
  ansible.builtin.template:
-    src: './files/network/interfaces'
+    src: './files/issue'
    dest: '/etc/{{ file }}'
  vars:
    files:
      - "issue"
      - "issue.net"
  loop: "{{ files }}"
  loop_control:
    label: "{{ file }}"
    loop_var: "file"
  tags:
    - issue
 - name: "Installer : Motd : Configure - Copy File"
  ansible.builtin.template:
    src: './files/motd'
    dest: '/etc/motd'
  tags:
    - motd
 - name: "Installer : Networking : Configure - Copy Configuration"
  ansible.builtin.template:
    src: './files/networking/interfaces'
    dest: '/etc/network/interfaces'
  tags:
    - networking
    - network
 - name: "Installer : Networking : Start - Restart Service"
  ansible.builtin.systemd_service:
    name: networking
    state: restarted
  tags:
    - networking
    - network
 - name: "Installer : FirewallD : Dependencies - Packages"
  ansible.builtin.apt:
@@ -66,17 +100,26 @@
      - python3-firewall
      - iptables
    state: latest
  tags:
    - firewalld
    - firewall
 - name: "Installer : FirewallD : Install"
  ansible.builtin.apt:
    name: "firewalld"
    state: latest
  tags:
    - firewalld
    - firewall
 - name: "Installer : FirewallD : Start"
  ansible.builtin.systemd_service:
    name: firewalld
    state: started
    enabled: true
  tags:
    - firewalld
    - firewall
 - name: "Installer : FirewallD : Rules"
  ansible.posix.firewalld:
@@ -90,12 +133,15 @@
      - http
      - https
      - ssh
      - dhcp
      - dns
  loop: "{{ services }}"
  loop_control:
    label: "{{ service }}"
    loop_var: "service"
-
+  tags:
-
+    - firewalld
    - firewall
 - name: "Installer - Ansible - Python Library"
  ansible.builtin.pip:
@@ -139,7 +185,7 @@
  tags:
    - ansible
- name: "Installer - Ansible - Dependencies / Python Libraries"
+- name: "Installer - Ansible - Dependencies - Python Libraries"
  ansible.builtin.pip:
    name: "{{ library }}"
    state: latest
@@ -158,8 +204,10 @@
  loop_control:
    label: "{{ library }}"
    loop_var: "library"
  tags:
    - ansible
- name: "Installer : MariaDB : Dependencies / Python Library : pymysql"
+- name: "Installer : MariaDB : Dependencies - Python Library : pymysql"
  ansible.builtin.pip:
    name: pymysql
    state: latest
@@ -168,6 +216,15 @@
    virtualenv_command: "python3 -m venv"
  tags:
    - mariadb
    - database
 - name: "Installer : MariaDB : Dependencies - Package : mariadb-client"
  ansible.builtin.apt:
    name: "mariadb-client"
    state: latest
  tags:
    - mariadb
    - database
 - name: "Installer : Podman : Install"
  ansible.builtin.apt:
@@ -178,13 +235,15 @@
      - buildah
      - slirp4netns
    state: latest
  tags:
    - podman
 - name: "Installer : Schedule : Maintenance"
  ansible.builtin.cron:
    name: "PVJJK 1.VOS TJAS - Infra - Maintenance"
    hour: "*/3"
    minute: "0"
-    job: "/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-tjas/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-tjas/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-tjas tasks.yml -t maintenance"
+    job: "/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-niinisalo/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-niinisalo/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-niinisalo tasks.yml -t maintenance"
  tags:
    - cron
@@ -192,6 +251,6 @@
  ansible.builtin.cron:
    name: "PVJJK 1.VOS TJAS - Infra - Deployer"
    minute: "*/5"
-    job: "/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-tjas/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-tjas/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-tjas tasks.yml -t deployer"
+    job: "/root/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/cwchristerw/tjas-infra -d /root/.ansible/pull/pvjjk-1vos-niinisalo/infra --accept-host-key --private-key /root/.ssh/keys/pvjjk-1vos-niinisalo/infra --vault-password-file /root/.ansible/vault/pvjjk-1vos-niinisalo tasks.yml -t deployer"
  tags:
    - cron
Author	SHA1	Message	Date
Christer Warén	cf65e1ac85	Update workstation installation guide	2025-09-01 16:30:51 +03:00
Christer Warén	177bafaa93	Fix typos in Init script	2025-09-01 15:56:52 +03:00
Christer Warén	89c5cc2437	FIx to work in WSL	2025-09-01 15:49:37 +03:00
Christer Warén	586ea6bd0e	Fix missing sudo in INSTRUCTIONS.md	2025-09-01 15:39:42 +03:00
Christer Warén	13d07913ef	Add workstation installation guide to INSTRUCTIONS.md	2025-09-01 15:33:12 +03:00
Christer Warén	718874a63d	Beautification of Protect script	2025-09-01 15:21:41 +03:00
Christer Warén	859b96eb88	Beautification of Init script	2025-09-01 15:21:19 +03:00
Christer Warén	e149ba3db0	Inventories Update	2025-09-01 15:20:42 +03:00
Christer Warén	2224e2c596	Inventories Update	2025-09-01 10:25:36 +03:00
Christer Warén	2b6921e9f3	Fix typo in Yggdrasil configuration	2025-09-01 10:12:30 +03:00
Christer Warén	b895ac02b9	Yggdrasil Configuration	2025-09-01 09:03:41 +03:00
Christer Warén	edbf3f6191	Inventories Update	2025-09-01 09:03:27 +03:00
Christer Warén	79e45822c1	Protect Update	2025-09-01 09:03:04 +03:00
Christer Warén	a4e7218050	Fix Kea configuration commands in Deployer tasks	2025-08-30 18:52:23 +03:00
Christer Warén	f1a5f0caa5	Add NET_BIND_SERVICE capability to PowerDNS containers	2025-08-28 12:43:16 +03:00
Christer Warén	7f8b4a1e13	Add NET_BIND_SERVICE capability to dnsdist container	2025-08-28 11:55:16 +03:00
Christer Warén	e1a1e4889a	Add parameters to dnsdist in Deployer tasks	2025-08-28 10:44:11 +03:00
Christer Warén	d5b99d3146	FIx PowerDNS container names in Deployer tasks	2025-08-27 14:03:04 +03:00
Christer Warén	be900d5785	Add useClientSubnet to dnsdist configuration	2025-08-27 13:55:05 +03:00
Christer Warén	84884d9015	Add PowerDNS Recursor to Deployer	2025-08-26 19:42:00 +03:00
Christer Warén	5589d94f11	Update Issue & MOTD	2025-08-26 13:37:04 +03:00
Christer Warén	491ad0aba8	Update VSCode settings	2025-08-26 13:36:48 +03:00
Christer Warén	dec30dd66b	Fix typo in server network configuration	2025-08-26 13:04:54 +03:00
Christer Warén	5008c1be97	Allow DHCP & DNS from FirewallD	2025-08-26 12:49:41 +03:00
Christer Warén	56b53fdc5b	Update network device configurations to INSTRUCTIONS.md	2025-08-26 12:49:22 +03:00
Christer Warén	2b671f8a6d	Add interfaces to subnets to restrict them to specific vlan	2025-08-26 09:08:10 +03:00
Christer Warén	ada1aa726d	Start Kea server in Deployer tasks	2025-08-26 08:31:00 +03:00
Christer Warén	89d03c5141	Set statiic IPs for interfaces	2025-08-26 08:11:46 +03:00
Christer Warén	b889bd2054	Update Kea tasks	2025-08-25 14:58:22 +03:00
Christer Warén	877cbc1005	Restore unique MAC addresses to interfaces	2025-08-25 14:05:25 +03:00
Christer Warén	6b83b10523	Remove static IPs from network interfaces	2025-08-25 13:59:24 +03:00
Christer Warén	21fcb394cd	Update Issue & MOTD	2025-08-25 12:23:01 +03:00
Christer Warén	aab33c9c21	Change name of office laptop	2025-08-25 12:11:40 +03:00
Christer Warén	742e77a1fc	Update	2025-08-25 12:10:41 +03:00
Christer Warén	63f6266f2c	Update	2025-08-25 12:02:51 +03:00
Christer Warén	c89ab05b1a	Add Issue and MOTD to Installer tasks	2025-08-25 12:02:23 +03:00
Christer Warén	41d961ce6b	Restart Networking during Installer tasks	2025-08-25 10:59:00 +03:00
Christer Warén	f81480af87	Network Changes	2025-08-25 10:26:26 +03:00
Christer Warén	76e57329ce	Fix typo in interfaces file	2025-08-16 14:57:18 +03:00
Christer Warén	c6b2c2cd25	Add vlan to packages to install in Installer tasks	2025-08-16 14:27:18 +03:00
Christer Warén	37114a0f8d	Update network interfaces	2025-08-16 14:20:32 +03:00
Christer Warén	47e7f0415b	Update Kea configuration	2025-08-16 14:20:23 +03:00
Christer Warén	296b3b5502	Add Kea database upgrade task to Deployer tasks	2025-08-16 14:04:20 +03:00
Christer Warén	681999d4e2	Deployer Tasks - Uodate	2025-08-16 13:54:33 +03:00
Christer Warén	41008ed852	Add database configuration task for Kea in Deployer tasks	2025-08-16 13:45:18 +03:00
Christer Warén	79c6ee8af8	Adding more tags to Installer tasks	2025-08-16 13:25:30 +03:00
Christer Warén	5339d47d11	Installer Tasks: Add mariadb-client package to dependencies for MariaDB	2025-08-16 13:17:40 +03:00
Christer Warén	8d1a7820c9	Fix syntax in Kea configuration	2025-08-16 13:01:14 +03:00
Christer Warén	b9d58a6822	Change database server address in Kea configuration	2025-08-16 12:41:46 +03:00
Christer Warén	4cfaf5f0a4	Fix wrong mac address of s3 switch in Kea configuration	2025-08-16 12:38:41 +03:00
Christer Warén	9e898bd5e3	Remove unnecessary hooks-libraries from Kea configuration	2025-08-16 12:29:18 +03:00
Christer Warén	669fdcc6a6	Fix typos in Kea configuration	2025-08-16 11:05:50 +03:00
Christer Warén	ffd215d9f8	Fix typo in Deployer tasks	2025-08-13 14:44:01 +03:00
Christer Warén	19fb89cfb2	Add interfaces to Kea configuration	2025-08-13 14:39:26 +03:00
Christer Warén	f17f1bfb7b	Update Deployer tasks: Add tags and replace DHCPD with Kea	2025-08-13 13:39:33 +03:00
Christer Warén	ee486ad369	Remove DHCPD configuration and update Kea configuration	2025-08-13 13:38:25 +03:00
Christer Warén	00cf46fe10	Commenting forcing to pull images due to Docker Hub limits	2025-08-08 19:33:40 +03:00
Christer Warén	811f681ba4	Fix MariaDB tasks in Deployer tasks with adding conditions	2025-08-08 19:08:08 +03:00
Christer Warén	034a790501	Fix typo in Deployer tasks	2025-08-08 18:57:02 +03:00
Christer Warén	c486c307c1	Fix typo in olympus.juva.tjas host variables	2025-08-08 18:52:55 +03:00
`@@ -1,2 +1,2 @@`
	`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClWZxHhmgV2LD3mrbLU2VxPXGMx02WaB5MU9t8XJsqAmsIKwUZSqHTrlR20dXPGlZhe5Rx4vf+ZKx0kuNKJMvswEkvpP0la9WSsawWHxhOTrqDr0yZMV1/CncdARw1vse3zJCQVbOflbKYsKgpdJHbMzk5SfSZijSscrgxRTa8qX/ndnmlGrgm4MxezgFBEJrzC4vCTZLK5LPkAva+2A6fwElgR7V1Dkg5p5l0/nvKbBje+ugaiTw7RPy42oC/hHrsvsnTQ4KheD1phRJFCSEnj6l7gxVetVBznZ/K697MrK4aNUFLDV29uiPALj+1fWAYTIO3WPNU/QkH7OEP8JO3 l1.office.tjas`	`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClWZxHhmgV2LD3mrbLU2VxPXGMx02WaB5MU9t8XJsqAmsIKwUZSqHTrlR20dXPGlZhe5Rx4vf+ZKx0kuNKJMvswEkvpP0la9WSsawWHxhOTrqDr0yZMV1/CncdARw1vse3zJCQVbOflbKYsKgpdJHbMzk5SfSZijSscrgxRTa8qX/ndnmlGrgm4MxezgFBEJrzC4vCTZLK5LPkAva+2A6fwElgR7V1Dkg5p5l0/nvKbBje+ugaiTw7RPy42oC/hHrsvsnTQ4KheD1phRJFCSEnj6l7gxVetVBznZ/K697MrK4aNUFLDV29uiPALj+1fWAYTIO3WPNU/QkH7OEP8JO3 argo.aito.tjas`
	`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPW5phGhwAG8dmT+sR0uF1gRc0X9xXZiiFxvKUEsPk1N cwchristerw`	`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPW5phGhwAG8dmT+sR0uF1gRc0X9xXZiiFxvKUEsPk1N cwchristerw`