sudo apt install dropbear-initramfs

sudo sed -i 's/#DROPBEAR_OPTIONS=/DROPBEAR_OPTIONS="-I 180 -j -k -p 4000 -s -c cryptroot-unlock"/g' /etc/dropbear/initramfs/dropbear.conf

# optional: configure IP if no DHCP avaiable
# echo 'IP=192.168.2.123::192.168.2.1:255.255.254.0:my-wks01' >> /etc/initramfs-tools/initramfs.conf

sudo ssh-import-id gh: -o /etc/dropbear/initramfs/authorized_keys

sudo update-initramfs -u

ssh root@your_workstation_ip -p 4444

# unlock disk
unlock-cryptroot

Links
https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/
https://realtechtalk.com/Howto_Set_Static_IP_on_boot_in_initramfs_for_dropbear_or_other_purposes_NFS_Linux_Debian_Ubuntu_CentOS-2278-articles

Manage collections

# Install collection
ansible-galaxy collection install ansible.posix
ansible-galaxy collection install git@git.example.com:foo/ansible-collections/bar
ansible-galaxy collection install git+file:///home/user/path/to/repo_name

# List collections
ansible-galaxy collection list

# default user Ansible collection directory
~/.ansible/collections/ansible_collections/

# env vars
ANSIBLE_COLLECTIONS_PATHS

# ~/.ansible.cfg 
[defaults]
collections_paths = /path/to/collection

# get current path
ansible-config dump | grep -i collection

Include collection in playbook

- hosts: all
  collections:
    - my_namespace.my_collection


- hosts: all
  tasks:
    - import_role:
        name: my_namespace.my_collection.my_role

Defile collection dependency in role

# ./meta/main.yml
---
dependencies:
  - role: my_namespace.my_collection.my_role
    vars:
      foo: "bar"

- include_role:
    name: "{{ item }}"
  collections:
    - my_namespace.my_collection
  vars:
    foo: bar
   loop:
    - my_role

Links
https://docs.ansible.com/ansible/latest/galaxy/user_guide.html
https://docs.ansible.com/ansible/latest/user_guide/collections_using.html
https://goetzrieger.github.io/ansible-collections/2-using-collections-from-playbooks/

Recreate / move qrouter namespace

ROUTER_ID=74490819-028e-424e-b8f9-c7e48cf672af

# list router NS
openstack network agent list --router ${ROUTER_ID} --long

# list available l3 agents
openstack network agent list --agent-type l3

# recreate L3 agent
SOURCE_NODE=ctl1-dev
TARGET_NODE=ctl2-dev

SOURCE_L3_ID=$(openstack network agent list --host ${SOURCE_NODE} --agent-type l3 -f value -c ID)
TARGET_L3_ID=$(openstack network agent list --host ${TARGET_NODE} --agent-type l3 -f value -c ID)

openstack network agent add router --l3 ${TARGET_L3_ID} ${ROUTER_ID}
openstack network agent remove router --l3 ${SOURCE_L3_ID} ${ROUTER_ID}

Recreate all network agents

openstack router list --agent $SOURCE_L3_ID -f value -c ID | while read ROUTER_ID; do
    openstack network agent add router --l3 ${TARGET_L3_ID} ${ROUTER_ID}
    openstack network agent remove router --l3 ${SOURCE_L3_ID} ${ROUTER_ID}
done

openstack network agent set $SOURCE_L3_ID --disable

List floating IP in qrouter namespace

for ROUTER_NETNS in $(ip netns | grep qrouter | cut -d" " -f1); do
    echo ${ROUTER_NETNS}
    ip netns exec ${ROUTER_NETNS} ip a | grep "scope global qg-"
    echo
done

Manual failover all active router

Server

sudo apt install -y wireguard

cd /etc/wireguard
umask 077;
wg genkey | tee privatekey | wg pubkey > publickey

/etc/wireguard/wg0.conf
[Interface]
Address = 192.168.6.1/24
ListenPort = 1194
PrivateKey = qz3LQkTEA8tOJEORyUxT2w2SIwdXwCLcO7joKq58tUs=
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE     

[Peer]
PublicKey = wL+h2EqxaQpcWgwO8SIXPGqhHgssvj9xqjHAPjYLJ28=
AllowedIPs = 192.168.6.2/32

sudo ufw allow 1194/udp
sudo ufw status

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo systemctl status wg-quick@wg0

# watch connections
watch -n1 wg

Client

https://www.mellanox.com/products/ethernet-drivers/linux/mlnx_en

VERSION=24.04-0.7.0.0
URL=http://www.mellanox.com/downloads/ofed/MLNX_EN-${VERSION}/mlnx-en-${VERSION}-ubuntu$(lsb_release -rs)-$(uname -p).tgz

# download
wget ${URL} -q -O /tmp/${URL##*/}
tar -C /tmp -xzf /tmp/mlnx-en-*-ubuntu*.tgz

# install prerequirements
# apt install -y apt-utils bzip2 lsof debhelper gcc make build-essential automake chrpath quilt autotools-dev perl  autoconf libltdl-dev dkms swig graphviz

# install
cd /tmp/mlnx-en-${VERSION}-ubuntu*/

# prebuild driver only
#./install --add-kernel-support-build-only

# install
#./install --force
./install -q --dpdk --without-fw-update

# show packages
ll /tmp/mlnx-en-*-generic/mlnx-en-*-ext.tgz

# install
# ./install -q --dkms --without-fw-update --force

Links
https://developer.nvidia.com/networking/ethernet-software

Restart DHCP namespaces

openstack subnet set --no-dhcp ${SUBNET_ID}
openstack subnet set --dhcp ${SUBNET_ID}

Find unnecessary DHCP namespaces

MAX_DHCP_NS=3
SUBNET_IDS=$(openstack subnet list --dhcp -c ID -f value)
for SUBNET_ID in ${SUBNET_IDS}; do
    NETWORK_ID=$(openstack subnet show ${SUBNET_ID} -c network_id -f value)
    DHCP_PORTS="$(openstack port list --device-owner network:dhcp --network ${NETWORK_ID} -c ID -c binding_host_id -c fixed_ips -c status -f value)"

    if [ $(echo "${DHCP_PORTS}" | wc -l) -ne ${MAX_DHCP_NS} ]; then
        echo "NETWORK_ID: ${NETWORK_ID}"
        echo "${DHCP_PORTS}"

        echo
    fi
done

Add / remove DHCP ports

NETWORK_ID=xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx
CONTROL_NODE=az3-ctl3-prod

DHCP_AGENT_ID=$(openstack network agent list --host ${CONTROL_NODE} --agent-type dhcp -f value -c ID)
echo "DHCP_AGENT_ID: ${DHCP_AGENT_ID}"

# Add DHCP namespace
openstack network agent add network ${DHCP_AGENT_ID} ${NETWORK_ID} --dhcp

# Remove DHCP namespace
openstack network agent remove network ${DHCP_AGENT_ID} ${NETWORK_ID} --dhcp

# List DHCP namespaces for network
openstack port list --device-owner network:dhcp --network ${NETWORK_ID} -c id -c mac_address -c fixed_ips -c status -c binding_host_id

Remove unnecessary DHCP port

# allow access to RBAC net for project 
openstack network rbac create --target-project foo-project1 --action access_as_shared --type network foo-net-01

# show rbac quota
neutron quota-show --tenant_id  | grep rbac_policy

# set rbac quota to unlimited
openstack quota set --rbac-policies -1 

openstack network rbac list

openstack network rbac show ${RBAC_ID}

Links
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/network-rbac.html
https://docs.openstack.org/mitaka/networking-guide/config-rbac.html
https://docs.openstack.org/python-openstackclient/pike/cli/command-objects/quota.html
https://docs.openstack.org/ocata/admin-guide/cli-networking-advanced-quotas.html

Create connection

VPN_GATEWAY=vpn1.example.com
VPN_USER=foo
VPN_ROUTES=192.168.11.0/24

nmcli connection add \
    connection.id vpn1 \
    connection.type vpn \
    connection.permissions "user:${USER}" \
    ipv4.routes "${VPN_ROUTES}" \
    ipv4.ignore-auto-routes yes \
    vpn.service-type org.freedesktop.NetworkManager.openconnect \
    vpn.data "
        protocol = anyconnect,
        authtype = cert,
        gateway = ${VPN_GATEWAY},
        cacert = ${HOME}/vpn1/ca.pem,
        usercert = ${HOME}/vpn1/certificate.pem,
        userkey = ${HOME}/vpn1/priv.pem,
        cookie-flags = 2
    " \
    vpn.secrets "
        form:main:group_list=CLIENTGROUP,
        form:main:username=${VPN_USER},
        save_passwords=yes
    "

Start connection and enter password once

nmcli connection up vpn1

Debug

#journalctl -fxe NM_CONNECTION=8d5ec3cb-99c5-47ea-84e2-38174cd14702
journalctl -fxe -t NetworkManager

cat /etc/NetworkManager/system-connections/vpn1.nmconnection 
nmcli con show vpn1

Links
https://0xsys.blogspot.com/2019/06/configure-vpn-using-nmcli.html

Create container

CONTAINER=wireguard

# Add ubuntu-minimal repository
lxc remote add --protocol simplestreams ubuntu-minimal https://cloud-images.ubuntu.com/minimal/releases/

# Create LXD container
#lxc launch ubuntu-minimal:lts ${CONTAINER}
lxc launch ubuntu-minimal:22.04 ${CONTAINER}

# update APT packages
lxc exec ${CONTAINER} -- bash -c "export http_proxy=${http_proxy} && apt update && apt -y dist-upgrade && apt -y autoremove"

# Install WireGuard
lxc exec ${CONTAINER} -- bash -c "export http_proxy=${http_proxy} && apt install -y wireguard iptables iputils-ping"

Configure UDP 4000 port forward to wireguard container

lxc config device add ${CONTAINER} udp51820 proxy listen=udp:0.0.0.0:51820 connect=udp:127.0.0.1:51820

Configure WireGuard

cd /etc/wireguard
umask 077;
wg genkey | tee privatekey | wg pubkey > publickey

# /etc/wireguard/wg0.conf
[Interface]
Address = 192.168.8.1/24
ListenPort = 51820
PrivateKey = aI+ohS+Jd5T5lMIDXqvLwp8g6eT6U28bQVS43t5YaU8=
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE     

[Peer]
PublicKey = yD3wRcoQ94Wu9o9WaLzjfA0S2IQrD91E8xxpSiMU6yE=
AllowedIPs = 192.168.8.2/32

Enable and start WireGuard systemd sercvice

# wg-quick up wg0
sudo systemctl enable --now wg-quick@wg0.service

WireGuard Home configuration

Build UEFI ISO

sudo apt install -y grub-efi-amd64-bin mtools xorriso mkisofs

mkdir -p iso/boot/grub
mkdir -p iso/EFI/BOOT

cp /tmp/ironic-python-agent.initramfs iso/boot/initrd.img
cp /tmp/ironic-python-agent.kernel iso/boot/vmlinuz

cat < iso/boot/grub/grub.cfg
set timeout=0
set root=(cd0)
set prefix=(memdisk)/boot/grub

menuentry 'Linux' {
   echo 'Loading kernel...'
   linux /boot/vmlinuz console=tty0 rw
   echo "Loading initrd..."
   initrd /boot/initrd.img
   echo "Booting..."
}
EOF

grub-mkstandalone -o iso/EFI/BOOT/BOOTX64.EFI -O x86_64-efi "boot/grub/grub.cfg=iso/boot/grub/grub.cfg"
dd if=/dev/zero of=iso/EFI/BOOT/efiboot.img bs=1M count=10
mkfs.msdos -F 12 -n 'EFIBOOTISO' iso/EFI/BOOT/efiboot.img
mmd -i iso/EFI/BOOT/efiboot.img ::EFI
mmd -i iso/EFI/BOOT/efiboot.img ::EFI/BOOT
mcopy -i iso/EFI/BOOT/efiboot.img iso/EFI/BOOT/BOOTX64.EFI ::EFI/BOOT/BOOTX64.EFI

xorriso -as mkisofs -V 'EFI_ISO_BOOT' -e EFI/BOOT/efiboot.img -no-emul-boot -o /tmp/efi-boot.iso iso/

Rebuild efi-boot.iso as Ironic esp.img UEFI image

cat < iso/boot/grub/grub.cfg
set timeout=0
set root=(cd0)
set prefix=(memdisk)/boot/grub

configfile /EFI/ubuntu/grub.cfg
EOF

ls -l /httpboot/
total 973693
-rw-r--r-- 1 root   root    10485760 Feb 11 17:28 esp.img
-rw-r--r-- 1 root   root   531835089 Feb 11 14:20 ipa.initramfs
-rw-r--r-- 1 root   root    11662080 Feb 11 14:21 ipa.kernel

Links
https://forums.fogproject.org/topic/15465/getting-fos-on-a-bootable-iso-image/7
https://forums.fogproject.org/topic/7727/building-usb-booting-fos-image/23
https://forums.fogproject.org/topic/7727/building-usb-booting-fos-image/22
https://github.com/syzdek/efibootiso