Merge ~ballot/launchpad-mojo-specs/+git/launchpad-mojo-specs:doc_iptables into launchpad-mojo-specs:master

[Benjamin Allot]

Unmerged commits

12d16b2... by Benjamin Allot on 2023-11-14

Add documentation about the iptables redirect and SR-IOV setup

lint:0 (build)

1 → 1 of 1 result

First • Previous • Next • Last

diff --git a/lp/README.md b/lp/README.md
index 35b3c33..439d7ba 100644
--- a/lp/README.md
+++ b/lp/README.md
@@ -70,3 +70,56 @@ To create the exchange used for OOPSes in the local RabbitMQ instance:
 ```shell
 juju run -u rabbitmq-server/leader -- rabbitmqadmin declare exchange name=oopses type=fanout durable=true
 ```
+
+### Production network setup
+
+This setup is specific to the production environment.
+
+#### SR-IOV
+
+Two new units, ppa-lb and launchpad-ppa-publisher, are now on SR-IOV instances.
+Those instances have a bond on the edge network, bypassing any firewalls.
+
+The specific part required for the routing and port forward aspect will be found in /etc/networkd-dispatcher/routable.d on those hosts
+on top of the netplan config in /etc/netplan/config.yaml
+
+### Iptables redirect
+
+Because txpkgupload is using port 22 which collides with SSH, and that using charms to modify Openssh on the host, it is now listening on port 5022.
+
+The current flow is:
+
+client (internet) -> ppa-lb (ipv4/ipv6) on port 22 -> iptables redirect to port 5022 -> haproxy redirect to launchpad-ppa-uploader on port 5022
+
+This is required for both IPv4 and IPv6, when a new connection is coming through the edge interface on port 22.
+
+The openssh daemon is listening on the private IP only on port 22 and is used for administration purpose.
+
+To bring those rules automatically when the bond-edge interface is configured, add this content into `/etc/networkd-dispatcher/routable.d/20-ppa-redirect`
+
+WARNING: this must be executable
+```
+sudo chmod +x /etc/networkd-dispatcher/routable.d/20-ppa-redirect
+```
+
+```bash
+#!/bin/bash
+
+set -ue
+# Redirect port 22 when hitting edge interface to 5022 on the same interface
+EDGE_IF=bond-edge
+
+# No op on other interfaces
+# See https://gitlab.com/craftyguy/networkd-dispatcher
+if [[ "${IFACE}" != "${EDGE_IF}" ]]; then
+  exit 0
+fi
+
+# There are 2 variables existing, IP_ADDRS and IP6_ADDRS, but cannot be tested at time of writing, feel free to update
+EDGE_IP_v4="$(ip -brief -4 addr show ${EDGE_IF?} | awk '{split($3, ip, "/"); print ip[1]}')"
+EDGE_IP_v6="$(ip -brief -6 addr show ${EDGE_IF?} | awk '{split($3, ip, "/"); print ip[1]}')"
+
+# Redirect port 22 coming through the EDGE_IP to port 5022 locally (haproxy)
+/usr/sbin/iptables -t nat -A PREROUTING -d ${EDGE_IP_v4?}/32 -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 5022
+/usr/sbin/ip6tables -t nat -A PREROUTING -d ${EDGE_IP_v6?}/112 -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 5022
+```