From f16397f95e116ae4d51448efffcfd98b1826bc69 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Thu, 27 Aug 2026 13:02:26 -0500 Subject: [PATCH] feat(netinfra): DHCP hot-standby + dual-stack NTP/SNMP on netinfra pair [#420] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DNS/DHCP/NTP redundancy per founder ruling 2026-08-27: - DHCP failover converted load-balance -> hot standby (split 255 on primary; secondary answers only if primary unreachable >3s). DHCP options now hand out BOTH nodes for DNS and NTP (active/active) — Tailscale hosts stay on MagicDNS 100.100.100.100. - netinfra-02 ntpsec deployed (pool.ntp.org, all interfaces); 01 repointed from debian pool zones to pool.ntp.org. NTP now redundant; GPS stratum-1 on pfvsvrpi tracked as follow-up ticket. - snmpd on both nodes with scoped ACLs (LibreNMS LAN+TS sources only) and ntpq/dhcpd-lease extends — prep for DNS/DHCP/NTP graphing. - Deployed sync-zones.sh (git version, DNS name instead of IP literal) to netinfra-02; zone sync verified 171/171 zones both nodes. 💘 Generated with Crush Assisted-by: Crush:glm-5.2 --- netinfra/dhcp/dhcpd-primary.conf | 7 ++++++- netinfra/dhcp/dhcpd-secondary.conf | 12 +++++++++--- netinfra/snmp/snmpd-netinfra-01.conf | 16 ++++++++++++++++ netinfra/snmp/snmpd-netinfra-02.conf | 16 ++++++++++++++++ 4 files changed, 47 insertions(+), 4 deletions(-) create mode 100644 netinfra/snmp/snmpd-netinfra-01.conf create mode 100644 netinfra/snmp/snmpd-netinfra-02.conf diff --git a/netinfra/dhcp/dhcpd-primary.conf b/netinfra/dhcp/dhcpd-primary.conf index 8534ace..5aeeee7 100644 --- a/netinfra/dhcp/dhcpd-primary.conf +++ b/netinfra/dhcp/dhcpd-primary.conf @@ -3,6 +3,11 @@ # Managed via Webmin DHCP module # # FAILOVER: this node is PRIMARY; peer is pfv-netinfra-02 (192.168.3.253) +# DESIGN [#420, founder ruling 2026-08-27]: DHCP failover = active/passive +# hot standby (split 255: primary serves all hashes; secondary answers only +# when primary unreachable for >3s via 'load balance max seconds'). +# DNS + NTP options hand out BOTH servers (active/active). Tailscale hosts +# use 100.100.100.100 MagicDNS, redundant to both netinfra TS IPs. # Global defaults option domain-name "knel.net"; @@ -25,7 +30,7 @@ failover peer "pfv-dhcp" { max-response-delay 30; max-unacked-updates 10; mclt 600; - split 128; + split 255; load balance max seconds 3; } diff --git a/netinfra/dhcp/dhcpd-secondary.conf b/netinfra/dhcp/dhcpd-secondary.conf index 702677f..3d3591a 100644 --- a/netinfra/dhcp/dhcpd-secondary.conf +++ b/netinfra/dhcp/dhcpd-secondary.conf @@ -1,8 +1,14 @@ -# dhcpd.conf — pfv-netinfra-01 (PRIMARY) +# dhcpd.conf — pfv-netinfra-02 (SECONDARY) # Migrated from pfv-netboot 2026-07-29 # Managed via Webmin DHCP module # -# FAILOVER: this node is PRIMARY; peer is pfv-netinfra-02 (192.168.3.253) +# FAILOVER: this node is SECONDARY; peer is pfv-netinfra-01 (192.168.3.252) +# DESIGN [#420, founder ruling 2026-08-27]: DHCP failover = active/passive +# hot standby (primary split 255 serves all clients while healthy; this +# node answers only when primary unreachable for >3s via +# 'load balance max seconds 3'). +# DNS + NTP options hand out BOTH servers (active/active). Tailscale hosts +# use 100.100.100.100 MagicDNS, redundant to both netinfra TS IPs. # Global defaults option domain-name "knel.net"; @@ -15,7 +21,7 @@ max-lease-time 7200; ddns-update-style none; authoritative; -# ----- failover peer (PRIMARY) ----- +# ----- failover peer (SECONDARY) ----- failover peer "pfv-dhcp" { secondary; address 192.168.3.253; diff --git a/netinfra/snmp/snmpd-netinfra-01.conf b/netinfra/snmp/snmpd-netinfra-01.conf new file mode 100644 index 0000000..010e09e --- /dev/null +++ b/netinfra/snmp/snmpd-netinfra-01.conf @@ -0,0 +1,16 @@ +# snmpd.conf — pfv-netinfra-01 [#420] scoped ACL for LibreNMS instrumentation +# Sources: tsys-librenms LAN (192.168.3.176) + Tailscale (100.86.204.77) only. +# No broad subnet grants (founder ruling 2026-08-27, matches dcinfra/sensors pattern). +sysLocation "Rack 3 netinfra (DNS/DHCP/NTP primary)" +sysContact ops@turnsys.com + +agentaddress 127.0.0.1:161,192.168.3.252:161,100.70.181.72:161 + +rocommunity kn3lmgmt 127.0.0.1 +rocommunity kn3lmgmt 192.168.3.176 +rocommunity kn3lmgmt 100.86.204.77 + +# Instrumentation feeds for the monitoring session (DNS/DHCP/NTP graphing): +extend ntpq /usr/bin/ntpq -c rv +extend dhcpd-leases /bin/sh -c "grep -c '^lease' /var/lib/dhcp/dhcpd.leases" +extend dhcpd-active /bin/sh -c "grep -c 'binding state active' /var/lib/dhcp/dhcpd.leases" diff --git a/netinfra/snmp/snmpd-netinfra-02.conf b/netinfra/snmp/snmpd-netinfra-02.conf new file mode 100644 index 0000000..d17ba85 --- /dev/null +++ b/netinfra/snmp/snmpd-netinfra-02.conf @@ -0,0 +1,16 @@ +# snmpd.conf — pfv-netinfra-02 [#420] scoped ACL for LibreNMS instrumentation +# Sources: tsys-librenms LAN (192.168.3.176) + Tailscale (100.86.204.77) only. +# No broad subnet grants (founder ruling 2026-08-27, matches dcinfra/sensors pattern). +sysLocation "Rack 3 netinfra (DNS/DHCP/NTP secondary)" +sysContact ops@turnsys.com + +agentaddress 127.0.0.1:161,192.168.3.253:161,100.71.171.20:161 + +rocommunity kn3lmgmt 127.0.0.1 +rocommunity kn3lmgmt 192.168.3.176 +rocommunity kn3lmgmt 100.86.204.77 + +# Instrumentation feeds for the monitoring session (DNS/DHCP/NTP graphing): +extend ntpq /usr/bin/ntpq -c rv +extend dhcpd-leases /bin/sh -c "grep -c '^lease' /var/lib/dhcp/dhcpd.leases" +extend dhcpd-active /bin/sh -c "grep -c 'binding state active' /var/lib/dhcp/dhcpd.leases"