Role service-fastd-mesh: update fastd peer limit method

roles/service-fastd-mesh/tasks/main.yml

@@ -6,24 +6,6 @@
     mode: 0755
   loop: "{{ meshes | subelements('fastd.nodes.instances') }}"
 
-- name: create fastd peer mesh directories
-  file:
-    path: "/etc/fastd/{{ item.0.id }}vpn-{{ item.1.mtu }}/peers"
-    state: directory
-    mode: 0755
-    owner: admin
-    group: admin
-  loop: "{{ meshes | subelements('fastd.nodes.instances') }}"
-
-- name: clone fastd peer mesh repos
-  git:
-    repo: "{{ item.1.peers.repo }}"
-    dest: "/etc/fastd/{{ item.0.id }}vpn-{{ item.1.mtu }}/peers"
-    version: "{{ item.1.peers.version }}"
-    update: no
-  loop: "{{ meshes | subelements('fastd.nodes.instances') }}"
-  become: false
-
 - name: template fastd mesh config
   template:
     src: fastd-mesh.conf.j2
@@ -39,25 +21,21 @@
   notify: restart fastd mesh instances
   loop: "{{ meshes | subelements('fastd.nodes.instances') }}"
 
-- name: copy peer_limit.conf if not exist
+- name: create peer_limit.txt if not exist
   copy:
-    src: peer_limit.conf
-    dest: "/etc/fastd/{{ item.0.id }}vpn-{{ item.1.mtu }}/peer_limit.conf"
+    content: ""
+    dest: "/etc/fastd/peer_limit.txt"
     owner: admin
     group: admin
     mode: 0640
     force: no
-  notify: restart fastd mesh instances
-  loop: "{{ meshes | subelements('fastd.nodes.instances') }}"
 
-- name: set file attributes for peer_limit.conf
+- name: set file attributes for peer_limit.txt
   file:
-    path: "/etc/fastd/{{ item.0.id }}vpn-{{ item.1.mtu }}/peer_limit.conf"
+    path: "/etc/fastd/peer_limit.txt"
     mode: 0640
     owner: admin
     group: admin
-  notify: restart fastd mesh instances
-  loop: "{{ meshes | subelements('fastd.nodes.instances') }}"
 
 - name: write systemd unit fastd-sync-meshkeys.service
   template:
@@ -77,18 +55,10 @@
     mode: 0644
   notify: reload systemd
 
-- name: create fastd_status.json file
-  file:
-    path: /var/www/html/fastd_status.json
-    state: touch
-    owner: admin
-    group: admin
-    mode: 0644
-
 - name: write configuration for fastd-peer-limit-update script
   template:
-    src: fastd_peer_limit_config.yaml.j2
-    dest: /home/admin/.ffmwu-config/fastd_peer_limit_config.yaml
+    src: fastd_peer_limit.yaml.j2
+    dest: /home/admin/.ffmwu-config/fastd_peer_limit.yaml
     owner: admin
     group: admin
     mode: 0644

roles/service-fastd-mesh/templates/fastd-mesh.conf.j2

@@ -19,11 +19,8 @@ bind {{ ansible_default_ipv6.address | ipaddr('public') | ipwrap }}:10{{ item.1.
 include "secret.conf";
 mtu {{ item.1.mtu }};
 
-peer group "vpn_nodes" {
-    include "peer_limit.conf";
-    include peers from "peers";
-}
-
 on up "/bin/systemctl reload networking";
 
+on verify "/home/admin/clones/backend-scripts/verify_fastd_peers_gw.py $PEER_KEY";
+
 status socket "/var/run/fastd-{{ item.0.id }}vpn-{{ item.1.mtu }}.status";

roles/service-fastd-mesh/templates/fastd-sync-meshkeys.timer.j2

@@ -6,7 +6,7 @@ Description=Update fastd mesh peers repos timer
 
 [Timer]
 OnBootSec=5m
-OnUnitActiveSec=15m
+OnUnitActiveSec=5m
 
 [Install]
 WantedBy=timers.target

roles/service-fastd-mesh/templates/fastd_exporter_vhost.conf.j2

@@ -13,10 +13,12 @@ server {
 
       allow 127.0.0.0/8;
       allow ::1/128;
-{% for host in groups['ffmwu-monitoring'] %}
+{% for group in prometheus_groups %}
+{% for host in groups[group] %}
       allow {{ lookup('dig', host, 'qtype=A') }};
       allow {{ lookup('dig', host, 'qtype=AAAA') }};
-      deny all;
 {% endfor %}
+{% endfor %}
+      deny all;
     }
 }

roles/service-fastd-mesh/templates/fastd_peer_limit.yaml.j2

@@ -0,0 +1,18 @@
+#
+# {{ ansible_managed }}
+#
+
+additional: 16
+metrics_url: 'https://%s.freifunk-mwu.de:9281/metrics'
+limit_file: '/etc/fastd/peer_limit'
+fastd_instances:
+{% for mesh in meshes %}
+{% for instance in mesh.fastd.nodes.instances %}
+  - {{ mesh.id }}vpn-{{ instance.mtu }}
+{% endfor %}
+{% endfor %}
+gateways:
+{% for gateway in groups['ffmwu-gateways'] %}
+  - {{ gateway.rsplit('.freifunk-mwu.de')[0] }}
+{% endfor %}
+fetch_timeout: 10

roles/service-fastd-mesh/templates/fastd_peer_limit_config.yaml.j2

@@ -1,24 +0,0 @@
-#
-# {{ ansible_managed }}
-#
-ansible_gate: True
-additional: 8
-fastd_instances:
-{% for mesh in meshes %}
-{% for instance in mesh.fastd.nodes.instances %}
-  - {{ mesh.id }}vpn-{{ instance.mtu }}
-{% endfor %}
-{% endfor %}
-cronlog: '/home/admin/.cronlog/limit.%s.log'
-fastd_config: '/etc/fastd/%s/peer_limit.conf'
-fastd_status: '/usr/local/bin/fastd-status'
-gateways:
-{% for gateway in groups['ffmwu-gateways'] %}
-  - {{ gateway.rsplit('.freifunk-mwu.de')[0] }}
-{% endfor %}
-restart_max: 43200
-stat: 'fastd_status.json'
-stat_ext: 'http://%s.freifunk-mwu.de/%s'
-stat_local: '/var/www/html/%s'
-remote_fetch_timeout: 10
-remote_data_timeout: 900