Currently, a lot of servers have public IcannNet addresses.
This is not needed, as we can switch to a more secure network topology:
That would help to reduce the attack surface of services.
| rOPS Nasqueron Operations | |||
| D2293 Provide a PaaS front-end role | |||
| D2672 | rOPS015557f0313e Prune salt-primary role on Ysul and WindRiver | ||
| D2596 | rOPS6deb32e01378 Set kernel state for router | ||
| D2566 | rOPSf9dbdab3b579 Configure IntraNought interface for RedHat servers | ||
| D2334 | rOPSd2434fa0cf3d Configure IntraNought interface for FreeBSD | ||
| D2330 | rOPS5750d01e83d2 Add router-001.nasqueron.org as router | ||
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Unknown Object (Maniphest Task) | |||||
| Open | None | T1616 Build a bastion - load balancers - private instances network topology | |||
| Resolved | dereckson | T1619 Connect all baremetal servers to Drake network | |||
| Resolved | dereckson | T1521 Restrict MySQL access |
For Salt and Vault, we're already using the private network.
The last step is to switch the Docker engines to the private IP, so the Docker ports are bind there, and create one unified proxy (nginx or something else) for the different engines instead to have a nginx on each. That's well drafted in D2293.