From 9d39b22b6189c31bdbd560b2be51c3d3df910c09 Mon Sep 17 00:00:00 2001 From: Christoph Emsenhuber Date: Sat, 8 Aug 2026 19:18:50 +0200 Subject: [PATCH] TP3-Rebuild: ap1+ap2 als reine Standalone-APs (CAPsMAN weg) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Beide hAP ax² neu als Standalone-Access-Points provisioniert, kein CAPsMAN mehr: - ap1 10.40.99.11 (core ether15), ap2 10.40.99.12 (branch ether24) - Uplink geraeteseitig auf ether1 (PoE-Port, poe-out=off); ether2 aus Trunk entfernt - 6 SSIDs (main WPA3+FT; infra/iot/media/untrusted/guest WPA2+3), iot nur 2,4 GHz, media FT=no; jede SSID mit eigenem datapath bridge+vlan-id -> TP3.1-Leck strukturell weg - Kanaele non-DFS: ap1 ch36/ch1, ap2 ch149/ch11 - Einheitliches Admin-PW auf allen 4 MikroTik (core/branch/ap1/ap2) Nautobot As-built (nautobot/ingest-ap-rebuild.py): ap1/ap2 Rolle Wireless AP + Active, Mgmt .99.11/.99.12, ether1-Trunk, stale L3-Objekte (vlan10-90/100, wg-hub) entfernt; crs326-core primary_ip4 auf .99.1 korrigiert. Verifiziert per GraphQL. Doku: CLAUDE.md Hardware-Tabelle + teilprojekte.md TP3 aktualisiert. Configs/PSKs liegen gitignored unter routeros/.secrets/. Co-Authored-By: Claude Opus 4.8 --- CLAUDE.md | 5 +- docs/teilprojekte.md | 1 + nautobot/ingest-ap-rebuild.py | 212 ++++++++++++++++++++++++++++++++++ 3 files changed, 216 insertions(+), 2 deletions(-) create mode 100644 nautobot/ingest-ap-rebuild.py diff --git a/CLAUDE.md b/CLAUDE.md index 329e6e9..52bb0f9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -31,8 +31,9 @@ GW je VLAN = `.1` · APs: ap1=`.1`, ap2=`.2` · Switches: ALLNET=`.11`, Omada=`. | ~~Omada Access-Switch (sw2)~~ | — | ❌ **abgebaut 2026-07-23** (TP15 Branch-Tausch) — durch `crs326-branch` in Technik OG ersetzt, physisch entfernt | | **crs326-branch** (CRS326, Technik OG) | **10.40.99.2** (VLAN99; temp VLAN10 `.10.2`) · Bootstrap Rev4 2026-08-08 | RouterOS 7.19.5 · `admin`/`~/.secrets` (`CRS326_BRANCH_*`) · REST `http://10.40.99.2/rest` · MikroMCP `routers.yaml` (live nach MCP-Neustart) · **TP15 ✅: ersetzt sw2** (L2-Switch), volle Portbelegung (ether1 Uplink-Trunk, 2/8 NAS, 3 Drucker, 4 Dock, 5/6 Sonos, 7 macmini, 24 ap2) · sw-id RGZJ-UK0T, MAC 04:F4:1C:B4:15:58 | | **crs326-core** (CRS326, Technik UG) | **10.40.99.1** (VLAN99-SVI = L3-GW; same-subnet-Fallback `10.40.10.1`) · Identity `crs326-core` | RouterOS 7.19.5 · `admin`/`~/.secrets` (`CRS326_CORE_*`) · MikroMCP routerId `crs326-core` (nach MCP-Neustart) · **TP15/TP21.1 ✅ 2026-08-08: PRODUKTIVER L3-Router** (ersetzt ap1) — Routing/DHCP (7 Server + 54 Leases)/DNS (plain `1.1.1.1`, DoH-Cloudflare-TODO)/NAT/WG-Hub (fm+dw live); WAN `vlan100`=Liwest `90.146.33.177` · sw-id 4W04-URHT, MAC 04:F4:1C:B4:17:76 | -| hAP ax² #1 (ap1) | ❌ **Werksreset + getrennt (2026-08-08)** — L3-Rolle → `crs326-core`; Ziel-Mgmt `10.40.99.11` | wird **reiner AP** (WLAN-Neuprovisionierung, eigene Session) · alte L3-Config-Referenz = `routeros/ap1-pre-core-cutover-20260806-073616.rsc` | -| hAP ax² #2 (ap2) | 10.40.41.2 (VLAN1, TP19.1-Umzug auf `.99.2` vertagt bis TP21/Nautobot) | MikroMCP (live) · **Port 2 am Omada-Switch** | +| hAP ax² #1 (ap1) | **10.40.99.11** (VLAN99) · Identity `ap1` | RouterOS 7.23.2 · `admin`/`~/.secrets` (`ROUTER_AP1_*`) · REST `http://10.40.99.11/rest` · MikroMCP `ap1` (live nach MCP-Neustart) · **TP3-Rebuild ✅ 2026-08-08: reiner Standalone-AP, KEIN CAPsMAN** — Uplink `ether1` (PoE-Port, `poe-out=off`) an crs326-core `ether15`; 6 SSIDs dirtyvader-main/-infra/-iot/-media/-untrusted/-guest, ch36/ch1; jede SSID mit `datapath` (TP3.1-Leck gefixt) · MAC D0:EA:11:4D:40:E0 · Config-Referenz `routeros/.secrets/ap1-prov-base.rsc` | +| hAP ax² #2 (ap2) | **10.40.99.12** (VLAN99) · Identity `ap2` | RouterOS 7.23.2 · `admin`/`~/.secrets` (`ROUTER_AP2_*`) · REST `http://10.40.99.12/rest` · MikroMCP `ap2` · **TP3-Rebuild ✅ 2026-08-08: reiner Standalone-AP** — Uplink `ether1` (PoE) an crs326-branch `ether24`; identisch zu ap1, ch149/ch11 · MAC D0:EA:11:4D:40:3A · Config `routeros/.secrets/ap2-prov-base.rsc` | +| **🔑 Einheitliches Admin-PW (2026-08-08)** | alle 4 MikroTik (core/branch/ap1/ap2) | user `admin`, gleiches PW (`~/.secrets/credentials.env` → `ROUTER_*_PASS`/`CRS326_*_PASS`; „Überlebensversicherung", User-Vorgabe). Werks-Defaults ap1/ap2 damit obsolet. | | NAS (nas-bf, DS923) | 10.40.20.10 | SSH `adm.christoph@10.40.20.10` (kein PW nötig) · Docker (Portainer endpointId=14) | | platform-pg (LXC 105, pve) | 10.40.20.20 | SSH via pve (`pct exec 105 --`) · **TP20 ✅ 2026-07-16: PG16, DB `nautobot`, Creds `postgres/.secrets`** | | Nautobot (Portainer-Stack, NAS) | 10.40.20.30 | Portainer ep14, Stack Id 203 · **TP21 ✅ 2026-07-16: `ghcr.io/nautobot/nautobot:3.1.7`, DB=platform-pg, Creds in `docs/nas-vlan20/stacks/210-nautobot.yml` (gitignored)** — Golden-Config-App/Device-Adoption noch offen | diff --git a/docs/teilprojekte.md b/docs/teilprojekte.md index 2f1994a..4a8abbb 100644 --- a/docs/teilprojekte.md +++ b/docs/teilprojekte.md @@ -107,6 +107,7 @@ Kontrolle: MikroMCP (MikroTik) live · ALLNET = Klickanleitungen · Omada → Co - **Begründung (kein Widerspruch zu Nautobot, aber ein echter Reibungspunkt):** CAPsMAN erzeugt auf dem CAP **dynamische** Objekte (`wifi13–22`), die nie in dessen eigener Config stehen → Golden-Config-Compliance sieht auf ap2 faktisch nichts. Genau diese Halbheit war die Ursache von TP3.1 (CAPsMAN schrieb `datapath.vlan-id` nicht auf die Leitung und legte die tagged-Member am CAP nicht an). - **Was NICHT verloren geht:** 802.11r/k/v braucht kein CAPsMAN, sondern nur gleiche SSID/PSK/Mobility-Domain → Fast-Roaming bleibt. Preis: Radio-/Kanaländerungen sind zwei Deployments statt eines Provision-Pushes — mit Nautobot ohnehin ein Job-Run. - **Reihenfolge:** WLAN-Neuprovisionierung erst **nach** dem CRS326-Bring-up (TP15), da Routing/DHCP/DNS vorher umziehen. + - ✅ **DURCH (2026-08-08): beide APs als reine Standalone-APs neu provisioniert, CAPsMAN weg.** ap1 `10.40.99.11` (an core `ether15`), ap2 `10.40.99.12` (an branch `ether24`); Uplink geräteseitig auf **`ether1`** (PoE-Port, `poe-out=off`) umgestellt, ether2 aus dem Trunk entfernt. 6 SSIDs (main WPA3+FT / infra/iot/media/untrusted/guest WPA2+3, iot nur 2,4 GHz, media FT=no); **jede SSID mit eigenem `datapath` bridge+vlan-id** → das TP3.1-„cfg-main-2g ohne datapath"-Leck ist strukturell weg. Kanäle non-DFS ap1 ch36/ch1, ap2 ch149/ch11. Client-Test grün (VLAN10/30-Leases korrekt). Configs `routeros/.secrets/ap{1,2}-prov-base.rsc`, PSKs `routeros/.secrets/wlan-psks.env`, As-built → Nautobot via `nautobot/ingest-ap-rebuild.py`. **Einheitliches Admin-PW auf allen 4 MikroTik** (User-Vorgabe). Henne-Ei beim Bring-up: Werks-`192.168.88.1` über Core-Temp-Pfad (`192.168.88.2` + masq, wieder entfernt) via scp+`/import`; Werks-Inline-Overrides auf wifi1/wifi2 mussten geleert werden (`!configuration.ssid !security.*`), sonst funkt die Main-VAP die Werks-SSID. Offen: DoH auf core (nur plain 1.1.1.1), breiterer CLAUDE.md-Gotcha-Cleanup (ap1-als-L3-Router-Referenzen sind überholt). ### TP3.1 — ap2 VLAN-Trunk-Fix ▸ ✅ Config live (2026-07-01) — `routeros/tp3.1-ap2-vlan.rsc` - **Root Cause:** ap2 (CAP, local forwarding) hatte `bridge vlan-filtering=no` → `datapath.vlan-id` wurde nie diff --git a/nautobot/ingest-ap-rebuild.py b/nautobot/ingest-ap-rebuild.py new file mode 100644 index 0000000..37e31c8 --- /dev/null +++ b/nautobot/ingest-ap-rebuild.py @@ -0,0 +1,212 @@ +#!/usr/bin/env python3 +"""BF-Netzwerk -> Nautobot: ap1/ap2 As-built als REINE Access Points (TP3-Rebuild, 2026-08-08). + +Governance-Auflage "intended config zurueckschreiben" nach dem WLAN-Neuaufbau (CAPsMAN abgeschafft, +L3 auf crs326-core). Re-modelliert ap1 + ap2 identisch als Standalone-APs: + + - Rolle Router -> Wireless AP, Status Active + - Mgmt vlan99: ap1 10.40.99.11, ap2 10.40.99.12 (primary_ip4) + - Uplink = ether1 (PoE-Port), Trunk: native VLAN1 + tagged 10/20/30/40/50/90/99 + - WLAN-VAPs (wifi1/wifi2 master + Slaves) je SSID->VLAN + - ENTFERNT die stale L3-Objekte von ap1: vlan10/20/30/40/50/90/100 (SVIs), wg-hub + +Muster wie ingest-crs326-ports.py: get-or-create + Delta-PATCH, idempotent. +Verifikation NUR per GraphQL (tagged_vlans liest sich per REST als null). +PSKs werden bewusst NICHT modelliert (liegen lokal am Geraet). + + export NAUTOBOT_TOKEN=... + python3 nautobot/ingest-ap-rebuild.py # Dry-Run + python3 nautobot/ingest-ap-rebuild.py --apply # schreiben +""" +import json, os, sys, urllib.request, urllib.error, urllib.parse + +BASE = "http://10.40.20.30:8080/api" +TOKEN = os.environ.get("NAUTOBOT_TOKEN", "") +DRY = "--apply" not in sys.argv +log = [] + + +def req(method, path, data=None): + url = path if path.startswith("http") else f"{BASE}{path}" + body = json.dumps(data).encode() if data is not None else None + r = urllib.request.Request(url, data=body, method=method) + r.add_header("Authorization", f"Token {TOKEN}") + r.add_header("Content-Type", "application/json") + r.add_header("Accept", "application/json") + try: + with urllib.request.urlopen(r, timeout=30) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + except urllib.error.HTTPError as e: + print(f"!! {method} {url}\n payload={json.dumps(data)}\n -> {e.code} {e.read().decode()[:500]}") + raise + + +def find(path, **params): + q = "&".join(f"{k}={urllib.parse.quote(str(v))}" for k, v in params.items()) + res = req("GET", f"{path}?{q}&limit=2") + return res["results"][0] if res.get("count") else None + + +def goc(path, match, payload, label=None): + name = label or payload.get("name") or str(match) + obj = find(path, **match) + if obj: + log.append(f" = {name}") + return obj + if DRY: + log.append(f" + {name} (dry-run)") + return {"id": f"DRY-{name}"} + obj = req("POST", path + "/", payload) + log.append(f" + {name}") + return obj + + +def patch(path, obj, payload, label): + delta = {} + for k, v in payload.items(): + cur = obj.get(k) + cur_id = cur.get("id") if isinstance(cur, dict) else cur + if cur_id != v: + delta[k] = v + if not delta: + log.append(f" = {label} (unveraendert)") + return obj + if DRY: + log.append(f" ~ {label}: {list(delta)} (dry-run)") + return obj + out = req("PATCH", f"{path}/{obj['id']}/", delta) + log.append(f" ~ {label}: {list(delta)}") + return out + + +def sid(name): + return find("/extras/statuses", name=name)["id"] + + +def rid(name): + return find("/extras/roles", name=name)["id"] + + +ETH, VIRT, BR, WIFI = "1000base-t", "virtual", "bridge", "ieee802.11ax" +S_ACTIVE = sid("Active") +R_AP = rid("Wireless AP") + +vg = find("/ipam/vlan-groups", name="BF") +V = {vid: find("/ipam/vlans", vid=vid, vlan_group=vg["id"]) for vid in (1, 10, 20, 30, 40, 50, 90, 99)} +ns_global = find("/ipam/namespaces", name="Global")["id"] + +DEVS = {n: find("/dcim/devices", name=n) for n in ("ap1", "ap2")} +TRUNK = [10, 20, 30, 40, 50, 90, 99] +STALE = ["vlan10", "vlan20", "vlan30", "vlan40", "vlan50", "vlan90", "vlan100", "wg-hub"] + +# VAP -> (Band-Beschreibung, VLAN) — Master fuehren dirtyvader-main (VLAN10) +VAPS = { + "wifi1": ("5GHz master - dirtyvader-main", 10), + "wifi2": ("2.4GHz master - dirtyvader-main", 10), + "w5-infra": ("5G slave - dirtyvader-infra", 20), + "w5-media": ("5G slave - dirtyvader-media", 40), + "w5-untrusted": ("5G slave - dirtyvader-untrusted", 50), + "w5-guest": ("5G slave - dirtyvader-guest", 90), + "w2-infra": ("2.4G slave - dirtyvader-infra", 20), + "w2-iot": ("2.4G slave - dirtyvader-iot (nur 2.4GHz)", 30), + "w2-media": ("2.4G slave - dirtyvader-media", 40), + "w2-untrusted": ("2.4G slave - dirtyvader-untrusted", 50), + "w2-guest": ("2.4G slave - dirtyvader-guest", 90), +} +MGMT = {"ap1": "10.40.99.11/24", "ap2": "10.40.99.12/24"} + + +def ifc(dev, name, typ, desc, mode=None, untagged=None, tagged=None): + obj = goc("/dcim/interfaces", {"device": dev, "name": name}, + {"device": DEVS[dev]["id"], "name": name, "type": typ, + "status": S_ACTIVE, "description": desc}, label=f"{dev}:{name}") + if DRY or str(obj["id"]).startswith("DRY"): + return obj + # Beim Zurueckstufen (kein tagged-Mode) zuerst tagged_vlans leeren, sonst 400 beim mode-Clear + if not tagged: + req("PATCH", f"/dcim/interfaces/{obj['id']}/", {"tagged_vlans": []}) + p = {"description": desc, "type": typ, "mode": mode or "", + "untagged_vlan": V[untagged]["id"] if untagged is not None else None} + obj = patch("/dcim/interfaces", obj, p, f"{dev}:{name}") + if tagged: + req("PATCH", f"/dcim/interfaces/{obj['id']}/", {"tagged_vlans": [V[t]["id"] for t in tagged]}) + return obj + + +def remove_iface(dev, name): + o = find("/dcim/interfaces", device=dev, name=name) + if not o: + log.append(f" . {dev}:{name} (schon weg)") + return + if DRY: + log.append(f" - {dev}:{name} (dry-run)") + return + req("DELETE", f"/dcim/interfaces/{o['id']}/") + log.append(f" - {dev}:{name}") + + +def assign_mgmt(dev_obj, addr, desc): + """IP get-or-create, exklusiv an dev:vlan99 haengen (fremde Assignments loesen), primary setzen.""" + ip = find("/ipam/ip-addresses", address=addr) or goc( + "/ipam/ip-addresses", {"address": addr}, + {"address": addr, "status": S_ACTIVE, "namespace": ns_global, "description": desc}, label=addr) + if DRY or str(ip["id"]).startswith("DRY"): + return + intf = find("/dcim/interfaces", device=dev_obj["name"], name="vlan99") + assigns = req("GET", f"/ipam/ip-address-to-interface/?ip_address={ip['id']}&limit=50").get("results", []) + have = False + for a in assigns: + if a["interface"]["id"] == intf["id"]: + have = True + else: + req("DELETE", f"/ipam/ip-address-to-interface/{a['id']}/") + log.append(f" - {addr} losgeloest von {a['interface'].get('display', '?')}") + if not have: + req("POST", "/ipam/ip-address-to-interface/", {"ip_address": ip["id"], "interface": intf["id"]}) + log.append(f" + {addr} -> {dev_obj['name']}:vlan99") + req("PATCH", f"/dcim/devices/{dev_obj['id']}/", {"primary_ip4": ip["id"]}) + + +def set_mgmt(dev, addr): + assign_mgmt(DEVS[dev], addr, f"{dev} Mgmt (VLAN99)") + + +# --- Core-Mgmt-Konsistenz: crs326-core primary = .99.1 (das stale .99.11 wandert unten zu ap1) --- +core = find("/dcim/devices", name="crs326-core") +if core: + print("== crs326-core: Mgmt-IP korrigieren -> 10.40.99.1") + assign_mgmt(core, "10.40.99.1/24", "crs326-core Mgmt/GW SVI (VLAN99)") + + +COMMENT = ("TP3-Rebuild 2026-08-08: reiner Standalone-AP (kein CAPsMAN). L3 auf crs326-core. " + "Uplink ether1 (PoE, poe-out=off), Trunk native VLAN1 + tagged 10/20/30/40/50/90/99. " + "6 SSIDs dirtyvader-main/-infra/-iot/-media/-untrusted/-guest. PSKs lokal am Geraet.") + +for dev in ("ap1", "ap2"): + if not DEVS[dev]: + print(f"!! Device {dev} nicht in Nautobot gefunden - uebersprungen") + continue + print(f"== {dev}: -> reiner Access Point") + patch("/dcim/devices", DEVS[dev], {"role": R_AP, "status": S_ACTIVE}, f"{dev} role/status") + ifc(dev, "bridge", BR, "vlan-filtering=yes; VLAN1 untagged, 10-99 tagged") + ifc(dev, "ether1", ETH, "Uplink-Trunk (PoE-Port, poe-out=off): native VLAN1 + tagged 10/20/30/40/50/90/99", + mode="tagged", untagged=1, tagged=TRUNK) + ifc(dev, "ether2", ETH, "frei (Alt-Uplink, seit ether1-Umstellung ungenutzt)") + for n in (3, 4, 5): + ifc(dev, f"ether{n}", ETH, "frei") + ifc(dev, "vlan99", VIRT, "Mgmt SVI (VLAN99)", mode="tagged", tagged=[99]) + if not DRY: + v99 = find("/dcim/interfaces", device=dev, name="vlan99") + br = find("/dcim/interfaces", device=dev, name="bridge") + req("PATCH", f"/dcim/interfaces/{v99['id']}/", {"parent_interface": br["id"]}) + for name, (desc, vlan) in VAPS.items(): + ifc(dev, name, WIFI, desc, mode="access", untagged=vlan) + for name in STALE: + remove_iface(dev, name) + set_mgmt(dev, MGMT[dev]) + if not DRY: + req("PATCH", f"/dcim/devices/{DEVS[dev]['id']}/", {"comments": COMMENT}) + +print("\n".join(log)) +print(f"\n{'DRY-RUN - nichts geschrieben. Mit --apply ausfuehren.' if DRY else 'ANGEWENDET.'}")