NINUX Basilicata: the infrastructure, step by step¶
This guide explains how to rebuild from scratch the infrastructure of the NINUX Basilicata community network: from the Proxmox host to the routers in people's homes, through DNS, OpenWISP, the OpenWrt firmware build and the Android app that manages everything from the phone.
It is our disaster recovery plan, and a starting point for other communities that want the same infrastructure. Every component lives in a public repository with its own detailed README: here you find the order in which to put them together, how they connect and why they are made this way.
How to use this guide
Follow the Rebuild chapters in order: each one assumes the previous ones are done. Where a step is already well explained in the README of its repository, the guide links to it instead of repeating it.
Repositories¶
| Repository | What it does | Chapter |
|---|---|---|
| ansible-dns | Authoritative DNS (BIND hidden primary, secondaries, DNSSEC), ACME certificates, router DDNS, monitoring | DNS and certificates |
| openwisp2 | Full OpenWISP server: controller, monitoring, RADIUS, topology, firmware upgrader, Wi-Fi pages, ZeroTier VPN, Babel, router logs, LuCI proxy | OpenWISP |
| openwisp-netconsole | "Netconsole" tab on the device page and log rotation | Modules |
| openwisp-luci | "LuCI" button on the device page, with an authenticated proxy | Modules |
| openwisp-luci-theme | "LuCI theme of the routers" box on the organization page: logo (with upload), name, colours and Basic/Advanced mode | Modules |
| openwisp-config | Fork of the OpenWISP agent of the routers, with our fixes | Modules |
| ansible-ninux-openwrt | NINUX OpenWrt firmware build with Ansible and Jenkins, upload to the firmware upgrader | Firmware and Jenkins |
| luci-theme-ninux | Lightweight LuCI theme for the routers, with Basic (simplified, like consumer routers) and Advanced modes | OpenWISP, Firmware and Jenkins |
| openwisp-android | Android app to manage OpenWISP | Android app |
| openwisp-voucher | Desktop program that creates and prints time-limited Wi-Fi accounts for the captive portal | Time-limited Wi-Fi access |
Rebuild order¶
- Proxmox: host, network, containers and VMs (chapter 1)
- DNS: zones, DNSSEC, wildcard certificates delivered to the containers (chapter 2)
- OpenWISP: openwisp2 playbook, organization, VPN, templates (chapter 3)
- Modules: netconsole and LuCI inside OpenWISP (chapter 4)
- Firmware: Jenkins, first build, images in the firmware upgrader (chapter 5)
- Routers: flashing, automatic registration, templates, mesh (chapter 6)
- App: installation and login (chapter 7)
- Vouchers: RADIUS group for guests and the time-limited access program (chapter 8)
The Operations page collects updates, backups, security and problems we have already met.
What is not in this guide¶
Passwords, tokens, keys and secrets are not here nor in the repositories:
commands use placeholders such as CHANGEME, and each repository explains
where the real values go (secrets.yml, vaults, ninux.yml encrypted with
ansible-vault, all outside git).
Contact
Questions about the guide or the app: app@ninux-nnxx.it. Fixes and improvements are welcome as issues or pull requests.