Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2072 Thanks!
Hello and welcome to yet
another talk here on Khowst Serenity
Flower Life from our studio
here in Potsdam.
This talk will be named Triffids Usable
Building Network Infrastructure
and will be given to you from us tour,
who is located in Dresden at sea to
guide its Will 50 Deutschland
to shower. These are talks that exist
on the subject of English Vixen.
Five years ago, the C3
D2 moved into a new
and renovated building,
and with this they had the opportunity to
kind of take over the network
infrastructure and become kind of
an ISP to all of the community
that is surrounding them inside the
building.
And it's talk, I hope, will tell us
how he structured
and maybe restructured
all of this networked infrastructure
based on Nicholas.
And I will wish you
lots of good information and
lots of fun here at this talk.
Reproducible building network
infrastructure by US total.
The stage is yours and hello.
Come back Sunday for the issues
from the beginning on.
I am actually a software developer by
heart, but I'm also a computer
administrator.
I have a strong interest in using
network infrastructure because it is
required for my communications programs
when I write software.
So over the time, I developed a few
strong opinions about how computer
networks should be designed so that they
actually serve their users and don't
put additional restrictions on them.
And I've always asked myself how
this can be done, actually.
And five years ago, I had the opportunity
to try this at a larger scale and learn
a lot. And that's why why I'm
doing this talk today because I want to
share my experience and maybe
inspire you to do the same for your
community.
And before I begin, I will tell you
a bit about the location because
where our hex base was located
before in an office complex, this was
recent.
This wouldn't have been possible.
But then we found
the traffic
and we met these
creative, open minded people.
The thing an old
factory building,
and we immediately felt
that they were us
and this
the the environment.
The screen is, for example, the old
factory hand, which tell
us where we can put up my phone
or link
and we can install antenna
and the fire and radio
to.
This region that provides
a lot of opportunity to fun
with technology here
at the best is there is a
ballroom that is
a beautiful event venue where we
hold our annual conference
up.
As to be nice atmosphere.
So in these buildings, they are built
and ethernet cables to all the apartments
because there were no tech people before
us. We were offered to run
it, so
it seized the opportunity because
I was very afraid there
would be a a
growing chaos if
organic clean.
So I invited
all the interest, the technical
people to propose the structure, and
that's what we've been running ever
since.
And our goals
are, of course,
the eyeballs want to watch some Facebook.
And it's often disappointing for me,
to be honest, most people would be
very happy.
Network address, translation, gateway
alone and the internet.
Trust that with Metcalfe's
Law one.
A Senate,
he postulated that
the value of a network grows
with the of connected
devices and users.
So actually, you wouldn't want
to be.
Do you want to be connected?
Maybe you want to be connected with
even faster cables to your neighbors?
The two are connected
in internet infrastructure.
Of course, pool their resources,
pool their money to get
high quality internet uplink,
which means for less
money, there's more peak bandwidth
for everyone and.
Because access is a fundamental
requirement, and it's 21st century.
There needs to be
open.
I think it's a shame that there's so
few open Wi-Fi in Germany.
When I ran the network, there has
to be open Wi-Fi and because
we want to run
and find that
we actually actually you have two
of the wireless access
points, which is a
kind of big difference to an ordinary
ISP.
And then we want to make it
useful beyond internet.
We want to enable that cooperation.
So that's why we oppose
the internet principle of the internet
and our network.
There is no network address translation
between neighbors, so
peer-to-peer and sharing printers
actually works.
And by now, it is a few
service for house internet
service.
But that's not what does talk us about
this talk about the underlying
infrastructure.
And because I do not want to be
the sole responsible
person for all of it,
I tried to enable collaborative
administration from the beginning on.
So of course, I
want to increase the bus factor,
so if anything happens to me
that people can continue to take care of
it. But I also want to invite users to
take care of the
of the infrastructure that is
beyond their premises because.
That would be very attractive to me as
well.
So I'm just projecting it
onto them.
And indeed, they are a few trusted
neighbors from outside the hackerspace
that have root access to the server.
But in reality, no
one really cares until there
is an outage.
So how do we enable that collaboration
and transparency?
Of course, like a software project,
we have all the configuration that you
get repository at
first. Five years ago, we started out
with a SaltStack, which was
recommended to me at the time.
I never got really happy with that
and switched to an nexus
this year.
And that means the set up is
entirely reproducible
from the codebase
is great for consistency.
So what you see in the repository
is the documentation.
There are no fires in
it'sI that have been touched by
someone business luckily
kind of enforced by a nexus,
but should be done with any other
deployment tool elsewhere.
And if you contrast that to
imperative style, where you actually
touch the files intellectually slash
Etsy, you will forget
about them after a few days
which have been modified, which are
actually important.
And this is even worse if you collaborate
with other administrators.
So a central repository
where you have everything that is
irrelevant in one place
is really great for transparency.
So Anne-Marie, you
Nicholas fanboy,
when there's no lockdown, we have
daily record exchange and
a with you at the space,
so we get accused of
circuit jerking and this is why this
talk is not going to be in the
advertisment.
And indeed, if you
prescribe declarative
administration to your collaborators,
that content can actually turn out to be
a blocker for people who are
not used to.
Declarative style,
who I used to touch face and
such ATC.
That is my experience.
But it's better than touching
to see you have to ignore these people.
So people are always calling out for
documentation.
My experience is that doesn't work.
People.
Who do not look into court.
Do not look into documentation, and
there's also this problem this external
addiction mutation gets
out of sync with the actual state
really quickly.
So that's why you best keep it in
the repository.
And that's what we do.
We've written quite some
texts so that every neighbor
can, like, get to know
the network.
But in fact, no one ever reached that no
one ever scans those QR codes.
And by now, because people,
even the
the admin team doesn't like to read
documentation, I
package the
packages little scripts
for four regular chores, so
they do not have to look up documentation
but just run the commands
that are, yeah, documented
in the process.
So how do we design our network?
Before we connect people, we actually
need to separate the networks
so they cannot
break the neighbors network with a
rope. It's a piece of a sending
out an IP address
or even worse, to wound up spoofing
spoofing to redirect traffic.
So what we want
is an isolated link between
a neighbor and a server
and then connects on the
IP level with
well-defined routing and maybe even
firewalls.
So what we need is virtualization, and
it's a vital technology for that card.
Virtual lab,
where you just give a
network a number and a
switch and to
send multiple networks over one cable.
This is where supported
VLAN packet format
you can see
on the on top, you can see
the normal Ethernet frame starting
with a destination and source addresses.
And then comes the packet type like
I before I bibisex IP,
you name it.
And on the bottom, you have a
special packet type
for Velan, which
is followed by the villain number,
the network number and
then the rest of
the original packet follows.
So when such a packet
is received by a network
device that understands that it
can look at the number
in the packet and assign
it to the proper network.
So this is
this is understood by lots
of configurable switches
and by Linux and open w.r.t
devices.
And this is what we actually
use on
top.
You can see cheap Wi-Fi routers
that are supported by
open w.r.t.
Remember, we run them for
our users to ensure they do not
only run their private
Wi-Fi network, but also their
public, the public network
that is open to anyone.
And we run it with open w.r.t
because it runs on many cheap devices
and means freedom.
And
we get updates, and it's nice
people often tell me to to just
buy devices from the proper vendor.
But that's not what we do here because
we don't actually have a budget.
In the middle, you can see big switches.
These are not the
10 euro switches you buy
for your desk.
But these are manageable switches that
can be configured so that you can
put sets of ports
in different numbers, which
are dense
and on the bottom.
That is the most important part
of A.
And once Tesla looks, we have freedom
and to do whatever we want.
So how do we configure these devices
to issue the configuration should come
from our repository
and from that data,
we just generate expected scripts.
Expect is a domain specific
language that just
sends output and expects input,
and that's how we can
control it and assess its connections
to these devices.
And I recognize this
as an OK way
to do it, but it works with any
device that is configurable over
the command line.
And we don't need vendor specific
tools to use
our devices because
we got them for free.
They are old.
They are.
There's no current software.
Some network switches
require
configuration via
a web interface that only supports
Internet Explorer six.
And it's really great if you
discover a hidden command line in it
where you can actually do
these things, would you simply?
But in the end, does this
technology really sex
and that there are no
updates?
It's a huge problem because this network
infrastructure, this is not only a
smartphone, I
I rather have a big Linux box
with 48 Ethernet ports instead.
So how do we segment
our network?
We decided to go for the
following network
types.
At first, we have a management network
which is not really accessible.
This is just for getting to
the network devices
and reconfiguring them with
generated scripts.
Then we have a core network, which is
just at the center.
It is where all the routers are there.
We run a routine protocol
open shortest path first so
that there's a consistent view of
the specific routes and
all the other
routes connected there.
And for
every network, we had
clients.
We have a gateway that is
between the core network
and those client networks, and those kind
of networks is one for services, one for
the hackerspace, one fully open Wi-Fi
and many for every neighbor.
And then there are isolated networks
because sometimes
people are afraid of doing
networking with people.
So we can connect them
with their modem in the basement.
Yeah, and provide an isolated Ethernet
link.
This has all other been very useful
for conferences like the urban sprawl
and the the U.S.
want to do, like
audio video breeches or put
their computer nodes
in another room.
So that's a lot of flexibility that you
get when
you have
manageability, which is put
everywhere.
This is a Griffith generated
visualization form
or configuration. It's
just a side product and
rectangular islets, which is circular
and hexagon.
All the access points and indeed
cheap open access points
are manageable switches.
A lot of them have configurable
the switching chips inside to
to separate all those
Ethernet ports.
So now that a physical structure is soft,
let's connect these networks logically
with IPv4 and IPV six.
I want a strong image,
this physical structure.
So
we have a startup, I look at
topology topology
with the core at the center.
And this way our route is up
and running a routine protocol
means we can add routers with
reconfiguring the others
so we don't have.
For flexibility, we have no constraints
by embedded hardware.
I know there's and there's hardware that
can do IP and IPV six rooting.
But on Linux,
it's just much more potential.
So for the routers, I decided
to to have the granularity
at the router level, so I put them in
Linux containers.
This is not like talking about this for
Nicholas and Alex.
See where we can actually
have moved to the network
interfaces per container.
And so we can
bring the core network into
one of the access networks to a
container,
and the villain is
handled by the Linux, host
the bridges and network
into the container.
So what the router containers do,
of course, is rooting,
not rooting for
the internet uplinks and
for the routers between the Kornet and
the access networks.
The HP servers for and
the IP for addresses as potential
treatments for any IPV six addresses
and neighbors can actually
get a firewall if they do not want
incoming connections.
So when you have
shed infrastructure, people are always
afraid of the leeches inside us.
That's why we need.
That's why we need Typekit scheduling
on the sending interfaces.
And for quite some
time, we used control delay
ship to our upstream bandwidth.
It is. This shape is also the default
for open N.W.T.
by now.
So this also keeps
queues short on Wi-Fi.
But by now, there is this
cake shaper
called Come on, applications kept
enhanced.
That boots on top of quarter
and brings many
more integrated features for
a most snappy internet access.
So now that our networks
and network runs and provides internet
to people,
I have spent a few thoughts
for appalling quality.
So we were on
network on cheap devices
where there are no no replacements,
there's no redundancy.
Because there's simply no similar
devices left.
That means we have the best monitoring
people call me when they don't have
internet.
But of course, I want to make people
happy.
And because they
have their want fire devices on
premises where we can't
go and check.
I was afraid of it's becoming
unplugged, which would mean there would
be dysfunction.
The Wi-Fi networks,
which is why I
made a little Akron drop that runs every
few minutes and checks if the
server is reachable
and if it's not that were turned on,
shut down the Wi-Fi, avoiding
broken Wi-Fi networks.
By now, we have multiple internet
connections.
Originally, I planned that move to
enable this can put into one internet
connection. Turns out one
big internet connection is enough.
For everyone.
So people don't actually care
about which technology they use to get to
the internet.
They just want internet
and I want to give them the fastest
experience.
So actually, everyone
is routed over
the fastest internet connection
except for the public network, which you
can't directly because we're in Germany.
That's why we use VPN providers.
But there's more internet connections.
And I use them as
fallback because we run or
we already run the routine protocol
between routers.
We have some dynamic sharing
of the rooting state.
But the protocol has
a consistent view of the routing table
in a network.
That means if you put multiple routing
multiple default routes for internet
access in there, the network
will decide on just one
router for everyone.
So I was looking for a solution with
that. And then I discovered that,
well, SPF can coexist
on one network in multiple instances,
and you can actually configure this.
But the routine protocol implementation
to select
routes from these OPF
instances with a specific preference.
So we remove
the decision process from the
we move the decision process from the
protocol into the routine suit and
have some preference
for which route to which
internet router to take if
the first one is done.
And this works very well
due to that. We don't have a
public IP addresses inside the network
where we don't have public.
I mean, I prefer addresses.
We have public IPV six addresses in the
network. But
that works too,
because on the
internet uplink that are not associated
with these addresses, we use not 66.
And on the space,
because we have moved to the
internet, connections
actually provide multiple
default worlds.
So users can actually
add a different route, taking that away
to the internet, just for the technical
people.
So
because we have a few service
now, the two services,
I am also looking into redundancy
for the network.
By now, we have
a second server that is on standby.
I bought booted every month to do updates
to deploy the extra state,
but then I it down
again because server
needs a lot of energy.
But I do now have also looked into
using pacemaker because these
containers they can be are pretty
independent from their host that can be
started on any host, on any server.
So that's actually really where
suitable for
for high availability
and to to
start them on another server when the
first server has gone down.
So.
Just to show you a quote
slight with caught,
this is how our next flick looks like
an exit.
We have an excellent configuration for
all the containers for the service.
And then we build packages from
that.
Packages containing Linux
that we can with it to a script
switch to very quickly
and in a kind of atomic
way, and we can also roll that
back in a very quick fashion.
And what you can also see here is
that device
configuration scripts just packages
that you can run with next run
and do the deployment
that way.
So it's really a nice interface and
flakes gifts
perfect cute usability
by pinning all the inputs,
all versions of the state that
goes into your code.
And Nicholas also
provides facilities to actually
start the system and look over to
the machine very quickly so it can
actually develop all of that
in on my local machine.
Tested.
And once it runs, I can't deploy
to production.
And that has worked really
well over time.
So in all the time, we connected
three isolated networks one hackerspace
network, 42
neighbor networks, we ran
41 Wi-Fi access points
with open Wi-Fi and neighbor
networks.
And if you listen to a number
that is less, why four extra
points than neighbor networks
people can actually share,
you know, plastic routers as well.
We ran seven manageable switches.
We have one active and one called
by server.
We have six service, a service and.
The entire house is Richard
Burr globally, IPV six
and Richard Burr from Jean, 42.
We have an infrastructure.
Few internet connections,
and I have to say once, once
the stuff is running smoothly,
maintenance gets reduced to
keeping devices updated, onboarding
new participants and
extending the network.
I get a lot of satisfaction from this
project because it actually provides
an important service to people that I
know. I want you to think about it.
You can do
it this too.
Once you automate your infrastructure,
you can do it very, very
easily for us.
I want you to ensure end to end
reachability, which is easy with
IPV six nowadays and promote
usage of the internet.
How it is supposed to be used to work
end to end so everyone can be
assisted.
Thank you for listening.
Thanks so much for your great
talk. Reproducible building network
infrastructure.
Back here on the Harat stage,
we of course collected some questions for
you. The first one would be
did you have any non-technical
issues with open public Wi-Fi?
I mean, you already talked about it a
bit. You explicitly
use VPN for those ones.
But what is your experience running those
networks on a kind of non-technical
level where the legal
level, I guess, because we were very
aware of the legal issues and Germany,
we decided to use a VPN provider
from the beginning on.
But the other aspect is that
people don't scan makes you are quotes.
People don't read my documentation.
They just say, Oh, there's a public Wi-Fi
that can use it. That's OK.
And yes, later they come to me and say
what I can. I can get like a private
Wi-Fi.
I've been using this open way for other
time, and people have been printing on
my friend to I don't know who it was.
All right, so this is a
kind of a positive experience that is
possible as well as long as you're kind
of legally safe to run your network.
So there's another question.
Well, you made a bit of advertisement
for a Nicholas, but there's
a question why didn't you choose a
few weeks?
The new to you
been very paranoid this system?
Too many passengers.
Oh, there's a there's a big concern
Exodus community here, and I actually
like the language a lot.
OK, so this would be would
have been an alternative, but you're
a clearly mixed race fan.
And so you just decided, yes, I am a
fanboy. This like like saltstack
ends of a chef
and puppet.
But I really think this race is based.
Nice.
Another question we collected here is
do you have or run a pipeline
on your git repository, which is kind
of related to the next US?
So the person that asked it says I have
no idea how says is really working.
So is it kind of like a pipeline
where you can deploy every change
to your overall network infrastructure
then? Or is it kind of implicit
within existing kind
of implicit?
Mm hmm. So the deployment is
self scripted and was very trivial to do
with Nicolas.
All right. So you just run
the updates on us and everyone
just gets the latest infrastructure
there.
All right.
With this and
yeah, with another thanks to you
as a to do this and
we can end this talk.
And again, thanks for watching here
on couse salinity for
life from the Potsdam stage.
See you for the next talk.