Revise Configure Panels

[tim-moody]

No description provided.

[tim-moody]

• Change enable/disable to want/don't want which will include install
• All services displayed along with current status (even not installed)
• Only run roles and network roles if they will change
• Separate Installed and Enabled, Enabled, Not installed on display lists
• Drive display off js structure with role, description, network_reqd, ansible_required
• ? add panel to review changes implied by all other panels
• add country code to hostapd settings
• create json by scraping https://en.wikipedia.org/wiki/ISO_3166-1 Current Codes

[tim-moody]

Roles and Attributes

Require runrole

• azuracast
• calibreweb
• captiveportal
• cups
• elgg
• exFAT
• gitea
• internetarchive
• jupyterhub
• kalite
• kiwix
• kolibri
• lokole
• mediawiki
• minetest
• moodle
• nextcloud
• nodered
• osm_vector_maps
• pbx
• sugarizer
• transmission
• usb_lib
• wondershaper
• wordpress
• monit
• munin
• awstats
• vnstat
• phpmyadmin
• openvpn
• remoteit

Require Network Role

• Role in the Network (Gateway, Appliance, LAN Controller)
• Override IP Addresses
• Check to use a static WAN IP Address instead of DHCP
• ? use_cache
• ? gw_block_https
• Wi-Fi Access Point parameters
• ? samba
• ? wifi up down

Modifiable Network Parameters

• iiab_hostname
• iiab_domain
• gui_desired_network_role
• gui_static_wan
• gui_static_wan_netmask
• gui_static_wan_gateway
• gui_static_wan_nameserver
• iiab_gateway_enabled
• host_country_code
• host_ssid
• host_wifi_mode
• host_channel
• hostapd_secure
• hostapd_password
• hostapd_install
• hostapd_enabled
• wifi_up_down
• ports_externally_visible
• bluetooth_enabled
• bluetooth_term_enabled
• gui_desired_home_url
• gw_squid_whitelist
• gw_block_https

Unmodifiable

• lan_ip: 172.18.96.1

• lan_netmask: 255.255.224.0

• wifi_hotspot_capacity_rpi_fix: True

• iiab_lan_enabled: True

• iiab_wan_enabled: True

• user_wan_iface: auto

• user_lan_iface: auto

• wan_ip: dhcp # wan_ip: 192.168.1.99

• wan_netmask: # wan_netmask: 255.255.255.0

• wan_gateway: # wan_gateway: 192.168.1.254

• wan_nameserver: # wan_nameserver: 192.168.1.254 or 8.8.8.8 or 1.1.1.1

• wan_try_dhcp_before_static_ip: True

• samba_udp_ports: 137:138

• samba_tcp_mports: 139,445

• shared_dir : "{{ content_base }}/public" # /library/public

• nginx_high_php_limits: False

• maps_from_internet_archive:

Unknown, requires nginx role?

• home page
• apache_allow_sudo

Dependencies handled automatically

• mongodb
• mosquitto
• nodejs
• postgresql
• yarn

Obsolete

• ? adm_cons_force_ssl
• activity_server
• idmgr
• ? squid
• ? edit permitted urls
• ? dansguardian
• xo_services
• ejabberd
• ejabberd_xs
• dokuwiki
• kalite_cron_enabled

[holta]

FYI IIAB's Squid was just overhauled completely in August, well-tested with allowlists and denylists, for the very latest versions of Squid:

• PR Deprecate DansGuardian & WonderShaper + overhaul Squid -- in future let's consider fortifying, removing or replacing Squid (some prefer Varnish as a proxy/cache) iiab#2948
• PR default_vars.yml & local_vars.yml: Caution that 'squid_enabled: True' acts like 'iiab_gateway_enabled: True' (but only for Port 80) iiab#2962
• PR Squid: Contextualize /etc/squid/squid.conf + allowlists for new implementers (HTTP/80 whitelists) + optimize its install in Stage 4-server-options iiab#2963

As summarized here:

• https://github.com/iiab/iiab/blob/master/roles/network/templates/squid/squid.conf.j2#L32-L46

Whether or not we want to advertise this is a different question. (As a school that actually offers Internet to its students in this decade, almost always wants to filter out certain https sites — which the Squid approach can't help with.)

[tim-moody]

this is mostly addressed by #475 and subsequent. leaving open for further enhancements.