Hive¶

Hive hosts some physical machines for Tails, see tpo/tpa#4+ for context.

Out of band access¶

Fetch and activate the OpenVPN config stored in our password store:

pass tor/oob/mtl-libvirt-01.tails.net/TOR_TOR_TOR.IPMI1.ovpn

Then if you place the file in /etc/openvpn/hive.conf, you can then connect to the VPN with systemctl start openvpn@hive

IPMI interfaces should be accessible via private IPs:

The TLS certificate is the same for all of them, also stored in the password store:

pass tor/oob/mtl-libvirt-01.tails.net/https-tls-cert.pem

Physical access¶

In order to access the physical servers, we need to request a visit 24 to 48h in advance and provide the time of visit and full names of people that will be present. The request can be made via a ticket on the client portal.

Design and architecture¶

Since so far we only have a few machines at hive, all networking is being handled by them and we don't have dedicated networking equipment.

All ports are rated for 1Gbps transmit speed and use ethernet with RJ45 connectors.

The OOB access is on a switch that confines those ports to a private network. We can access that private network via a VPN connection.

We don't have a private network between the machines.

Network topology¶

The two network zones that we can use have the following characteristics:

• public network:
  • IPv4: 170.39.196.8/29 with gateway on 170.39.196.9
  • IPv6: 2602:fd23:0:/64 with gateway on 2602:fd23:0:1
  • MTU: 1500
  • The public network has a commit of 50TB/month

• OOB: 172.16.6.112/29 with gateway on 172.16.6.113. No direct transit to the Internet. See password manager for access to VPN.

Electrical power¶

• Power: 600w
• Redundancy Type: A+B
• Voltage: 240v
• Outlets: 3x A+B