Configure network bonding and VLAN tagging for high availability and network segmentation

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Configuration variables
BOND_INTERFACE="bond0"
BOND_MODE="active-backup"
VLAN_IDS=(100 200)
VLAN_IPS=("192.168.100.10/24" "192.168.200.10/24")
GATEWAY="192.168.100.1"
DNS_SERVERS="8.8.8.8 8.8.4.4"

# Function to print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Usage message
usage() {
    echo "Usage: $0 [interface1] [interface2] [bond_mode]"
    echo "  interface1: First network interface (default: auto-detect)"
    echo "  interface2: Second network interface (default: auto-detect)"
    echo "  bond_mode: Bonding mode (default: active-backup)"
    echo "  Available modes: active-backup, balance-rr, balance-xor, 802.3ad"
    exit 1
}

# Cleanup function for rollback
cleanup() {
    print_error "Script failed. Attempting rollback..."
    if [[ "$PKG_MGR" == "apt" ]]; then
        if [[ -f /etc/netplan/99-network-bonding.yaml.backup ]]; then
            mv /etc/netplan/99-network-bonding.yaml.backup /etc/netplan/99-network-bonding.yaml
            netplan apply
        fi
    else
        nmcli connection show | grep -E "(bond0|vlan)" | awk '{print $1}' | xargs -I {} nmcli connection delete {} 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check for root privileges
if [[ $EUID -ne 0 ]]; then
    print_error "This script must be run as root or with sudo"
    exit 1
fi

# Auto-detect distribution
print_status "[1/8] Detecting distribution..."
if [[ -f /etc/os-release ]]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            NETWORK_MGR="netplan"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            NETWORK_MGR="networkmanager"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            NETWORK_MGR="networkmanager"
            ;;
        *) 
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    print_error "Cannot detect distribution (/etc/os-release not found)"
    exit 1
fi

print_status "Detected distribution: $ID using $NETWORK_MGR"

# Parse arguments
if [[ $# -gt 0 && $1 == "-h" || $1 == "--help" ]]; then
    usage
fi

# Auto-detect network interfaces if not provided
print_status "[2/8] Detecting network interfaces..."
AVAILABLE_INTERFACES=($(ip link show | grep -E '^[0-9]+: (en|eth)' | cut -d':' -f2 | sed 's/^ *//'))

if [[ ${#AVAILABLE_INTERFACES[@]} -lt 2 ]]; then
    print_error "At least 2 network interfaces are required for bonding"
    exit 1
fi

INTERFACE1=${1:-${AVAILABLE_INTERFACES[0]}}
INTERFACE2=${2:-${AVAILABLE_INTERFACES[1]}}
BOND_MODE=${3:-$BOND_MODE}

print_status "Using interfaces: $INTERFACE1, $INTERFACE2 with mode: $BOND_MODE"

# Install required packages
print_status "[3/8] Installing required packages..."
if [[ "$PKG_MGR" == "apt" ]]; then
    apt update
    $PKG_INSTALL ifenslave vlan net-tools
else
    $PKG_INSTALL NetworkManager NetworkManager-team
fi

# Load bonding kernel module
print_status "[4/8] Loading bonding kernel module..."
modprobe bonding
if ! grep -q "^bonding" /etc/modules 2>/dev/null; then
    echo "bonding" >> /etc/modules
fi

# Configure network bonding based on distribution
print_status "[5/8] Configuring network bonding..."

if [[ "$NETWORK_MGR" == "netplan" ]]; then
    # Ubuntu/Debian with Netplan
    NETPLAN_CONFIG="/etc/netplan/99-network-bonding.yaml"
    
    # Backup existing configuration
    if [[ -f "$NETPLAN_CONFIG" ]]; then
        cp "$NETPLAN_CONFIG" "$NETPLAN_CONFIG.backup"
    fi
    
    cat > "$NETPLAN_CONFIG" << EOF
network:
  version: 2
  renderer: networkd
  ethernets:
    $INTERFACE1:
      dhcp4: no
      dhcp6: no
    $INTERFACE2:
      dhcp4: no
      dhcp6: no
  bonds:
    $BOND_INTERFACE:
      interfaces:
        - $INTERFACE1
        - $INTERFACE2
      parameters:
        mode: $BOND_MODE
        primary: $INTERFACE1
        mii-monitor-interval: 100
        fail-over-mac-policy: active
      dhcp4: no
      dhcp6: no
  vlans:
EOF

    # Add VLAN configurations
    for i in "${!VLAN_IDS[@]}"; do
        VLAN_ID=${VLAN_IDS[$i]}
        VLAN_IP=${VLAN_IPS[$i]}
        
        cat >> "$NETPLAN_CONFIG" << EOF
    $BOND_INTERFACE.$VLAN_ID:
      id: $VLAN_ID
      link: $BOND_INTERFACE
      addresses:
        - $VLAN_IP
EOF
        
        # Add gateway and DNS for the first VLAN
        if [[ $i -eq 0 ]]; then
            cat >> "$NETPLAN_CONFIG" << EOF
      routes:
        - to: 0.0.0.0/0
          via: $GATEWAY
      nameservers:
        addresses:
          - 8.8.8.8
          - 8.8.4.4
EOF
        fi
    done
    
    chmod 644 "$NETPLAN_CONFIG"
    chown root:root "$NETPLAN_CONFIG"
    
else
    # RHEL-based with NetworkManager
    # Create bond interface
    nmcli connection add type bond ifname "$BOND_INTERFACE" con-name "$BOND_INTERFACE" \
        bond.options "mode=$BOND_MODE,miimon=100,primary=$INTERFACE1"
    
    # Add slave interfaces
    nmcli connection add type ethernet ifname "$INTERFACE1" con-name "$BOND_INTERFACE-slave1" master "$BOND_INTERFACE"
    nmcli connection add type ethernet ifname "$INTERFACE2" con-name "$BOND_INTERFACE-slave2" master "$BOND_INTERFACE"
    
    # Create VLAN interfaces
    for i in "${!VLAN_IDS[@]}"; do
        VLAN_ID=${VLAN_IDS[$i]}
        VLAN_IP=${VLAN_IPS[$i]%/*}
        VLAN_PREFIX=${VLAN_IPS[$i]#*/}
        
        if [[ $i -eq 0 ]]; then
            nmcli connection add type vlan ifname "$BOND_INTERFACE.$VLAN_ID" con-name "vlan$VLAN_ID" \
                dev "$BOND_INTERFACE" vlan.id "$VLAN_ID" ip4 "$VLAN_IP/$VLAN_PREFIX" gw4 "$GATEWAY"
        else
            nmcli connection add type vlan ifname "$BOND_INTERFACE.$VLAN_ID" con-name "vlan$VLAN_ID" \
                dev "$BOND_INTERFACE" vlan.id "$VLAN_ID" ip4 "$VLAN_IP/$VLAN_PREFIX"
        fi
    done
    
    # Set DNS for the primary connection
    nmcli connection modify vlan${VLAN_IDS[0]} ipv4.dns "$DNS_SERVERS"
fi

# Apply network configuration
print_status "[6/8] Applying network configuration..."
if [[ "$NETWORK_MGR" == "netplan" ]]; then
    netplan apply
else
    # Bring up NetworkManager connections
    nmcli connection up "$BOND_INTERFACE"
    nmcli connection up "$BOND_INTERFACE-slave1"
    nmcli connection up "$BOND_INTERFACE-slave2"
    
    for VLAN_ID in "${VLAN_IDS[@]}"; do
        nmcli connection up "vlan$VLAN_ID"
    done
fi

# Wait for interfaces to come up
sleep 5

# Configure firewall for VLAN traffic
print_status "[7/8] Configuring firewall..."
if command -v ufw >/dev/null 2>&1; then
    # Ubuntu/Debian with UFW
    for VLAN_ID in "${VLAN_IDS[@]}"; do
        ufw allow in on "$BOND_INTERFACE.$VLAN_ID" 2>/dev/null || true
    done
elif command -v firewall-cmd >/dev/null 2>&1; then
    # RHEL-based with firewalld
    systemctl start firewalld 2>/dev/null || true
    for VLAN_ID in "${VLAN_IDS[@]}"; do
        firewall-cmd --permanent --zone=public --add-interface="$BOND_INTERFACE.$VLAN_ID" 2>/dev/null || true
    done
    firewall-cmd --reload 2>/dev/null || true
fi

# Verification checks
print_status "[8/8] Verifying configuration..."

# Check bond interface
if ip link show "$BOND_INTERFACE" >/dev/null 2>&1; then
    print_status "Bond interface $BOND_INTERFACE created successfully"
    
    # Check bond status
    if [[ -f "/proc/net/bonding/$BOND_INTERFACE" ]]; then
        BOND_STATUS=$(cat "/proc/net/bonding/$BOND_INTERFACE" | grep -E "(Bonding Mode|MII Status)" | head -2)
        print_status "Bond status:\n$BOND_STATUS"
    fi
else
    print_error "Bond interface $BOND_INTERFACE not found"
    exit 1
fi

# Check VLAN interfaces
for VLAN_ID in "${VLAN_IDS[@]}"; do
    if ip link show "$BOND_INTERFACE.$VLAN_ID" >/dev/null 2>&1; then
        VLAN_IP=$(ip addr show "$BOND_INTERFACE.$VLAN_ID" | grep -oP 'inet \K[\d.]+/\d+' || echo "No IP")
        print_status "VLAN $VLAN_ID interface created with IP: $VLAN_IP"
    else
        print_warning "VLAN $VLAN_ID interface not found"
    fi
done

# Test connectivity
print_status "Testing connectivity..."
if ping -c 2 -W 5 "$GATEWAY" >/dev/null 2>&1; then
    print_status "Gateway connectivity: OK"
else
    print_warning "Gateway connectivity: FAILED (may be expected if gateway is not configured)"
fi

print_status "Network bonding and VLAN configuration completed successfully!"
print_status "Bond interface: $BOND_INTERFACE"
print_status "Mode: $BOND_MODE"
print_status "Physical interfaces: $INTERFACE1, $INTERFACE2"
print_status "VLAN IDs: ${VLAN_IDS[*]}"

print_warning "Please verify network connectivity and switch configuration before rebooting!"