Merge remote-tracking branch 'origin/develop' into benvin/go-signer-rpms

2026-10-04 15:00:20 +11:00
parent ee726e2220 0272104504
commit 1f34f833f5
18 changed files with 403 additions and 15 deletions
@@ -178,6 +178,8 @@ lookup_options:
    convert_to: Sensitive
  stalwart::fallback_admin_password:
    convert_to: Sensitive
+  wireguard::interfaces:
+    convert_to: Sensitive

 facts_path: '/opt/puppetlabs/facter/facts.d'

@@ -367,6 +369,7 @@ ssh::server::options:

 profiles::ssh::knownhosts::lines:
  - '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1HD97vYxLTniE4qNpGuftUlvmkEXIuX8+7nbENv/IzsGUghEDRtyThjQ7ojNKIsQ7f8wXr0gMcI+fAPfrbcOMHCAoYMomikwL0b3h95SZI40q3CyM+0DMnwiVVDX6C1QxkO2Rv9cszSkCa85NotJhXiUuTBI9BFcRPy+mAhbpAru+bfypYofI0wW97XNTl8Jgwmni5MgutBIQAokFIn5ux8iWxndCH3AqDtmkwC5DfQeQ+wZx7rkwqJEpJffQzrjb1gIM6P9hDCVBBVPh/3o80IJ69rFWrJAZUb+JpG4cXJH0NcSW+wqc3JCT/x3q8VlHwOTXSlNNKtOJCRx73mB8e1XTTy2a9FgpKDDg5XQXWHAViJDz1RTRL9gRefMylRgKz4bXoTuY9kJWM8hPTyUejtukbJThlBJc3OmDxBZBF7F0iqB11pHexok43OCEiANodVa36eWu9/5X032Vm48fZ1/akDPY/NSy3wAn7kwut+A0/JAHFHASrq+1mt9YurkJegI+YHXO6eEWpBIpmI7ORHJbGL4MhkHrxYzVamuP8CkU7tXzsv138+wpOcRHNp9yJY4PT40BZkRf/O3O+jt3pj9Dj8rvgywF2W6hFzywh3Y78upOprRkQlQtHfsI8EyrYI8/hUw2u3H+3yPXh3YjWfqvWVG1BRLRHBV7m90uaw=='
+  - '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDi80G0GtKMdRj4azPwxbJW46NG0y8seSVSnvFm2Ka/nckdUb/3lRlQuPYf1tkbqqFlcXjDM8+u0tzM2kLsgfn0Dpujm1fuoA66yGGweBjtxLFErH5+6+/KND5I9w8LMY2AtVztnBk/CVx8RwgrooABDRZiBH7OOAOpJqqFI7LvEsv61zC0nAqbYJ8uxfx+r4lJ9dUhK1woitEqC4npSRUn5KJK+KAEd7AzcUkZb6TO9A3oRPz1nQ/qU+QNMmVUi+wRj9kJR18mxErugyLLTNcFDBqSdHNun3eUNBUmoS2cAa8ZVscOLzbUGejVK9UY06Q7wu+J34Fzl8CN5tBqRHGZ3ykqGZ6gG+O0Egr9Rm3Obgkujpio2uTh27LhBy72vjgJ8kTFmPlzANTJFpKlsy91usSFPh8WZeIo6VpPLqnC32rjfNkfqHyPAeJ3+rdOkUZoDjMoZc3wxxLZTgMU5ud1w4LxQNRkNiaT/tRRNQF8o+pygkS7xxKduBBMzYdRS1OifaS4gyvP82oOyquWywhyFNtG7ph8FQwc34puM7FyxfaJ0XL/+zAfPMhDoOojvofADJo73R+FgVyer+mCJw4KtWJ4JzZrNTYz1Xl8WlhF8RDzOYfSH46qzJFa9FcRqgP4LUkgzdvcQ+1hBFpvpHtw3vl3DiqtZDDbK9SyrEtdnw=='

 profiles::base::groups::local:
  admins:
@@ -400,7 +403,7 @@ networking::route_defaults:

 # logging:
 victorialogs::client::journald::enable: true
-victorialogs::client::journald::inserturl: https://vlinsert.service.consul:9428/insert/journald
+victorialogs::client::journald::inserturl: https://logs-ingest.k8s.syd1.au.unkin.net:443/insert/journald

 # FIXME these are for the proxmox ceph cluster
 profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
@@ -0,0 +1,45 @@
+---
+# primary interface is the WAN uplink; pin host identity to the dum0 loopback
+networking_loopback0_ip: 198.18.2.160
+networking_loopback1_ip: 198.18.21.160
+
+# dns: keep the local dnsmasq resolver
+profiles::dns::base::nameservers:
+  - 127.0.0.1
+profiles::dns::base::search:
+  - main.unkin.net
+profiles::dns::base::primary_interface: dum0
+profiles::dns::updater::deny_ranges:
+  - 198.18.199.0/24
+  - 198.18.200.0/24
+  - 10.42.0.0/16
+  - 10.43.0.0/16
+  - 10.10.12.0/24     # wg0
+  - 103.216.190.0/23  # wan uplink
+profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"
+
+# ssh: listen on localhost and dum0 only; knock out the common wan primary ip
+lookup_options:
+  ssh::server::options:
+    merge:
+      strategy: deep
+      knockout_prefix: '--'
+ssh::server::options:
+  ListenAddress:
+    - "--%{facts.networking.ip}"
+    - 127.0.0.1
+    - "%{hiera('networking_loopback0_ip')}"
+profiles::ssh::sign::principals:
+  - "%{hiera('networking_loopback0_ip')}"
+
+# frrouting
+frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
+frrouting::ospfd_interfaces:
+  dum0:
+    area: 0.0.0.0
+  dum1:
+    area: 0.0.0.0
+  bond0.201:
+    area: 0.0.0.0
+frrouting::ospf_preferred_source_enable: true
+frrouting::ospf_preferred_source: "%{hiera('networking_loopback1_ip')}"
@@ -77,6 +77,7 @@ profiles::yum::global::repos:
    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
    gpgcheck: false
    mirrorlist: absent
+    metadata_expire: '60'
  rpm-vendor:
    name: rpm-vendor
    descr: rpm-vendor repository
@@ -84,6 +85,7 @@ profiles::yum::global::repos:
    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
    gpgcheck: false
    mirrorlist: absent
+    metadata_expire: '60'
  # Per-release variants, resolved from the host's EL major version so el8
  # hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
  rpm-internal-release:
@@ -93,6 +95,7 @@ profiles::yum::global::repos:
    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
    gpgcheck: false
    mirrorlist: absent
+    metadata_expire: '60'
  rpm-vendor-release:
    name: rpm-vendor-el%{facts.os.release.major}
    descr: rpm-vendor-el%{facts.os.release.major} repository
@@ -100,6 +103,7 @@ profiles::yum::global::repos:
    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
    gpgcheck: false
    mirrorlist: absent
+    metadata_expire: '60'

  # Additional repositories - default to absent, roles can override with ensure: present
  # FRRouting repositories
@@ -60,6 +60,7 @@ profiles::yum::global::repos:
    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f%{facts.os.release.major}/
    gpgcheck: false
    mirrorlist: absent
+    metadata_expire: '60'
  rpm-vendor:
    name: rpm-vendor-f%{facts.os.release.major}
    descr: rpm-vendor-f%{facts.os.release.major} repository
@@ -67,3 +68,4 @@ profiles::yum::global::repos:
    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f%{facts.os.release.major}/
    gpgcheck: false
    mirrorlist: absent
+    metadata_expire: '60'
@@ -65,6 +65,9 @@ profiles::nginx::simpleproxy::locations:
      - 127.0.0.1
      - "%{facts.networking.ip}"
      - 198.18.24.0/24
+      - 198.18.21.0/24
+      - 198.18.15.0/24
+      - 198.18.19.0/24
    location_deny:
      - all
  # authorised access from external
@@ -0,0 +1,26 @@
+---
+hiera_include:
+  - frrouting
+  - exporters::frr_exporter
+
+# routing
+sysctl::base::values:
+  net.ipv4.ip_forward:
+    value: '1'
+  net.ipv4.conf.all.rp_filter:
+    value: '0'
+  net.ipv4.conf.default.rp_filter:
+    value: '0'
+
+# frrouting
+exporters::frr_exporter::enable: true
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::daemons:
+  ospfd: true
+
+# consul
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: frr_exporter
+    disposition: write
@@ -1,5 +1,6 @@
 ---
 profiles::puppet::autosign::subnet_ranges:
+  - '198.18.2.0/24'
  - '198.18.13.0/24'
  - '198.18.14.0/24'
  - '198.18.15.0/24'
@@ -26,6 +27,15 @@ profiles::puppet::cobbler_enc::packages:
  - 'requests'
  - 'PyYAML'
 profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
+
+# Deep-merged with the entries in roles/infra/puppet.yaml.
+profiles::packages::include:
+  encapic:
+    ensure: '0.2.0'
+
+profiles::puppet::encapic::encapi_url: https://encapi.k8s.syd1.au.unkin.net
+profiles::puppet::server::external_nodes: '/usr/bin/encapic-enc'
+
 profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
 profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
 profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'