Merge branch 'develop' into neoloc/grafana
This commit is contained in:
@@ -1,5 +1,6 @@
|
||||
---
|
||||
profiles::puppet::puppetdb::puppetdb_host: prodinf01n04.main.unkin.net
|
||||
profiles::puppet::puppetdb::postgres_host: prodinf01n05.main.unkin.net
|
||||
profiles::packages::install:
|
||||
- policycoreutils
|
||||
|
||||
puppetdb::master::config::create_puppet_service_resource: false
|
||||
#puppetdb::master::config::puppetdb_host: "%{lookup('profiles::puppet::puppetdb::puppetdb_host')}"
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
profiles::cobbler::params::default_password_crypted: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJidO18dSzKXgDEvFhigrDmiMTW+D7obTCZVAvl0JzQ6nqRdnh6Xa+j+yc7YzYtCg9VH60vfcutHFGhJptlMbTQq3vSUoF9ylgTutaW/to4T8jb8gBqK1n7b+devEQh4soJtOdAPSidCX4aqsP9dK3I8IijNWMABz59usGbY6oWedmC4865PBcxyIu3phWynNULTXPBEAqdXAutkh4N3P1ydFk3eARCVS3uWo7zaXVsu4vIkjYRDCUyFXBWb12L/NmQ2EhGwckPwgX/rcKRL9r49GxQTLBHJ5MoHQanwoiRw+5Tz3qLW69z+hk91VpnpkZgANc081rmhdyp6qmuIAVDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBiDUwXVJ6mmwzt4YAxg3+qgDDWm5mlWEgsZqCHwG0n94v7oqCBqY2WQdTJAM3TtKlX2nOPlLEmfLrwqtsS2r3QzLo=]
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
profiles::packages::install:
|
||||
- cobbler
|
||||
- cobbler3.2-web
|
||||
- httpd
|
||||
- syslinux
|
||||
- dnf-plugins-core
|
||||
- debmirror
|
||||
- pykickstart
|
||||
- fence-agents
|
||||
- selinux-policy-devel
|
||||
- ipxe-bootimgs
|
||||
|
||||
profiles::pki::vault::alt_names:
|
||||
- cobbler.main.unkin.net
|
||||
|
||||
profiles::cobbler::params::service_cname: 'cobbler.main.unkin.net'
|
||||
profiles::selinux::setenforce::mode: permissive
|
||||
|
||||
hiera_classes:
|
||||
- profiles::selinux::setenforce
|
||||
@@ -0,0 +1,77 @@
|
||||
---
|
||||
profiles::dhcp::server::ntpservers:
|
||||
- ntp01.main.unkin.net
|
||||
- ntp02.main.unkin.net
|
||||
profiles::dhcp::server::interfaces:
|
||||
- eth0
|
||||
profiles::dhcp::server::default_lease_time: 1200
|
||||
profiles::dhcp::server::globaloptions:
|
||||
- 'arch code 93 = unsigned integer 16'
|
||||
|
||||
profiles::dhcp::server::pools:
|
||||
syd1-prod:
|
||||
network: 198.18.15.0
|
||||
mask: 255.255.255.0
|
||||
range:
|
||||
- '198.18.15.200 198.18.15.220'
|
||||
gateway: 198.18.15.254
|
||||
nameservers:
|
||||
- 198.18.13.12
|
||||
- 198.18.13.13
|
||||
domain_name: main.unkin.net
|
||||
pxeserver: 198.18.13.27
|
||||
syd1-test:
|
||||
network: 198.18.16.0
|
||||
mask: 255.255.255.0
|
||||
range:
|
||||
- '198.18.16.200 198.18.16.220'
|
||||
gateway: 198.18.16.254
|
||||
nameservers:
|
||||
- 198.18.13.12
|
||||
- 198.18.13.13
|
||||
domain_name: main.unkin.net
|
||||
pxeserver: 198.18.13.27
|
||||
syd1-prod1:
|
||||
network: 198.18.13.0
|
||||
mask: 255.255.255.0
|
||||
range:
|
||||
- '198.18.13.200 198.18.13.220'
|
||||
gateway: 198.18.13.254
|
||||
nameservers:
|
||||
- 198.18.13.12
|
||||
- 198.18.13.13
|
||||
domain_name: main.unkin.net
|
||||
pxeserver: 198.18.13.27
|
||||
syd1-prod2:
|
||||
network: 198.18.14.0
|
||||
mask: 255.255.255.0
|
||||
range:
|
||||
- '198.18.14.200 198.18.14.220'
|
||||
gateway: 198.18.14.254
|
||||
nameservers:
|
||||
- 198.18.13.12
|
||||
- 198.18.13.13
|
||||
domain_name: main.unkin.net
|
||||
pxeserver: 198.18.13.27
|
||||
drw1-prod:
|
||||
network: 198.18.17.0
|
||||
mask: 255.255.255.0
|
||||
range:
|
||||
- '198.18.17.200 198.18.17.220'
|
||||
gateway: 198.18.17.1
|
||||
nameservers:
|
||||
- 198.18.17.7
|
||||
- 198.18.17.8
|
||||
domain_name: main.unkin.net
|
||||
pxeserver: 198.18.13.27
|
||||
|
||||
# UFI 64-bit
|
||||
profiles::dhcp::server::classes:
|
||||
UEFI-64:
|
||||
parameters:
|
||||
- 'match if option arch = 00:07 or option arch = 00:09'
|
||||
- 'filename "/ipxe.efi"'
|
||||
Legacy:
|
||||
parameters:
|
||||
- 'match if option arch = 00:00'
|
||||
- 'filename "/undionly.kpxe"'
|
||||
@@ -1,11 +1,13 @@
|
||||
---
|
||||
profiles::dns::master::nameservers:
|
||||
- prodinf01n23.main.unkin.net
|
||||
- prodinf01n24.main.unkin.net
|
||||
|
||||
profiles::dns::master::ns_role: roles::infra::dns::master
|
||||
profiles::dns::master::use_ns: region
|
||||
profiles::dns::master::acls:
|
||||
acl-main.unkin.net:
|
||||
addresses:
|
||||
- 198.18.13.0/24
|
||||
- 198.18.14.0/24
|
||||
- 198.18.15.0/24
|
||||
- 198.18.16.0/24
|
||||
- 198.18.17.0/24
|
||||
|
||||
profiles::dns::master::zones:
|
||||
@@ -15,6 +17,30 @@ profiles::dns::master::zones:
|
||||
dynamic: false
|
||||
ns_notify: true
|
||||
source: '/var/named/sources/main.unkin.net.conf'
|
||||
13.18.198.in-addr.arpa:
|
||||
domain: '13.18.198.in-addr.arpa'
|
||||
zone_type: 'master'
|
||||
dynamic: false
|
||||
ns_notify: true
|
||||
source: '/var/named/sources/13.18.198.in-addr.arpa.conf'
|
||||
14.18.198.in-addr.arpa:
|
||||
domain: '14.18.198.in-addr.arpa'
|
||||
zone_type: 'master'
|
||||
dynamic: false
|
||||
ns_notify: true
|
||||
source: '/var/named/sources/14.18.198.in-addr.arpa.conf'
|
||||
15.18.198.in-addr.arpa:
|
||||
domain: '15.18.198.in-addr.arpa'
|
||||
zone_type: 'master'
|
||||
dynamic: false
|
||||
ns_notify: true
|
||||
source: '/var/named/sources/15.18.198.in-addr.arpa.conf'
|
||||
16.18.198.in-addr.arpa:
|
||||
domain: '16.18.198.in-addr.arpa'
|
||||
zone_type: 'master'
|
||||
dynamic: false
|
||||
ns_notify: true
|
||||
source: '/var/named/sources/16.18.198.in-addr.arpa.conf'
|
||||
17.18.198.in-addr.arpa:
|
||||
domain: '17.18.198.in-addr.arpa'
|
||||
zone_type: 'master'
|
||||
@@ -27,6 +53,10 @@ profiles::dns::master::views:
|
||||
recursion: false
|
||||
zones:
|
||||
- main.unkin.net
|
||||
- 13.18.198.in-addr.arpa
|
||||
- 14.18.198.in-addr.arpa
|
||||
- 15.18.198.in-addr.arpa
|
||||
- 16.18.198.in-addr.arpa
|
||||
- 17.18.198.in-addr.arpa
|
||||
match_clients:
|
||||
- acl-main.unkin.net
|
||||
|
||||
@@ -2,28 +2,64 @@
|
||||
profiles::dns::resolver::acls:
|
||||
acl-main.unkin.net:
|
||||
addresses:
|
||||
- 10.10.8.1/32
|
||||
- 198.18.21.160/27
|
||||
- 198.18.21.192/27
|
||||
- 198.18.13.0/24
|
||||
- 198.18.14.0/24
|
||||
- 198.18.15.0/24
|
||||
- 198.18.16.0/24
|
||||
- 198.18.17.0/24
|
||||
|
||||
profiles::dns::resolver::zones:
|
||||
main.unkin.net-forward:
|
||||
domain: 'main.unkin.net'
|
||||
8.10.10.in-addr.arpa-forward:
|
||||
domain: '8.10.10.in-addr.arpa'
|
||||
zone_type: 'forward'
|
||||
forwarders:
|
||||
- 198.18.17.23
|
||||
- 198.18.17.24
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
forward: 'only'
|
||||
16.10.10.in-addr.arpa-forward:
|
||||
domain: '16.10.10.in-addr.arpa'
|
||||
zone_type: 'forward'
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
forward: 'only'
|
||||
20.10.10.in-addr.arpa-forward:
|
||||
domain: '20.10.10.in-addr.arpa'
|
||||
zone_type: 'forward'
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
forward: 'only'
|
||||
unkin.net-forward:
|
||||
domain: 'unkin.net'
|
||||
zone_type: 'forward'
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
forward: 'only'
|
||||
dmz.unkin.net-forward:
|
||||
domain: 'dmz.unkin.net'
|
||||
zone_type: 'forward'
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
forward: 'only'
|
||||
network.unkin.net-forward:
|
||||
domain: 'network.unkin.net'
|
||||
zone_type: 'forward'
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
forward: 'only'
|
||||
prod.unkin.net-forward:
|
||||
domain: 'prod.unkin.net'
|
||||
zone_type: 'forward'
|
||||
forwarders:
|
||||
- 10.10.8.1
|
||||
forward: 'only'
|
||||
17.18.198.in-addr.arpa-forward:
|
||||
domain: '17.18.198.in-addr.arpa'
|
||||
zone_type: 'forward'
|
||||
forwarders:
|
||||
- 198.18.17.23
|
||||
- 198.18.17.24
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
forward: 'only'
|
||||
|
||||
profiles::dns::resolver::views:
|
||||
@@ -31,7 +67,18 @@ profiles::dns::resolver::views:
|
||||
recursion: true
|
||||
zones:
|
||||
- main.unkin.net-forward
|
||||
- unkin.net-forward
|
||||
- dmz.unkin.net-forward
|
||||
- network.unkin.net-forward
|
||||
- prod.unkin.net-forward
|
||||
- consul-forward
|
||||
- 13.18.198.in-addr.arpa-forward
|
||||
- 14.18.198.in-addr.arpa-forward
|
||||
- 15.18.198.in-addr.arpa-forward
|
||||
- 16.18.198.in-addr.arpa-forward
|
||||
- 17.18.198.in-addr.arpa-forward
|
||||
- 8.10.10.in-addr.arpa-forward
|
||||
- 16.10.10.in-addr.arpa-forward
|
||||
- 20.10.10.in-addr.arpa-forward
|
||||
match_clients:
|
||||
- acl-main.unkin.net
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
---
|
||||
profiles::gitea::init::mysql_pass: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAjmMVHQcvy0PLruFWI6UmYqM2uEqXntV8HdA54RCTm7GaneXsW+rom+ibFVd0i9L+spQPQzcidh7FlzBRYgny8yH8TqZlh7XMraXSYG2EvrjwzNvgnwhY5mGEQNQcQkqN9Orfsf6HjXmXg2CxajYibKu0/belJZFffzPzzrn15wy3Cj5lDjAziqYoD+8Ko1zkF9lWz4ewVjll82yo8iSpidN+PyvoeWsi/eJ9cW72TgFLt/rvGquLq3MuW54J716hrR1Z37Uf0OO18AiKCVjoCi5Cf/k0VKRsXM8Myu2KInqrGcUHAO+fsOXBXnmU0MOxW0OIOmwxfwY6LJfN23arlDBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB6GktEMe8gSTijJ/dIHC5/gCCblMojNKO1ig9fNsuT9I2u5Bt4iJrSMN+GBGnCzO1Bvw==]
|
||||
profiles::gitea::init::lfs_jwt_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEACd6q4E/4l1EYD3SFjc1okibyJ13kcGGWU+ShbCgwLgkW7INkyCxhbNm69yPA7WcyuRhH/Lfz/XjJKd3BSCyRQPr5IUOIRINspx82tLBcaMzY/99GFrfyDnf3+SV/AxrPJ/zD5TGkKQP7uX6WjC9DXpHE+pFJa9wBAipmV439y0JDVt2gXFmhqBWThSjBDBfJ5X4zO5wY8CfBX4APOcD5hIQP/T4n04dQLNpigEKKy6B+GFuooTbdmMmFj3ZpT+cUS8Aw9mFkBwyyN1o+50XU3vW4eieUz8cYkzDPu574XfTunqD2jcvPiFjCla8G1SpKfHkruKnZWwgO0Ntw9td5QDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAIRVL5j4dzbYg6f2XjvkQ6gDAd2qUNzPn2flZgKwsjIZcYdmFMTn48hGPUFfVaMDeyzPoJi84CyRJl8cQvcAe52sw=]
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
# additional altnames
|
||||
profiles::pki::vault::alt_names:
|
||||
- git.main.unkin.net
|
||||
- git.service.consul
|
||||
- git.query.consul
|
||||
- "git.service.%{facts.country}-%{facts.region}.consul"
|
||||
|
||||
consul::services:
|
||||
git:
|
||||
service_name: 'git'
|
||||
tags:
|
||||
- 'git'
|
||||
- 'gitea'
|
||||
address: "%{facts.networking.ip}"
|
||||
port: 443
|
||||
checks:
|
||||
- id: 'gitea_https_check'
|
||||
name: 'Gitea HTTPS Check'
|
||||
http: "https://%{facts.networking.fqdn}:443"
|
||||
method: 'GET'
|
||||
tls_skip_verify: true
|
||||
interval: '10s'
|
||||
timeout: '1s'
|
||||
profiles::consul::client::node_rules:
|
||||
- resource: service
|
||||
segment: git
|
||||
disposition: write
|
||||
|
||||
# manage a simple nginx reverse proxy
|
||||
profiles::nginx::simpleproxy::nginx_vhost: 'git.query.consul'
|
||||
profiles::nginx::simpleproxy::nginx_aliases:
|
||||
- git.main.unkin.net
|
||||
- git.service.consul
|
||||
- git.query.consul
|
||||
- "git.service.%{facts.country}-%{facts.region}.consul"
|
||||
profiles::nginx::simpleproxy::proxy_port: 3000
|
||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||
nginx::client_max_body_size: 250M
|
||||
@@ -0,0 +1,91 @@
|
||||
---
|
||||
profiles::haproxy::ls_stats::port: 9090
|
||||
profiles::haproxy::ls_stats::user: 'admin'
|
||||
profiles::selinux::setenforce::mode: permissive
|
||||
|
||||
profiles::haproxy::selinux::ports:
|
||||
- 9090
|
||||
profiles::haproxy::selinux::sebooleans:
|
||||
- haproxy_connect_any
|
||||
|
||||
profiles::haproxy::server::globals:
|
||||
log:
|
||||
- /dev/log local0
|
||||
- /dev/log local1 notice
|
||||
stats:
|
||||
- timeout 30s
|
||||
- socket /var/lib/haproxy/stats
|
||||
ca-base: /etc/ssl/certs
|
||||
crt-base: /etc/ssl/private
|
||||
ssl-default-bind-ciphers: EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
|
||||
ssl-default-bind-options: 'ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.3'
|
||||
ssl-default-server-ciphers: kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL
|
||||
ssl-default-server-options: no-sslv3
|
||||
tune.ssl.default-dh-param: 2048
|
||||
|
||||
profiles::haproxy::server::defaults:
|
||||
mode: http
|
||||
option:
|
||||
- httplog
|
||||
- dontlognull
|
||||
- http-server-close
|
||||
- forwardfor except 127.0.0.0/8
|
||||
- redispatch
|
||||
timeout:
|
||||
- http-request 10s
|
||||
- queue 1m
|
||||
- connect 10s
|
||||
- client 5m
|
||||
- server 5m
|
||||
- http-keep-alive 10s
|
||||
- check 10s
|
||||
retries: 3
|
||||
maxconn: 5000
|
||||
|
||||
profiles::haproxy::frontends:
|
||||
fe_http:
|
||||
description: 'Global HTTP Frontend'
|
||||
bind:
|
||||
0.0.0.0:80:
|
||||
- transparent
|
||||
mode: 'http'
|
||||
options:
|
||||
acl:
|
||||
- 'acl-letsencrypt path_beg /.well-known/acme-challenge/'
|
||||
http-request:
|
||||
- 'set-header X-Forwarded-Proto https'
|
||||
- 'set-header X-Real-IP %[src]'
|
||||
fe_https:
|
||||
description: 'Global HTTPS Frontend'
|
||||
bind:
|
||||
0.0.0.0:443:
|
||||
- ssl
|
||||
- crt-list /etc/haproxy/certificate.list
|
||||
- ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
|
||||
- force-tlsv12
|
||||
mode: 'http'
|
||||
options:
|
||||
acl:
|
||||
- 'acl-letsencrypt path_beg /.well-known/acme-challenge/'
|
||||
http-request:
|
||||
- 'set-header X-Forwarded-Proto https'
|
||||
- 'set-header X-Real-IP %[src]'
|
||||
|
||||
profiles::haproxy::backends:
|
||||
be_letsencrypt:
|
||||
description: Backend for LetsEncrypt Verifications
|
||||
collect_exported: true
|
||||
options:
|
||||
balance: roundrobin
|
||||
be_default:
|
||||
description: Backend for unmatched HTTP traffic
|
||||
collect_exported: true
|
||||
options:
|
||||
balance: roundrobin
|
||||
option:
|
||||
- httpchk GET /
|
||||
- forwardfor
|
||||
cookie: SRVNAME insert
|
||||
http-request:
|
||||
- set-header X-Forwarded-Port %[dst_port]
|
||||
- add-header X-Forwarded-Proto https if { dst_port 443 }
|
||||
@@ -1,6 +1,10 @@
|
||||
---
|
||||
profiles::ntp::client::client_only: false
|
||||
profiles::ntp::server::allowquery:
|
||||
- '198.18.13.0/24'
|
||||
- '198.18.14.0/24'
|
||||
- '198.18.15.0/24'
|
||||
- '198.18.16.0/24'
|
||||
- '198.18.17.0/24'
|
||||
|
||||
profiles::ntp::server::peers:
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
---
|
||||
profiles::yum::global::repos:
|
||||
centos_8_advanced_virtualization:
|
||||
name: 'virt-advanced-virtualization'
|
||||
descr: 'CentOS Advanced Virtualization'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/advancedvirt-common
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||
centos_8_ceph_pacific:
|
||||
name: 'storage-ceph-pacific'
|
||||
descr: 'CentOS Ceph Pacific'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/ceph-pacific
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||
centos_8_rabbitmq_38:
|
||||
name: 'messaging-rabbitmq-38'
|
||||
descr: 'CentOS RabbitMQ 38'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/messaging/x86_64/rabbitmq-38
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
|
||||
centos_8_nfv_openvswitch:
|
||||
name: 'nfv-openvswitch-2'
|
||||
descr: 'CentOS NFV OpenvSwitch'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/nfv/x86_64/openvswitch-2
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
|
||||
centos_8_openstack_xena:
|
||||
name: 'cloud-openstack-xena'
|
||||
descr: 'CentOS OpenStack Xena'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/cloud/x86_64/openstack-xena
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
|
||||
centos_8_opstools:
|
||||
name: 'opstools-collectd-5'
|
||||
descr: 'CentOS OpsTools - collectd'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/opstools/x86_64/collectd-5
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
|
||||
centos_8_ovirt45:
|
||||
name: 'virt-ovirt-45'
|
||||
descr: 'CentOS oVirt 4.5'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/ovirt-45
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||
centos_8_stream_gluster10:
|
||||
name: 'storage-gluster-10'
|
||||
descr: 'CentOS oVirt 4.5 - Glusterfs 10'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||
@@ -0,0 +1,58 @@
|
||||
---
|
||||
profiles::firewall::firewalld::ensure_package: 'installed'
|
||||
profiles::firewall::firewalld::ensure_service: 'running'
|
||||
|
||||
sudo::purge_ignore:
|
||||
- '50_vdsm'
|
||||
- '50_vdsm_hook_ovirt_provider_ovn_hook'
|
||||
- '60_ovirt-ha'
|
||||
|
||||
profiles::yum::global::repos:
|
||||
centos_8_advanced_virtualization:
|
||||
name: 'virt-advanced-virtualization'
|
||||
descr: 'CentOS Advanced Virtualization'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/advancedvirt-common
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||
centos_8_ceph_pacific:
|
||||
name: 'storage-ceph-pacific'
|
||||
descr: 'CentOS Ceph Pacific'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/ceph-pacific
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||
centos_8_rabbitmq_38:
|
||||
name: 'messaging-rabbitmq-38'
|
||||
descr: 'CentOS RabbitMQ 38'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/messaging/x86_64/rabbitmq-38
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
|
||||
centos_8_nfv_openvswitch:
|
||||
name: 'nfv-openvswitch-2'
|
||||
descr: 'CentOS NFV OpenvSwitch'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/nfv/x86_64/openvswitch-2
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
|
||||
centos_8_openstack_xena:
|
||||
name: 'cloud-openstack-xena'
|
||||
descr: 'CentOS OpenStack Xena'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/cloud/x86_64/openstack-xena
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
|
||||
centos_8_opstools:
|
||||
name: 'opstools-collectd-5'
|
||||
descr: 'CentOS OpsTools - collectd'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/opstools/x86_64/collectd-5
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
|
||||
centos_8_ovirt45:
|
||||
name: 'virt-ovirt-45'
|
||||
descr: 'CentOS oVirt 4.5'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/ovirt-45
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||
centos_8_stream_gluster10:
|
||||
name: 'storage-gluster-10'
|
||||
descr: 'CentOS oVirt 4.5 - Glusterfs 10'
|
||||
target: /etc/yum.repos.d/ovirt.repo
|
||||
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
sudo::configs:
|
||||
ceph-smartctl:
|
||||
priority: 20
|
||||
content: |
|
||||
ceph ALL=NOPASSWD: /usr/sbin/smartctl -x --json=o /dev/*
|
||||
ceph ALL=NOPASSWD: /usr/sbin/nvme * smart-log-add --json /dev/*
|
||||
@@ -0,0 +1,3 @@
|
||||
---
|
||||
profiles::packages::install:
|
||||
- puppetserver
|
||||
@@ -0,0 +1,3 @@
|
||||
---
|
||||
profiles::puppet::eyaml::publickey: ENC[PKCS7,MIIFjQYJKoZIhvcNAQcDoIIFfjCCBXoCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAizhVN1svMJqLlkDWcm/qhMNajKL9G7GvBxG04dOdYLUu99wgmIlD1vetNIoJrQ6defmVuMMzT3IxzIDrRf8QEVL7hstIFoGlhv0ObBewjLJY34v3B7Sxj0nv8XPTLd8Q6LZQb+KSo0SLQxbjEw60qAl5DbDqXUNOx2OIV3yP1IaCzzi6llb1ZOWPcBESt6HEnLzqkwzEK+2/QGBOMqChP1EP7JHFrWQw5YYCLUcYCLVts1K57Q7ThFwckUA0v8Vh9HdlZqA0XPxKyVK7nfw/Y1CpwRTwZ8GYnry1/iLNYjFGkDU0V5pf+ZhlZfIChVccma9NCSlQtA+7DikNcpLTfTCCBE4GCSqGSIb3DQEHATAdBglghkgBZQMEASoEEJQ4jJz/oSqW79tDOSv2pWCAggQgvi+p2P7tkIY4c0yNEIFjnXa3Imopg4bZ29TQJnPLAqVM7Bexh0XhxAjWk8YFvxQ0Yio+3JKlvqlsFVpecumV6NHwVPe521Hl7l88eRvgCHBC3tVm98+N2A0GdGbT+begqsj0nPTDScixJE79dGZK6/qgf3NuYPCj+drFwWrDuZXpIYMHJcOrVhqlg4RFW4ZYUxbsAC2eNFXUF0bYpKej3voCnlj/o6RxLEC/Gv2T66e9sFjeANo9W84uAfZ1t4cweVzYh1h6Yiw+0ewWA6ndg8thgr2Uk9JdpjXzS0QTtElGmNv+tZmCH45o0HUunPZs0gkn5unT0pzZosqgSeu0HdHcsImJpuJVRIVjAXypku7LtBKnP3VA5iXi2lld/suEOeeU18Aw3pxFQrKV3cexiWLa4mpKn8JR1HBxw4NcLj3/fes41fxW0zLyY8m4MksaIpc4BXz33uup5rHdVblbD1raZJPAg7k8KufStsRBmeokdysF+PJebrCfTH8goR3BWGfCVWQEoDjB2wAhVTQKuzAh3d51k+s4uvJchNBDgfGt/s9hdBFU/VQTZUyOoSEOwxB1857sOF3iPLM1233XEhZd2AOl4h5xy1z3+aSOG0jiihWt6QdosUig/IHxyO4gWaEO37iaLlF0ZVSJKjOV/IBCHJAaAG476uSNv+kTKgvu0PQtIfcKHpa1ppHi96fO8FKX76l26VoGKf/kMi6bWdTObYZnyiN7fz342ewMpwu70wQQWo33riK0hhF6bRu40J/KmgoUaUz3jSnErv+EeeREYww5SSNlMhpQNBNj+WfEDRC4Zx9VsF1cjtTY1um0kYdoyTHBLH6V1oAEiFIScHqkW1zKVAEiBh2v6C1U3fwAzOyAbnDlBrsuhnVxbJa8O1d5yw+U2py6xdC3Wq6FsAP9kdfDu+mjNDOwwJWZa8iTj3NHum1G6xklF2JHtmp2p1gY0e/JCETIk5Xh1okf404F9Xi+CWvlmlPXie9SdwgyJWpXOM60pJN2iMOFKPGn4chppMka38HakDKbdNNTELxNE+/yVECT0uQ8iBvETX1FU+y4LpGFghmwAIiKB1HZXx/0Gof0+txj/p9AgnpeVvDbq4iiZOulcu2BepsrFDg2zNLollfhAo+6QvElpk2MI1yHrg3OaTt7U8JV1dxHyIWjbtRvbiiS1E6mKGiOpkIQd/IHBjkujvEd7LVeE721HrLdGRaTR9QJfTR8jPZGHMlZa14a2pcxliyYd9RFSVOkVZH2LetuSWStQ1gPdBEeKDSWyFBA0Rxzlw2Sl25MJ4PAIpimyUYrnxTa2XgHyavMa0kjVAhX15+ywze2ypOVnB9/q3L3M5JCq+eaOBicJQiERX4h7Yj499S9Y/2nxk2DOUxi965BDIZGSG3/qOtl]
|
||||
profiles::puppet::eyaml::privatekey: ENC[PKCS7,MIIH/QYJKoZIhvcNAQcDoIIH7jCCB+oCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAkH2q64bYf5Es/YNK6c6d5t9PYcbc9NGzC6F2AzjWeLV9rdT+DBNmhPeyHN4jR6edzLRaNL+u3cuur3mTxwSJcEXdyHQSbXJLlGpd9CPEjuerqdsXkFvamP//nHjwvSosBUo4PKtllphX0XHP6JS0Mm+nukv0YyDk+63+cETuyP5M1FVsLSK8ZWblOn1uBgNhhjGZF5nNeayjJKloWdVY8+pS8L6/y0QprF05oLDvI0JgK9wud8NID+LCNtb2Z5/mq2ScpMB/r/ji/oPHs40zhANqOiAuy/sUWwIivdB2iKKvcLfJ8tbtCanXuQxboqnulL1+C87Y4m1rmk4cNtKU3DCCBr4GCSqGSIb3DQEHATAdBglghkgBZQMEASoEELXUERpdYNf8m2IXbCw/MxiAggaQ187hqDCftN9RvnFRHnlHyPZijykRgs558tdh0yA8GscJ9vim8kxQXrxM6gqAGgmV7xYnpyK0pvEn0/6cEFkcBkpkQOtlyil+4WB9bcLJIF4LzPut0pz4Eq/6zMSM9PGWCRFe3ufkdoDq5M1SlHa/Aoi/LwNu5EFFlFZeeDiZyUMupLJUHbTQ+wt2JgQLfpBzeCGb5BRLvSPH0+Y7ShwHgp2ZCtxc/tT5cdQq5a3+tt9ZYSy5Hj+c8I2WBPm3wghA7QULCB1+42K4A8BJ7HQucaT1mRMc0QnCt68xQkhBulxGnADPaRAWICmuAF2KBv/eS74TdYj3z0OCSZW5k1wDBz8FCSIodn2a1LgBMrFRCAS2fwRn7Hc0yguCRl9ppERW+8K3pg7aAiBqJbeTwQN/VICNan92y+cbUndO9a/U16zKD4SxfW8PMwSu/qz6i45gUjQ83THjwNAE6el0lYFYivBsEEg66Sqo2cXtPQlAdB8lOsS34TQq21zipikgAAii0mGoH738t2CYL6tMUGthpcfXLioU0AhXjLVED1PIpmWxieFENWO8SUx3NjXyoefBVQrzc1PPAgeVGSaOBoJSN7xNx3/RQhWck0240DZmi+41z5CF1z91eZY+ZJYa/SaHVWWZ7GgQDEXGnWKQkMZce6RK0qw0/8B0x5O6aIlBrB7aSVQIkDLSUw8bq7N5dAeKXLu+2QHhG1yl+Bmn1xDMILFphJNT2ZNXkoSd0r1WUePWBEFCOBPsu3cHaK9DZiXSdfJ3dY+1NYuVZDQshQ1Fe4IKpHm/0mtz60DjrTTaJ3kAsPLCpeFGJ+1U/TdO+IgPAsiHUIaDRtv19ZeH7/Pa/kAceIe16F8CRNkzJ62D8CH4RYEXxTJ7oogYbhsw+5WQ3ZGzJHNvxcX4EVofjIsr2uIQEAVTu9VSDY2LyihJBEs0EBw25dai52u2g1Jjtteod9p6B+rwrcVGKAzdEo7nF9qK6+dS8VlfFbmbU1/ulIpM0hUr3ZFsUSv1qUGqUmYdgndvE0+gHop71fsnQRmT9wTdQlUs7RC0+BPWvf7eGljJT+omDwv+wSShikWku9ZSk58HqZ74f2RizxL7Ny8SWCkOf1u+Gi8kalMhr+1p8e39S6WTws8rJHxIQrzfY7aqZwYIZzLl4JMnqBvbkUlCEKNHmVAVt6AgPGfTmoEzSgulHEMCETuBQl4dS8mtFvWRKCy0jC2fAUfIAoihoh/2g3MTbKQCM3aSHrqyPTAduN2VkQwTM4JmgU6YYWy4kXjPWsgEm+FjqOKQqd5Q5bwIOoFLSVQgrTtoKVUXzK8VbTDNDhLj+LggB9MMncr5X44LkdtrktYWeQ1CbBGYUTNHyXxT2nbJm7DJos4zjSIqnkSiR2VyRAkxF9TSXjnZwtsziXC4gdonjA+ImV5aUvL5aTO2zbTYQOqgrauS/SWS4tXbZ4Thw86d2zbO32Kvuu4bfHVTN087eiRuiFmjtz43PwBRMxjABLDe/ZRUHLDomAVydTS98aIswUb33jHoPtEkz4bWEtZlhwrqguvPzLSJT1SNZnDhNsdzO96GDB2vtvXmIiQq+/8jh0LKIoOCFWKsFfB0GrkZZvLnF6oQQ/MiYNNY1TLnHMAg2uSF+ap/g8QRvfE5FX2UquYE1ATeD+8iRw0g2crNXGVRynBo6ESd5O+zwcMitO/Re9tQM4rfNj83VgWeSUNLxhOZmbYs0hDEbS0lXIWa1NbASuXWk/FBXzr8X/ZdlZPWAMWe3J9Bqh6e1FhgGD6ZZmSTYxHzlz5TNCf+aMqnJRb5eyN+UM5iWgW/VpAlKWMl98c1lsKwccAS/SH2zugKwBT8Bf/4wnbpHrZe817vVF7raVcaYvNnYTzdSQCcnvRK/D40sqleOhtfX/vdjOFWfoukbEJnXNytkTZeKrBm83z6tmYe4siQdfn4X9/lGNWEDyjYiJX8czH6yMlRW+FposOpE4Y9Dgs694iPHmYt1/1VbuW240uG6VT/d+OjSD5L6JfTT47pghoWTl0dQGbKd3kmoku7C7ll5etCdz5UIY2JOmS1gx6NgvsElJyflgQHgXLiSKpB0iSZ7zTRKlBmRG7uiU582nkbXHQ7BwZkP3nq95bgtCmk+0pvioYYg/jK8hvuiv+b8Ez2pHaTLabn/jYww8ewIZz0W5mWgcCDwdebtP2CCSnB2IPjyzAh2TW8JTljeoJAe9ai+iqiX4400R2hXZl6KMpC]
|
||||
@@ -1,5 +1,9 @@
|
||||
---
|
||||
profiles::puppet::autosign::subnet_ranges:
|
||||
- '198.18.13.0/24'
|
||||
- '198.18.14.0/24'
|
||||
- '198.18.15.0/24'
|
||||
- '198.18.16.0/24'
|
||||
- '198.18.17.0/24'
|
||||
|
||||
profiles::puppet::autosign::domains:
|
||||
@@ -8,9 +12,64 @@ profiles::puppet::autosign::domains:
|
||||
# profiles::puppet::autosign::nodes:
|
||||
# - 'somenode.main.unkin.net'
|
||||
|
||||
profiles::puppet::enc::repo: https://git.unkin.net/unkinben/puppet-enc.git
|
||||
profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkinben/puppet-r10k.git
|
||||
profiles::puppet::cobbler_enc::cobbler_scheme: https
|
||||
profiles::puppet::cobbler_enc::cobbler_hostname: cobbler.main.unkin.net
|
||||
profiles::puppet::cobbler_enc::version: 'system'
|
||||
profiles::puppet::cobbler_enc::packages:
|
||||
- 'requests'
|
||||
- 'PyYAML'
|
||||
profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
|
||||
profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkinben/puppet-r10k.git
|
||||
profiles::puppet::g10k::bin_path: '/opt/puppetlabs/bin/g10k'
|
||||
profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
|
||||
profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
|
||||
profiles::puppet::g10k::default_environment: 'develop'
|
||||
profiles::puppet::gems::puppet:
|
||||
- 'deep_merge'
|
||||
- 'ipaddr'
|
||||
- 'hiera-eyaml'
|
||||
|
||||
profiles::helpers::certmanager::vault_config:
|
||||
addr: 'https://vault.query.consul:8200'
|
||||
mount_point: 'pki_int'
|
||||
approle_path: 'approle'
|
||||
role_name: 'servers_default'
|
||||
output_path: '/tmp/certmanager'
|
||||
role_id: "%{lookup('certmanager::role_id')}"
|
||||
|
||||
profiles::puppet::server::agent_server: 'puppet.query.consul'
|
||||
profiles::puppet::server::report_server: 'puppet.query.consul'
|
||||
profiles::puppet::server::ca_server: 'puppetca.query.consul'
|
||||
profiles::puppet::server::dns_alt_names:
|
||||
- "%{facts.networking.fqdn}"
|
||||
- "%{facts.networking.hostname}"
|
||||
- puppetmaster.main.unkin.net
|
||||
- puppet.main.unkin.net
|
||||
- puppet.service.consul
|
||||
- puppet.query.consul
|
||||
- puppetmaster
|
||||
- puppet
|
||||
|
||||
consul::services:
|
||||
puppet:
|
||||
service_name: 'puppet'
|
||||
tags:
|
||||
- 'puppet'
|
||||
- 'master'
|
||||
address: "%{facts.networking.ip}"
|
||||
port: 8140
|
||||
checks:
|
||||
- id: 'puppet_https_check'
|
||||
name: 'Puppet HTTPS Check'
|
||||
http: "https://%{facts.networking.fqdn}:8140/status/v1/simple"
|
||||
method: 'GET'
|
||||
tls_skip_verify: true
|
||||
interval: '10s'
|
||||
timeout: '1s'
|
||||
profiles::consul::client::node_rules:
|
||||
- resource: service
|
||||
segment: puppet
|
||||
disposition: write
|
||||
- resource: service
|
||||
segment: puppetca
|
||||
disposition: write
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
---
|
||||
# additional servername aliases
|
||||
profiles::puppet::puppetboard::nginx_aliases:
|
||||
- puppetboard.service.consul
|
||||
- puppetboard.query.consul
|
||||
- "puppetboard.service.%{facts.country}-%{facts.region}.consul"
|
||||
- "%{facts.networking.fqdn}"
|
||||
|
||||
# additional altnames
|
||||
profiles::pki::vault::alt_names:
|
||||
- puppetboard.main.unkin.net
|
||||
- puppetboard.service.consul
|
||||
- puppetboard.query.consul
|
||||
- "puppetboard.service.%{facts.country}-%{facts.region}.consul"
|
||||
|
||||
consul::services:
|
||||
puppetboard:
|
||||
service_name: 'puppetboard'
|
||||
tags:
|
||||
- 'puppet'
|
||||
- 'puppetboard'
|
||||
address: "%{facts.networking.ip}"
|
||||
port: 80
|
||||
checks:
|
||||
- id: 'puppetboard_http_check'
|
||||
name: 'Puppetboard HTTP Check'
|
||||
http: "http://%{facts.networking.fqdn}:80"
|
||||
method: 'GET'
|
||||
tls_skip_verify: true
|
||||
interval: '10s'
|
||||
timeout: '1s'
|
||||
profiles::consul::client::node_rules:
|
||||
- resource: service
|
||||
segment: puppetboard
|
||||
disposition: write
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
profiles::puppet::puppetdb_api::java_bin: /usr/lib/jvm/jre-11/bin/java
|
||||
profiles::puppet::puppetdb_api::java_args:
|
||||
'-Xmx': '2048m'
|
||||
'-Xms': '256m'
|
||||
|
||||
profiles::puppet::client::dns_alt_names:
|
||||
- puppetdbapi.main.unkin.net
|
||||
- puppetdbapi.service.consul
|
||||
- puppetdbapi.query.consul
|
||||
|
||||
# additional altnames
|
||||
profiles::pki::vault::alt_names:
|
||||
- puppetdbapi.main.unkin.net
|
||||
- puppetdbapi.service.consul
|
||||
- puppetdbapi.query.consul
|
||||
- puppetdbapi
|
||||
|
||||
consul::services:
|
||||
puppetdbapi:
|
||||
service_name: 'puppetdbapi'
|
||||
tags:
|
||||
- 'puppet'
|
||||
- 'puppetdb'
|
||||
- 'puppetdbapi'
|
||||
address: "%{facts.networking.ip}"
|
||||
port: 8080
|
||||
checks:
|
||||
- id: 'puppetdbapi_http_check'
|
||||
name: 'PuppetDB API HTTP Check'
|
||||
http: "http://%{facts.networking.fqdn}:8080"
|
||||
method: 'GET'
|
||||
tls_skip_verify: true
|
||||
interval: '10s'
|
||||
timeout: '1s'
|
||||
profiles::consul::client::node_rules:
|
||||
- resource: service
|
||||
segment: puppetdbapi
|
||||
disposition: write
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
postgresql_config_entries:
|
||||
max_connections: 300
|
||||
shared_buffers: '256MB'
|
||||
@@ -1,40 +1,13 @@
|
||||
---
|
||||
profiles::packages::install:
|
||||
- createrepo
|
||||
|
||||
profiles::pki::vault::alt_names:
|
||||
- repos.main.unkin.net
|
||||
|
||||
profiles::reposync::webserver::nginx_listen_mode: both
|
||||
profiles::reposync::webserver::nginx_cert_type: vault
|
||||
profiles::reposync::repos_list:
|
||||
almalinux_8_8_baseos:
|
||||
repository: 'BaseOS'
|
||||
description: 'AlmaLinux 8.8 - BaseOS'
|
||||
osname: 'almalinux'
|
||||
release: '8.8'
|
||||
mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.8/baseos
|
||||
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
|
||||
almalinux_8_8_appstream:
|
||||
repository: 'AppStream'
|
||||
description: 'AlmaLinux 8.8 - AppStream'
|
||||
osname: 'almalinux'
|
||||
release: '8.8'
|
||||
mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.8/appstream
|
||||
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
|
||||
almalinux_8_8_highavailability:
|
||||
repository: 'HighAvailability'
|
||||
description: 'AlmaLinux 8.8 - HighAvailability'
|
||||
osname: 'almalinux'
|
||||
release: '8.8'
|
||||
mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.8/ha
|
||||
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
|
||||
almalinux_8_8_powertools:
|
||||
repository: 'PowerTools'
|
||||
description: 'AlmaLinux 8.8 - PowerTools'
|
||||
osname: 'almalinux'
|
||||
release: '8.8'
|
||||
mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.8/powertools
|
||||
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
|
||||
almalinux_8_8_extras:
|
||||
repository: 'extras'
|
||||
description: 'AlmaLinux 8.8 - extras'
|
||||
osname: 'almalinux'
|
||||
release: '8.8'
|
||||
mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.8/extras
|
||||
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
|
||||
almalinux_8_9_baseos:
|
||||
repository: 'BaseOS'
|
||||
description: 'AlmaLinux 8.9 - BaseOS'
|
||||
@@ -70,12 +43,67 @@ profiles::reposync::repos_list:
|
||||
release: '8.9'
|
||||
mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/extras
|
||||
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
|
||||
centos_8_advanced_virtualization:
|
||||
repository: 'virt-advanced-virtualization'
|
||||
description: 'CentOS Advanced Virtualization'
|
||||
osname: 'centos'
|
||||
release: '8' # Assumed static value for demonstration
|
||||
mirrorlist: 'http://mirrorlist.centos.org/?release=8&arch=x86_64&repo=virt-advanced-virtualization' # Assuming 'stream' and 'x86_64'
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||
centos_8_ceph_pacific:
|
||||
repository: 'storage-ceph-pacific'
|
||||
description: 'CentOS Ceph Pacific'
|
||||
osname: 'centos'
|
||||
release: '8' # Assumed static value for demonstration
|
||||
mirrorlist: 'http://mirrorlist.centos.org/?release=8&arch=x86_64&repo=storage-ceph-pacific' # Assuming '8' and 'x86_64'
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||
centos_8_rabbitmq_38:
|
||||
repository: 'messaging-rabbitmq-38'
|
||||
description: 'CentOS RabbitMQ 38'
|
||||
osname: 'centos'
|
||||
release: '8-stream' # Specified based on the repository name
|
||||
mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=messaging-rabbitmq-38' # Assuming '8' and 'x86_64'
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
|
||||
centos_8_nfv_openvswitch:
|
||||
repository: 'nfv-openvswitch-2'
|
||||
description: 'CentOS NFV OpenvSwitch'
|
||||
osname: 'centos'
|
||||
release: '8-stream' # Assumed static value for demonstration
|
||||
mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=nfv-openvswitch-2' # Assuming 'stream' and 'x86_64'
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
|
||||
centos_8_openstack_xena:
|
||||
repository: 'cloud-openstack-xena'
|
||||
description: 'CentOS OpenStack Xena'
|
||||
osname: 'centos'
|
||||
release: '8-stream' # Directly taken from the provided mirrorlist
|
||||
mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=cloud-openstack-xena' # Assuming 'x86_64'
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
|
||||
centos_8_opstools:
|
||||
repository: 'opstools-collectd-5'
|
||||
description: 'CentOS OpsTools - collectd'
|
||||
osname: 'centos'
|
||||
release: '8-stream' # Assumed static value for demonstration
|
||||
mirrorlist: 'http://mirrorlist.centos.org/?arch=x86_64&release=8-stream&repo=opstools-collectd-5' # Assuming 'stream' and 'x86_64'
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
|
||||
centos_8_ovirt45:
|
||||
repository: 'virt-ovirt-45'
|
||||
description: 'CentOS oVirt 4.5'
|
||||
osname: 'centos'
|
||||
release: '8-stream' # Assumed static value for demonstration
|
||||
mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=virt-ovirt-45' # Assuming 'stream' and 'x86_64'
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||
centos_8_stream_gluster10:
|
||||
repository: 'storage-gluster-10'
|
||||
description: 'CentOS oVirt 4.5 - Glusterfs 10'
|
||||
osname: 'centos'
|
||||
release: '8-stream' # Assumed static value for demonstration
|
||||
mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=storage-gluster-10' # Assuming 'stream' and 'x86_64'
|
||||
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||
epel_8_everything:
|
||||
repository: 'Everything'
|
||||
description: 'EPEL 8 Everything'
|
||||
osname: 'epel'
|
||||
release: '8'
|
||||
# baseurl: 'https://dl.fedoraproject.org/pub/epel/8/Everything/x86_64/'
|
||||
mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-8&arch=x86_64'
|
||||
gpgkey: 'https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8'
|
||||
mariadb_11_2_el8:
|
||||
@@ -91,18 +119,18 @@ profiles::reposync::repos_list:
|
||||
osname: 'puppet7'
|
||||
release: 'el'
|
||||
baseurl: 'https://yum.puppet.com/puppet7/el/8/x86_64/'
|
||||
gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet'
|
||||
gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
|
||||
postgresql_rhel8_common:
|
||||
repository: 'common'
|
||||
description: 'PostgreSQL Common RHEL 8'
|
||||
osname: 'postgresql'
|
||||
release: 'rhel8'
|
||||
baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-8-x86_64/'
|
||||
gpgkey: 'https://download.postgresql.org/pub/repos/yum/RPM-GPG-KEY-PGDG'
|
||||
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||
postgresql_rhel8_16:
|
||||
repository: '16'
|
||||
description: 'PostgreSQL 16 RHEL 8'
|
||||
osname: 'postgresql'
|
||||
release: 'rhel8'
|
||||
baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-x86_64/'
|
||||
gpgkey: 'https://download.postgresql.org/pub/repos/yum/RPM-GPG-KEY-PGDG'
|
||||
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||
|
||||
@@ -1,11 +1,27 @@
|
||||
---
|
||||
profiles::sql::galera_member::cluster_name: galera01
|
||||
profiles::sql::galera_member::galera_master: prodinf01n29.main.unkin.net
|
||||
profiles::sql::galera_member::configure_firewall: false
|
||||
profiles::sql::galera_member::wsrep_sst_method: rsync
|
||||
profiles::sql::galera_member::galera_members_lookup: true
|
||||
profiles::sql::galera_member::galera_members_role: roles::infra::sql::galera
|
||||
profiles::sql::galera_member::datadir: /data/mariadb
|
||||
profiles::sql::galera_member::innodb_buffer_pool_size: 256M
|
||||
profiles::sql::galera_member::innodb_file_per_table: 1
|
||||
profiles::sql::galera_member::package_name: mariadb-galera-server
|
||||
|
||||
consul::services:
|
||||
mariadb:
|
||||
service_name: "mariadb-%{facts.environment}"
|
||||
tags:
|
||||
- 'database'
|
||||
- 'mariadb'
|
||||
address: "%{facts.networking.ip}"
|
||||
port: 3306
|
||||
checks:
|
||||
- id: 'mariadb_tcp_check'
|
||||
name: 'MariaDB TCP Check'
|
||||
tcp: "%{facts.networking.ip}:3306"
|
||||
interval: '10s'
|
||||
timeout: '1s'
|
||||
profiles::consul::client::node_rules:
|
||||
- resource: service
|
||||
segment: "mariadb-%{facts.environment}"
|
||||
disposition: write
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
profiles::consul::server::acl_master_token: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAFCDnJyImf/X8f6WGqt37XbuuSg5hCeC5Uhdd0u1/Jjlz4AzMyhF41Vs6iVrV6irlsMDziSQrcEvGumTPmYShRQiRv0GvkhHUpn2XROKd63KolsWRj2K2S5FhgwolgtQc05DLmGaQ6FIUMVk3aKU/v8IGSDopcjdhwTJtheOLgiiEjv8TsjWKOOIa0H7caa6ZiZxcf2Y99Wv9gIZdt+LnXGdlDuO88+gkYTpRM07RY21nr4VS821y0MwFcYx2SyzMDk60RvgCmvA6RdoyHBUYAu07IX6IjP5LZwpAkcPcA4gADVP7vOPT2WhVAtkzpg+RwNxkuWYA5roO2r1UhERixjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC9TM/c8nXJswHAUSU6kFCDgDBob2r0tFLq1Jw313Ys8jUtKsetsrc5x7uIDYzOqr7ulEM9B0VOD2ekR9IRYZMsBCg=]
|
||||
@@ -0,0 +1,79 @@
|
||||
---
|
||||
profiles::consul::server::members_lookup: true
|
||||
profiles::consul::server::data_dir: /data/consul
|
||||
profiles::consul::server::addresses:
|
||||
dns: "%{::networking.ip}"
|
||||
http: "%{::networking.ip}"
|
||||
https: "%{::networking.ip}"
|
||||
grpc: "%{::networking.ip}"
|
||||
grpc_tls: "%{::networking.ip}"
|
||||
profiles::consul::server::ports:
|
||||
dns: 8600
|
||||
http: 8500
|
||||
https: -1
|
||||
profiles::consul::server::acl:
|
||||
enabled: true
|
||||
default_policy: 'deny'
|
||||
down_policy: 'extend-cache'
|
||||
tokens:
|
||||
initial_management: "%{alias('profiles::consul::server::acl_tokens_initial_management')}"
|
||||
default: "%{alias('profiles::consul::server::acl_tokens_default')}"
|
||||
replication: "%{alias('profiles::consul::server::acl_tokens_replication')}"
|
||||
|
||||
# additional altnames
|
||||
profiles::pki::vault::alt_names:
|
||||
- consul.main.unkin.net
|
||||
- consul.service.consul
|
||||
- consul
|
||||
|
||||
# manage a simple nginx reverse proxy
|
||||
profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'
|
||||
profiles::nginx::simpleproxy::nginx_aliases:
|
||||
- consul
|
||||
- consul.main.unkin.net
|
||||
profiles::nginx::simpleproxy::proxy_port: 8500
|
||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||
|
||||
profiles::consul::prepared_query::rules:
|
||||
vault:
|
||||
ensure: 'present'
|
||||
service_name: 'vault'
|
||||
service_failover_n: 3
|
||||
service_only_passing: true
|
||||
ttl: 10
|
||||
puppet:
|
||||
ensure: 'present'
|
||||
service_name: 'puppet'
|
||||
service_failover_n: 3
|
||||
service_only_passing: true
|
||||
ttl: 10
|
||||
puppetca:
|
||||
ensure: 'present'
|
||||
service_name: 'puppetca'
|
||||
service_failover_n: 3
|
||||
service_only_passing: true
|
||||
ttl: 10
|
||||
edgecache:
|
||||
ensure: 'present'
|
||||
service_name: 'edgecache'
|
||||
service_failover_n: 3
|
||||
service_only_passing: true
|
||||
ttl: 10
|
||||
puppetdbapi:
|
||||
ensure: 'present'
|
||||
service_name: 'puppetdbapi'
|
||||
service_failover_n: 3
|
||||
service_only_passing: true
|
||||
ttl: 10
|
||||
puppetboard:
|
||||
ensure: 'present'
|
||||
service_name: 'puppetboard'
|
||||
service_failover_n: 3
|
||||
service_only_passing: true
|
||||
ttl: 10
|
||||
git:
|
||||
ensure: 'present'
|
||||
service_name: 'git'
|
||||
service_failover_n: 3
|
||||
service_only_passing: true
|
||||
ttl: 10
|
||||
@@ -0,0 +1,120 @@
|
||||
---
|
||||
consul::services:
|
||||
edgecache:
|
||||
service_name: 'edgecache'
|
||||
tags:
|
||||
- 'cache'
|
||||
- 'edge'
|
||||
address: "%{facts.networking.ip}"
|
||||
port: 443
|
||||
checks:
|
||||
- id: 'edgecache_https_check'
|
||||
name: 'EdgeCache HTTPS Check'
|
||||
http: "https://%{facts.networking.fqdn}"
|
||||
method: 'GET'
|
||||
tls_skip_verify: true
|
||||
interval: '10s'
|
||||
timeout: '1s'
|
||||
profiles::consul::client::node_rules:
|
||||
- resource: service
|
||||
segment: edgecache
|
||||
disposition: write
|
||||
|
||||
# additional altnames
|
||||
profiles::pki::vault::alt_names:
|
||||
- edgecache.service.consul
|
||||
- edgecache.query.consul
|
||||
|
||||
profiles::edgecache::params::nginx_resolvers_enable: true
|
||||
profiles::edgecache::params::nginx_resolvers_ipv4only: true
|
||||
profiles::edgecache::params::nginx_listen_mode: both
|
||||
profiles::edgecache::params::nginx_cert_type: vault
|
||||
profiles::edgecache::params::nginx_aliases:
|
||||
- edgecache.service.consul
|
||||
- edgecache.query.consul
|
||||
profiles::edgecache::params::directories:
|
||||
/data/edgecache: { owner: root, group: root }
|
||||
/data/edgecache/pub: { owner: nginx, group: nginx }
|
||||
/data/edgecache/pub/centos: { owner: nginx, group: nginx }
|
||||
/data/edgecache/pub/almalinux: { owner: nginx, group: nginx }
|
||||
/data/edgecache/pub/debian: { owner: nginx, group: nginx }
|
||||
/data/edgecache/pub/epel: { owner: nginx, group: nginx }
|
||||
/data/edgecache/pub/postgres: { owner: nginx, group: nginx }
|
||||
/data/edgecache/pub/postgres/apt: { owner: nginx, group: nginx }
|
||||
/data/edgecache/pub/postgres/yum: { owner: nginx, group: nginx }
|
||||
|
||||
profiles::edgecache::params::mirrors:
|
||||
debian:
|
||||
ensure: present
|
||||
location: /debian
|
||||
proxy: http://mirror.gsl.icu
|
||||
debian_pool:
|
||||
ensure: present
|
||||
location: /debian/pool
|
||||
proxy: http://mirror.gsl.icu
|
||||
proxy_cache: cache
|
||||
proxy_cache_valid:
|
||||
- '200 302 1440h'
|
||||
- '404 1m'
|
||||
centos_repodata:
|
||||
ensure: present
|
||||
location: '~* ^/centos/.*/repodata/'
|
||||
proxy: http://gsl-syd.mm.fcix.net
|
||||
centos_data:
|
||||
ensure: present
|
||||
location: /centos
|
||||
proxy: http://gsl-syd.mm.fcix.net
|
||||
proxy_cache: cache
|
||||
proxy_cache_valid:
|
||||
- '200 302 1440h'
|
||||
- '404 1m'
|
||||
almalinux_repodata:
|
||||
ensure: present
|
||||
location: '~* ^/almalinux/.*/repodata/'
|
||||
proxy: http://gsl-syd.mm.fcix.net
|
||||
almalinux_data:
|
||||
ensure: present
|
||||
location: /almalinux
|
||||
proxy: http://gsl-syd.mm.fcix.net
|
||||
proxy_cache: cache
|
||||
proxy_cache_valid:
|
||||
- '200 302 1440h'
|
||||
- '404 1m'
|
||||
epel_repodata:
|
||||
ensure: present
|
||||
location: '~* ^/epel/.*/repodata/'
|
||||
proxy: http://gsl-syd.mm.fcix.net
|
||||
epel_data:
|
||||
ensure: present
|
||||
location: /epel
|
||||
proxy: http://gsl-syd.mm.fcix.net
|
||||
proxy_cache: cache
|
||||
proxy_cache_valid:
|
||||
- '200 302 1440h'
|
||||
- '404 1m'
|
||||
postgres_yum_repodata:
|
||||
ensure: present
|
||||
location: '~* ^/postgres/yum/.*/repodata/'
|
||||
rewrite_rules:
|
||||
- '^/postgres/yum/(.*)$ /pub/repos/yum/$1 break'
|
||||
proxy: https://download.postgresql.org
|
||||
postgres_yum_data:
|
||||
ensure: present
|
||||
location: /postgres/yum
|
||||
proxy: https://download.postgresql.org/pub/repos/yum
|
||||
proxy_cache: cache
|
||||
proxy_cache_valid:
|
||||
- '200 302 1440h'
|
||||
- '404 1m'
|
||||
postgres_apt:
|
||||
ensure: present
|
||||
location: /postgres/apt
|
||||
proxy: https://download.postgresql.org/pub/repos/apt
|
||||
postgres_apt_pool:
|
||||
ensure: present
|
||||
location: /postgres/apt/pool
|
||||
proxy: https://download.postgresql.org/pub/repos/apt/pool
|
||||
proxy_cache: cache
|
||||
proxy_cache_valid:
|
||||
- '200 302 1440h'
|
||||
- '404 1m'
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
profiles::minio::server::minio_root_pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAcAGh4K8P/bOwHs7FEAssBcYgtT+FlkMW4/jpJf230sbOh0jswvCl0woQMMw+AIpkXNJ//YcmDBkhdE92RCK8C4Xi/2nkdWjPt9FQwuT47BhAKISjunRs9R61dKj5aOwAlTQ3lNtsQsknGz17AMTyPEGQC9SnPxYirLRr9VgJX/EKPjl7M2LbkZTJChwIE6IiT+LSzye7YgpkJ7O6h4jNIp5ryWaUqSUfooYjqHc1zl4Bs9ZfyY1K/CWCTIbtd4hY1ZlskRlVa9yA0cWhsufV0gw43RA/bCAJPowLc64bZ4XlLx9Fy0qHKjTCDRLzysUoq0QjIR2Ulf1TkcCJAVLwFDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC3+P+RW/JoQemkVJE/mpAngDAw1JpFkBvLj4AlbJePvpnG+fFN8coOE+5N94NgGd9Gtl2NZt/g5x/7xFHS28cSlIg=]
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
profiles::minio::server::minio_members_role: roles::infra::storage::minio
|
||||
profiles::minio::server::minio_root_user: admin
|
||||
profiles::minio::server::minio_opts:
|
||||
- '--anonymous'
|
||||
profiles::minio::server::minio_members_lookup: true
|
||||
profiles::minio::server::version: 'RELEASE.2023-12-20T01-00-02Z'
|
||||
profiles::minio::server::checksum: '09fafaf399885b4912bafda6fa03fc4ccbc39ec45e17239677217317915d6aeb'
|
||||
profiles::minio::server::checksum_type: 'sha256'
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
vault::unseal_keys:
|
||||
- ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAHfDhuu2C5ZEALdJlmOqWukEiAQQiVJ7KjpSRuf9h7RYwR+u8UNdcJYK1xFvYwmUczw6hkST/Zr06T4JwavpAHHuaRbyl8N1qZjlwt4MO5CPUTBT8k+EOaocF2byUXpYBThETjLB+WNLJAU3Dq8JboekCJ2F1Zjd8Mmdtu1C3Ip5ii5iVGbQShxDSPsdjtk8Q49lUKj61tLyuvadcTcxllHyXs6siWl7atBfIS6OX5KgA66VJhxOeoyyBaiqSSu7OqqZa2siYGTvjJS3UFDf8J+itsJJ1+0KUtkl07PvItkIruSAlHZGagVPrizAyEx1j4hFvVTGHac86bcV/5M9z5DBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDCjxoJHSXr/4XvXaxVbUGOgDCQ4DL05Qnw3+3qHWZRKvNChHgrhRPi2HmkiGni+A4ZVF9LHs+mF8TQ/t3Q1DrSy3I=]
|
||||
- ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAoapLUNj1f+7BEvjzR9CO0Qz3LhI5M326BVliikRY7hpL2+0CnTOlR9K3YapD83LtpuiNbXqbk1mhi44ak0CTet8yz0ZH/BPkVYgV2Ll9ISdN4Knnnlf2Ljt/gHGf03jiUKwfXxu87LfvCySAMgzYonQ90cfIDc+XH6CoQv27WM3U1q79RcWl/w9Z/XwJiKyANSCXfBT16+RawrzmVo+zWbteqx09MfOHr7Q36VwOqjJaO94A/Dj3m/YJIOhmYXd52h+am6Kc1Q9dnzycKZYoKYOv+qi+bY4frx9sRvBxoGDGMb1mXTDSPeIT6NXbMCIsTsmYxjxAvBET72oKWXJUcDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDy/pkTHpz4F9l1J6cKW4A9gDD873VdHr3ArjpE1R82wS5brCbBe7ntEuNFQMbnFPvOXwI4EaYV3IMRNv6Lzk6BBSI=]
|
||||
- ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAVKVb6/nhbgEx6b2b90gfuXbZglZpoJjQtyzDQtCZzcZxh/xVFjwUy1XX/3+dueazFd5Ge5NnqQdxs/h5MBSjexHJhEm3fmA+gnns8sdYX5SDJSnhYvS1cB/wmfHuvkj3ZhIFxg0jlPlKz24QST99ouxKI2c490ByIbcFCr+A5GWnO7D/kf1Y+M0Sg2YiPE4zqF2zx1sgOfaV2xvQbRqqSjDPim/mYff95AtWwN9KbcAvc/7vDi4PrHR8GY9RXhI8FBEvelAT0H0NmnaCw4TvWXF/YxztlG9E55G3MsFyVAQJT7Dl8w4w5nk4AJJBMaXlO2s4AWD4Y+MVQh62hjqgHjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBptatyhSChU/V0R+IVd5hRgDCmA07/V4UBz1nVMc2vZm2KvnUOPofO74hwkkoxOnk6O2h6arbw8GNHj7WxeHXoXPk=]
|
||||
- ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAOGvhPhbKt8hkYTif5C+IE7iqcoeXm68BeUzlzE9qAY7lzQoAENauDKoIgoQT0hA7zrKZXPTUDrcw8SdxNp7Zo/Dr44urdr4LiT+QZwYTE09Xn8yIA3ij1XnXQ5bYP70TycuOjpVT0BKK+qSkklfd7IAw76AnUWF1D6P9MjT+shOmVNHQQSRrL2JLNppetQRCyOEMzkeDI/58/ohexvyUcY8WT4YMNhl/IrNBdcJ3xOwnJqEAXSUTre15T2I+7f+prhj4cS2V9qd0ZwUXSueL38EIMKwmq1ugb+zm8UYzqfKpRk/1THqT8T/r8B4PR2QxtiwtzLk388ag1mqQ/jHL9zBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAlKLuJOARFD1vt/R9gfp4LgDA0irHwG41ByRyYcKT87ra9tsdhb+i9ugnNRbFQ1UPTk7bFwS3HUteEJwNzcNIwFXY=]
|
||||
- ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEQvjVATvI+UVWrowTWSxtluiPrfa8akOSgr+MdcAh5Mgypw6RUeVJ2Sh8jekePZOO7Y0IQSfyNWOFAsaxBgeG7aEu6loFwxcSzrilg9c/2bV7Ybxr5saDViTjHO+UOYPPVRsJKeYvWd+vTdM+J7Eg3LGwzdLqyYu824affGm41KsSJdtxbNC1EzR+AOEU7SO8FkDIUZl2ekwz+3FfBX5TyXywlZGrbS7DkABB1jrO/JJtgnRu4D1AgUWjSJINXKyi9Xf91ZUyYCbVJ1asmRhOcCDcRigs82CF6nWbsSad80Z/ZoGVGYSlCsSXd4t8iEujCzeTkfBRK6Azr71f0zbBjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAeR7zOfSz3Sd19UkcmdMJLgDBiPUNdk6zh2inhCqms/qnt7BqDBAYEzHuzbsM3U3PO+UIeJdym51cu3YKw3MkVuyw=]
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
profiles::vault::server::members_role: roles::infra::storage::vault
|
||||
profiles::vault::server::members_lookup: true
|
||||
profiles::vault::server::data_dir: /data/vault
|
||||
profiles::vault::server::manage_storage_dir: true
|
||||
profiles::vault::server::tls_disable: false
|
||||
vault::download_url: http://repos.main.unkin.net/unkin/8/x86_64/os/Archives/vault_1.15.5_linux_amd64.zip
|
||||
|
||||
# additional altnames
|
||||
profiles::pki::vault::alt_names:
|
||||
- vault.main.unkin.net
|
||||
- vault.service.consul
|
||||
- vault.service.consul
|
||||
- vault
|
||||
|
||||
# manage a simple nginx reverse proxy
|
||||
profiles::nginx::simpleproxy::nginx_vhost: 'vault.service.consul'
|
||||
profiles::nginx::simpleproxy::nginx_aliases:
|
||||
- vault.main.unkin.net
|
||||
- vault
|
||||
profiles::nginx::simpleproxy::proxy_scheme: 'http'
|
||||
profiles::nginx::simpleproxy::proxy_host: '127.0.0.1'
|
||||
profiles::nginx::simpleproxy::proxy_port: 8200
|
||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||
Reference in New Issue
Block a user