unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Adapt base classes for the mail edge gateway
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details

Browse Source
This commit is contained in:
Unkin Agent
2026-10-12 22:38:45 +11:00
parent 05c1176cdc
commit 8c722c36db
2 changed files with 87 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hieradata/roles/infra/mail/gateway.yaml
+13
View File
@@ -1,7 +1,20 @@
---
lookup_options:
ssh::server::options:
merge:
strategy: deep
hiera_include:
- redis
# no consul datacentre at the edge, so nothing to register or scrape via consul
profiles::consul::client::enable: false
exporters::node_exporter::enable: false
# ssh only from the vpc and the lab over the vpn route
ssh::server::options:
AllowUsers: '*@10.0.0.0/8 *@172.16.0.0/12 *@192.168.0.0/16 *@198.18.0.0/16'
# local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route
dnsmasq::no_resolv: true
dnsmasq::cache_size: 10000
site/profiles/manifests/consul/client.pp
+74 -71
View File
@@ -12,91 +12,94 @@ class profiles::consul::client (
Array[Hash] $node_rules = [],
Hash $ports = {},
Stdlib::IP::Address $host_addr = $facts['networking']['ip'],
Boolean $enable = true,
) {
if $facts['enc_role'] != $members_role {
if $enable {
if $facts['enc_role'] != $members_role {
# set a datacentre/cluster name
$consul_cluster = "${::facts['country']}-${::facts['region']}"
# set a datacentre/cluster name
$consul_cluster = "${::facts['country']}-${::facts['region']}"
# if lookup is enabled, find all the hosts in the specified role and create the servers_array
if $members_lookup {
# if lookup is enabled, find all the hosts in the specified role and create the servers_array
if $members_lookup {
# check that the role is also set
unless !($members_role == undef) {
fail("members_role must be provided for ${title} when members_lookup is True")
# check that the role is also set
unless !($members_role == undef) {
fail("members_role must be provided for ${title} when members_lookup is True")
}
# if it is, find hosts, sort them so they dont cause changes every run
$servers_array = sort(puppetdb_query(
"facts[certname] {
name = 'enc_role' and value = '${members_role}' and
certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
}"
).map |$fact| { $fact['certname'] })
# else use provided array from params
}else{
$servers_array = $consul_servers
}
# if it is, find hosts, sort them so they dont cause changes every run
$servers_array = sort(puppetdb_query(
"facts[certname] {
name = 'enc_role' and value = '${members_role}' and
certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
}"
).map |$fact| { $fact['certname'] })
# else use provided array from params
}else{
$servers_array = $consul_servers
}
# deploy the consul agent
class { 'consul':
config_hash => {
'data_dir' => $data_dir,
'datacenter' => $consul_cluster,
'log_level' => 'INFO',
'node_name' => $facts['networking']['fqdn'],
'retry_join' => $servers_array,
'bind_addr' => $host_addr,
'advertise_addr' => $host_addr,
'enable_script_checks' => true,
'ports' => $ports,
'acl' => {
tokens => {
default => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")
# deploy the consul agent
class { 'consul':
config_hash => {
'data_dir' => $data_dir,
'datacenter' => $consul_cluster,
'log_level' => 'INFO',
'node_name' => $facts['networking']['fqdn'],
'retry_join' => $servers_array,
'bind_addr' => $host_addr,
'advertise_addr' => $host_addr,
'enable_script_checks' => true,
'ports' => $ports,
'acl' => {
tokens => {
default => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")
}
}
}
},
},
}
}
}
# Create ACL policy that allows nodes to update themselves and read others
consul_policy { $facts['networking']['hostname']:
description => "${facts['networking']['fqdn']} puppet-generated-policy",
rules => $node_rules,
acl_api_token => $consul_api_token,
hostname => $consul_hostname,
protocol => $consul_protocol,
port => $consul_port,
}
# Create ACL policy that allows nodes to update themselves and read others
consul_policy { $facts['networking']['hostname']:
description => "${facts['networking']['fqdn']} puppet-generated-policy",
rules => $node_rules,
acl_api_token => $consul_api_token,
hostname => $consul_hostname,
protocol => $consul_protocol,
port => $consul_port,
}
consul_token { $facts['networking']['hostname']:
accessor_id => fqdn_uuid($facts['networking']['fqdn']),
description => "${facts['networking']['fqdn']} puppet-generated-token",
policies_by_name => [$facts['networking']['hostname']],
acl_api_token => $consul_api_token,
secret_id => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}"),
hostname => $consul_hostname,
protocol => $consul_protocol,
port => $consul_port,
consul_token { $facts['networking']['hostname']:
accessor_id => fqdn_uuid($facts['networking']['fqdn']),
description => "${facts['networking']['fqdn']} puppet-generated-token",
policies_by_name => [$facts['networking']['hostname']],
acl_api_token => $consul_api_token,
secret_id => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}"),
hostname => $consul_hostname,
protocol => $consul_protocol,
port => $consul_port,
}
}
# ensure the consul token is saved for the root user
file {'/root/.config/consul_node_token':
ensure => file,
owner => 'root',
group => 'root',
mode => '0600',
content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")),
require => File['/root/.config'],
}
# ensure the consul token is saved for the root user
file {'/root/.config/consul_node_token':
ensure => file,
owner => 'root',
group => 'root',
mode => '0600',
content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")),
require => File['/root/.config'],
}
# cleanup /usr/local/bin/consul which was created by url install method
if $facts['os']['family'] == 'RedHat' {
file {'/usr/local/bin/consul':
ensure => absent,
# cleanup /usr/local/bin/consul which was created by url install method
if $facts['os']['family'] == 'RedHat' {
file {'/usr/local/bin/consul':
ensure => absent,
}
}
}
}