26b908e5e7
feat: add node_pools ( #317 )
...
- change agentv2 to common node_pool
- set default node_pool to default
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/317
2025-06-15 17:43:19 +10:00
1cbc1be808
feat: add host_volumes to nomad ( #315 )
...
- add puppet client certs
- add tls-ca-bundle
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/315
2025-06-14 19:37:50 +10:00
60834ced00
feat: nomad cni additions ( #314 )
...
- add consul-cni package
- enable grpc for consul servers
- enable consul connect for consul servers
- set recursors for consul
- add ports to consul agent (grpc, dns, http for nomad)
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/314
2025-06-14 18:47:24 +10:00
a26daca28c
feat: stop manage nginx repo ( #312 )
...
- use epel repo for nginx
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/312
2025-06-09 14:18:30 +10:00
057c4ab747
feat: manage nginx resource ordering ( #311 )
...
- ensure the package is installed before creating directories
- ensure nginx is restarted when vhost config changes
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/311
2025-06-09 11:18:39 +10:00
bb2f59621a
feat: split reposync into two roles ( #307 )
...
- reposync and packagerepo web service
- change backing datastore to be cephfs /shared/app/packagerepo
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/307
2025-06-01 11:33:44 +10:00
1a904af2ee
feat: change g10k to use a package ( #304 )
...
- the archive path is no longer valid
- produced a g10k rpm with rpmbuilder
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/304
2025-05-31 13:51:51 +10:00
bdd833fa4e
feat: create basic k8s roles to start deployment ( #302 )
...
- just create roles so can deploy hosts
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/302
2025-05-30 23:21:02 +10:00
3d5d40f381
chore: minor jellyfin updates ( #300 )
...
- add jellyfin to video group, for access to gpu
- install intel related gpu drivers
- export lxc jellyfin to haproxy
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/300
2025-05-27 19:55:55 +10:00
b3347f9226
chore: migrate media applications ( #299 )
...
- migrate media applications to new cephfs pool + incus
- enable exporting haproxy
- move ceph-client-setup to only apply to non-lxc hosts
- ensure unrar is installed for nzbget
- updated jellyfin use of data_dir
- set lxc instances for jellyfin to use /shared/apps/jellyfin
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/299
2025-05-25 20:27:17 +10:00
1d23fef82e
feat: update settings for ceph ( #298 )
...
- enable root logins via ssh with keys
- add ssh key for ceph to root user
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/298
2025-05-25 20:22:00 +10:00
c0aab1087e
fix: readd to jellyfin_haproxy ( #297 )
...
- fix operator for jellyfin/haproxy
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/297
2025-05-24 21:10:56 +10:00
596e498a00
feat: change media arr apps to hiera_include ( #296 )
...
- change profiles::media::* to be hiera_included
- this is required to enable it to be hiera_excluded on virtual == lxc
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/296
2025-05-24 20:23:56 +10:00
93cd02deec
chore: update media roles for incus ( #294 )
...
- prevent incus roles from exporting haproxy endpoints (for now)
- incus doesnt need to mount cephfs
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/294
2025-05-24 18:59:46 +10:00
520e8a34e0
feat: add a nomad agent v2 role ( #293 )
...
- excludes ceph (will be passed from incus)
- excludes frrouting (will use host-networking)
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/293
2025-05-24 15:35:20 +10:00
77d07672f8
chore: dont mount cephfs inside lxc ( #292 )
...
- lxc instances will have cephfs passed from the host
- skip cephfs mounting for lxc instances
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/292
2025-05-22 21:06:15 +10:00
d9e8637ad6
feat: manage more ceph requirements ( #288 )
...
- add ceph-common to provide utilities for managing ceph
- add root and sysadmin ssh keys for ceph deployments
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/288
2025-05-17 11:14:45 +10:00
2f088c461f
feat: add ceph roles ( #284 )
...
- add hieradata to manage ceph repo
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/284
2025-05-15 19:29:53 +10:00
a7b793238a
fix: exclude docker0 interfaces ( #282 )
...
- docker0 is the same on many hosts
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/282
2025-05-11 16:53:34 +10:00
87a6c73578
neoloc/loopback_dns ( #281 )
...
- manage all interfaces in dns (except lo and anycast)
- move loopback0 anycast addresses to be anycast0
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/281
2025-05-11 16:36:04 +10:00
3e0141bb1b
feat: change to anycast resolver ( #280 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/280
2025-05-11 11:39:00 +10:00
ed947dee59
fix: listen-addr -> listen-address ( #275 )
...
- listen-address is the correct option
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/275
2025-05-04 00:07:45 +10:00
a70b6492b0
feat: update consul/dnsmasq ( #274 )
...
- update params with bind/advertise addr
- update params with anycast ip option
- migrate dnsmasq config to template
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/274
2025-05-03 23:51:29 +10:00
1b8f50786f
feat: ensure the vault audit_log exists ( #272 )
...
- without this, vault will not take a leadership role
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/272
2025-05-03 22:25:10 +10:00
b05acb23f4
feat: use custom cert for puppetdb access ( #271 )
...
- manually generated certificate using sudo puppetserver ca generate --certname puppetdbapi.query.consul
- saved certificate and private_key in eyaml
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/271
2025-05-03 12:41:23 +10:00
62f71e1feb
chore: change puppetboard python version ( #270 )
...
- change python version to follow python3_release fact
- this will follow os-release upgrades
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/270
2025-05-03 01:07:52 +10:00
07b89ab737
feat: enable terraform access to puppetca ( #267 )
...
- enable terraform to clean certificates
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/267
2025-04-28 18:46:58 +10:00
1e3ce0ec1c
feat: dont set gid/uid for sysadmin ( #265 )
...
- sysadmin doesnt need to be a specific uid/gid, the next available
uid/gid is fine
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/265
2025-04-26 20:02:57 +10:00
496ed12a58
feat: change vault to use package install ( #264 )
...
- vault 18.2 rpm produced by rpmbuilder repo
- ensure the /etc/vault directory is managed
- ensure service file is managed by puppet
- ensure package comes from unkin repo (not hashicorp)
- disable_mlock as unprivileged containers cannot use mlock
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/264
2025-04-26 18:40:31 +10:00
e4166c6b14
feat: lxc compatability with datavol ( #263 )
...
- lxc doesnt mount block devices, just check for mountpoint
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/263
2025-04-26 17:28:57 +10:00
ecce93bedb
feat: lxc cannot use chronyd ( #259 )
...
- ensure lxc nodes do not attempt to install chronyd
- ensure chrony is removed
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/259
2025-04-24 23:18:45 +10:00
9dcaafb8ba
feat: lxc updates ( #258 )
...
- add virtual/lxc.yaml
- add crypto crypto-policies-scripts
- ensure ssh::server is managed
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/258
2025-04-24 23:03:01 +10:00
bc5bd11f5e
feat: disable cobbler cache ( #256 )
...
- this is required to resolve issues with terraform deploying cobbler
settings
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/256
2025-04-24 21:18:59 +10:00
2321186ad5
neoloc/mpls_ldp_frr ( #255 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/255
2025-04-24 16:51:31 +10:00
c24babe309
feat: add incus image host ( #254 )
...
- add role
- add consul service + checks
- manage the datavol as zfs
- insure the incus fact exists before attempting to read it
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/254
2025-04-24 01:00:39 +10:00
c225564bdb
feat: continue incus implementation ( #245 )
...
- migrate to systemd-networkd
- setup dummy, bridge and static/ethernet interfaces
- manage sshd.service droping to start ssh after networking is online
- enable ip forewarding
- add fastpool/data/incus dataset
- enable ospf and frr
- add loopback0 as ssh listenaddress
- add loopback1/2 for ceph cluster/public traffic
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/245
2025-04-06 16:38:04 +10:00
d87983d8fc
chore: add sysadmin user after first run ( #242 )
...
- enables extra_groups to function correctly
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/242
2025-04-02 20:27:11 +11:00
978013f325
chore: set default nameservers ( #240 )
...
- if no nameservers are returned from puppetdb query, use default
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/240
2025-03-31 22:49:47 +11:00
829b1b05fd
feat: cleanup consul from url install ( #239 )
...
- set bind_dir to be /usr/bin for rhel, /usr/local/bin for debian
- remove url-installed consul from rhel
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/239
2025-03-30 18:40:09 +11:00
e025928d77
chore: set secretid for puppetboard ( #232 )
...
- manage the secret_key for puppetboard
- required since module upgrade
https://github.com/voxpupuli/puppetboard/issues/721
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/232
2025-03-30 01:53:25 +11:00
e3e8b3484d
chore: enable extra groups ( #231 )
...
- enable adding extra groups to the sysadmin user
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/231
2025-03-30 01:20:59 +11:00
6a04701891
feat: add incus role ( #229 )
...
- add basic infra::incus role
- add autossl, consul and ssh-principals for incus
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/229
2025-03-30 00:56:04 +11:00
dd5a4646ff
feat: update all modules ( #228 )
...
- update puppetlabs-* modules
- update puppet-* modules
- add limits and sysctl
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/228
2025-03-30 00:51:49 +11:00
3a4e606459
chore: set yum/dnf metadata expiry ( #226 )
...
- set expiry to 1 day so that dnf frequently checks for updates from packagerepo
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/226
2025-03-29 22:37:37 +11:00
e0c3a23424
fix: define missing .cache directory ( #221 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/221
2025-03-13 21:48:47 +11:00
8eb751e22f
feat: change enc_* fact to read direct from cobbler ( #219 )
...
- change enc_role and enc_env to read direct from cobbler
- cleanup profiles::base::facts
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/219
2025-03-12 23:09:15 +11:00
afd3405c98
feat: add etcd module/role ( #215 )
...
- add etcd module
- add etcd role, profile and hieradata
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/215
2025-01-26 20:00:20 +11:00
a5a193d9eb
feat: update jupyterlab container ( #209 )
...
- change to packer created alma9 instance
- change docker root to use /data volume
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/209
2025-01-04 14:10:44 +11:00
4400456519
feat: add frrouting module ( #208 )
...
- add frrouting module
- enable ospf daemon on nomad agents
- enable docker volumes
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/208
2024-12-27 23:39:03 +11:00
022a564dc0
feat: add nomad agent role ( #206 )
...
- add nomad agent role
- mount cephfs volume nomadfs to /shared/nomad
- manage docker volume path to be /shared/nomad
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/206
2024-12-26 20:20:51 +11:00
6ebf5c03a5
feat: add nomad profile/role ( #200 )
...
- add basic consul manage nomad servers
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/200
2024-12-22 22:35:31 +11:00
46b4fdf632
neoloc/sysadmin_early ( #197 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/197
2024-12-09 22:12:01 +11:00
aaf81d0a6c
feat: create sysadmin on firstrun ( #196 )
...
- prevent packages from using uid 1000
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/196
2024-12-09 21:51:37 +11:00
afbc15ff40
feat: import crypto-policices earlier ( #195 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/195
2024-12-08 22:50:25 +11:00
64248a45c2
feat: ensure crypto-policices are managed before yumrepos ( #194 )
...
- ensure crypto_policies are set before creating yum yumrepos
- ensure that they rpmdb is rebuilt after upgrading to el9
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/194
2024-12-08 20:30:08 +11:00
ec926dfe0a
feat: enable network manager on el9 ( #189 )
...
- el9 doesnt have the network-scripts scripts
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/189
2024-12-08 19:11:54 +11:00
40af30d0ff
chore: change packagerepo vhost name ( #188 )
...
- ensure http endpoint works for packagerepo.service.consul
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/188
2024-12-08 17:05:38 +11:00
bac90b5459
Merge pull request 'fix: permissions for cobbler files' ( #187 ) from neoloc/cobbler_perms into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/187
2024-12-08 08:37:36 +11:00
41aab65f85
fix: permissions for cobbler files
...
- ensure idempotency for /var/lib/cobbler/web.ss
2024-12-08 08:36:35 +11:00
766f124b2c
feat: edgecache updates
...
- update metadatacache size
- increase cache age from 60d to 365d
- subscribe nginx service to ssl certs
2024-12-07 23:50:45 +11:00
58d31c5c9a
chore: migrate puppet-r10k
...
- moved puppet-r10k the unkin organisation
- ensure branch is set to follow origin/master
2024-11-17 19:26:27 +11:00
845b91b497
fix: ensure reposync directories exist
2024-11-16 22:32:15 +11:00
6493f392b8
Merge pull request 'neoloc/jupyterhub' ( #174 ) from neoloc/jupyterhub into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/174
2024-11-16 20:20:16 +11:00
92a9655a50
feat: jupyterhub updates
...
- always pull containers when starting new instance
- enable access to terminal
2024-11-16 19:54:19 +11:00
42ad972697
feat: add ldap configuration
...
- add group members to jupyterhub_user
- add svc_jupyterhub user for ldap binding
- paramatarise all ldap fields required
- manage the notebook data directory
2024-11-16 19:20:20 +11:00
61f5f1ce1f
feat: add docker settings
...
- list docker network and image
- fix ldap_admin setting to be a list of users
2024-11-10 20:26:18 +11:00
c6bdae5790
Merge pull request 'feat: add jupyterhub role' ( #173 ) from neoloc/jupyterhub into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/173
2024-11-10 19:14:49 +11:00
159d66af18
feat: add jupyterhub role
...
- add nodejs module to use npm package provider
- add jupyterhub role
- add class to configure the jupyterhub instance
- add ldap groups
- add nginx simpleproxy
2024-11-10 19:09:50 +11:00
76b4c8c930
Merge pull request 'feat: add jumphost role' ( #171 ) from neoloc/jumphost into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/171
2024-10-27 13:18:50 +11:00
0455965525
feat: add jumphost role
...
- add role for ssh proxy/jumphost
2024-10-27 13:15:28 +11:00
ca87702466
feat: ensure vault restarts with ssl cert
...
- ensure the vault service resource subscribes to the ssl crt/key
- update unseal script to retry unseal process until it completes
2024-10-27 12:59:36 +11:00
4bf4b42fdf
feat: restart nginx on ssl change
...
- manage nginx service from simpleproxy class
- ensure nginx restarts when ssl certificates are changed
2024-09-27 21:46:46 +10:00
0210d849c7
feat: add gitea runner role
...
- ensure docker is configured
- create runner user/group
- deploy config.yaml from hiera hash
- install runner from url
- register the runner with the gitea instance
- manage the act_runner service
2024-09-07 17:59:02 +10:00
42d8047043
fix: comments in gitea role
...
- was copy of puppetboard, missed updating the comment
2024-09-03 22:34:48 +10:00
afda425fab
feat: psql changes on master only
...
- add fact to detect if a psql host is a slave
- only import users/db/grants on master
2024-09-03 22:13:50 +10:00
2912cbb68b
feat: add droneci runner
...
- add runner role
2024-08-25 00:00:48 +10:00
5d36a4053b
feat: add droneci module
...
- add droneci module for server
- add droneci/server role
- add consul query for droneci service
- manage certificates, ssh principals, consul services/checks
2024-08-24 00:34:15 +10:00
8fad79f2bc
feat: manage database/user/grants for patroni
...
- add defines for exporting/collecting psql objects for patroni
- add generic profile for managing patroni psql databases for an app
2024-08-24 00:33:18 +10:00
1a2023f4ff
Merge pull request 'feat: add patroni/psql cluster' ( #140 ) from neoloc/patroni into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/140
2024-08-10 23:40:29 +10:00
35834f8f5a
feat: add patroni/psql cluster
...
- add patroni puppet module
- add patroni role and hieradata
- add sql/patroni class that utilised consul
2024-08-10 22:34:43 +10:00
dafac3d5ab
fix: require vault-unseal.service
...
- wrong service name specified
2024-08-07 22:05:50 +10:00
3ce2ec3754
Merge pull request 'feat: auto-unseal vault every hour' ( #132 ) from neoloc/vault_unseal_check into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/132
2024-08-06 22:51:54 +10:00
7863d54275
feat: auto-unseal vault every hour
...
- add cron job to run vault unsealing service hourly
2024-08-06 22:51:16 +10:00
988e7c2a32
Merge pull request 'feat: auto restart puppetdb' ( #131 ) from neoloc/puppetdb_restart into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/131
2024-08-06 22:47:02 +10:00
0c44654a47
feat: auto restart puppetdb
...
- found several times the puppetdb service locks up after a week of active time
- restart the puppetdb nightly to prevent lock ups
2024-08-06 22:43:07 +10:00
20ee6fa19e
Merge pull request 'feat: add rundeck runner user' ( #130 ) from neoloc/rundeck_user into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/130
2024-08-06 22:36:54 +10:00
c846cc4e21
feat: add rundeck runner user
...
- add rundeck account on all hosts except rundeck
- add rundeck ssh private/public key to rundeck server
2024-08-06 22:33:32 +10:00
2ae8dbc0ac
feat: add gonic role
...
- basic role only
2024-08-01 22:38:32 +10:00
eb32a216f5
Merge pull request 'neoloc/rundeck' ( #121 ) from neoloc/rundeck into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/121
2024-07-28 02:05:20 +10:00
5354c99b1e
feat: add rundeck profile
...
- export mysql user for each rundeck server
- ensure the jdbc driver for mariadb is available
- exclude jq from default packages (managed by rundeck)
- add groups for admin/user for each project in rundeck
- add consul service
- add vault certificates
- add ssh principals
- add nginx simpleproxy
2024-07-28 01:51:41 +10:00
6a3123e12e
Merge pull request 'feat: change packages to Hash' ( #120 ) from neoloc/packages_hash into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/120
2024-07-27 16:29:48 +10:00
08241692ee
feat: add rundeck
...
- add puppet-rundeck module
- add rundeck role
2024-07-27 13:06:14 +10:00
76989e45c4
feat: change packages to Hash
...
- change from multiple arrays for managing packages to a hash
- change to ensure_packages to prevent duplicate resource conflicts
2024-07-27 13:05:54 +10:00
cc01259a64
feat: change packages to Hash
...
- change from multiple arrays for managing packages to a hash
- change to ensure_packages to prevent duplicate resource conflicts
2024-07-27 13:01:06 +10:00
b5148fc2a0
Merge pull request 'fix: generate_types cahnges' ( #119 ) from neoloc/puppetserver_startup into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/119
2024-07-27 00:17:46 +10:00
ab44bfc430
fix: generate_types cahnges
...
- this command will always fail, remove the systemd dropin
- create script that will run and exit with 0
- create systemd service/timer to run script daily
2024-07-27 00:13:25 +10:00
480eced404
Merge pull request 'feat: add vrrp to halb' ( #116 ) from neoloc/keepalived into develop
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/116
2024-07-14 22:07:34 +10:00
946922fdb9
feat: add vrrp to halb
...
- update keepalived module to 5.1.0
- add keepalived::vrrp::* to be deep merged in hiera
- add vrrp dns configuration
- add vrrp instance/script to halb in syd1
2024-07-13 20:15:13 +10:00
0fb11b22cf
feat: add param for ffmpeg
...
- add param to jellyfin class to specify the path to ffmpeg
- update templates to use location
2024-07-11 22:41:08 +10:00
f63cf2f654
fix: create nginx cache dirs before nginx class
2024-07-09 23:29:56 +10:00
