87a6c73578
neoloc/loopback_dns ( #281 )
...
- manage all interfaces in dns (except lo and anycast)
- move loopback0 anycast addresses to be anycast0
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/281
2025-05-11 16:36:04 +10:00
3e0141bb1b
feat: change to anycast resolver ( #280 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/280
2025-05-11 11:39:00 +10:00
bb6f6cbd49
feat: anycast dnsmasters ( #279 )
...
- change dns masters on incus to anycast for bind
- change to networkd to support anycast/loopbacks
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/279
2025-05-10 23:00:03 +10:00
51d6c1e81d
fix: enable dns resolver access for dmz1 ( #278 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/278
2025-05-10 06:57:05 +10:00
537a207779
feat: update upstream ip for consul dns ( #277 )
...
- set bind resolvers to use consuls anycast address for forwarding
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/277
2025-05-09 22:10:35 +10:00
f322440d01
feat: setup anycast consul dns ( #276 )
...
- manage frrouting repo/ospf
- change to systemd-networkd
- enable ospf on incus nodes bridges
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/276
2025-05-09 22:07:42 +10:00
b05acb23f4
feat: use custom cert for puppetdb access ( #271 )
...
- manually generated certificate using sudo puppetserver ca generate --certname puppetdbapi.query.consul
- saved certificate and private_key in eyaml
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/271
2025-05-03 12:41:23 +10:00
cdf9456456
feat: update psql15 repos for roles ( #269 )
...
- update patroni to use packagerepo
- update puppetdb to use packagerepo
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/269
2025-04-29 21:04:45 +10:00
2323ef7749
feat: postgresql15/postgresql17 ( #268 )
...
- add postgresql15 and 17 to reposync
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/268
2025-04-28 21:39:45 +10:00
9359b8902e
feat: vault mlock ( #266 )
...
- enable mlock by default
- disable mlock on lxd/incus nodes (lxc doesnt support it)
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/266
2025-04-26 22:43:20 +10:00
496ed12a58
feat: change vault to use package install ( #264 )
...
- vault 18.2 rpm produced by rpmbuilder repo
- ensure the /etc/vault directory is managed
- ensure service file is managed by puppet
- ensure package comes from unkin repo (not hashicorp)
- disable_mlock as unprivileged containers cannot use mlock
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/264
2025-04-26 18:40:31 +10:00
78f4d2a88f
feat: cleanup mpls configuration ( #262 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/262
2025-04-26 00:39:23 +10:00
762d980ea8
feat: update dns resolver zone management ( #261 )
...
- move zones to common role path
- specify forwarders for each zone in region based hiera
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/261
2025-04-25 01:01:47 +10:00
463abe4b9d
feat: add reverse dns zones for incus ( #260 )
...
- add reverse dns zones for incus hosts
- update acls for openresolver
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/260
2025-04-24 23:48:34 +10:00
ecce93bedb
feat: lxc cannot use chronyd ( #259 )
...
- ensure lxc nodes do not attempt to install chronyd
- ensure chrony is removed
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/259
2025-04-24 23:18:45 +10:00
9dcaafb8ba
feat: lxc updates ( #258 )
...
- add virtual/lxc.yaml
- add crypto crypto-policies-scripts
- ensure ssh::server is managed
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/258
2025-04-24 23:03:01 +10:00
a21c1b3697
Adding hieradata/node/ausyd1nxvm1072.main.unkin.net.yaml ( #257 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/257
2025-04-24 21:25:00 +10:00
2321186ad5
neoloc/mpls_ldp_frr ( #255 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/255
2025-04-24 16:51:31 +10:00
c24babe309
feat: add incus image host ( #254 )
...
- add role
- add consul service + checks
- manage the datavol as zfs
- insure the incus fact exists before attempting to read it
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/254
2025-04-24 01:00:39 +10:00
bfda2b628b
feat: enable ip forwarding for gitea runners ( #253 )
...
- required to enable docker containers reach git service
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/253
2025-04-21 18:40:17 +10:00
278f8001b0
feat: add frr synced repo ( #252 )
...
- add frr repo to incus hosts
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/252
2025-04-18 21:21:23 +10:00
0fe44cf4e2
feat: add frr repos ( #251 )
...
- add frr/stable/el8
- add frr/stable/el9
- add frr/extras/el8
- add frr/extras/el9
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/251
2025-04-15 02:21:55 +10:00
25b06cde22
feat: move bridge management to incus ( #250 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/250
2025-04-15 00:04:14 +10:00
0e3dd4d7d0
feat: initialise barebones server ( #248 )
...
- manage incus servers init
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/248
2025-04-06 23:56:50 +10:00
b6ea353cfb
feat: update dns resolver acls ( #246 )
...
- add dmz acl
- add common acl
- add loopback/ceph/physical subnets to main acl
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/246
2025-04-06 16:44:16 +10:00
c225564bdb
feat: continue incus implementation ( #245 )
...
- migrate to systemd-networkd
- setup dummy, bridge and static/ethernet interfaces
- manage sshd.service droping to start ssh after networking is online
- enable ip forewarding
- add fastpool/data/incus dataset
- enable ospf and frr
- add loopback0 as ssh listenaddress
- add loopback1/2 for ceph cluster/public traffic
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/245
2025-04-06 16:38:04 +10:00
06666fe488
fix: resolve issue with baseos in el9 ( #244 )
...
- was not correctly provisioning the baseos repo for el9 incus hosts
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/244
2025-04-02 21:02:08 +11:00
9dc88e6db6
feat: deep merge zpools/datasets ( #243 )
...
- change prodnxsr0009 to use nvme0n1 as zfs device
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/243
2025-04-02 20:35:04 +11:00
95bc2716cf
neoloc/incus_deploy ( #241 )
...
feat: deploy incus
- manage sysctl based on incus recommendations
- manage limits based on incus recommendations
- manage zpools and zfs datasets
- add incus hiera settings
feat: manage repo for zfs
- dont use zfs module to manage repo, use profiles:😋 :global::repos
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/241
2025-03-31 23:14:05 +11:00
829b1b05fd
feat: cleanup consul from url install ( #239 )
...
- set bind_dir to be /usr/bin for rhel, /usr/local/bin for debian
- remove url-installed consul from rhel
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/239
2025-03-30 18:40:09 +11:00
427fe352b4
feat: debian package for consul not managed ( #237 )
...
- change debian hosts to use the url method to download consul
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/237
2025-03-30 17:13:54 +11:00
45b061a053
feat: change almalinux9 to use packagerepo ( #236 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/236
2025-03-30 17:05:03 +11:00
d39d25d3f1
feat: add almalinux 9.5 repos using mirrorlist ( #235 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/235
2025-03-30 16:24:55 +11:00
06b458cb0e
feat: reposync for almalinux 9.4 (in vault) ( #234 )
...
- sync baseos, ha, appstream and crb repos
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/234
2025-03-30 12:31:09 +11:00
e3046563a2
chore: install consul from package ( #233 )
...
- upgrade to puppet-consul changed default install method to archive
- ensure package method is used
- dont manage the repo, consul is packaged by rpmbuilder
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/233
2025-03-30 02:04:13 +11:00
e025928d77
chore: set secretid for puppetboard ( #232 )
...
- manage the secret_key for puppetboard
- required since module upgrade
https://github.com/voxpupuli/puppetboard/issues/721
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/232
2025-03-30 01:53:25 +11:00
6a04701891
feat: add incus role ( #229 )
...
- add basic infra::incus role
- add autossl, consul and ssh-principals for incus
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/229
2025-03-30 00:56:04 +11:00
dd5a4646ff
feat: update all modules ( #228 )
...
- update puppetlabs-* modules
- update puppet-* modules
- add limits and sysctl
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/228
2025-03-30 00:51:49 +11:00
4e47745077
chore: setup unkin repo for el9 and el8 ( #227 )
...
- update the unkin repo definition for el8 and el9
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/227
2025-03-29 22:50:08 +11:00
b95bcbd10a
feat: add zfs to reposync ( #224 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/224
2025-03-29 20:08:31 +11:00
adc0cf2c09
neoloc/lxd_hosts ( #223 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/223
2025-03-29 19:40:01 +11:00
771b981d91
feat: enable nomad to manage sessions/services ( #222 )
...
- this is required to start patroni
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/222
2025-03-20 19:21:40 +11:00
a309244713
feat: add nomad nodes ( #220 )
...
- change existing nodes to be nomad-agents
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/220
2025-03-13 21:23:40 +11:00
b981a6fb01
feat: enable nomad jobs to query dns ( #218 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/218
2025-03-09 17:49:35 +11:00
7c1d96bd22
feat: add k8s and docker repos ( #217 )
...
- add docker stable repos to packagerepo
- add k8s 1.32 to packagerepo
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/217
2025-01-27 12:59:59 +11:00
0222f5ec4a
feat: update consul etcd check ( #216 )
...
- check the health api endpoint
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/216
2025-01-26 20:05:18 +11:00
afd3405c98
feat: add etcd module/role ( #215 )
...
- add etcd module
- add etcd role, profile and hieradata
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/215
2025-01-26 20:00:20 +11:00
ab7ce3bbfa
Adding hieradata/node/ausyd1nxvm1071.main.unkin.net.yaml ( #214 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/214
2025-01-25 20:15:20 +11:00
4a85c5feff
Adding hieradata/node/ausyd1nxvm1070.main.unkin.net.yaml ( #213 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/213
2025-01-25 20:15:05 +11:00
6134b4664b
Adding hieradata/node/ausyd1nxvm1069.main.unkin.net.yaml ( #212 )
...
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/212
2025-01-05 12:51:57 +11:00
