feat: adding rke2

- manage rke2 repos
- add rke2 module (init, params, install, config, service)
- split roles::infra::k8s::node -> control/compute roles
- moved common k8s config into k8s.yaml
- add bootstrap_node, manage server and token fields in rke2 config
- manage install of helm
- manage node attributes (from puppet facts)
- manage frr exclusions for service/cluster network

.gitignore

@@ -1 +0,0 @@
-sources/

Puppetfile

@@ -19,7 +19,6 @@ mod 'puppetlabs-haproxy', '8.2.0'
 mod 'puppetlabs-java', '11.1.0'
 mod 'puppetlabs-reboot', '5.1.0'
 mod 'puppetlabs-docker', '10.2.0'
-mod 'puppetlabs-mailalias_core', '1.2.0'
 
 # puppet
 mod 'puppet-python', '7.4.0'
@@ -44,8 +43,6 @@ mod 'puppet-letsencrypt', '11.1.0'
 mod 'puppet-rundeck', '9.2.0'
 mod 'puppet-redis', '11.1.0'
 mod 'puppet-nodejs', '11.0.0'
-mod 'puppet-postfix', '5.1.0'
-mod 'puppet-alternatives', '6.0.0'
 
 # other
 mod 'saz-sudo', '9.0.2'
@@ -63,7 +60,6 @@ mod 'rehan-mkdir', '2.0.0'
 mod 'tailoredautomation-patroni', '2.0.0'
 mod 'ssm-crypto_policies', '0.3.3'
 mod 'thias-sysctl', '1.0.8'
-mod 'cirrax-dovecot', '1.3.3'
 
 mod 'bind',
   :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',

doc/puppet/README.md

@@ -29,21 +29,3 @@ these steps are required when adding additional puppet masters, as the subject a
 
     sudo systemctl start puppetserver
     sudo cp /root/current_crl.pem /etc/puppetlabs/puppet/ssl/crl.pem
-
-
-## troubleshooting
-
-### Issue 1:
-
-    [sysadmin@ausyd1nxvm2056 ~]$ sudo puppet agent -t
-    Error: The CRL issued by 'CN=Puppet CA: prodinf01n01.main.unkin.net' is missing
-
-Find another puppetserver that IS working, copy the `/etc/puppetlabs/puppet/ssl/crl.pem` to this host, run puppet again.
-
-
-### Issue 2:
-
-    [sysadmin@ausyd1nxvm2097 ~]$ sudo puppet agent -t
-    Error: Failed to parse CA certificates as PEM
-
-The puppet-agents CA cert `/etc/puppetlabs/puppet/ssl/certs/ca.pem` is empty or missing. Grab it from any other host. Run puppet again.

hieradata/common.yaml

@@ -158,15 +158,6 @@ lookup_options:
   rke2::config_hash:
     merge:
       strategy: deep
-  postfix::configs:
-    merge:
-      strategy: deep
-  postfix::maps:
-    merge:
-      strategy: deep
-  postfix::virtuals:
-    merge:
-      strategy: deep
 
 facts_path: '/opt/puppetlabs/facter/facts.d'
 
@@ -185,6 +176,9 @@ profiles::ntp::client::peers:
   - 2.au.pool.ntp.org
   - 3.au.pool.ntp.org
 
+profiles::base::puppet_servers:
+  - 'prodinf01n01.main.unkin.net'
+
 consul::install_method: 'package'
 consul::manage_repo: false
 consul::bin_dir: /usr/bin

hieradata/os/AlmaLinux/all_releases.yaml

@@ -3,8 +3,7 @@
 profiles::firewall::firewalld::ensure_package: 'absent'
 profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
-profiles::puppet::agent::version: '7.37.2'
+profiles::puppet::agent::puppet_version: '7.34.0'
-profiles::puppet::agent::openvox_enable: true
 
 hiera_include:
   - profiles::almalinux::base
@@ -54,6 +53,13 @@ profiles::yum::global::repos:
     baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
     gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
     mirrorlist: absent
+  puppet:
+    name: puppet
+    descr: puppet repository
+    target: /etc/yum.repos.d/puppet.repo
+    baseurl: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-puppet-20250406
+    mirrorlist: absent
   unkinben:
     name: unkinben
     descr: unkinben repository

hieradata/os/Debian/Debian11.yaml

@@ -11,4 +11,4 @@ profiles::apt::components:
   - main
   - non-free
 
-profiles::puppet::agent::version: '7.25.0-1bullseye'
+profiles::puppet::agent::puppet_version: '7.25.0-1bullseye'

hieradata/os/Debian/Debian12.yaml

@@ -12,4 +12,4 @@ profiles::apt::components:
   - non-free
   - non-free-firmware
 
-profiles::puppet::agent::version: 'latest'
+profiles::puppet::agent::puppet_version: 'latest'

hieradata/roles/infra/git/runner.yaml

@@ -2,7 +2,6 @@
 hiera_include:
   - docker
   - profiles::gitea::runner
-  - incus::client
 
 docker::version: latest
 docker::curl_ensure: false
@@ -40,8 +39,7 @@ profiles::gitea::runner::config:
     privileged: false
     options:
     workdir_parent: /workspace
-    valid_volumes:
+    valid_volumes: []
-      - /etc/pki/tls/vault
     docker_host: ""
     force_pull: true
     force_rebuild: false

hieradata/roles/infra/k8s.eyaml

@@ -1 +1 @@
-rke2::node_token: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAOD+w5nJFqEYWFj+tZQ65Oi19eDhaWtpLQ0gwEdBtMmY9sPJ63l1q2qH933NH6TOd1UlMDvGfoDLCae+yt/MAW//cJ15X3QbiVQ23DdfCOlUEZN6fjVrveEt/yIeFQmWvnkMS4pRfPbgQu2OHm37PpuPE7s6dUyGItAYjchrRhtQ7ibhXDnN7miG+oVRXP2T8b/V5WPdmA222DSV6r/AnqaWkna9W/oh/I2sNKeEm5q3f8bh8Gxt1dDy3VwaZ3lAh3uR+SUm7P/6PTYw8opxiumFBvos0mRiXIdOwUuqrAS8hafWBhxnDLlTBfz62Nc4wQmQ8gz0bHJZSipH9G6mIEDCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ2WG6ROWFlQdXx0TuO5oABoBwTDtAXIj7y6I1B3zCnFoMHETf5d7ulPGdgwZsENf0UIHpg2l0w503MUHHbu6YDFiDiTE0oDNJPVHid7TO+XwWFgh5v1MWi/XeEBgCs6nMCW8qkX0Z3UXaZdSBUll1M4sRtuqscBnoD/LLs2kKfxrqQg==]
+rke2::node_token: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEACQ4IIE9qT7x+KBTtvksUwvko6U/wnRn4PZEHUc91u9StIcjd0N6uH3hrJ4ddJmwikXf9Sz/5t+kSPvcVewFcjzvMHzJXqaE57KX0hqjFpqSGMlqWy4hdrZTHm/W65PkB73j21HLn9gH7m4rmqLomSbIe21P7sFM5+1pbnQejx9Us43Mu7PNy+8rQCcdEeBnRmzLaVWR8c35aXMHANqefLaLPCWjTbDY4jhcHPkNse5thpyUW89Bnq6caTJjNNQRI9U2FX2qHqwFh/rcjtGwDk9JUJvpF1qb9mdY68txMfaQ2KQh0gH67nxVf0cDppUxJaQ86Uu71BQX54l/om9AFrDCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQFfKTlWnJq2zqP6jsLAzw94BwDu32IVvfvYvsuNcOJHc4ipI0PV/6AcatIDaXjK+K8BMLdWxpOVsVf4vL1zPatB5UTwc8rm1UvxWN8SbtqF8accmAA0GbIexQezsJYaAI3NT9gItGj/aJjTitl+ed7QfNCd36HVH9FEmfDaGwN7f/yw==]

hieradata/roles/infra/k8s.yaml

@@ -23,6 +23,7 @@ rke2::config_hash:
     - "country=%{facts.country}"
     - "asset=%{facts.dmi.product.serial_number}"
     - "zone=%{zone}"
+    - "environment=%{environment}"
 
 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
 python::manage_dev_package: false
@@ -78,15 +79,15 @@ profiles::yum::global::repos:
     name: rancher-rke2-common-latest
     descr: rancher-rke2-common-latest
     target: /etc/yum.repos.d/rke2-common.repo
-    baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/
+    baseurl: https://rpm.rancher.io/rke2/latest/common/centos/%{facts.os.release.major}/noarch
-    gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/public.key
+    gpgkey: https://rpm.rancher.io/public.key
     mirrorlist: absent
   rancher-rke2-1-33-latest:
     name: rancher-rke2-1-33-latest
     descr: rancher-rke2-1-33-latest
     target: /etc/yum.repos.d/rke2-1-33.repo
-    baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/
+    baseurl: https://rpm.rancher.io/rke2/latest/1.33/centos/%{facts.os.release.major}/x86_64
-    gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/public.key
+    gpgkey: https://rpm.rancher.io/public.key
     mirrorlist: absent
 
 # dns

hieradata/roles/infra/k8s/control.eyaml

@@ -1 +0,0 @@
----

hieradata/roles/infra/k8s/control.yaml

@@ -3,17 +3,13 @@
 rke2::node_type: server
 rke2::helm_install: true
 rke2::helm_repos:
+  metallb: https://metallb.github.io/metallb
   rancher-stable: https://releases.rancher.com/server-charts/stable
-  purelb: https://gitlab.com/api/v4/projects/20400619/packages/helm/stable
-  jetstack: https://charts.jetstack.io
-  harbor: https://helm.goharbor.io
-  traefik: https://traefik.github.io/charts
-  hashicorp: https://helm.releases.hashicorp.com
 rke2::extra_config_files:
   - rke2-canal-config
-  - rke2-nginx-ingress-config
 rke2::config_hash:
   advertise-address: "%{hiera('networking_loopback0_ip')}"
+  cluster-domain: "svc.k8s.unkin.net"
   tls-san:
     - "join-k8s.service.consul"
     - "api-k8s.service.consul"
@@ -32,7 +28,6 @@ rke2::config_hash:
   kube-controller-manager-arg:
     - '--node-monitor-period=4s'
   protect-kernel-defaults: true
-  disable-kube-proxy: false
 
 # configure consul service
 consul::services:

hieradata/roles/infra/mail.yaml

@@ -1,20 +0,0 @@
----
-
-# Common mail server configuration
-
-# base postfix configuration (passed to postfix class)
-postfix::relayhost: 'direct'
-postfix::myorigin: 'main.unkin.net'
-postfix::manage_aliases: true
-
-# Common postfix virtuals for all mail servers
-postfix::virtuals:
-  'root':
-    ensure: present
-    destination: 'ben@main.unkin.net'
-  'postmaster':
-    ensure: present
-    destination: 'ben@main.unkin.net'
-  'abuse':
-    ensure: present
-    destination: 'ben@main.unkin.net'

hieradata/roles/infra/mail/backend.yaml

@@ -1,87 +0,0 @@
----
-# additional altnames
-profiles::pki::vault::alt_names:
-  - mail.main.unkin.net
-
-# manage dovecot
-dovecot::install::packages:
-  - dovecot
-  - dovecot-pgsql
-profiles::dovecot::server::maildir_path: "%{hiera('profiles::postfix::gateway::virtual_mailbox_base')}"
-
-#dovecot::config:
-#  auth.conf:
-#    values:
-#      auth_mechanisms: 'plain login'
-#      auth_username_format: '%Lu'
-#      auth_default_realm: 'main.unkin.net'
-#  auth-vmail.conf:
-#    values:
-#      passdb: |
-#        {
-#          driver = pam
-#        }
-#      userdb: |
-#        {
-#          driver = passwd
-#          override_fields = uid=vmail gid=vmail home=/shared/apps/maildata/%u
-#        }
-#  mail.conf:
-#    values:
-#      mail_plugins: '$mail_plugins'
-#      namespace inbox: |
-#        {
-#          inbox = yes
-#          location =
-#          mailbox Drafts {
-#            special_use = \Drafts
-#          }
-#          mailbox Junk {
-#            special_use = \Junk
-#          }
-#          mailbox Sent {
-#            special_use = \Sent
-#          }
-#          mailbox "Sent Messages" {
-#            special_use = \Sent
-#          }
-#          mailbox Trash {
-#            special_use = \Trash
-#          }
-#        }
-#    sections:
-#      - name: 'namespace inbox'
-#        values:
-#          'inbox': 'yes'
-#          'seperator': '.'
-#          'prefix': 'INBOX'
-
-# backend-specific postfix configuration
-postfix::mydestination: 'localhost'
-postfix::mynetworks: '127.0.0.0/8 [::1]/128 10.10.12.0/24'
-postfix::smtp_listen: ['0.0.0.0', '::']
-postfix::use_dovecot_lda: true        # use built-in dovecot LDA support
-postfix::mail_user: 'vmail:vmail'
-profiles::postfix::gateway::enable_postscreen: false  # disable postscreen (backend doesn't need it)
-profiles::postfix::gateway::myhostname: 'mail.main.unkin.net'
-profiles::postfix::gateway::enable_dovecot: true    # enable dovecot integration
-profiles::postfix::gateway::virtual_mailbox_domains:
-  - 'main.unkin.net'
-profiles::postfix::gateway::virtual_mailbox_base: '/shared/apps/maildata'
-
-profiles::postfix::gateway::virtual_mailbox_maps:
-  'ben@main.unkin.net': 'main.unkin.net/ben/'
-  'root@main.unkin.net': 'main.unkin.net/ben/'
-  'postmaster@main.unkin.net': 'main.unkin.net/ben/'
-  'abuse@main.unkin.net': 'main.unkin.net/ben/'
-
-profiles::postfix::gateway::smtpd_client_restrictions:
-  - 'permit_mynetworks'
-  - 'reject_unauth_destination'
-profiles::postfix::gateway::smtpd_sender_restrictions:
-  - 'permit_mynetworks'
-  - 'reject_non_fqdn_sender'
-profiles::postfix::gateway::smtpd_recipient_restrictions:
-  - 'permit_mynetworks'
-  - 'reject_non_fqdn_recipient'
-  - 'reject_unauth_destination'

hieradata/roles/infra/mail/gateway.yaml

@@ -1,34 +0,0 @@
----
-# additional altnames
-profiles::pki::vault::alt_names:
-  - in-mta.main.unkin.net
-
-# gateway-specific postfix configuration
-postfix::mydestination: 'blank'
-postfix::mynetworks: '127.0.0.0/8 [::1]/128'
-postfix::smtp_listen: '0.0.0.0'
-postfix::mta: true
-profiles::postfix::gateway::myhostname: 'in-mta.main.unkin.net'
-
-profiles::postfix::gateway::relay_recipients_maps:
-  '@main.unkin.net': 'OK'
-
-profiles::postfix::gateway::relay_domains_maps:
-  'main.unkin.net': 'OK'
-
-profiles::postfix::gateway::postscreen_access_maps:
-  '127.0.0.1/32': 'permit'
-  '10.10.12.200/32': 'permit'
-
-profiles::postfix::gateway::helo_access_maps:
-  '.dynamic.': 'REJECT'
-  '.dialup.': 'REJECT'
-  'unknown': 'REJECT'
-  'localhost': 'REJECT You are not localhost'
-
-# postfix transports
-postfix::transports:
-  'main.unkin.net':
-    ensure: present
-    destination: 'relay'
-    nexthop: 'ausyd1nxvm2120.main.unkin.net:25'

hieradata/roles/infra/puppet.yaml

@@ -1,3 +1,3 @@
 ---
 profiles::packages::include:
-  openvox-server: {}
+  puppetserver: {}

hieradata/roles/infra/reposync/syncer.yaml

@@ -283,20 +283,6 @@ profiles::reposync::repos_list:
     release: 'rhel9'
     baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-9-x86_64/'
     gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  rke2_common_el9:
-    repository: 'common'
-    description: 'RKE2 common RHEL 9'
-    osname: 'rke2'
-    release: "rhel9"
-    baseurl: "https://rpm.rancher.io/rke2/latest/common/centos/9/noarch"
-    gpgkey: "https://rpm.rancher.io/public.key"
-  rke2_1_33_el9:
-    repository: '1.33'
-    description: 'RKE2 1.33 RHEL 9'
-    osname: 'rke2'
-    release: "rhel9"
-    baseurl: "https://rpm.rancher.io/rke2/latest/1.33/centos/9/x86_64"
-    gpgkey: "https://rpm.rancher.io/public.key"
   zfs_dkms_rhel8:
     repository: 'dkms'
     description: 'ZFS DKMS RHEL 8'

hieradata/roles/infra/storage/vault.yaml

@@ -4,8 +4,7 @@ profiles::vault::server::members_lookup: true
 profiles::vault::server::data_dir: /data/vault
 profiles::vault::server::manage_storage_dir: true
 profiles::vault::server::tls_disable: false
-vault::package_name: openbao
+vault::download_url: http://repos.main.unkin.net/unkin/8/x86_64/os/Archives/vault_1.15.5_linux_amd64.zip
-vault::package_ensure: 2.4.1
 
 # additional altnames
 profiles::pki::vault::alt_names:

modules/exporters/manifests/frr_exporter.pp

@@ -16,14 +16,6 @@ class exporters::frr_exporter (
       ensure => installed,
     }
 
-    # ensure the frr_exporter user can read the directory
-    file { $socket_dir:
-      ensure => directory,
-      owner  => 'frr',
-      group  => 'frr',
-      mode   => '0751',
-    }
-
     # manage the user/group
     if $manage_user {
       group { $group:

modules/incus/lib/facter/incus_trust_list.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-
-# lib/facter/incus_trust_list.rb
-require 'json'
-
-Facter.add(:incus_trust_list) do
-  confine do
-    # Only run on systems that have incus installed and running
-    incus_path = Facter::Util::Resolution.which('incus')
-    incus_path && File.exist?('/var/lib/incus/server.key')
-  end
-
-  setcode do
-    incus_path = Facter::Util::Resolution.which('incus')
-    next {} unless incus_path
-
-    begin
-      # Run incus config trust list --format=json
-      trust_output = Facter::Core::Execution.execute("#{incus_path} config trust list --format=json")
-      next {} if trust_output.empty?
-
-      # Parse the JSON output
-      JSON.parse(trust_output)
-    rescue StandardError
-      {}
-    end
-  end
-end

modules/incus/manifests/client.pp

@@ -1,16 +0,0 @@
-# incus::client
-#
-# This class configures a host as an incus client and exports its certificate
-# for automatic trust management on incus servers.
-#
-class incus::client {
-
-  # Export this client's certificate for collection by incus servers
-  @@incus::client_cert { $facts['networking']['fqdn']:
-    hostname    => $facts['networking']['fqdn'],
-    certificate => $facts['vault_cert_content'],
-    fingerprint => $facts['vault_cert_fingerprint'],
-    tag         => 'incus_client',
-  }
-
-}

modules/incus/manifests/client_cert.pp

@@ -1,41 +0,0 @@
-# Define the exported resource type for incus client certificates
-define incus::client_cert (
-  String $hostname,
-  Optional[String] $certificate = undef,
-  Optional[String] $fingerprint = undef,
-) {
-
-  # Only proceed if we have both certificate and fingerprint
-  if $certificate and $fingerprint {
-
-    $trust_list = $facts['incus_trust_list']
-    $existing_client = $trust_list.filter |$client| { $client['name'] == $hostname }
-
-    if $existing_client.empty {
-      # Add new certificate
-      exec { "incus_trust_add_${hostname}":
-        path    => ['/bin', '/usr/bin'],
-        command => "echo '${certificate}' > /tmp/${hostname}.crt && \
-                    incus config trust add-certificate /tmp/${hostname}.crt --name ${hostname} && \
-                    rm -f /tmp/${hostname}.crt",
-        unless  => "incus config trust list --format=json | grep '\"name\":\"${hostname}\"'",
-      }
-    } else {
-      # Check if fingerprints are different
-      $existing_fingerprint = $existing_client[0]['fingerprint']
-
-      if $existing_fingerprint != $fingerprint {
-        # Remove existing and add new certificate only if fingerprints differ
-        exec { "incus_trust_update_${hostname}":
-          path    => ['/bin', '/usr/bin'],
-          command => "incus config trust remove ${existing_fingerprint} && \
-                      echo '${certificate}' > /tmp/${hostname}.crt && \
-                      incus config trust add-certificate /tmp/${hostname}.crt --name ${hostname} && \
-                      rm -f /tmp/${hostname}.crt",
-          onlyif  => "incus config trust list --format=json | grep '${existing_fingerprint}'",
-        }
-      }
-      # If fingerprints match, do nothing (certificate is already correct)
-    }
-  }
-}

modules/incus/manifests/init.pp

@@ -21,10 +21,6 @@ class incus (
     enable     => true,
     hasstatus  => true,
     hasrestart => true,
-    subscribe  => [
-      File['/var/lib/incus/server.crt'],
-      File['/var/lib/incus/server.key'],
-    ],
   }
 
   file_line { 'subuid_root':
@@ -59,22 +55,6 @@ class incus (
     }
   }
 
-  file { '/var/lib/incus/server.crt':
-    ensure => file,
-    source => '/etc/pki/tls/vault/certificate.crt',
-    owner  => 'root',
-    group  => 'root',
-    mode   => '0644',
-  }
-
-  file { '/var/lib/incus/server.key':
-    ensure => file,
-    source => '/etc/pki/tls/vault/private.key',
-    owner  => 'root',
-    group  => 'root',
-    mode   => '0600',
-  }
-
   if $facts['incus'] and $facts['incus']['config'] {
     # set core.https_address
     if $facts['incus']['config']['core.https_address'] != "${server_addr}:${server_port}" {
@@ -92,10 +72,5 @@ class incus (
         }
       }
     }
-
-    # Collect exported client certificates and manage trust
-    Incus::Client_cert <<| tag == 'incus_client' |>> {
-      require => Service['incus'],
-    }
   }
 }

modules/libs/lib/facter/vault_cert_content.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-# lib/facter/vault_cert_content.rb
-
-Facter.add(:vault_cert_content) do
-  confine kernel: 'Linux'
-  setcode do
-    cert_path = '/etc/pki/tls/vault/certificate.crt'
-    File.read(cert_path) if File.exist?(cert_path) && File.readable?(cert_path)
-  end
-end

modules/libs/lib/facter/vault_cert_fingerprint.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-# lib/facter/vault_cert_fingerprint.rb
-
-Facter.add(:vault_cert_fingerprint) do
-  confine kernel: 'Linux'
-  setcode do
-    require 'openssl'
-    require 'digest'
-
-    cert_path = '/etc/pki/tls/vault/certificate.crt'
-    if File.exist?(cert_path) && File.readable?(cert_path)
-      begin
-        cert_content = File.read(cert_path)
-        cert = OpenSSL::X509::Certificate.new(cert_content)
-        # Calculate SHA256 fingerprint like incus does
-        Digest::SHA256.hexdigest(cert.to_der)
-      rescue StandardError
-        nil
-      end
-    end
-  end
-end

modules/rke2/files/ingress-route-rancher.yaml

@@ -1,23 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rancher
-  namespace: cattle-system
-  annotations:
-    kubernetes.io/ingress.class: nginx
-spec:
-  tls:
-    - hosts: [rancher.main.unkin.net]
-      secretName: tls-rancher
-  rules:
-    - host: rancher.main.unkin.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: rancher
-                port:
-                  number: 80

modules/rke2/files/purelb-config.yaml

@@ -1,45 +0,0 @@
-apiVersion: purelb.io/v1
-kind: LBNodeAgent
-metadata:
-  name: common
-  namespace: purelb
-spec:
-  local:
-    extlbint: kube-lb0
-    localint: default
-    sendgarp: false
----
-apiVersion: purelb.io/v1
-kind: LBNodeAgent
-metadata:
-  name: dmz
-  namespace: purelb
-spec:
-  local:
-    extlbint: kube-lb0
-    localint: default
-    sendgarp: false
----
-apiVersion: purelb.io/v1
-kind: ServiceGroup
-metadata:
-  name: dmz
-  namespace: purelb
-spec:
-  local:
-    v4pools:
-      - subnet: 198.18.199.0/24
-        pool: 198.18.199.0/24
-        aggregation: /32
----
-apiVersion: purelb.io/v1
-kind: ServiceGroup
-metadata:
-  name: common
-  namespace: purelb
-spec:
-  local:
-    v4pools:
-      - subnet: 198.18.200.0/24
-        pool: 198.18.200.0/24
-        aggregation: /32

modules/rke2/files/rke2-canal-config.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: helm.cattle.io/v1
 kind: HelmChartConfig
 metadata:

modules/rke2/files/rke2-nginx-ingress-config.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: helm.cattle.io/v1
-kind: HelmChartConfig
-metadata:
-  name: rke2-ingress-nginx
-  namespace: kube-system
-spec:
-  valuesContent: |-
-    controller:
-      hostPort:
-        enabled: false
-      service:
-        enabled: true
-        type: LoadBalancer
-        externalTrafficPolicy: Local
-        loadBalancerClass: purelb.io/purelb
-        allocateLoadBalancerNodePorts: false
-        annotations:
-          purelb.io/service-group: common
-          purelb.io/addresses: "198.18.200.0"

modules/rke2/lib/facter/k8s_masters.rb

@@ -1,39 +0,0 @@
-# frozen_string_literal: true
-
-require 'json'
-require 'open3'
-
-Facter.add(:k8s_masters) do
-  confine do
-    File.exist?('/etc/rancher/rke2/rke2.yaml') &&
-      File.executable?('/usr/bin/kubectl')
-  end
-
-  setcode do
-    env = { 'KUBECONFIG' => '/etc/rancher/rke2/rke2.yaml' }
-    cmd = ['/usr/bin/kubectl', 'get', 'nodes', '-o', 'json']
-
-    stdout, stderr, status = Open3.capture3(env, *cmd)
-
-    if status.success?
-      json = JSON.parse(stdout)
-
-      master_count = json['items'].count do |item|
-        roles = item.dig('metadata', 'labels') || {}
-
-        # Look for well-known labels assigned to control-plane nodes
-        roles.any? do |key, _|
-          key =~ %r{node-role\.kubernetes\.io/(control-plane|master|etcd)}
-        end
-      end
-
-      master_count
-    else
-      Facter.debug("kubectl error: #{stderr}")
-      0
-    end
-  rescue StandardError => e
-    Facter.debug("Exception in k8s_masters fact: #{e.message}")
-    0
-  end
-end

modules/rke2/lib/facter/k8s_namespaces.rb

@@ -1,29 +0,0 @@
-# frozen_string_literal: true
-
-require 'json'
-require 'open3'
-
-Facter.add(:k8s_namespaces) do
-  confine do
-    File.exist?('/etc/rancher/rke2/rke2.yaml') &&
-      File.executable?('/usr/bin/kubectl') # Adjust this path if needed
-  end
-
-  setcode do
-    env = { 'KUBECONFIG' => '/etc/rancher/rke2/rke2.yaml' }
-    cmd = ['/usr/bin/kubectl', 'get', 'namespaces', '-o', 'json']
-
-    stdout, stderr, status = Open3.capture3(env, *cmd)
-
-    if status.success?
-      json = JSON.parse(stdout)
-      json['items'].map { |item| item['metadata']['name'] }
-    else
-      Facter.debug("kubectl error: #{stderr}")
-      []
-    end
-  rescue StandardError => e
-    Facter.debug("Exception in k8s_namespaces fact: #{e.message}")
-    []
-  end
-end

modules/rke2/manifests/config.pp

@@ -9,6 +9,9 @@ class rke2::config (
   Array[String[1]]        $extra_config_files = $rke2::extra_config_files,
 ){
 
+  # if agent, add token. what other fields should i add?
+  # how can I add a tls secret using kubectl to add ephemeral certs.
+
   # if its not the bootstrap node, add join path to config
   if $node_type == 'server' {
     if $trusted['certname'] != $bootstrap_node {
@@ -17,7 +20,7 @@ class rke2::config (
         token  => $node_token,
       } )
     }else{
-      $config = merge($config_hash, {})
+      $config = $config_hash
     }
   } elsif $node_type == 'agent' {
       $config = merge($config_hash, {
@@ -66,33 +69,9 @@ class rke2::config (
   }
 
   # on the controller nodes only
-  if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
+  if $node_type == 'server' {
 
-    # wait for purelb helm to setup namespace
+    # manage extra config config
-    if 'purelb' in $facts['k8s_namespaces'] {
-      file {'/var/lib/rancher/rke2/server/manifests/purelb-config.yaml':
-        ensure  => file,
-        owner   => 'root',
-        group   => 'root',
-        mode    => '0644',
-        source  => 'puppet:///modules/rke2/purelb-config.yaml',
-        require => Service['rke2-server'],
-      }
-    }
-
-    # wait for rancher helm to setup namespace
-    if 'cattle-system' in $facts['k8s_namespaces'] {
-      file {'/var/lib/rancher/rke2/server/manifests/ingress-route-rancher.yaml':
-        ensure  => file,
-        owner   => 'root',
-        group   => 'root',
-        mode    => '0644',
-        source  => 'puppet:///modules/rke2/ingress-route-rancher.yaml',
-        require => Service['rke2-server'],
-      }
-    }
-
-    # manage extra config config (these are not dependent on helm)
     $extra_config_files.each |$file| {
 
       file {"/var/lib/rancher/rke2/server/manifests/${file}.yaml":
@@ -104,6 +83,5 @@ class rke2::config (
         require => Service['rke2-server'],
       }
     }
-
   }
 }

modules/rke2/manifests/helm.pp

@@ -1,3 +1,4 @@
+
 # manage helm
 class rke2::helm (
   Enum['server', 'agent'] $node_type = $rke2::node_type,
@@ -20,8 +21,8 @@ class rke2::helm (
       mode   => '0755',
     }
 
-    # on the controller nodes only, and after 3 master nodes exist
+    # on the controller nodes only
-    if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
+    if $node_type == 'server' {
 
       # check if the repo already exists
       $helm_repos.each | String $repo, Stdlib::HTTPSUrl $url | {
@@ -38,44 +39,6 @@ class rke2::helm (
           }
         }
       }
-
-      # install specific helm charts to bootstrap environment
-      $plb_cmd = 'helm install purelb purelb/purelb \
-                  --create-namespace \
-                  --namespace=purelb \
-                  --repository-config /etc/helm/repositories.yaml'
-      exec { 'install_purelb':
-        command     => $plb_cmd,
-        path        => ['/usr/bin', '/bin'],
-        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
-        unless      => 'helm list -n purelb | grep -q ^purelb',
-      }
-
-      $cm_cmd = 'helm install cert-manager jetstack/cert-manager \
-                  --namespace cert-manager \
-                  --create-namespace \
-                  --set crds.enabled=true \
-                  --repository-config /etc/helm/repositories.yaml'
-      exec { 'install_cert_manager':
-        command     => $cm_cmd,
-        path        => ['/usr/bin', '/bin'],
-        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
-        unless      => 'helm list -n cert-manager | grep -q ^cert-manager',
-      }
-
-      $r_cmd = 'helm install rancher rancher-stable/rancher \
-                  --namespace cattle-system \
-                  --create-namespace \
-                  --set hostname=rancher.main.unkin.net \
-                  --set bootstrapPassword=admin \
-                  --set ingress.tls.source=secret \
-                  --repository-config /etc/helm/repositories.yaml'
-      exec { 'install_rancher':
-        command     => $r_cmd,
-        path        => ['/usr/bin', '/bin'],
-        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
-        unless      => 'helm list -n cattle-system | grep -q ^rancher',
-      }
     }
   }
 }

modules/zfs/lib/facter/zfs_datasets.rb

@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-Facter.add(:zfs_datasets) do
-  confine kernel: 'Linux'
-  setcode do
-    datasets = []
-
-    if Facter::Core::Execution.which('zfs')
-      begin
-        output = Facter::Core::Execution.execute('zfs list -H -o name 2>/dev/null', on_fail: nil)
-        datasets = output.strip.split("\n") if output && !output.empty?
-      rescue StandardError => e
-        Facter.debug("Error getting zfs dataset information: #{e.message}")
-      end
-    end
-
-    datasets.empty? ? nil : datasets
-  end
-end

modules/zfs/lib/facter/zfs_zpool_cache_present.rb

@@ -3,8 +3,7 @@
 Facter.add('zfs_zpool_cache_present') do
   confine kernel: 'Linux'
   setcode do
-    cache_file = '/etc/zfs/zpool.cache'
+    File.exist?('/etc/zfs/zpool.cache')
-    File.exist?(cache_file) && File.size(cache_file).positive?
   end
 end
 

modules/zfs/lib/facter/zfs_zpools.rb

@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-Facter.add(:zfs_zpools) do
-  confine kernel: 'Linux'
-  setcode do
-    zpools = []
-
-    if Facter::Core::Execution.which('zpool')
-      begin
-        output = Facter::Core::Execution.execute('zpool list -H -o name 2>/dev/null', on_fail: nil)
-        zpools = output.strip.split("\n") if output && !output.empty?
-      rescue StandardError => e
-        Facter.debug("Error getting zpool information: #{e.message}")
-      end
-    end
-
-    zpools.empty? ? nil : zpools
-  end
-end

modules/zfs/manifests/init.pp

@@ -38,11 +38,8 @@ class zfs (
 
   # create zpools
   $zpools.each | $zpool, $data | {
-    # Only create zpool if it doesn't already exist
+    zpool { $zpool:
-    if $facts['zfs_zpools'] == undef or !($zpool in $facts['zfs_zpools']) {
+      * => $data
-      zpool { $zpool:
-        * => $data
-      }
     }
   }
 

site/profiles/files/postfix/gateway/aliases

@@ -1,54 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-
-postmaster: root
-
-# Many mailers use this address to represent the empty SMTP return path
-MAILER-DAEMON:	postmaster
-
-# Common aliases for system accounts.
-bin:		root
-daemon:		root
-games:		root
-ingres:		root
-nobody:		root
-system:		root
-toor:		root
-foo:		root
-falken:		root
-
-# Well-known aliases.
-admin:		root
-manager:	root
-dumper:		root
-operator:	root
-
-# traps to catch security attacks
-decode:		root
-moof:		root
-moog:		root
-
-# Standard aliases also defined by RFC 2142
-abuse:		postmaster
-
-# reports of network infrastructure difficulties
-noc:		root
-
-# address to report secuirty problems
-security:	root
-
-# DNS administrator (DNS soa records should use this)
-hostmaster:	root
-
-# Usenet news service administrator
-news:		usenet
-usenet:		root
-
-# http/web service administrator
-www:		webmaster
-webmaster:	root
-
-# UUCP service administrator
-uucp:		root
-
-# FTP administrator (especially anon FTP)
-ftp:		root

site/profiles/manifests/base.pp

@@ -1,5 +1,7 @@
 # this is the base class, which will be used by all servers
-class profiles::base () {
+class profiles::base (
+  Array  $puppet_servers,
+) {
 
   # run a limited set of classes on the first run aimed at bootstrapping the new node
   if $facts['firstrun'] {
@@ -11,7 +13,11 @@ class profiles::base () {
 
     # manage the puppet agent
     include profiles::puppet::agent
-    include profiles::puppet::client
+
+    # manage puppet clients
+    if ! member($puppet_servers, $trusted['certname']) {
+      include profiles::puppet::client
+    }
 
     # include the base profiles
     include profiles::base::repos

site/profiles/manifests/defaults.pp

@@ -11,7 +11,6 @@ class profiles::defaults {
     ensure  => present,
     require => [
       Class['profiles::base::repos'],
-      Exec['dnf_makecache'],
     ]
   }
 

site/profiles/manifests/dovecot/server.pp

@@ -1,99 +0,0 @@
-class profiles::dovecot::server (
-  Stdlib::Absolutepath $tls_cert_file = '/etc/pki/tls/vault/certificate.pem',
-  Stdlib::Absolutepath $tls_key_file  = '/etc/pki/tls/vault/certificate.pem',
-  Stdlib::Absolutepath $tls_ca_file   = '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
-  Stdlib::Absolutepath $maildir_path  = '/var/vmail',
-  String $maildir_var                 = '%d/%n',
-  String $hostname                    = $trusted['certname'],
-  Array[String] $listen               = ['*', '::'],
-  Array[String] $protocols            = ['imap'],
-) {
-
-  # Ensure the maildata directory exists
-  file { $maildir_path:
-    ensure => directory,
-    owner  => 'vmail',
-    group  => 'vmail',
-    mode   => '0755',
-  }
-
-  # Create vmail user for dovecot
-  user { 'vmail':
-    ensure     => present,
-    uid        => 5000,
-    gid        => 5000,
-    home       => $maildir_path,
-    shell      => '/usr/sbin/nologin',
-    managehome => false,
-    system     => true,
-  }
-
-  group { 'vmail':
-    ensure => present,
-    gid    => 5000,
-    system => true,
-  }
-
-  # Main dovecot configuration
-  $main_config = {
-    values => {
-      'listen'                    => join($listen, ', '),
-      'protocols'                 => join($protocols, ' '),
-      'default_login_user'        => 'vmail',
-      'default_internal_user'     => 'vmail',
-      'first_valid_uid'           => '5000',
-      'last_valid_uid'            => '5000',
-      'first_valid_gid'           => '5000',
-      'last_valid_gid'            => '5000',
-      'mail_uid'                  => 'vmail',
-      'mail_gid'                  => 'vmail',
-      'mail_location'             => "maildir:${maildir_path}/${maildir_var}/Maildir",
-      'login_trusted_networks'    => '10.0.0.0/8 127.0.0.0/8 [::1]/128',
-      'disable_plaintext_auth'    => 'no',
-      'auth_mechanisms'           => 'cram-md5 plain login',
-      'ssl'                       => 'required',
-      'ssl_cert'                  => $tls_cert_file,
-      'ssl_key'                   => $tls_key_file,
-      'ssl_ca'                    => $tls_ca_file,
-      'ssl_min_protocol'          => 'TLSv1.2',
-      'ssl_cipher_list'           => join([
-        'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES',
-        'ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS'
-      ], ':'),
-      'ssl_prefer_server_ciphers' => 'yes',
-    },
-    sections => [
-      {
-        name   => 'passdb',
-        values => {
-          'driver' => 'passwd-file',
-          'args'   => 'scheme=CRAM-MD5 username_format=%u /etc/dovecot/users',
-        },
-      },
-      {
-        name   => 'userdb',
-        values => {
-          'driver' => 'static',
-          'args'   => "uid=vmail gid=vmail home=${maildir_path}/${maildir_var}",
-        },
-      },
-    ],
-  }
-
-
-  #  # Postfix smtp-auth
-  #  unix_listener /var/spool/postfix/private/auth {
-  #    mode = 0666
-  #    user = postfix
-  #    group = postfix
-  #  }
-
-
-  # Configure dovecot
-  class { 'dovecot':
-    main_config        => $main_config,
-    include_sysdefault => false,
-    require            => [User['vmail'], Group['vmail'], File[$maildir_path]],
-  }
-
-}

site/profiles/manifests/nginx/simpleproxy.pp

@@ -136,10 +136,9 @@ class profiles::nginx::simpleproxy (
     }
 
     service { 'nginx':
-      ensure     => true,
+      ensure    => true,
-      enable     => true,
+      enable    => true,
-      hasrestart => true,
+      subscribe => [
-      subscribe  => [
         File[$selected_ssl_cert],
         File[$selected_ssl_key],
         Nginx::Resource::Server[$nginx_vhost]

site/profiles/manifests/postfix/gateway.pp

@@ -1,392 +0,0 @@
-class profiles::postfix::gateway (
-  Stdlib::Absolutepath $tls_cert_file = '/etc/pki/tls/vault/certificate.pem',
-  Stdlib::Absolutepath $tls_key_file  = '/etc/pki/tls/vault/certificate.pem',
-  Stdlib::Absolutepath $tls_ca_file   = '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
-  String $myhostname                  = $trusted['certname'],
-  String $message_size_limit          = '133169152',
-  String $mailbox_size_limit          = '133169152',
-  String $local_transport             = 'error:No local mail delivery',
-  Boolean $enable_postscreen          = true,
-  Array[String] $alias_maps           = [
-    'hash:/etc/aliases',
-    'hash:/etc/postfix/aliases',
-  ],
-  Array[String] $postscreen_dnsbl_sites = [
-    'zen.spamhaus.org*3',
-    'b.barracudacentral.org=127.0.0.[2..11]*2',
-    'bl.spameatingmonkey.net*2',
-    'bl.spamcop.net',
-    'dnsbl.sorbs.net',
-    'swl.spamhaus.org*-4',
-    'list.dnswl.org=127.[0..255].[0..255].0*-2',
-    'list.dnswl.org=127.[0..255].[0..255].1*-4',
-    'list.dnswl.org=127.[0..255].[0..255].[2..3]*-6',
-  ],
-  Array[String] $smtpd_client_restrictions = [
-    'permit_sasl_authenticated',
-    'permit_mynetworks',
-    'reject_rbl_client zen.spamhaus.org',
-  ],
-  Array[String] $smtpd_sender_restrictions = [
-    'permit_sasl_authenticated',
-    'check_sender_access hash:/etc/postfix/sender_access',
-    'reject_non_fqdn_sender',
-    'reject_unknown_sender_domain',
-  ],
-  Array[String] $smtpd_recipient_restrictions = [
-    'permit_sasl_authenticated',
-    'permit_mynetworks',
-    'reject_unauth_destination',
-    'reject_non_fqdn_recipient',
-    'reject_unknown_recipient_domain',
-    'check_recipient_access hash:/etc/postfix/recipient_access',
-    'reject_unverified_recipient',
-  ],
-  Array[String] $smtpd_relay_restrictions = [
-    'permit_sasl_authenticated',
-    'permit_mynetworks',
-    'reject_unauth_destination',
-  ],
-  Hash[Stdlib::Fqdn, String] $smtp_tls_policy_maps = {},
-  Hash[String, String] $sender_canonical_maps = {},
-  Hash[Stdlib::Email, String] $sender_access_maps = {},
-  Hash[String, String] $relay_recipients_maps = {},
-  Hash[Stdlib::Fqdn, String] $relay_domains_maps = {},
-  Hash[String, String] $recipient_canonical_maps = {},
-  Hash[Stdlib::Email, String] $recipient_access_maps = {},
-  Hash[Variant[Stdlib::IP::Address, Stdlib::IP::Address::CIDR], String] $postscreen_access_maps = {},
-  Hash[String, String] $helo_access_maps = {},
-  Hash[Stdlib::Email, String] $virtual_mailbox_maps = {},
-  Hash[Variant[Stdlib::Email, Pattern[/^@.+$/]], Stdlib::Email] $virtual_alias_maps = {},
-  # Dovecot integration
-  Boolean $enable_dovecot = false,
-  Array[Stdlib::Fqdn] $virtual_mailbox_domains = [],
-  String $virtual_uid_maps = 'static:5000',
-  String $virtual_gid_maps = 'static:5000',
-  Stdlib::Absolutepath $virtual_mailbox_base = '/var/vmail',
-  String $virtual_transport = 'dovecot',
-) {
-
-  $alias_maps_string = join($alias_maps, ', ')
-
-  # Set master.cf configuration based on postscreen setting
-  if $enable_postscreen {
-    $master_smtp = 'smtp      inet  n       -       n       -       1       postscreen'
-    $master_entries = [
-      'smtpd     pass  -       -       n       -       -       smtpd',
-      'dnsblog   unix  -       -       n       -       0       dnsblog',
-      'tlsproxy  unix  -       -       n       -       0       tlsproxy',
-    ]
-    $postscreen_configs = {
-      'postscreen_access_list' => {
-        'value' => 'permit_mynetworks, cidr:/etc/postfix/postscreen_access'
-      },
-      'postscreen_blacklist_action' => {
-        'value' => 'enforce'
-      },
-      'postscreen_cache_map' => {
-        'value' => 'btree:$data_directory/postscreen_cache'
-      },
-      'postscreen_dnsbl_action' => {
-        'value' => 'enforce'
-      },
-      'postscreen_dnsbl_sites' => {
-        'value' => join($postscreen_dnsbl_sites, ', ')
-      },
-      'postscreen_dnsbl_threshold' => {
-        'value' => '2'
-      },
-      'postscreen_greet_action' => {
-        'value' => 'enforce'
-      },
-      'postscreen_greet_banner' => {
-        'value' => '$smtpd_banner'
-      },
-      'postscreen_greet_wait' => {
-        'value' => "\${stress?2}\${stress:6}s"
-      },
-    }
-  } else {
-    $master_smtp = undef
-    $master_entries = []
-    $postscreen_configs = {}
-  }
-
-  # Base postfix configuration
-  $base_configs = {
-    'alias_database' => {
-      'value' => $alias_maps_string
-    },
-    'default_destination_recipient_limit' => {
-      'value' => '1'
-    },
-    'disable_vrfy_command' => {
-      'value' => 'yes'
-    },
-    'enable_long_queue_ids' => {
-      'value' => 'yes'
-    },
-    'error_notice_recipient' => {
-      'value' => 'root'
-    },
-    'header_checks' => {
-      'value' => 'regexp:/etc/postfix/header_checks'
-    },
-    'local_recipient_maps' => {
-      'ensure' => 'blank'
-    },
-    'local_transport' => {
-      'value' => $local_transport
-    },
-    'mailbox_size_limit' => {
-      'value' => $mailbox_size_limit
-    },
-    'message_size_limit' => {
-      'value' => $message_size_limit
-    },
-    'myhostname' => {
-      'value' => $myhostname
-    },
-    'non_smtpd_milters' => {
-      'ensure' => 'blank'
-    },
-    'qmqpd_authorized_clients' => {
-      'value' => '127.0.0.1 [::1]'
-    },
-    'recipient_canonical_maps' => {
-      'value' => 'hash:/etc/postfix/recipient_canonical'
-    },
-    'recipient_delimiter' => {
-      'value' => '+'
-    },
-    'relay_domains' => {
-      'value' => 'hash:/etc/postfix/relay_domains'
-    },
-    'relay_recipient_maps' => {
-      'value' => 'hash:/etc/postfix/relay_recipients'
-    },
-    'sender_canonical_maps' => {
-      'value' => 'hash:/etc/postfix/sender_canonical'
-    },
-    'smtp_tls_CAfile' => {
-      'value' => $tls_ca_file
-    },
-    'smtp_tls_mandatory_protocols' => {
-      'value' => '!SSLv2,!SSLv3'
-    },
-    'smtp_tls_note_starttls_offer' => {
-      'value' => 'yes'
-    },
-    'smtp_tls_protocols' => {
-      'value' => '!SSLv2,!SSLv3'
-    },
-    'smtp_tls_security_level' => {
-      'value' => 'may'
-    },
-    'smtp_tls_session_cache_database' => {
-      'value' => 'btree:/var/lib/postfix/smtp_tls_session_cache'
-    },
-    'smtp_use_tls' => {
-      'value' => 'yes'
-    },
-    'smtpd_banner' => {
-      'value' => '$myhostname ESMTP $mail_name'
-    },
-    'smtpd_client_restrictions' => {
-      'value' => join($smtpd_client_restrictions, ', ')
-    },
-    'smtpd_data_restrictions' => {
-      'value' => 'reject_unauth_pipelining'
-    },
-    'smtpd_delay_reject' => {
-      'value' => 'yes'
-    },
-    'smtpd_discard_ehlo_keywords' => {
-      'value' => 'chunking, silent-discard'
-    },
-    'smtpd_forbid_bare_newline' => {
-      'value' => 'yes'
-    },
-    'smtpd_forbid_bare_newline_exclusions' => {
-      'value' => '$mynetworks'
-    },
-    'smtpd_forbid_unauth_pipelining' => {
-      'value' => 'yes'
-    },
-    'smtpd_helo_required' => {
-      'value' => 'yes'
-    },
-    'smtpd_helo_restrictions' => {
-      'value' => 'check_helo_access hash:/etc/postfix/helo_access, reject_invalid_hostname'
-    },
-    'smtpd_milters' => {
-      'value' => 'inet:127.0.0.1:33333'
-    },
-    'smtpd_recipient_restrictions' => {
-      'value' => join($smtpd_recipient_restrictions, ', ')
-    },
-    'smtpd_relay_restrictions' => {
-      'value' => join($smtpd_relay_restrictions, ', ')
-    },
-    'smtpd_sender_restrictions' => {
-      'value' => join($smtpd_sender_restrictions, ', ')
-    },
-    'smtpd_tls_CAfile' => {
-      'value' => $tls_ca_file
-    },
-    'smtpd_tls_cert_file' => {
-      'value' => $tls_cert_file
-    },
-    'smtpd_tls_ciphers' => {
-      'value' => 'medium'
-    },
-    'smtpd_tls_key_file' => {
-      'value' => $tls_key_file
-    },
-    'smtpd_tls_loglevel' => {
-      'value' => '1'
-    },
-    'smtpd_tls_mandatory_protocols' => {
-      'value' => '!SSLv2,!SSLv3'
-    },
-    'smtpd_tls_protocols' => {
-      'value' => '!SSLv2,!SSLv3'
-    },
-    'smtpd_tls_received_header' => {
-      'value' => 'yes'
-    },
-    'smtpd_tls_security_level' => {
-      'value' => 'may'
-    },
-    'smtpd_tls_session_cache_database' => {
-      'value' => 'btree:/var/lib/postfix/smtpd_tls_session_cache'
-    },
-    'smtpd_tls_session_cache_timeout' => {
-      'value' => '3600s'
-    },
-    'smtpd_use_tls' => {
-      'value' => 'yes'
-    },
-    'tls_medium_cipherlist' => {
-      'value' => join([
-        'ECDSA+AESGCM:ECDH+AESGCM:DH+AESGCM:ECDSA+AES:ECDH+AES:DH+AES',
-        'ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS'
-      ], ':')
-    },
-    'tls_preempt_cipherlist' => {
-      'value' => 'yes'
-    },
-    'tls_random_source' => {
-      'value' => 'dev:/dev/urandom'
-    },
-    'unverified_recipient_reject_code' => {
-      'value' => '550'
-    },
-    'unverified_recipient_reject_reason' => {
-      'value' => 'No user at this address'
-    },
-    'smtp_tls_policy_maps' => {
-      'value' => 'hash:/etc/postfix/smtp_tls_policy_maps'
-    },
-  }
-
-
-  # Postfix maps (all using templates now)
-  $postfix_maps = {
-    'postscreen_access' => {
-      'ensure'  => 'present',
-      'type'    => 'cidr',
-      'content' => template('profiles/postfix/gateway/postscreen_access.erb')
-    },
-    'relay_recipients' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/relay_recipients.erb')
-    },
-    'relay_domains' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/relay_domains.erb')
-    },
-    'aliases' => {
-      'ensure' => 'present',
-      'type'   => 'hash',
-      'source' => 'puppet:///modules/profiles/postfix/gateway/aliases'
-    },
-    'helo_access' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/helo_access.erb')
-    },
-    'sender_access' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/sender_access.erb')
-    },
-    'recipient_access' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/recipient_access.erb')
-    },
-    'recipient_canonical' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/recipient_canonical.erb')
-    },
-    'sender_canonical' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/sender_canonical.erb')
-    },
-    'smtp_tls_policy_maps' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/smtp_tls_policy_maps.erb')
-    },
-    'virtual_mailbox_maps' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/virtual_mailbox_maps.erb')
-    },
-    'virtual_alias_maps' => {
-      'ensure'  => 'present',
-      'type'    => 'hash',
-      'content' => template('profiles/postfix/gateway/virtual_alias_maps.erb')
-    },
-  }
-
-  if $enable_dovecot {
-    postfix::config {
-      'virtual_mailbox_domains': value => join($virtual_mailbox_domains, ', ');
-      'virtual_mailbox_maps':    value => 'hash:/etc/postfix/virtual_mailbox_maps';
-      'virtual_alias_maps':      value => 'hash:/etc/postfix/virtual_alias_maps';
-      'virtual_uid_maps':        value => $virtual_uid_maps;
-      'virtual_gid_maps':        value => $virtual_gid_maps;
-      'virtual_mailbox_base':    value => $virtual_mailbox_base;
-      'virtual_transport':       value => $virtual_transport;
-      'home_mailbox':            value => "${virtual_mailbox_base}/%d/%n/Maildir";
-    }
-  } else {
-    postfix::config {
-      'virtual_mailbox_domains': ensure => 'absent';
-      'virtual_mailbox_maps':    ensure => 'absent';
-      'virtual_uid_maps':        ensure => 'absent';
-      'virtual_gid_maps':        ensure => 'absent';
-      'virtual_mailbox_base':    ensure => 'absent';
-      'virtual_transport':       ensure => 'absent';
-      'home_mailbox':            ensure => 'absent';
-    }
-  }
-
-  # Merge base configs with postscreen configs
-  $all_configs = $base_configs + $postscreen_configs
-
-  class { 'postfix':
-    master_smtp    => $master_smtp,
-    master_entries => $master_entries,
-    alias_maps     => $alias_maps_string,
-    configs        => $all_configs,
-    maps           => $postfix_maps,
-  }
-
-}

site/profiles/manifests/puppet/agent.pp

@@ -1,68 +1,37 @@
 # profiles::puppet::agent
 # This class manages Puppet agent package and service.
 class profiles::puppet::agent (
-  String  $version        = 'latest',
+  String $puppet_version      = 'latest',
-  Boolean $openvox_enable = false,
 ) {
 
-  # set openvox package, yumrepo, service
+  # if puppet-version is anything other than latest, set a versionlock
-  if $openvox_enable {
+  $puppet_versionlock_ensure = $puppet_version ? {
-    $use_package = 'openvox-agent'
-    $use_yumrepo = 'openvox'
-    $use_service = 'puppet'
-  }else{
-    $use_package = 'puppet-agent'
-    $use_yumrepo = 'puppet'
-    $use_service = 'puppet'
-  }
-
-  # manage the yumrepo for the given package
-  if $openvox_enable and $facts['os']['family'] == 'RedHat' {
-    yumrepo { 'openvox':
-      ensure  => 'present',
-      baseurl => "https://packagerepo.service.consul/openvox7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/",
-      descr   => 'openvox repository',
-      gpgkey  => "https://packagerepo.service.consul/openvox7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/GPG-KEY-openvox.pub",
-      notify  => Exec['dnf_makecache'],
-    }
-  }else{
-    yumrepo { 'puppet':
-      ensure  => 'present',
-      baseurl => "https://packagerepo.service.consul/puppet7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/",
-      descr   => 'puppet repository',
-      gpgkey  => "https://packagerepo.service.consul/puppet7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/RPM-GPG-KEY-puppet-20250406",
-      notify  => Exec['dnf_makecache'],
-    }
-  }
-
-  # if agent-version is anything other than latest, set a versionlock
-  $agent_versionlock_ensure = $version ? {
     'latest' => 'absent',
     default  => 'present',
   }
-  $agent_versionlock_version = $version ? {
+  $puppet_versionlock_version = $puppet_version ? {
     'latest' => undef,
-    default  => $version,
+    default  => $puppet_version,
   }
 
   case $facts['os']['family'] {
     'RedHat': {
-      # Ensure the agent package is installed and locked to a specific version
+      # Ensure the puppet-agent package is installed and locked to a specific version
-      package { $use_package:
+      package { 'puppet-agent':
-        ensure  => $version,
+        ensure  => $puppet_version,
-        require => Yumrepo[$use_yumrepo],
+        require => Yumrepo['puppet'],
       }
 
       # versionlock puppet-agent
-      yum::versionlock{$use_package:
+      yum::versionlock{'puppet-agent':
-        ensure  => $agent_versionlock_ensure,
+        ensure  => $puppet_versionlock_ensure,
-        version => $agent_versionlock_version,
+        version => $puppet_versionlock_version,
       }
     }
     'Debian': {
       # Ensure the puppet-agent package is installed and locked to a specific version
-      package { $use_package:
+      package { 'puppet-agent':
-        ensure  => $version,
+        ensure  => $puppet_version,
         require => Class['profiles::apt::puppet7'],
       }
     }
@@ -70,11 +39,12 @@ class profiles::puppet::agent (
   }
 
   # Ensure the puppet service is running
-  service { $use_service:
+  service { 'puppet':
     ensure     => 'running',
     enable     => true,
     hasrestart => true,
-    require    => Package[$use_package],
+    require    => Package['puppet-agent'],
   }
 
 }
+

site/profiles/manifests/puppet/puppetdb_api.pp

@@ -26,12 +26,6 @@ class profiles::puppet::puppetdb_api (
       before  => Class['puppetdb::server'],
     }
 
-    # cleanup puppetdb first, this isnt replaced by openvoxdb (conflicts)
-    package { 'puppetdb':
-      ensure => 'purged',
-      before => Class['puppetdb::server'],
-    }
-
     class { 'puppetdb::server':
       manage_firewall        => false,
       ssl_listen_address     => $listen_address,
@@ -50,7 +44,6 @@ class profiles::puppet::puppetdb_api (
       database_name          => $database_name,
       database_password      => Sensitive($database_password),
       database_validate      => $database_validate,
-      puppetdb_package       => 'openvoxdb',
     }
 
     contain ::puppetdb::server

site/profiles/manifests/puppet/puppetmaster.pp

@@ -20,23 +20,12 @@ class profiles::puppet::puppetmaster (
     include profiles::puppet::puppetca
     include profiles::puppet::eyaml
 
-    # migration to openvox, cleanup puppetserver/puppetdb-termini
-    package {'puppetdb-termini':
-      ensure => purged,
-      before => Package['openvoxdb-termini'],
-    }
-    package {'puppetserver':
-      ensure => purged,
-      before => Package['openvox-server'],
-    }
-
     class { 'puppetdb::master::config':
       puppetdb_server     => $puppetdb_host,
       manage_storeconfigs => false,
-      terminus_package    => 'openvoxdb-termini',
     }
 
-    Package['openvox-server']
+    Package['puppetserver']
     -> Class['profiles::puppet::gems']
     -> Class['profiles::puppet::r10k']
     -> Class['profiles::puppet::g10k']

site/profiles/manifests/yum/global.pp

@@ -55,7 +55,4 @@ class profiles::yum::global (
   # setup dnf-autoupdate
   include profiles::yum::autoupdater
 
-  # ensure dnf makecache runs before packages
-  Yumrepo <| |> -> Exec['dnf_makecache'] -> Package <| |>
-
 }

site/profiles/templates/postfix/gateway/helo_access.erb

@@ -1,11 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Controls access based on HELO/EHLO hostnames to block spam patterns
-# HELO/EHLO access controls
-# Format: pattern    action
-# Example: .dynamic.example.com    REJECT
-# Example: localhost    REJECT You are not localhost
-
-<% @helo_access_maps.each do |pattern, action| -%>
-<%= pattern %>             <%= action %>
-<% end -%>

site/profiles/templates/postfix/gateway/postscreen_access.erb

@@ -1,10 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Controls which IP addresses/networks are allowed through postscreen
-# Postscreen access controls (CIDR format)
-# Format: network/mask    action
-# Example: 192.168.1.0/24    permit
-
-<% @postscreen_access_maps.each do |network, action| -%>
-<%= network %> <%= action %>
-<% end -%>

site/profiles/templates/postfix/gateway/recipient_access.erb

@@ -1,11 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Controls access based on recipient email addresses or domains
-# Recipient access controls
-# Format: recipient_pattern    action
-# Example: @example.com    OK
-# Example: admin@foo.net    REJECT
-
-<% @recipient_access_maps.each do |recipient, action| -%>
-<%= recipient %>    <%= action %>
-<% end -%>

site/profiles/templates/postfix/gateway/recipient_canonical.erb

@@ -1,10 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Rewrites recipient addresses before delivery (address normalization)
-# Recipient canonical address mapping
-# Format: original_address    canonical_address
-# Example: user@olddomain.com    user@example.com
-
-<% @recipient_canonical_maps.each do |original, canonical| -%>
-<%= original %>    <%= canonical %>
-<% end -%>

site/profiles/templates/postfix/gateway/relay_domains.erb

@@ -1,10 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Defines which domains are allowed for mail relaying
-# Relay domains control
-# Format: domain    action
-# Example: example.com    OK
-
-<% @relay_domains_maps.each do |domain, action| -%>
-<%= domain %>       <%= action %>
-<% end -%>

site/profiles/templates/postfix/gateway/relay_recipients.erb

@@ -1,10 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Defines which recipient addresses are allowed for mail relaying
-# Relay recipients control
-# Format: recipient_pattern    action
-# Example: @example.com    OK
-
-<% @relay_recipients_maps.each do |recipient, action| -%>
-<%= recipient %>       <%= action %>
-<% end -%>

site/profiles/templates/postfix/gateway/sender_access.erb

@@ -1,11 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Controls access based on sender email addresses or domains
-# Sender access controls
-# Format: sender_pattern    action
-# Example: spammer@foo.net    REJECT
-# Example: @badspammer.com   REJECT
-
-<% @sender_access_maps.each do |sender, action| -%>
-<%= sender %>    <%= action %>
-<% end -%>

site/profiles/templates/postfix/gateway/sender_canonical.erb

@@ -1,10 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Rewrites sender addresses before sending (address masquerading)
-# Sender canonical address mapping
-# Format: original_address    canonical_address
-# Example: user@internal.local    user@example.com
-
-<% @sender_canonical_maps.each do |original, canonical| -%>
-<%= original %>    <%= canonical %>
-<% end -%>

site/profiles/templates/postfix/gateway/smtp_tls_policy_maps.erb

@@ -1,11 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Enforces TLS security policies for outbound mail per destination domain
-# SMTP TLS policy map for outbound connections
-# Format: destination    policy
-# Example: gmail.com    encrypt
-# Example: secure-bank.example.com    secure
-
-<% @smtp_tls_policy_maps.each do |destination, policy| -%>
-<%= destination %>    <%= policy %>
-<% end -%>

site/profiles/templates/postfix/gateway/virtual_alias_maps.erb

@@ -1,9 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Defines virtual alias mappings
-# Maps email addresses or patterns to target addresses
-# Format: alias@foo.net    real@corp.foo.net
-
-<% @virtual_alias_maps.each do |source, target| -%>
-<%= source %>       <%= target %>
-<% end -%>

site/profiles/templates/postfix/gateway/virtual_mailbox_maps.erb

@@ -1,9 +0,0 @@
-# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
-#
-# Defines virtual mailbox mappings for dovecot delivery
-# Maps email addresses to maildir paths
-# Format: user@domain    maildir/path/
-
-<% @virtual_mailbox_maps.each do |email, path| -%>
-<%= email %>       <%= path %>
-<% end -%>

site/profiles/templates/reposync/autopromoter.erb

@@ -1,72 +1,33 @@
 #!/usr/bin/env bash
-set -euo pipefail
-
-: "${DRY_RUN:=}"   # set DRY_RUN=1 to preview deletions
-
-log() { printf '[%(%F %T)T] %s\n' -1 "$*" >&2; }
 
 # Function to create symlink for snapshots
 create_symlink() {
-  local osname="$1"     # e.g. almalinux
-  local release="$2"    # e.g. 9.6
-  local repository="$3" # e.g. appstream
-  local basepath="$4"   # e.g. /shared/apps/packagerepo
-  local label="$5"      # monthly|weekly|daily
-  local date_value="$6" # YYYYMMDD for the snapshot to promote
-
-  local snap_path="${basepath}/snap/${osname}/${release}/${repository}-${date_value}"
-  local symlink_target="${basepath}/snap/${osname}/${release}/${repository}-${label}"
-
-  if [[ -d "$snap_path" ]]; then
-    ln -sfn "$snap_path" "$symlink_target"
-    log "Symlink set: ${symlink_target} -> ${snap_path}"
-    return 0
-  else
-    log "Snapshot path does not exist: $snap_path"
-    return 1
-  fi
-}
-
-# Cleanup snapshot directories older than a cutoff date (YYYYMMDD)
-cleanup_older_than_monthly() {
   local osname="$1"
   local release="$2"
   local repository="$3"
   local basepath="$4"
-  local cutoff_date="$5"  # newly promoted monthly date, YYYYMMDD
+  local label="$5" # 'monthly', 'weekly', or 'daily'
+  local date_format="$6" # Date format for finding the snapshot
 
-  local root="${basepath}/snap/${osname}/${release}"
+  # The path where snapshots are stored
-  local pattern="${repository}-"[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]
+  local snap_path="${basepath}/snap/${osname}/${release}/${repository}-${date_format}"
 
-  shopt -s nullglob
+  # The target path for the symlink
-  for dir in "${root}"/${pattern}; do
+  local symlink_target="${basepath}/snap/${osname}/${release}/${repository}-${label}"
-    # Skip symlinks and non-directories
-    [[ -L "$dir" ]] && continue
-    [[ -d "$dir" ]] || continue
 
-    # Extract the date suffix
+  # Check if the source directory exists
-    local name base datepart
+  if [[ -d "$snap_path" ]]; then
-    name="$(basename -- "$dir")"
+    # Create the symlink, overwrite if it already exists
-    base="${name%-????????}"     # remove last 8 chars
+    ln -sfn "$snap_path" "$symlink_target"
-    datepart="${name#${base}-}"  # after "<repo>-"
+    echo "Symlink created for $snap_path -> $symlink_target"
-
+  else
-    # Only act on valid YYYYMMDD dates
+    echo "Snapshot path does not exist: $snap_path"
-    if [[ "$datepart" =~ ^[0-9]{8}$ ]]; then
+    return 1
-      if [[ "$datepart" -lt "$cutoff_date" ]]; then
+  fi
-        if [[ -n "${DRY_RUN}" ]]; then
-          log "[DRY_RUN] Would remove: $dir"
-        else
-          log "Removing: $dir"
-          rm -rf --one-file-system -- "$dir"
-        fi
-      fi
-    fi
-  done
-  shopt -u nullglob
 }
 
 # Determine which snapshot to promote based on the passed argument
-case "${1:-}" in
+case "$1" in
   monthly)
     promote_date=$(date --date="$(date +%Y%m01) -1 month" +%Y%m%d)
     ;;
@@ -82,26 +43,11 @@ case "${1:-}" in
     ;;
 esac
 
-label="$1"
+# Call the function with appropriate arguments
-
+# Iterate over the repositories to create symlinks for each
-# Process each repo conf
 for conf in /etc/reposync/conf.d/*.conf; do
-  # shellcheck disable=SC1090
   source "$conf"
 
-  # Expecting these vars in the conf: OSNAME, RELEASE, REPOSITORY, BASEPATH
+  # Create symlink based on the provided argument
-  : "${OSNAME:?missing OSNAME in $conf}"
+  create_symlink "$OSNAME" "$RELEASE" "$REPOSITORY" "$BASEPATH" "$1" "$promote_date"
-  : "${RELEASE:?missing RELEASE in $conf}"
-  : "${REPOSITORY:?missing REPOSITORY in $conf}"
-  : "${BASEPATH:?missing BASEPATH in $conf}"
-
-  # 1) Promote the symlink for this label
-  if create_symlink "$OSNAME" "$RELEASE" "$REPOSITORY" "$BASEPATH" "$label" "$promote_date"; then
-    # 2) If monthly, clean up older snapshot dirs for this repo
-    if [[ "$label" == "monthly" ]]; then
-      cleanup_older_than_monthly "$OSNAME" "$RELEASE" "$REPOSITORY" "$BASEPATH" "$promote_date"
-    fi
-  else
-    log "Skipping cleanup for ${OSNAME}/${RELEASE}/${REPOSITORY} due to missing ${REPOSITORY}-${promote_date}"
-  fi
 done

site/roles/manifests/infra/mail/backend.pp

@@ -1,12 +0,0 @@
-# a role to deploy a imap/pop3 backend for mail services
-class roles::infra::mail::backend {
-  if $facts['firstrun'] {
-    include profiles::defaults
-    include profiles::firstrun::init
-  }else{
-    include profiles::defaults
-    include profiles::base
-    include profiles::dovecot::server
-    include profiles::postfix::gateway
-  }
-}

site/roles/manifests/infra/mail/gateway.pp

@@ -1,11 +0,0 @@
-# a role to deploy a dmz mx gateway for mail services
-class roles::infra::mail::gateway {
-  if $facts['firstrun'] {
-    include profiles::defaults
-    include profiles::firstrun::init
-  }else{
-    include profiles::defaults
-    include profiles::base
-    include profiles::postfix::gateway
-  }
-}