feat: add woodpecker ci jobs

- pre-commit job to run pre-commit against
2026-02-28 17:03:39 +11:00
124 changed files with 547 additions and 2324 deletions
@@ -0,0 +1,24 @@
+name: Build
+
+on:
+  pull_request:
+
+jobs:
+  precommit:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Install requirements
+        run: |
+          dnf groupinstall -y "Development Tools" -y
+          dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
+
+      - name: Pre-Commit All Files
+        run: |
+          uvx pre-commit run --all-files
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: bolt-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/bolt-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: epp-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/epp-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: erb-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/erb-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -0,0 +1,10 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - dnf groupinstall -y "Development Tools" -y
+      - dnf install uv rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel libffi libffi-devel -y
+      - uvx pre-commit run --all-files
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: puppet-lint
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/puppet-lint.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: puppet-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/puppet-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: ruby-check
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/ruby-check.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: ruby-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/ruby-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: yamllint
-    image: git.unkin.net/unkin/almalinux9-base:20260606
-    commands:
-      - uvx pre-commit run --all-files --config ci/yamllint.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 250m
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -53,6 +53,7 @@ mod 'saz-ssh', '13.1.0'
 mod 'saz-limits', '5.0.0'
 mod 'ghoneycutt-timezone', '4.0.0'
 mod 'ghoneycutt-puppet', '3.3.0'
+mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
 mod 'broadinstitute-certs', '3.0.1'
@@ -65,5 +66,5 @@ mod 'thias-sysctl', '1.0.8'
 mod 'cirrax-dovecot', '1.3.3'

 mod 'bind',
-  :git => 'https://git.unkin.net/unkinben/puppet-bind.git',
+  :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',
  :tag => '1.0'
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: bolt-validate
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: epp-validate
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: erb-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: puppet-lint
-        args:
-          - --no-80chars-check
-          - --no-documentation-check
-          - --no-puppet_url_without_modules-check
-          - --fail-on-warnings
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: puppet-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: ruby-validate
-  - repo: 'https://github.com/jumanjihouse/pre-commit-hooks'
-    rev: 3.0.0
-    hooks:
-      - id: reek
-      - id: rubocop
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: ruby-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/adrienverge/yamllint'
-    rev: v1.32.0
-    hooks:
-      - id: 'yamllint'
-        args:
-          [
-            "-d {extends: relaxed, rules: {line-length: disable}, ignore: chart}",
-            "-s",
-          ]
@@ -88,13 +88,36 @@

 # SSH Hostkey Signing

-The `sshca` ssh engine, its `signhost` role, the `sshca/sign/signhost` policy and
-the `sshsigner` approle are managed in terraform-vault:
+## create ssh engine, key, set ttl
+    vault secrets enable -path=ssh-host-signer ssh
+    vault write ssh-host-signer/config/ca generate_signing_key=true
+    vault secrets tune -max-lease-ttl=87600h ssh-host-signer

- `config/ssh_secret_backend/sshca.yaml`
- `config/ssh_secret_backend_role/sshca/signhost.yaml`
- `config/auth_approle_role/approle/sshsigner.yaml`
- `policies/sshca/sign/signhost.yaml`
+## create role
+    vault write ssh-host-signer/roles/hostrole \
+        key_type=ca \
+        algorithm_signer=rsa-sha2-256 \
+        ttl=87600h \
+        allow_host_certificates=true \
+        allowed_domains="unkin.net" \
+        allow_subdomains=true \
+        allow_baredomains=true

-## get the sshsigner approle id
-    vault read -field=role_id auth/approle/role/sshsigner/role-id
+## create policy to use hostrole
+    cat <<EOF > sshsign-host.hcl
+    path "ssh-host-signer/sign/hostrole" {
+        capabilities = ["create", "update"]
+    }
+    EOF
+
+    vault policy write sshsign-host-policy sshsign-host.hcl
+
+    vault write auth/approle/role/sshsign-host-role \
+        bind_secret_id=false \
+        token_policies="sshsign-host-policy" \
+        token_ttl=30s \
+        token_max_ttl=30s \
+        token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32"
+
+## get the sshsign-host-role approle id
+    vault read -field=role_id auth/approle/role/sshsign-host-role/role-id
@@ -30,7 +30,6 @@ hierarchy:
      - "roles/%{::enc_role_tier1}.eyaml"
      - "roles/%{::enc_role_tier1}.yaml"
      - "virtual/%{facts.virtual}.yaml"
-      - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.%{facts.os.release.minor}.yaml"
      - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"
      - "os/%{facts.os.name}/all_releases.yaml"
      - "common.eyaml"
@@ -6,4 +6,3 @@ profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDo
 profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
 profiles::consul::server::acl_tokens_default: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAh4Ag95xgkIZHL0gP9OLnZauih0dB1/2l9Jzw8mP3OiIv7fw23otHYONlS3Emtj7oxW8MKcZGKDCzwCT6T2p+V5wx1n15wr2J+FmL24VbclJwrMPQ4AdgP359B9h21uoyo7Zdy7RuuvLfkU1fWXbs3SeWbi2HJs1Ed1/oI1jzr3OgwMbVtbyzd1VuAXeZ9bHQG3IA8z+w/k5m61th0HTyHjw7eldQulbohDuwv545z9axHEoHKCRT2a3ZwBufV2ST6Dm3g9GERzXE9Adp9DQC5adqM74wfsujOMLK2QFJSSIOj2uCs1CpEnrNrQ8zjP3fudM2z3l7KdSHZazEamCSxTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBY/Tn9tzEKYc5dxnzP2rP7gDBWKgVP3lf2T4Q0WPQt3ns0E6RUSO6OtBegb/5qDyohY2nsDeJTnMKOYzYt/J1PhnY=]
 profiles::consul::server::acl_tokens_replication: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzTIxbaAR/TZYnC671aBhiahsfwf3ieyeSHpD5hQm40sMEF/fXlEDijq9i2ykPikm94074j1Uo4HNzv/V9GTf0NSC/64t61jJ/Ya3QKa5f/36+DcRj3lcETsSIyhWwmU+E+zkY8I2r68MtXAuvSoMSMZdpgWSkPx/3FFgZlrsg//bzDu69jS9cx4UK582N3A6QN4Uy/qwYtJcm+2iTQlqqgGRWGqnSgTirxhegxPbJGWTDoAEpAL4/DyF5/hqcUn6mgoSfAsHF3loPHOqN30lG+9o0THWJ9B8Gf4W/1X2UWA/avmUnqBnumGoz0p7AYdNgpW+qLl2rk4lyGYa4kvQjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD9KSLH3Pn/1EIzgVJM+8VOgDDpKWzHfSVsfUMyTD0XIRPGclTdmxqCnsdhKNqmUfSjkYIf2nI9rQtSK6n42TYuO4k=]
-profiles::dns::updater::key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJ4GrN3W4zGfVygfji1MeGyAlmlFN45TVP5st6b66jSKeDYNg9BwdnXahUzkmKvFIYdPWyvXqJdvuyUNz7lWr1dw/pTNHrvqUKSvI0C5TOwmtrTwXtTvucDGs7c7FZDfgUxvLs/Vrp0ZdW3C81QXWNBI8vBfVZyiegPNq+5mX7mtcrFE7jZj1g1qwpg/30lrlCguPyXqnmdtBa7VAyU2Al1UZwkrKIYSAOb9GTnvM6bk5L26pW/NXGj+ffacwf58b4AiKCak5lhoCIInVnlogPuThxULN4RF+MYAVIlgwk159CR1abjWjioxvmP7XgjQUwUuTlgoLh9fDZa0amDeFZTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBEb1BTjhuTN9wGrxc2rdQVgDCctNdt72UR/Hj4wteK7XIX6fF43+7FYKBZnPtyWIWalwDniH//H3gfsJ+ULqSb82w=]
@@ -146,8 +146,6 @@ lookup_options:
      strategy: deep
  profiles::etcd::node::initial_cluster_token:
    convert_to: Sensitive
-  profiles::dns::updater::key_secret:
-    convert_to: Sensitive
  sysctl::base::values:
    merge:
      strategy: deep
@@ -178,8 +176,6 @@ lookup_options:
    convert_to: Sensitive
  stalwart::fallback_admin_password:
    convert_to: Sensitive
-  wireguard::interfaces:
-    convert_to: Sensitive

 facts_path: '/opt/puppetlabs/facter/facts.d'

@@ -210,28 +206,8 @@ vault::manage_config_dir: true
 vault::disable_mlock: false

 profiles::dns::base::nameservers:
-  - 198.18.200.7
+  - 198.18.19.16
 profiles::dns::master::basedir: '/var/named/sources'
-
-# dns record publishing. During the k8s cutover both methods run; set
-# manage_export false once k8s is authoritative.
-#   - export:   legacy exported-resources -> puppet DNS master
-#   - nsupdate: RFC2136 to the k8s bind-authoritative write endpoint (.9),
-#               inert until the TSIG key is set in eyaml:
-#                 profiles::dns::updater::key_secret: ENC[...]
-#               (must match the key the bind-authoritative zones allow-update
-#               with; algorithm hmac-sha256)
-# k8s is now authoritative: clients resolve via the k8s bind-resolvers
-# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the
-# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s
-# bind-authoritative cluster fed by the nsupdate path below. The legacy
-# exported-resources -> VM-master /var/named/sources files are no longer in any
-# client's resolution path, so stop exporting them. Rollback: set back to true.
-profiles::dns::updater::manage_export: false
-profiles::dns::updater::manage_nsupdate: true
-profiles::dns::updater::server: '198.18.200.9'
-profiles::dns::updater::key_name: 'client-update'
-profiles::dns::updater::key_algorithm: 'hmac-sha256'
 #profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
 #profiles::dns::base::use_ns: 'region'
 profiles::consul::server::members_role: roles::infra::storage::consul
@@ -369,7 +345,6 @@ ssh::server::options:

 profiles::ssh::knownhosts::lines:
  - '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1HD97vYxLTniE4qNpGuftUlvmkEXIuX8+7nbENv/IzsGUghEDRtyThjQ7ojNKIsQ7f8wXr0gMcI+fAPfrbcOMHCAoYMomikwL0b3h95SZI40q3CyM+0DMnwiVVDX6C1QxkO2Rv9cszSkCa85NotJhXiUuTBI9BFcRPy+mAhbpAru+bfypYofI0wW97XNTl8Jgwmni5MgutBIQAokFIn5ux8iWxndCH3AqDtmkwC5DfQeQ+wZx7rkwqJEpJffQzrjb1gIM6P9hDCVBBVPh/3o80IJ69rFWrJAZUb+JpG4cXJH0NcSW+wqc3JCT/x3q8VlHwOTXSlNNKtOJCRx73mB8e1XTTy2a9FgpKDDg5XQXWHAViJDz1RTRL9gRefMylRgKz4bXoTuY9kJWM8hPTyUejtukbJThlBJc3OmDxBZBF7F0iqB11pHexok43OCEiANodVa36eWu9/5X032Vm48fZ1/akDPY/NSy3wAn7kwut+A0/JAHFHASrq+1mt9YurkJegI+YHXO6eEWpBIpmI7ORHJbGL4MhkHrxYzVamuP8CkU7tXzsv138+wpOcRHNp9yJY4PT40BZkRf/O3O+jt3pj9Dj8rvgywF2W6hFzywh3Y78upOprRkQlQtHfsI8EyrYI8/hUw2u3H+3yPXh3YjWfqvWVG1BRLRHBV7m90uaw=='
-  - '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDi80G0GtKMdRj4azPwxbJW46NG0y8seSVSnvFm2Ka/nckdUb/3lRlQuPYf1tkbqqFlcXjDM8+u0tzM2kLsgfn0Dpujm1fuoA66yGGweBjtxLFErH5+6+/KND5I9w8LMY2AtVztnBk/CVx8RwgrooABDRZiBH7OOAOpJqqFI7LvEsv61zC0nAqbYJ8uxfx+r4lJ9dUhK1woitEqC4npSRUn5KJK+KAEd7AzcUkZb6TO9A3oRPz1nQ/qU+QNMmVUi+wRj9kJR18mxErugyLLTNcFDBqSdHNun3eUNBUmoS2cAa8ZVscOLzbUGejVK9UY06Q7wu+J34Fzl8CN5tBqRHGZ3ykqGZ6gG+O0Egr9Rm3Obgkujpio2uTh27LhBy72vjgJ8kTFmPlzANTJFpKlsy91usSFPh8WZeIo6VpPLqnC32rjfNkfqHyPAeJ3+rdOkUZoDjMoZc3wxxLZTgMU5ud1w4LxQNRkNiaT/tRRNQF8o+pygkS7xxKduBBMzYdRS1OifaS4gyvP82oOyquWywhyFNtG7ph8FQwc34puM7FyxfaJ0XL/+zAfPMhDoOojvofADJo73R+FgVyer+mCJw4KtWJ4JzZrNTYz1Xl8WlhF8RDzOYfSH46qzJFa9FcRqgP4LUkgzdvcQ+1hBFpvpHtw3vl3DiqtZDDbK9SyrEtdnw=='

 profiles::base::groups::local:
  admins:
@@ -403,7 +378,7 @@ networking::route_defaults:

 # logging:
 victorialogs::client::journald::enable: true
-victorialogs::client::journald::inserturl: https://logs-ingest.k8s.syd1.au.unkin.net:443/insert/journald
+victorialogs::client::journald::inserturl: https://vlinsert.service.consul:9428/insert/journald

 # FIXME these are for the proxmox ceph cluster
 profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
@@ -412,45 +387,6 @@ profiles::ceph::client::mons:
  - 10.18.15.2
  - 10.18.15.3

-# de96a98f cluster topology (prodnxsr0001-0019) - single source of truth for
-# /etc/ceph/ceph.conf rendered by profiles::ceph::client on the k8s (osd) and
-# incus (mon/mgr/mds) roles. fsid/mons are overridden per-role in the role hiera.
-# public_network is the /32 of every ceph host's ceph-public loopback.
-profiles::ceph::client::cluster_public_ips:
-  - 198.18.23.1
-  - 198.18.23.2
-  - 198.18.23.3
-  - 198.18.23.4
-  - 198.18.23.5
-  - 198.18.23.6
-  - 198.18.23.7
-  - 198.18.23.8
-  - 198.18.23.9
-  - 198.18.23.10
-  - 198.18.23.11
-  - 198.18.23.12
-  - 198.18.23.13
-  - 198.18.23.14
-  - 198.18.23.15
-  - 198.18.23.16
-  - 198.18.23.17
-  - 198.18.23.18
-  - 198.18.23.19
-profiles::ceph::client::mon_initial_members:
-  - prodnxsr0009
-  - prodnxsr0010
-  - prodnxsr0011
-  - prodnxsr0012
-  - prodnxsr0013
-# two mds daemon instances per mon/mgr/mds host (rendered only where
-# render_mds_config is true, i.e. the incus node role).
-profiles::ceph::client::mds_instances:
-  prodnxsr0009: 2
-  prodnxsr0010: 2
-  prodnxsr0011: 2
-  prodnxsr0012: 2
-  prodnxsr0013: 2
-
 profiles::ceph::conf::config:
  global:
    auth_client_required: 'cephx'
@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
  - syd1
@@ -2,16 +2,8 @@
 timezone::timezone: 'Australia/Sydney'
 certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
 profiles_dns_upstream_forwarder_unkin:
-  - 198.18.200.7
+  - 198.18.19.15
 profiles_dns_upstream_forwarder_consul:
  - 198.18.19.14
 profiles_dns_upstream_forwarder_k8s:
  - 198.18.19.20
-profiles::consul::client::members_lookup: false
-# static: k8s-compiled hosts can't see the servers in PuppetDB; update when servers change
-profiles::consul::client::consul_servers:
-  - ausyd1nxvm2005.main.unkin.net
-  - ausyd1nxvm2006.main.unkin.net
-  - ausyd1nxvm2007.main.unkin.net
-  - ausyd1nxvm2008.main.unkin.net
-  - ausyd1nxvm2009.main.unkin.net
@@ -1,9 +1,21 @@
 ---
-haproxy_server_k8s_syd1_traefik_internal: 'k8s-traefik-internal 198.18.200.4:443 ssl verify none check inter 2s rise 3 fall 2'
-haproxy_server_k8s_syd1_traefik_external: 'k8s-traefik-external 198.18.199.0:443 ssl verify none check inter 2s rise 3 fall 2'
-
 profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
-profiles::haproxy::dns::vrrp_cnames: []
+profiles::haproxy::dns::vrrp_cnames:
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - nzbget.main.unkin.net
+  - git.unkin.net
+  - fafflix.unkin.net
+  - grafana.unkin.net
+  - dashboard.ceph.unkin.net
+  - mail-webadmin.main.unkin.net
+  - mail-in.main.unkin.net
+  - mail.main.unkin.net
+  - autoconfig.main.unkin.net
+  - autodiscover.main.unkin.net

 profiles::haproxy::mappings:
  fe_http:
@@ -25,7 +37,6 @@ profiles::haproxy::mappings:
      - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
      - 'autoconfig.main.unkin.net be_stalwart_webadmin'
      - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
-      - 'auth.unkin.net be_k8s_kanidm'
  fe_https:
    ensure: present
    mappings:
@@ -45,7 +56,6 @@ profiles::haproxy::mappings:
      - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
      - 'autoconfig.main.unkin.net be_stalwart_webadmin'
      - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
-      - 'auth.unkin.net be_k8s_kanidm'

 profiles::haproxy::frontends:
  fe_http:
@@ -70,7 +80,6 @@ profiles::haproxy::frontends:
        - 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
        - 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
        - 'acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net'
-        - 'acl_kanidm req.hdr(host) -i auth.unkin.net'
        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
      use_backend:
        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -90,7 +99,6 @@ profiles::haproxy::frontends:
        - 'set-header X-Frame-Options DENY if acl_grafana'
        - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
        - 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
-        - 'set-header X-Frame-Options DENY if acl_kanidm'
        - 'set-header X-Content-Type-Options nosniff'
        - 'set-header X-XSS-Protection 1;mode=block'

@@ -312,26 +320,6 @@ profiles::haproxy::backends:
        - add-header X-Forwarded-Proto https if { dst_port 9443 }
      redirect: 'scheme https if !{ ssl_fc }'
      stick-table: 'type ip size 200k expire 30m'
-  be_k8s_kanidm:
-    description: Backend for Kanidm (auth.unkin.net via Kubernetes internal Traefik)
-    collect_exported: false
-    options:
-      balance: roundrobin
-      option:
-        - httpchk
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      http-check:
-        - 'connect ssl sni auth.unkin.net'
-        - 'send meth GET uri /status ver HTTP/1.1 hdr Host auth.unkin.net'
-        - 'expect status 200'
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      server: "%{lookup('haproxy_server_k8s_syd1_traefik_internal')} sni str(auth.unkin.net)"
  be_stalwart_imap:
    description: Backend for Stalwart IMAP (STARTTLS)
    collect_exported: false
@@ -405,7 +393,6 @@ profiles::haproxy::certlist::certificates:
  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/vault/certificate.pem

 # additional altnames
@@ -416,7 +403,9 @@ profiles::pki::vault::alt_names:
  - mail-webadmin.main.unkin.net

 # additional cnames
-profiles::haproxy::dns::cnames: []
+profiles::haproxy::dns::cnames:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net

 # letsencrypt certificates
 certbot::client::service: haproxy
@@ -433,4 +422,3 @@ certbot::client::domains:
  - git.unkin.net
  - grafana.unkin.net
  - dashboard.ceph.unkin.net
-  - auth.unkin.net
@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
  - drw1
@@ -1,3 +0,0 @@
---
-# Canary for the puppet-on-k8s migration (roles::base test host).
-profiles::puppet::migrate::enabled: true
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.21  # management loopback
-networking_loopback1_ip: 198.18.22.14  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.14  # ceph-public loopback
-networking_1000_ip: 198.18.15.14       # 1gbe network
-networking_2500_ip: 198.18.21.14       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:e5:c1
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:03
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.22  # management loopback
-networking_loopback1_ip: 198.18.22.15  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.15  # ceph-public loopback
-networking_1000_ip: 198.18.15.15       # 1gbe network
-networking_2500_ip: 198.18.21.15       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a6:30:c4
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:4f:f4
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.23  # management loopback
-networking_loopback1_ip: 198.18.22.16  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.16  # ceph-public loopback
-networking_1000_ip: 198.18.15.16       # 1gbe network
-networking_2500_ip: 198.18.21.16       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:9f:22:13
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:0c
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.24  # management loopback
-networking_loopback1_ip: 198.18.22.17  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.17  # ceph-public loopback
-networking_1000_ip: 198.18.15.17       # 1gbe network
-networking_2500_ip: 198.18.21.17       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: 8c:04:ba:9c:b6:08
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:12
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.25  # management loopback
-networking_loopback1_ip: 198.18.22.18  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.18  # ceph-public loopback
-networking_1000_ip: 198.18.15.18       # 1gbe network
-networking_2500_ip: 198.18.21.18       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:db:94
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:4f:fa
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.26  # management loopback
-networking_loopback1_ip: 198.18.22.19  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.19  # ceph-public loopback
-networking_1000_ip: 198.18.15.19       # 1gbe network
-networking_2500_ip: 198.18.21.19       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:56:11
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:00
@@ -1,45 +0,0 @@
---
-# primary interface is the WAN uplink; pin host identity to the dum0 loopback
-networking_loopback0_ip: 198.18.2.160
-networking_loopback1_ip: 198.18.21.160
-
-# dns: keep the local dnsmasq resolver
-profiles::dns::base::nameservers:
-  - 127.0.0.1
-profiles::dns::base::search:
-  - main.unkin.net
-profiles::dns::base::primary_interface: dum0
-profiles::dns::updater::deny_ranges:
-  - 198.18.199.0/24
-  - 198.18.200.0/24
-  - 10.42.0.0/16
-  - 10.43.0.0/16
-  - 10.10.12.0/24     # wg0
-  - 103.216.190.0/23  # wan uplink
-profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"
-
-# ssh: listen on localhost and dum0 only; knock out the common wan primary ip
-lookup_options:
-  ssh::server::options:
-    merge:
-      strategy: deep
-      knockout_prefix: '--'
-ssh::server::options:
-  ListenAddress:
-    - "--%{facts.networking.ip}"
-    - 127.0.0.1
-    - "%{hiera('networking_loopback0_ip')}"
-profiles::ssh::sign::principals:
-  - "%{hiera('networking_loopback0_ip')}"
-
-# frrouting
-frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
-frrouting::ospfd_interfaces:
-  dum0:
-    area: 0.0.0.0
-  dum1:
-    area: 0.0.0.0
-  bond0.201:
-    area: 0.0.0.0
-frrouting::ospf_preferred_source_enable: true
-frrouting::ospf_preferred_source: "%{hiera('networking_loopback1_ip')}"
@@ -1,7 +1,7 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
 crypto_policies::policy: 'DEFAULT'
-almalinux-base-repo: almalinux
+
 profiles::packages::include:
  network-scripts: {}

@@ -1,2 +0,0 @@
---
-almalinux-base-repo: almalinux-vault
@@ -1,7 +1,7 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
 crypto_policies::policy: 'DEFAULT:SHA1'
-almalinux-base-repo: almalinux
+
 profiles::yum::global::repos:
  crb:
    ensure: present
@@ -23,45 +23,45 @@ profiles::yum::global::repos:
    name: baseos
    descr: baseos repository
    target: /etc/yum.repos.d/baseos.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  extras:
    name: extras
    descr: extras repository
    target: /etc/yum.repos.d/extras.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  appstream:
    name: appstream
    descr: appstream repository
    target: /etc/yum.repos.d/appstream.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  highavailability:
    name: highavailability
    descr: highavailability repository
    target: /etc/yum.repos.d/highavailability.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  crb:
    ensure: absent
    name: crb
    descr: crb repository
    target: /etc/yum.repos.d/crb.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  powertools:
    ensure: absent
    name: powertools
    descr: powertools repository
    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
+    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  epel:
    name: epel
@@ -70,40 +70,14 @@ profiles::yum::global::repos:
    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
    mirrorlist: absent
-  rpm-internal:
-    name: rpm-internal
-    descr: rpm-internal repository
-    target: /etc/yum.repos.d/rpm-internal.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+  unkinben:
+    name: unkinben
+    descr: unkinben repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
+    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
    gpgcheck: false
    mirrorlist: absent
-    metadata_expire: '60'
-  rpm-vendor:
-    name: rpm-vendor
-    descr: rpm-vendor repository
-    target: /etc/yum.repos.d/rpm-vendor.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
-    gpgcheck: false
-    mirrorlist: absent
-    metadata_expire: '60'
-  # Per-release variants, resolved from the host's EL major version so el8
-  # hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
-  rpm-internal-release:
-    name: rpm-internal-el%{facts.os.release.major}
-    descr: rpm-internal-el%{facts.os.release.major} repository
-    target: /etc/yum.repos.d/rpm-internal-release.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent
-    metadata_expire: '60'
-  rpm-vendor-release:
-    name: rpm-vendor-el%{facts.os.release.major}
-    descr: rpm-vendor-el%{facts.os.release.major} repository
-    target: /etc/yum.repos.d/rpm-vendor-release.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent
-    metadata_expire: '60'

  # Additional repositories - default to absent, roles can override with ensure: present
  # FRRouting repositories
@@ -273,8 +247,8 @@ profiles::yum::global::repos:
    name: rpmfusion-free
    descr: rpmfusion-free repository
    target: /etc/yum.repos.d/rpmfusion-free.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    baseurl: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/
+    gpgkey: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
    gpgcheck: 1
    mirrorlist: absent
  rpmfusion-nonfree:
@@ -282,7 +256,15 @@ profiles::yum::global::repos:
    name: rpmfusion-nonfree
    descr: rpmfusion-nonfree repository
    target: /etc/yum.repos.d/rpmfusion-nonfree.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    baseurl: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/
+    gpgkey: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
    gpgcheck: 1
    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el%{facts.os.release.major}
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent
@@ -1,71 +0,0 @@
-# hieradata/os/Fedora/all_releases.yaml
---
-# Fedora reuses the RedHat osfamily code paths (dnf/yum, crypto-policies,
-# firewalld, openvox). Everything here keys off facts.os.release.major so a
-# future Fedora release only needs its artifactapi local repos created, not new
-# hieradata.
-
-# crypto-policies: use the distro default. Kept here (not per-release) so newer
-# Fedora releases inherit it for free.
-crypto_policies::policy: 'DEFAULT'
-
-# Puppet agent via OpenVox. RedHat-family builds for Fedora live under
-# openvox7/fedora/<major> (see profiles::puppet::agent).
-profiles::puppet::agent::openvox_enable: true
-
-lm-sensors::package: lm_sensors
-
-# Fedora-specific base setup (NetworkManager, future workstation/laptop hooks).
-hiera_include:
-  - profiles::fedora::base
-
-# Base package set adjustments for Fedora:
-#   - p7zip was dropped from Fedora; the real 7-Zip ships as "7zip"
-#   - dstat was removed from Fedora with no drop-in successor in the base set
-#   - iotop is provided by the C rewrite package "iotop-c"
-profiles::packages::exclude:
-  - p7zip
-  - dstat
-  - iotop
-profiles::packages::include:
-  7zip: {}
-  iotop-c: {}
-  crypto-policies-scripts: {}
-  lzo: {}
-  policycoreutils: {}
-  unar: {}
-  xz: {}
-
-profiles::yum::global::repos:
-  fedora:
-    name: fedora
-    descr: Fedora %{facts.os.release.major} - %{facts.os.architecture}
-    target: /etc/yum.repos.d/fedora.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/%{facts.os.release.major}/Everything/%{facts.os.architecture}/os/
-    gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
-    metalink: absent
-    mirrorlist: absent
-  updates:
-    name: updates
-    descr: Fedora %{facts.os.release.major} - %{facts.os.architecture} - Updates
-    target: /etc/yum.repos.d/fedora-updates.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/%{facts.os.release.major}/Everything/%{facts.os.architecture}/
-    gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
-    metalink: absent
-    mirrorlist: absent
-  rpm-internal:
-    name: rpm-internal-f%{facts.os.release.major}
-    descr: rpm-internal-f%{facts.os.release.major} repository
-    target: /etc/yum.repos.d/rpm-internal.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent
-    metadata_expire: '60'
-  rpm-vendor:
-    name: rpm-vendor-f%{facts.os.release.major}
-    descr: rpm-vendor-f%{facts.os.release.major} repository
-    target: /etc/yum.repos.d/rpm-vendor.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f%{facts.os.release.major}/
-    gpgcheck: false
-    mirrorlist: absent
-    metadata_expire: '60'
@@ -2,8 +2,6 @@
 hiera_include:
  - profiles::nginx::simpleproxy

-profiles::puppet::migrate::enabled: true
-
 profiles::yum::global::repos:
  ceph:
    ensure: present
@@ -67,9 +65,6 @@ profiles::nginx::simpleproxy::locations:
      - 127.0.0.1
      - "%{facts.networking.ip}"
      - 198.18.24.0/24
-      - 198.18.21.0/24
-      - 198.18.15.0/24
-      - 198.18.19.0/24
    location_deny:
      - all
  # authorised access from external
@@ -57,3 +57,5 @@ profiles::yum::global::repos:
    ensure: present
  rpmfusion-nonfree:
    ensure: present
+  unkinben:
+    ensure: present
@@ -14,9 +14,6 @@ profiles::pki::vault::alt_names:
  - radosgw.service.consul
  - radosgw.query.consul
  - "radosgw.service.%{facts.country}-%{facts.region}.consul"
-  # S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
-  # on the cert so TLS validates for that hostname.
-  - s3.ceph.unkin.net

 # additional repos
 profiles::yum::global::repos:
@@ -29,8 +26,6 @@ profiles::yum::global::repos:
 profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
 profiles::nginx::simpleproxy::nginx_aliases:
  - radosgw.service.au-syd1.consul
-  # nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
-  - s3.ceph.unkin.net
 profiles::nginx::simpleproxy::proxy_port: 7480
 profiles::nginx::simpleproxy::proxy_path: '/'
 nginx::client_max_body_size: 5000M
@@ -6,10 +6,8 @@ hiera_include:
 profiles::dns::resolver::acls:
  acl-main.unkin.net:
    addresses:
-      - 198.18.1.10/32
-      - 198.18.2.160/27
+      - 10.10.8.1/32
      - 198.18.21.160/27
-      - 198.18.2.192/27
      - 198.18.21.192/27
      - 198.18.13.0/24
      - 198.18.14.0/24
@@ -82,14 +82,8 @@ profiles::sql::postgresdb::dbname: gitea
 profiles::sql::postgresdb::dbuser: gitea

 # deploy gitea
-gitea::base_url: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/gitea'
-gitea::install::checksums:
-  1.26.2:
-    linux:
-      amd64: 5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a
-
-gitea::ensure: '1.26.2'
-gitea::checksum: '5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a'
+gitea::ensure: '1.22.4'
+gitea::checksum: 'd549104f55067e6fb156e7ba060c9af488f36e12d5e747db7563fcc99eaf8532'
 gitea::manage_user: false
 gitea::manage_group: false
 gitea::manage_home: false
@@ -5,17 +5,11 @@ hiera_include:
  - incus
  - zfs
  - profiles::ceph::node
-  - profiles::ceph::mon
-  - profiles::ceph::mgr
-  - profiles::ceph::mds
-  - profiles::ceph::osd
  - profiles::ceph::client
  - profiles::ceph::dashboard
  - profiles::storage::cephfsvols
  - exporters::frr_exporter

-profiles::puppet::migrate::enabled: true
-
 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
 python::manage_dev_package: false

@@ -105,7 +99,7 @@ profiles::yum::global::repos:
 profiles::dns::base::primary_interface: loopback0

 # dashboard/haproxy
-profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback2_ip')}"
+profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback0_ip')}"

 # networking
 systemd::manage_networkd: true
@@ -205,9 +199,7 @@ profiles::accounts::sysadmin::extra_groups:
  - incus-admin

 # manage cephfs mounts
-profiles::ceph::client::manage_ceph_conf: true
-# mon/mgr/mds host: render the [mds] + [mds.*] sections
-profiles::ceph::client::render_mds_config: true
+profiles::ceph::client::manage_ceph_conf: false
 profiles::ceph::client::manage_ceph_package: false
 profiles::ceph::client::manage_ceph_paths: false
 profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
@@ -2,75 +2,14 @@
 hiera_include:
  - profiles::selinux::setenforce
  - profiles::ceph::node
-  - profiles::ceph::osd
  - profiles::ceph::client
  - exporters::frr_exporter
  - frrouting
  - rke2

-profiles::puppet::migrate::enabled: true
-
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345
-# pull the airgap image bundle via artifactapi (host-reachable pre-CNI), not github directly
-rke2::container_archive_source: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download'
-rke2::manage_registries: true
-rke2::registries:
-  docker.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "dockerhub/$1"
-    disable-default-registry-endpoint: true
-  ghcr.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "ghcr/$1"
-    disable-default-registry-endpoint: true
-  quay.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "quay/$1"
-    disable-default-registry-endpoint: true
-  registry.k8s.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "k8s-registry/$1"
-    disable-default-registry-endpoint: true
-  registry.gitlab.com:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "gitlab/$1"
-    disable-default-registry-endpoint: true
-  docker.elastic.co:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "elastic/$1"
-    disable-default-registry-endpoint: true
-  gcr.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "gcr/$1"
-    disable-default-registry-endpoint: true
-  docker.litellm.ai:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "litellm/$1"
-    disable-default-registry-endpoint: true
-  public.ecr.aws:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "ecr-public/$1"
-    disable-default-registry-endpoint: true
 rke2::config_hash:
  bind-address: "%{hiera('networking_loopback0_ip')}"
  node-ip: "%{hiera('networking_loopback0_ip')}"
@@ -94,7 +33,7 @@ profiles::packages::include:

 profiles::selinux::setenforce::mode: disabled

-profiles::ceph::client::manage_ceph_conf: true
+profiles::ceph::client::manage_ceph_conf: false
 profiles::ceph::client::manage_ceph_package: false
 profiles::ceph::client::manage_ceph_paths: false
 profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
@@ -186,17 +125,6 @@ frrouting::ospf_exclude_k8s_enable: true
 frrouting::k8s_cluster_cidr: '10.42.0.0/16'  # RKE2 cluster-cidr (pods)
 frrouting::k8s_service_cidr: '10.43.0.0/16'  # RKE2 service-cidr

-# sysctl recommendations
-sysctl::base::values:
-  net.ipv4.conf.default.rp_filter:
-    value: '0'
-  net.ipv4.conf.all.rp_filter:
-    value: '0'
-  fs.inotify.max_user_watches:
-    value: '524288'
-  fs.inotify.max_user_instances:
-    value: '512'
-
 # add loopback interfaces to ssh list
 ssh::server::options:
  ListenAddress:
@@ -30,9 +30,6 @@ rke2::config_hash:
    - '--node-monitor-period=4s'
  protect-kernel-defaults: true
  disable-kube-proxy: false
-  # taint the control-plane/etcd nodes so only tolerating workloads schedule here
-  node-taint:
-    - "node-role.kubernetes.io/control-plane=true:NoSchedule"

 # configure consul service
 consul::services:
@@ -33,7 +33,7 @@ profiles::packages::include:

 profiles::selinux::setenforce::mode: disabled

-profiles::ceph::client::manage_ceph_conf: true
+profiles::ceph::client::manage_ceph_conf: false
 profiles::ceph::client::manage_ceph_package: false
 profiles::ceph::client::manage_ceph_paths: false
 profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
@@ -11,7 +11,6 @@ profiles::metrics::grafana::db_name: "%{hiera('profiles::sql::postgresdb::dbname
 profiles::metrics::grafana::db_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
 profiles::metrics::grafana::db_pass: "%{hiera('profiles::sql::postgresdb::dbpass')}"
 profiles::metrics::grafana::pgsql_backend: true
-profiles::metrics::grafana::version: '13.0.2'
 profiles::metrics::grafana::plugins:
  victoriametrics-logs-datasource:
    ensure: present
@@ -1,30 +0,0 @@
---
-hiera_include:
-  - frrouting
-  - exporters::frr_exporter
-
-# routing
-sysctl::base::values:
-  net.ipv4.ip_forward:
-    value: '1'
-  net.ipv4.conf.all.rp_filter:
-    value: '0'
-  net.ipv4.conf.default.rp_filter:
-    value: '0'
-  # overrides 50-redhat.conf's per-interface rp_filter=1 (applied by udev on link add); sysctl -n can't glob, so no enforce
-  net.ipv4.conf.*.rp_filter:
-    value: '0'
-    enforce: false
-
-# frrouting
-exporters::frr_exporter::enable: true
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::daemons:
-  ospfd: true
-
-# consul
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: frr_exporter
-    disposition: write
@@ -16,4 +16,3 @@ certbot::domains:
  - git.unkin.net
  - grafana.unkin.net
  - dashboard.ceph.unkin.net
-  - auth.unkin.net
@@ -1,6 +1,5 @@
 ---
 profiles::puppet::autosign::subnet_ranges:
-  - '198.18.2.0/24'
  - '198.18.13.0/24'
  - '198.18.14.0/24'
  - '198.18.15.0/24'
@@ -27,20 +26,7 @@ profiles::puppet::cobbler_enc::packages:
  - 'requests'
  - 'PyYAML'
 profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
-
-# Deep-merged with the entries in roles/infra/puppet.yaml.
-profiles::packages::include:
-  encapic:
-    ensure: '0.2.0'
-  certmanager:
-    ensure: '0.2.0'
-  sshsignhost:
-    ensure: '0.1.0'
-
-profiles::puppet::encapic::encapi_url: https://encapi.k8s.syd1.au.unkin.net
-profiles::puppet::server::external_nodes: '/usr/bin/encapic-enc'
-
-profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
+profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkin/puppet-r10k.git
 profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
 profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
 profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
@@ -61,9 +47,10 @@ profiles::helpers::certmanager::vault_config:

 profiles::helpers::sshsignhost::vault_config:
  addr: 'https://vault.service.consul:8200'
-  mount_point: 'sshca'
+  mount_point: 'ssh-host-signer'
  approle_path: 'approle'
-  role_name: 'signhost'
+  role_name: 'hostrole'
+  output_path: '/tmp/sshsignhost'
  role_id: "%{lookup('sshsignhost::role_id')}"

 profiles::puppet::server::agent_server: 'puppet.query.consul'
@@ -13,19 +13,9 @@ profiles::consul::server::addresses:
  grpc_tls: "%{::networking.ip}"
 profiles::consul::server::ports:
  grpc: 8502
-  grpc_tls: 8503
  dns: 8600
  http: 8500
  https: -1
-profiles::consul::server::tls:
-  defaults:
-    ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
-    cert_file: /etc/pki/tls/vault/full_chain.crt
-    key_file: /etc/pki/tls/vault/private.key
-  internal_rpc:
-    verify_incoming: false
-    verify_outgoing: false
-    verify_server_hostname: false
 profiles::consul::server::acl:
  enabled: true
  default_policy: 'deny'
@@ -41,8 +31,6 @@ profiles::pki::vault::alt_names:
  - consul.service.consul
  - "consul.service.%{facts.country}-%{facts.region}.consul"
  - consul
-  - "server.%{facts.country}-%{facts.region}.consul"
-  - "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"

 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'
@@ -58,18 +46,6 @@ profiles::consul::client::node_rules:
  - resource: service
    segment: frr_exporter
    disposition: write
-  - resource: service
-    segment: mesh-gateway
-    disposition: write
-  - resource: service_prefix
-    segment: ''
-    disposition: read
-  - resource: node_prefix
-    segment: ''
-    disposition: read
-  - resource: agent_prefix
-    segment: ''
-    disposition: read
 profiles::consul::prepared_query::rules:
  vault:
    ensure: 'present'
@@ -27,24 +27,4 @@ profiles::nginx::simpleproxy::proxy_port: 8200
 profiles::nginx::simpleproxy::proxy_path: '/'

 profiles::packages::include:
-  # openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
  openbao-plugins: {}
-  # Secrets plugins pinned to the exact version whose binary matches the sha256
-  # registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
-  # on upgrade, or OpenBao refuses to launch the plugin after a restart.
-  openbao-plugin-secrets-litellm:
-    ensure: '0.1.1'
-  openbao-plugin-secrets-gpg:
-    ensure: '0.1.0'
-  openbao-plugin-secrets-rancher:
-    ensure: '0.1.1'
-  openbao-plugin-secrets-gitea:
-    ensure: '0.1.0'
-  openbao-plugin-secrets-apptoken:
-    ensure: '0.1.0'
-  openbao-plugin-secrets-netbox:
-    ensure: '0.1.0'
-  openbao-plugin-secrets-ghp:
-    ensure: '0.1.0'
-  openbao-plugin-secrets-arrstack:
-    ensure: '0.2.0'
@@ -1,8 +1,3 @@
 ---
-# physical hosts only (facts.virtual == 'physical'); merged 'unique' with the
-# common hiera_include in profiles::base.
-hiera_include:
-  - profiles::lldpd
-
 profiles::packages::include:
  "%{hiera('lm-sensors::package')}": {}
@@ -1,51 +0,0 @@
-# manage dnsmasq as a dns forwarder and dhcp relay
-class dnsmasq (
-  Boolean $manage_package                    = true,
-  Boolean $manage_service                    = true,
-  String  $package_name                      = 'dnsmasq',
-  String  $service_name                      = 'dnsmasq',
-  Stdlib::Absolutepath $config_file          = '/etc/dnsmasq.conf',
-  Stdlib::Absolutepath $config_dir           = '/etc/dnsmasq.d',
-  Boolean $purge_config_dir                  = false,
-  Array[String] $interfaces                  = [],
-  Array[Stdlib::IP::Address] $listen_addresses = ['127.0.0.1'],
-  Enum['bind-interfaces', 'bind-dynamic', 'none'] $bind_mode = 'bind-interfaces',
-  Boolean $no_resolv                         = false,
-  Array[String] $servers                     = [],
-  Hash[String, Array[String]] $forwards      = {},
-  Optional[Integer[0]] $cache_size           = undef,
-  Boolean $domain_needed                     = true,
-  Boolean $bogus_priv                        = true,
-  Array[String] $dhcp_relays                 = [],
-  Array[String] $options                     = [],
-) {
-
-  if $manage_package {
-    package { $package_name:
-      ensure => installed,
-      before => File[$config_file, $config_dir],
-    }
-  }
-
-  file { $config_dir:
-    ensure  => directory,
-    recurse => $purge_config_dir,
-    purge   => $purge_config_dir,
-  }
-
-  file { $config_file:
-    ensure  => file,
-    owner   => 'root',
-    group   => 'root',
-    mode    => '0644',
-    content => template('dnsmasq/dnsmasq.conf.erb'),
-  }
-
-  if $manage_service {
-    service { $service_name:
-      ensure    => running,
-      enable    => true,
-      subscribe => File[$config_file, $config_dir],
-    }
-  }
-}
@@ -1,40 +0,0 @@
-# THIS FILE IS MANAGED BY PUPPET
-user=dnsmasq
-group=dnsmasq
-conf-dir=<%= @config_dir %>,.rpmnew,.rpmsave,.rpmorig
-
-<% @interfaces.each do |iface| -%>
-interface=<%= iface %>
-<% end -%>
-<% unless @listen_addresses.empty? -%>
-listen-address=<%= @listen_addresses.join(',') %>
-<% end -%>
-<% unless @bind_mode == 'none' -%>
-<%= @bind_mode %>
-<% end -%>
-<% if @no_resolv -%>
-no-resolv
-<% end -%>
-<% if @domain_needed -%>
-domain-needed
-<% end -%>
-<% if @bogus_priv -%>
-bogus-priv
-<% end -%>
-<% if @cache_size -%>
-cache-size=<%= @cache_size %>
-<% end -%>
-<% @servers.each do |server| -%>
-server=<%= server %>
-<% end -%>
-<% @forwards.keys.sort.each do |domain| -%>
-<% @forwards[domain].each do |server| -%>
-server=/<%= domain %>/<%= server %>
-<% end -%>
-<% end -%>
-<% @dhcp_relays.each do |relay| -%>
-dhcp-relay=<%= relay %>
-<% end -%>
-<% @options.each do |line| -%>
-<%= line %>
-<% end -%>
@@ -28,8 +28,8 @@ class externaldns::master inherits externaldns {
      dynamic         => true,
      allow_updates   => ['key externaldns-key'],
      allow_transfers => empty($slave_ips) ? {
-        true  => ['key externaldns-key'],
-        false => ['key externaldns-key','dns-slaves'],
+        true  => [],
+        false => ['dns-slaves'],
      },
      ns_notify       => !empty($slave_ips),
      also_notify     => $slave_ips,
@@ -42,4 +42,4 @@ class externaldns::master inherits externaldns {
    recursion => false,
    zones     => $externaldns::k8s_zones,
  }
-}
+}
@@ -22,12 +22,7 @@ class incus::cluster (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require 'facter'
-
-Facter.add(:ceph_osd_devices) do
-  confine kernel: 'Linux'
-  confine { Facter.value(:is_virtual) == false }
-  confine { Facter::Core::Execution.which('pvs') }
-  setcode do
-    devices = []
-    output = Facter::Core::Execution.execute(
-      'pvs --noheadings -o pv_name,vg_name 2>/dev/null',
-      on_fail: nil
-    )
-    output&.each_line do |line|
-      pv_name, vg_name = line.split
-      next unless pv_name && vg_name
-
-      devices << pv_name if vg_name.start_with?('ceph-')
-    end
-    devices.sort
-  end
-end
@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-
-require 'facter'
-
-# Detects active ceph service instances via systemctl and exposes facts
-# for use in ceph service management profiles.
-# rubocop:disable Style/ClassAndModuleChildren
-module Unkin
-  module Ceph
-    # Detects active ceph service instances via systemctl and exposes Facter facts.
-    module Utils
-      TYPES = %w[mon mgr mds osd].freeze
-
-      def self.services
-        output = Facter::Core::Execution.execute(
-          'systemctl list-units "ceph*" --no-legend --plain --all 2>/dev/null',
-          on_fail: ''
-        )
-        parse_units(output)
-      end
-
-      def self.parse_units(output)
-        result = TYPES.each_with_object({}) { |type, hash| hash[type] = [] }
-        output.each_line do |line|
-          unit = line.split.first
-          next unless unit
-
-          match_unit(result, unit)
-        end
-        result
-      end
-
-      def self.match_unit(result, unit)
-        TYPES.each do |type|
-          match = unit.match(/\Aceph-#{type}@(.+)\.service\z/)
-          result[type] << "ceph-#{type}@#{match[1]}" if match
-        end
-      end
-
-      TYPES.each do |type|
-        define_singleton_method(:"#{type}?") { !services[type].empty? }
-      end
-    end
-  end
-end
-# rubocop:enable Style/ClassAndModuleChildren
-
-Facter.add('ceph_services') do
-  setcode { Unkin::Ceph::Utils.services }
-end
-
-Unkin::Ceph::Utils::TYPES.each do |type|
-  Facter.add("is_ceph_#{type}") do
-    setcode { Unkin::Ceph::Utils.public_send(:"#{type}?") }
-  end
-end
@@ -1,88 +0,0 @@
-# frozen_string_literal: true
-
-# lib/facter/dns_records.rb
-#
-# Reports this host's expected DNS records (assembled by profiles::dns::updater
-# into its records file) versus what is currently deployed on the authoritative
-# server, so puppet can detect drift and re-apply.
-#
-# Structured value:
-#   { server, count, expected => [{zone,fqdn,type,ttl,value}], in_sync,
-#     drift => [{...,deployed => [...]}] }
-
-# Helpers for the dns_records fact.
-module DnsRecordsFact
-  RECORDS_FILE = '/var/lib/dns-updater/records'
-  SERVER_FILE  = '/var/lib/dns-updater/server'
-
-  module_function
-
-  # normalise a value for comparison: strip, drop trailing dot, downcase
-  def norm(value)
-    value.to_s.strip.chomp('.').downcase
-  end
-
-  def server
-    File.exist?(SERVER_FILE) ? File.read(SERVER_FILE).strip : nil
-  end
-
-  # a name relative to a zone (or @) as a fully-qualified name
-  def to_fqdn(name, zone)
-    return "#{zone}." if name.to_s.empty? || name == '@'
-
-    "#{name}.#{zone}."
-  end
-
-  # parse one "zone|name|type|ttl|value" line into a record hash (nil to skip)
-  def parse_line(line)
-    line = line.strip
-    return nil if line.empty? || line.start_with?('#')
-
-    zone, name, type, ttl, value = line.split('|', 5)
-    return nil unless zone && type && value
-
-    { 'zone' => zone, 'fqdn' => to_fqdn(name, zone), 'type' => type, 'ttl' => ttl, 'value' => value }
-  end
-
-  # parse the records file into record hashes
-  def expected
-    return [] unless File.exist?(RECORDS_FILE)
-
-    File.readlines(RECORDS_FILE).filter_map { |line| parse_line(line) }
-  end
-
-  # the values currently deployed for a record, per the authoritative server
-  def deployed(record, srv)
-    cmd = ['dig', '+short', '+time=2', '+tries=1']
-    cmd << "@#{srv}" if srv && !srv.empty?
-    cmd += [record['fqdn'], record['type']]
-    out = Facter::Core::Execution.execute(cmd.join(' '), on_fail: '')
-    out.to_s.split("\n").map { |line| norm(line) }.reject(&:empty?)
-  end
-
-  def report
-    srv = server
-    exp = expected
-    drift = exp.filter_map do |record|
-      dep = deployed(record, srv)
-      record.merge('deployed' => dep) unless dep.include?(norm(record['value']))
-    end
-    { 'server' => srv, 'count' => exp.length, 'expected' => exp, 'in_sync' => drift.empty?, 'drift' => drift }
-  end
-end
-
-Facter.add(:dns_records) do
-  confine kernel: 'Linux'
-  setcode do
-    File.exist?(DnsRecordsFact::RECORDS_FILE) ? DnsRecordsFact.report : nil
-  end
-end
-
-# Convenience boolean for `if $facts['dns_records_insync']` guards.
-Facter.add(:dns_records_insync) do
-  confine kernel: 'Linux'
-  setcode do
-    v = Facter.value(:dns_records)
-    v.nil? ? nil : v['in_sync']
-  end
-end
@@ -3,21 +3,13 @@
 require 'facter'
 require 'yaml'
 require 'net/http'
-require 'openssl'
 require 'uri'
 require 'fileutils'

-# EncapiENC module: Fetches ENC data from encapi, caches it, and provides structured facts.
-module EncapiENC
+# CobblerENC module: Fetches ENC data from Cobbler, caches it, and provides structured facts.
+module CobblerENC
  CACHE_FILE = '/var/cache/puppet_enc.yaml'
  CACHE_TTL = 7 * 24 * 60 * 60 # 7 days in seconds
-  # Facter runs under Puppet's vendored ruby, whose OpenSSL trusts only
-  # /opt/puppetlabs/puppet/ssl/cert.pem and never the system trust store, so the
-  # estate CA anchor profiles::pki::vaultca installs has to be named explicitly.
-  CA_BUNDLE_PATHS = [
-    '/etc/pki/ca-trust/source/anchors/vaultcaroot.pem',
-    '/usr/local/share/ca-certificates/vaultcaroot.pem'
-  ].freeze
  @enc_data = nil # In-memory cache for the ENC response

  def self.read_cache
@@ -37,22 +29,9 @@ module EncapiENC
    File.write(CACHE_FILE, cache_data.to_yaml)
  end

-  def self.ca_bundle
-    CA_BUNDLE_PATHS.find { |path| File.exist?(path) }
-  end
-
-  def self.http_client(uri)
-    client = Net::HTTP.new(uri.host, uri.port)
-    client.use_ssl = true
-    client.verify_mode = OpenSSL::SSL::VERIFY_PEER
-    bundle = ca_bundle
-    client.ca_file = bundle if bundle
-    client
-  end
-
-  def self.fetch_from_encapi
-    uri = URI("https://encapi.k8s.syd1.au.unkin.net/cblr/svc/op/puppet/hostname/#{Facter.value(:fqdn) || Facter.value(:hostname)}")
-    response = http_client(uri).request(Net::HTTP::Get.new(uri))
+  def self.fetch_from_cobbler
+    uri = URI("http://cobbler.main.unkin.net/cblr/svc/op/puppet/hostname/#{Facter.value(:fqdn) || Facter.value(:hostname)}")
+    response = Net::HTTP.get_response(uri)

    raise "Failed to fetch ENC data. HTTP #{response.code}" unless response.is_a?(Net::HTTPSuccess)

@@ -62,7 +41,7 @@ module EncapiENC
  def self.retrieve_enc_data
    return @enc_data if @enc_data

-    @enc_data = fetch_from_encapi
+    @enc_data = fetch_from_cobbler
    write_cache(@enc_data)
    @enc_data
  end
@@ -70,26 +49,26 @@ module EncapiENC
  def self.fetch_enc_data
    retrieve_enc_data
  rescue StandardError => e
-    Facter.warn("Error retrieving encapi ENC data: #{e.message}")
+    Facter.warn("Error retrieving Cobbler ENC data: #{e.message}")
    @enc_data = read_cache
    return @enc_data unless @enc_data.empty?

-    raise 'No cached ENC data available and encapi is unreachable.'
+    raise 'No cached ENC data available and Cobbler is down.'
  end

  def self.enc_role
-    fetch_enc_data.fetch('classes', {}).keys.first || raise('ENC Role not found in encapi ENC response')
+    fetch_enc_data.fetch('classes', {}).keys.first || raise('ENC Role not found in Cobbler ENC response')
  end

  def self.enc_env
-    fetch_enc_data.fetch('environment', nil) || raise('ENC Environment not found in encapi ENC response')
+    fetch_enc_data.fetch('environment', nil) || raise('ENC Environment not found in Cobbler ENC response')
  end
 end

 Facter.add('enc_role') do
-  setcode { EncapiENC.enc_role }
+  setcode { CobblerENC.enc_role }
 end

 Facter.add('enc_env') do
-  setcode { EncapiENC.enc_env }
+  setcode { CobblerENC.enc_env }
 end
@@ -1,104 +0,0 @@
-# frozen_string_literal: true
-
-require 'facter'
-require 'json'
-
-# Exposes LLDP neighbour topology (switch/port each interface is cabled to) as
-# the structured `lldp` fact, keyed by local interface. This is the only source
-# of physical switch/port topology in the estate and feeds NetBox. Uses
-# `lldpctl -f json0`: json0 wraps every node in an array regardless of
-# cardinality, so one neighbour and many neighbours parse identically (plain
-# `keyvalue` folds the neighbour's sysname into the key path, and plain `json`
-# collapses single-element arrays into objects). Never raises: any error or a
-# down daemon yields an empty hash so a puppet run can never break.
-module LldpFact
-  SOCKETS = ['/run/lldpd.socket', '/var/run/lldpd.socket'].freeze
-
-  module_function
-
-  # First element of a json0 node (everything is array-wrapped), or the value
-  # itself if it is not an array; nil when absent.
-  def first(node)
-    node.is_a?(Array) ? node[0] : node
-  end
-
-  # Array form of a json0 node whatever its cardinality.
-  def list(node)
-    node.is_a?(Array) ? node : [node].compact
-  end
-
-  # Value string of a json0 leaf like [{ 'value' => 'x' }].
-  def leaf(node)
-    entry = first(node)
-    entry.is_a?(Hash) ? entry['value'] : entry
-  end
-
-  # Chassis MAC from its id list, preferring the entry typed 'mac'.
-  def chassis_mac(chassis)
-    ids = list(chassis['id'])
-    mac = ids.find { |id| id.is_a?(Hash) && id['type'] == 'mac' } || ids.first
-    mac.is_a?(Hash) ? mac['value'] : nil
-  end
-
-  # Topology record for one local interface, or nil when it has no neighbour.
-  def neighbour(iface)
-    chassis = first(iface['chassis'])
-    port    = first(iface['port'])
-    return nil unless chassis && port
-
-    chassis_fields(chassis).merge(port_fields(port, first(iface['vlan'])))
-  end
-
-  def chassis_fields(chassis)
-    {
-      'neighbor_chassis_name' => leaf(chassis['name']),
-      'neighbor_chassis_mac' => chassis_mac(chassis),
-      'neighbor_chassis_descr' => leaf(chassis['descr'])
-    }
-  end
-
-  def port_fields(port, vlan)
-    port_id = first(port['id'])
-    vlan_h  = vlan.is_a?(Hash) ? vlan : {}
-    {
-      'neighbor_port_id' => port_id.is_a?(Hash) ? port_id['value'] : port_id,
-      'neighbor_port_descr' => leaf(port['descr']),
-      'vlan_id' => vlan_h['vlan-id'],
-      'vlan_name' => vlan_h['value']
-    }
-  end
-
-  def interfaces(output)
-    lldp = first(JSON.parse(output)['lldp']) || {}
-    list(lldp['interface'])
-  end
-
-  # Map of local interface => topology record, skipping interfaces with no
-  # neighbour.
-  def collect(ifaces)
-    ifaces.each_with_object({}) do |iface, acc|
-      next unless iface.is_a?(Hash)
-
-      name = iface['name']
-      data = neighbour(iface)
-      acc[name] = data if name && data
-    end
-  end
-
-  def resolve
-    output = Facter::Core::Execution.execute('lldpctl -f json0 2>/dev/null', on_fail: nil)
-    return {} if output.to_s.empty?
-
-    collect(interfaces(output))
-  rescue StandardError
-    {}
-  end
-end
-
-Facter.add(:lldp) do
-  confine kernel: 'Linux'
-  confine { Facter.value(:is_virtual) == false }
-  confine { Facter::Core::Execution.which('lldpctl') }
-  confine { LldpFact::SOCKETS.any? { |path| File.exist?(path) } }
-  setcode { LldpFact.resolve }
-end
@@ -5,7 +5,6 @@ require 'ipaddr'
 # a class that creates facts based on the subnet
 class SubnetAttributes
  SUBNET_TO_ATTRIBUTES = {
-    '198.18.2.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # router loopbacks
    '198.18.13.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
    '198.18.14.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
    '198.18.15.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
@@ -6,8 +6,8 @@ class nzbget (
  $manage_group       = $nzbget::params::manage_group,
  $service_enable     = $nzbget::params::service_enable,
  $service_name       = $nzbget::params::service_name,
-  $bind_address       = $nzbget::params::bind_address,
-  $port               = $nzbget::params::port,
+  $bind_address       = $sonarr::params::bind_address,
+  $port               = $sonarr::params::port,
 ) inherits nzbget::params {

  include nzbget::install
@@ -20,12 +20,7 @@ class redisha::redis (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${redisha_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -23,12 +23,7 @@ class redisha::sentinel (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${redisha_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -7,8 +7,6 @@ class rke2::config (
  Stdlib::Fqdn            $bootstrap_node = $rke2::bootstrap_node,
  String                  $node_token = $rke2::node_token,
  Array[String[1]]        $extra_config_files = $rke2::extra_config_files,
-  Boolean                 $manage_registries = $rke2::manage_registries,
-  Hash                    $registries = $rke2::registries,
 ){

  # if its not the bootstrap node, add join path to config
@@ -30,24 +28,6 @@ class rke2::config (
    $config = $config_hash
  }

-  if $manage_registries {
-    file { '/etc/rancher/rke2/registries.yaml':
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => epp('rke2/registries.yaml.epp', { registries => $registries }),
-      require => Package["rke2-${node_type}"],
-      notify  => Service["rke2-${node_type}"],
-    }
-  }else{
-    file { '/etc/rancher/rke2/registries.yaml':
-      ensure  => absent,
-      require => Package["rke2-${node_type}"],
-      notify  => Service["rke2-${node_type}"],
-    }
-  }
-
  # create the config file
  file { $config_file:
    ensure  => file,
@@ -12,8 +12,6 @@ class rke2 (
  Hash                    $helm_repos = $rke2::params::helm_repos,
  Array[String[1]]        $extra_config_files = $rke2::params::extra_config_files,
  Stdlib::HTTPUrl         $container_archive_source = $rke2::params::container_archive_source,
-  Boolean                 $manage_registries = $rke2::params::manage_registries,
-  Hash                    $registries = $rke2::params::registries,
 ) inherits rke2::params {

  include rke2::install
@@ -6,17 +6,10 @@ class rke2::install (
  Stdlib::HTTPUrl         $container_archive_source = $rke2::container_archive_source,
 ){

-  # versionlock rke2 before install so the lock exists before any upgrade is attempted
+  # versionlock rke2
  yum::versionlock{"rke2-${node_type}":
    ensure  => present,
    version => "${rke2_version}~${rke2_release}",
-    before  => Package["rke2-${node_type}"],
-  }
-
-  # lock rke2-common (a strict = version dep) so the rolling latest channel can't drift it ahead of the pinned server/agent
-  yum::versionlock{'rke2-common':
-    ensure  => present,
-    version => "${rke2_version}~${rke2_release}",
  }

  # install rke2
@@ -34,10 +27,10 @@ class rke2::install (
    before  => Service["rke2-${node_type}"],
  }

-  # preload the airgap bundle (has the default canal CNI images) so canal starts from disk, not the mirror VIP that needs flannel first
+  # download required archive of containers
  archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
    ensure  => present,
-    source  => "${container_archive_source}/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
+    source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
    require => [
      Package["rke2-${node_type}"],
      File['/var/lib/rancher/rke2/agent/images'],
@@ -1,8 +1,8 @@
 # rke2 params
 class rke2::params (
  Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.13',
-  String                  $rke2_release = 'rke2r2',
+  String                  $rke2_version = '1.33.4',
+  String                  $rke2_release = 'rke2r1',
  Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
  Hash                    $config_hash = {},
  Stdlib::HTTPSUrl        $join_url = 'https://127.0.0.1:9345',
@@ -12,6 +12,4 @@ class rke2::params (
  Hash                    $helm_repos = {},
  Array[String[1]]        $extra_config_files = [],
  Stdlib::HTTPUrl         $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
-  Boolean                 $manage_registries = false,
-  Hash                    $registries = {},
 ) {}
@@ -1,20 +0,0 @@
-<%- | Hash $registries | -%>
---
-# DO NOT MODIFY - MANAGED BY PUPPET
-mirrors:
-<%- $registries.each |$registry, $config| { -%>
-  <%= $registry %>:
-    endpoint:
-<%- $config['endpoint'].each |$ep| { -%>
-      - "<%= $ep %>"
-<%- } -%>
-<%- if $config['rewrite'] { -%>
-    rewrite:
-<%- $config['rewrite'].each |$pattern, $replacement| { -%>
-      "<%= $pattern %>": "<%= $replacement %>"
-<%- } -%>
-<%- } -%>
-<%- if $config['disable-default-registry-endpoint'] { -%>
-    disable-default-registry-endpoint: true
-<%- } -%>
-<%- } -%>
@@ -167,13 +167,7 @@ class stalwart (

  # Query cluster members for validation
  $cluster_query = "enc_role='${cluster_role}' and country='${facts['country']}' and region='${facts['region']}'"
-  $cluster_members_raw = puppetdb_query(
-    "facts[certname] {
-      name = 'enc_role' and value = '${cluster_role}' and
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-    }"
-  ).map |$fact| { $fact['certname'] }
+  $cluster_members_raw = query_nodes($cluster_query, 'networking.fqdn')
  $cluster_members = $cluster_members_raw ? {
    undef   => [],
    default => $cluster_members_raw,
@@ -186,20 +180,7 @@ class stalwart (

  # Query HAProxy nodes for proxy trusted networks
  $haproxy_query = "enc_role='${haproxy_role}' and country='${facts['country']}' and region='${facts['region']}'"
-  $haproxy_members_raw = puppetdb_query(
-    "facts[certname,value] {
-      name = 'networking' and
-      certname in facts[certname] {
-        name = 'enc_role' and value = '${haproxy_role}'
-      } and
-      certname in facts[certname] {
-        name = 'country' and value = '${facts['country']}'
-      } and
-      certname in facts[certname] {
-        name = 'region' and value = '${facts['region']}'
-      }
-    }"
-  ).map |$fact| { $fact['value']['ip'] }
+  $haproxy_members_raw = query_nodes($haproxy_query, 'networking.ip')
  $haproxy_ips = $haproxy_members_raw ? {
    undef   => [],
    default => sort($haproxy_members_raw),
@@ -1,44 +0,0 @@
-# manage wireguard interfaces via wg-quick
-class wireguard (
-  Boolean                        $manage_package = true,
-  String                         $package_name   = 'wireguard-tools',
-  Variant[Hash, Sensitive[Hash]] $interfaces = {},
-) {
-
-  if $manage_package {
-    package { $package_name:
-      ensure => installed,
-      before => File['/etc/wireguard'],
-    }
-  }
-
-  file { '/etc/wireguard':
-    ensure => directory,
-    owner  => 'root',
-    group  => 'root',
-    mode   => '0700',
-  }
-
-  # hiera hands eyaml secrets over as plain strings inside the (Sensitive) hash; re-wrap them per resource
-  $raw = $interfaces ? {
-    Sensitive => $interfaces.unwrap,
-    default   => $interfaces,
-  }
-
-  $raw.each |String $iface, Hash $data| {
-    $peers = $data.get('peers', []).map |Hash $peer| {
-      $peer['preshared_key'] =~ String ? {
-        true    => $peer + { 'preshared_key' => Sensitive($peer['preshared_key']) },
-        default => $peer,
-      }
-    }
-    $private_key = $data['private_key'] =~ String ? {
-      true    => Sensitive($data['private_key']),
-      default => $data['private_key'],
-    }
-
-    wireguard::interface { $iface:
-      * => $data + { 'peers' => $peers, 'private_key' => $private_key },
-    }
-  }
-}
@@ -1,63 +0,0 @@
-# manage one wg-quick interface; without private_key, /etc/wireguard/<iface>.key is generated once and loaded via PostUp
-define wireguard::interface (
-  Array[Stdlib::IP::Address]           $addresses,
-  Optional[Stdlib::Port]               $listen_port = undef,
-  Optional[Integer[1280, 9000]]        $mtu         = undef,
-  Optional[Sensitive[String[1]]]       $private_key = undef,
-  Array[Struct[{
-    public_key           => String[1],
-    allowed_ips          => Variant[String[1], Array[String[1], 1]],
-    preshared_key        => Optional[Sensitive[String[1]]],
-    endpoint             => Optional[String[1]],
-    persistent_keepalive => Optional[Integer[0, 65535]],
-  }]]                                  $peers       = [],
-) {
-
-  $conf = "/etc/wireguard/${name}.conf"
-  $key  = $private_key.then |$k| { $k.unwrap }
-
-  if $private_key =~ Undef {
-    $keyfile = "/etc/wireguard/${name}.key"
-
-    exec { "wireguard_genkey_${name}":
-      command => "/bin/sh -c 'umask 077; wg genkey > ${keyfile}'",
-      creates => $keyfile,
-      path    => ['/usr/bin', '/usr/sbin', '/bin', '/sbin'],
-      require => File['/etc/wireguard'],
-    }
-
-    file { $keyfile:
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0600',
-      require => Exec["wireguard_genkey_${name}"],
-      before  => [File[$conf], Service["wg-quick@${name}"]],
-    }
-  }
-
-  file { $conf:
-    ensure    => file,
-    owner     => 'root',
-    group     => 'root',
-    mode      => '0600',
-    content   => Sensitive(template('wireguard/wg.conf.erb')),
-    show_diff => false,
-    notify    => Exec["wireguard_syncconf_${name}"],
-  }
-
-  service { "wg-quick@${name}":
-    ensure  => running,
-    enable  => true,
-    require => File[$conf],
-  }
-
-  # syncconf applies peer/key changes without bouncing the tunnel; address/mtu changes need a manual restart
-  exec { "wireguard_syncconf_${name}":
-    command     => "/bin/bash -c 'wg syncconf ${name} <(wg-quick strip ${name})'",
-    onlyif      => "/usr/sbin/ip link show ${name}",
-    path        => ['/usr/bin', '/usr/sbin', '/bin', '/sbin'],
-    refreshonly => true,
-    require     => Service["wg-quick@${name}"],
-  }
-}
@@ -1,31 +0,0 @@
-# THIS FILE IS MANAGED BY PUPPET
-[Interface]
-<% @addresses.each do |addr| -%>
-Address = <%= addr %>
-<% end -%>
-<% if @listen_port -%>
-ListenPort = <%= @listen_port %>
-<% end -%>
-<% if @mtu -%>
-MTU = <%= @mtu %>
-<% end -%>
-<% if @key -%>
-PrivateKey = <%= @key %>
-<% else -%>
-PostUp = wg set %i private-key /etc/wireguard/%i.key
-<% end -%>
-<% @peers.each do |peer| -%>
-
-[Peer]
-PublicKey = <%= peer['public_key'] %>
-<% if peer['preshared_key'] -%>
-PresharedKey = <%= peer['preshared_key'].unwrap %>
-<% end -%>
-AllowedIPs = <%= Array(peer['allowed_ips']).join(', ') %>
-<% if peer['endpoint'] -%>
-Endpoint = <%= peer['endpoint'] %>
-<% end -%>
-<% if peer['persistent_keepalive'] -%>
-PersistentKeepalive = <%= peer['persistent_keepalive'] %>
-<% end -%>
-<% end -%>
@@ -12,9 +12,6 @@ class profiles::base () {
    # manage the puppet agent
    include profiles::puppet::agent
    include profiles::puppet::client
-    # k8s migration switch; ships disabled, flip its ::enabled boolean in
-    # hiera (node/role/common) to repoint a target onto puppet-on-k8s.
-    include profiles::puppet::migrate

    # include the base profiles
    include profiles::base::repos
@@ -2,9 +2,6 @@
 class profiles::ceph::client (
  String $fsid,
  Array[Stdlib::Host] $mons,
-  # cluster topology (single source of truth: hieradata/common.yaml)
-  Array[Stdlib::Host] $cluster_public_ips,
-  Array[Stdlib::Host] $mon_initial_members,
  Stdlib::Absolutepath $config_file = '/etc/ceph/ceph.conf',
  Boolean $manage_ceph_conf = true,
  Boolean $manage_ceph_package = true,
@@ -13,24 +10,6 @@ class profiles::ceph::client (
  String $group = 'ceph',
  Stdlib::Filemode $mode = '0644',
  Hash $keyrings = {},
-  # [global] tunables (defaults match the live hand-maintained ceph.conf)
-  String $auth_client_required = 'cephx',
-  String $auth_cluster_required = 'cephx',
-  String $auth_service_required = 'cephx',
-  Boolean $mon_allow_pool_delete = true,
-  Boolean $ms_bind_ipv4 = true,
-  Boolean $ms_bind_ipv6 = false,
-  Integer $osd_crush_chooseleaf_type = 1,
-  Integer $osd_pool_default_min_size = 2,
-  Integer $osd_pool_default_size = 3,
-  Integer $osd_pool_default_pg_num = 128,
-  # mds config sections; only rendered on mon/mgr/mds hosts (render_mds_config)
-  Boolean $render_mds_config = false,
-  Hash[String, Integer] $mds_instances = {},
-  Hash $mds_common = {
-    'keyring'            => '/var/lib/ceph/mds/ceph-$id/keyring',
-    'mds_standby_replay' => true,
-  },
 ) {

  # dont run this on proxmox nodes
@@ -43,13 +22,6 @@ class profiles::ceph::client (
      }
    }

-    # only depend on the package when this class manages it; on the ceph
-    # hosts the package is delivered by cephadm / profiles::packages instead.
-    $config_require = $manage_ceph_package ? {
-      true    => Package['ceph-common'],
-      default => undef,
-    }
-
    # manage the ceph directory
    if $manage_ceph_paths {
      file { '/etc/ceph':
@@ -57,11 +29,11 @@ class profiles::ceph::client (
        owner   => $owner,
        group   => $group,
        mode    => $mode,
-        require => $config_require,
+        require => Package['ceph-common'],
      }
    }

-    # render /etc/ceph/ceph.conf from cluster topology in hiera
+    # create a basic client config
    if $manage_ceph_conf {
      file { $config_file:
        ensure  => file,
@@ -69,7 +41,7 @@ class profiles::ceph::client (
        group   => $group,
        mode    => $mode,
        content => template('profiles/ceph/client.conf.erb'),
-        require => $config_require,
+        require => Package['ceph-common'],
      }
    }

@@ -1,13 +0,0 @@
-class profiles::ceph::mds (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mds'] {
-    $facts['ceph_services']['mds'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}
@@ -1,13 +0,0 @@
-class profiles::ceph::mgr (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mgr'] {
-    $facts['ceph_services']['mgr'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}
@@ -1,13 +0,0 @@
-class profiles::ceph::mon (
-  Boolean $ensure_running = true,
-) {
-
-  if $ensure_running and $facts['is_ceph_mon'] {
-    $facts['ceph_services']['mon'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}
@@ -1,16 +0,0 @@
-class profiles::ceph::osd (
-  Boolean $ensure_running = true,
-) {
-
-  # tune the I/O scheduler on the disks backing ceph OSDs
-  include profiles::ceph::osd_scheduler
-
-  if $ensure_running and $facts['is_ceph_osd'] {
-    $facts['ceph_services']['osd'].each |String $svc| {
-      service { $svc:
-        ensure => running,
-        enable => true,
-      }
-    }
-  }
-}
@@ -1,32 +0,0 @@
-class profiles::ceph::osd_scheduler (
-  String[1] $scheduler = 'none',
-) {
-
-  $devices = $facts['ceph_osd_devices']
-
-  # no-op where the fact is absent/empty (VMs, non-OSD hosts have no ceph PVs)
-  if $devices =~ Array[String[1], 1] {
-
-    # strip /dev/ so the rule matches the udev KERNEL sysname (e.g. sda)
-    $kernel_names    = $devices.map |$dev| { regsubst($dev, '^.*/', '') }
-    $sysname_matches = $kernel_names.map |$name| { "--sysname-match=${name}" }
-
-    file { '/etc/udev/rules.d/60-ceph-osd-scheduler.rules':
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => template('profiles/ceph/osd-scheduler.rules.erb'),
-      notify  => Exec['ceph-osd-scheduler-reload'],
-    }
-
-    # apply immediately; udev re-applies on reboot and device re-add
-    $trigger = "udevadm trigger --subsystem-match=block --action=change ${join($sysname_matches, ' ')}"
-
-    exec { 'ceph-osd-scheduler-reload':
-      command     => "udevadm control --reload-rules && ${trigger}",
-      path        => ['/usr/bin', '/bin', '/usr/sbin', '/sbin'],
-      refreshonly => true,
-    }
-  }
-}
@@ -68,10 +68,7 @@ class profiles::cobbler::config {
  # export cnames for cobbler
  if $is_cobbler_master {
    profiles::dns::record { "${::facts['networking']['fqdn']}_${service_cname}_CNAME":
-      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
-      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
-      # ("ausyd1nxvm2098.") and dead-ends in NXDOMAIN.
-      value  => "${::facts['networking']['fqdn']}.",
+      value  => $::facts['networking']['hostname'],
      type   => 'CNAME',
      record => "${service_cname}.",
      zone   => $::facts['networking']['domain'],
@@ -28,12 +28,7 @@ class profiles::consul::client (
      }

      # if it is, find hosts, sort them so they dont cause changes every run
-      $servers_array = sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${members_role}' and
-          certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] })
+      $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))

    # else use provided array from params
    }else{
@@ -1,52 +0,0 @@
-# profiles::consul::mesh_gateway
-class profiles::consul::mesh_gateway (
-  Stdlib::IP::Address $address    = $facts['networking']['ip'],
-  Stdlib::Port        $port       = 8443,
-  Stdlib::Port        $http_port  = 8500,
-  Stdlib::Port        $grpc_port  = 8502,
-  Stdlib::Absolutepath $token_file = '/etc/consul.d/mesh-gateway.token',
-) {
-  include profiles::consul::client
-
-  # include after profiles::consul::server, which declares Class['consul'] only once /data is mounted
-  if defined(Class['consul']) {
-    package { 'envoy':
-      ensure => installed,
-    }
-
-    file { $token_file:
-      ensure  => file,
-      owner   => 'consul',
-      group   => 'consul',
-      mode    => '0600',
-      require => Class['consul'],
-      content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")),
-    }
-
-    systemd::unit_file { 'consul-mesh-gateway.service':
-      enable    => true,
-      active    => true,
-      content   => @("UNIT"),
-        [Unit]
-        Description=Consul mesh gateway (envoy)
-        Requires=consul.service
-        After=consul.service
-
-        [Service]
-        User=consul
-        Group=consul
-        ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \
-          -address=${address}:${port} -wan-address=${address}:${port} \
-          -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \
-          -token-file=${token_file}
-        Restart=on-failure
-        RestartSec=5
-
-        [Install]
-        WantedBy=multi-user.target
-        | UNIT
-      require   => [Package['envoy'], Class['consul']],
-      subscribe => File[$token_file],
-    }
-  }
-}
@@ -11,7 +11,6 @@ class profiles::consul::server (
  Hash      $acl = {},
  Hash      $ports = {},
  Hash      $addresses = {},
-  Hash      $tls = {},
  Boolean   $members_lookup     = false,
  String    $members_role       = undef,
  Array     $consul_servers     = [],
@@ -66,22 +65,12 @@ class profiles::consul::server (
      }

      # if it is, find hosts, sort them so they dont cause changes every run
-      $servers_array = sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${members_role}' and
-          certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] })
+      $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn'))

      if $join_remote_regions {
        # get all nodes in the members_role for each other region
        $region_to_servers = $remote_regions.reduce({}) |$memo, $region| {
-          $servers = sort(puppetdb_query(
-            "facts[certname] {
-              name = 'enc_role' and value = '${members_role}' and
-              certname in facts[certname] { name = 'region' and value = '${region}' }
-            }"
-          ).map |$fact| { $fact['certname'] })
+          $servers = sort(query_nodes("enc_role='${members_role}' and region='${region}'", 'networking.fqdn'))
          $memo + { $region => $servers }
        }

@@ -113,8 +102,6 @@ class profiles::consul::server (
          'acl'                  => $acl,
          'ports'                => $ports,
          'addresses'            => $addresses,
-          'tls'                  => $tls,
-          'auto_reload_config'   => true,
          'disable_remote_exec'  => $disable_remote_exec,
          'disable_update_check' => $disable_update_check,
          'domain'               => $domain,
@@ -132,7 +119,7 @@ class profiles::consul::server (
          'advertise_addr'       => $advertise_addr,
          'retry_join'           => $servers_array,
          'retry_join_wan'       => $remote_servers_array,
-          'connect'              => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true },
+          'connect'              => { 'enabled' => true },
          'recursors'            => ['198.18.19.16'],
        },
      }
@@ -11,38 +11,16 @@ class profiles::dns::base (
  Optional[String] $ns_role = undef,
 ){

-  # install bind_utils (provides nsupdate)
+  # install bind_utils
  include bind::updater

-  # assemble the host's DNS records and nsupdate them to the authoritative server
-  include profiles::dns::updater
-
  # if ns_role is set, find all hosts matching that enc_role
  $nameserver_array = $ns_role ? {
    undef   => $nameservers,
    default => $use_ns ? {
-      'all'     => puppetdb_query(
-        "facts[certname,value] {
-          name = 'networking' and
-          certname in nodes[certname] { facts.enc_role = '${ns_role}' }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
-      'region'  => puppetdb_query(
-        "facts[certname,value] {
-          name = 'networking' and
-          certname in nodes[certname] {
-            facts.enc_role = '${ns_role}' and facts.region = '${facts['region']}'
-          }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
-      'country' => puppetdb_query(
-        "facts[certname,value] {
-          name = 'networking' and
-          certname in nodes[certname] {
-            facts.enc_role = '${ns_role}' and facts.country = '${facts['country']}'
-          }
-        }"
-      ).map |$fact| { $fact['value']['ip'] },
+      'all'     => query_nodes("enc_role='${ns_role}'", 'networking.ip'),
+      'region'  => query_nodes("enc_role='${ns_role}' and region=${facts['region']}", 'networking.ip'),
+      'country' => query_nodes("enc_role='${ns_role}' and country=${facts['country']}", 'networking.ip'),
    }
  }

@@ -20,21 +20,9 @@ class profiles::dns::master (
  $nameservers_array = $ns_role ? {
    undef   => [$facts['networking']['fqdn']],
    default => $use_ns ? {
-      'all'     => sort(puppetdb_query(
-        "facts[certname] { name = 'enc_role' and value = '${ns_role}' }"
-      ).map |$fact| { $fact['certname'] }),
-      'region'  => sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${ns_role}' and
-          certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] }),
-      'country' => sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${ns_role}' and
-          certname in facts[certname] { name = 'country' and value = '${facts['country']}' }
-        }"
-      ).map |$fact| { $fact['certname'] }),
+      'all'     => sort(query_nodes("enc_role='${ns_role}'", 'networking.fqdn')),
+      'region'  => sort(query_nodes("enc_role='${ns_role}' and region=${facts['region']}", 'networking.fqdn')),
+      'country' => sort(query_nodes("enc_role='${ns_role}' and country=${facts['country']}", 'networking.fqdn')),
    }
  }

@@ -44,9 +32,7 @@ class profiles::dns::master (
      $facts['networking']['fqdn'] => $facts['networking']['ip']
    },
    default => $nameservers_array.reduce({}) |$acc, $fqdn| {
-      $result = puppetdb_query(
-        "facts[certname,value] { name = 'networking' and certname = '${fqdn}' }"
-      ).map |$fact| { $fact['value']['ip'] }
+      $result = query_nodes("networking.fqdn='${fqdn}'", 'networking.ip')
      $ip = $result[0]
      $acc + { "${fqdn}." => $ip }
    }
@@ -1,10 +1,4 @@
-# profiles::dns::record
-#
-# Declares a DNS record for this host. Publishes it via either or both methods,
-# controlled by profiles::dns::updater's toggles (both on during cutover):
-#   - nsupdate: a local concat fragment consumed by profiles::dns::updater,
-#     which nsupdates it to the authoritative server.
-#   - export: the legacy @@concat::fragment exported to the puppet DNS master.
+# defines the base record that will be exported
 define profiles::dns::record (
  String  $record,
  Enum[
@@ -19,26 +13,11 @@ define profiles::dns::record (
  String  $value,
  String  $zone,
  Integer $order,
-  Integer $ttl = 300,
+  Stdlib::AbsolutePath $basedir = lookup('profiles::dns::master::basedir'),
 ) {
-  include profiles::dns::updater
-
-  # new: local records file consumed by the nsupdate service
-  if $profiles::dns::updater::manage_nsupdate {
-    # zone|name|type|ttl|value  (parsed by the dns-update script)
-    concat::fragment { "dns-record-${name}":
-      target  => $profiles::dns::updater::records_file,
-      content => "${zone}|${record}|${type}|${ttl}|${value}\n",
-      order   => sprintf('%03d', $order),
-    }
-  }
-
-  # legacy: export the fragment to the puppet DNS master
-  if $profiles::dns::updater::manage_export {
-    @@concat::fragment { "${zone}_${name}":
-      target  => "${profiles::dns::updater::master_basedir}/${zone}.conf",
-      content => "${record} IN ${type} ${value}\n",
-      order   => $order,
-    }
+  @@concat::fragment { "${zone}_${name}":
+    target  => "${basedir}/${zone}.conf",
+    content => "${record} IN ${type} ${value}\n",
+    order   => $order,
  }
 }
@@ -1,172 +0,0 @@
-# profiles::dns::updater
-#
-# Publishes this host's DNS records. Two methods, independently toggled so both
-# can run during the k8s cutover (profiles::dns::record honours the same flags):
-#
-#   - nsupdate ($manage_nsupdate): assemble the records into a local file and
-#     nsupdate them to the k8s authoritative write endpoint via a systemd .path
-#     unit that watches the file. Inert until $key_secret (TSIG) is set.
-#   - export ($manage_export): the legacy exported-resources flow to the puppet
-#     DNS master. Kept during cutover; disable once k8s is authoritative.
-#
-# nsupdate comes from bind-utils (installed via bind::updater in
-# profiles::dns::base).
-class profiles::dns::updater (
-  Boolean                     $manage_nsupdate = true,
-  Boolean                     $manage_export   = true,
-  String                      $server          = '198.18.200.9',
-  String                      $key_name        = 'client-update',
-  String                      $key_algorithm   = 'hmac-sha256',
-  Optional[Sensitive[String]] $key_secret      = undef,
-  Integer                     $default_ttl     = 300,
-  Stdlib::AbsolutePath        $records_file    = '/var/lib/dns-updater/records',
-  Stdlib::AbsolutePath        $state_dir       = '/var/lib/dns-updater',
-  Stdlib::AbsolutePath        $config_dir      = '/etc/dns-updater',
-  Stdlib::AbsolutePath        $master_basedir  = lookup('profiles::dns::master::basedir'),
-  # dns-updater daemon (replaces the dns-update shell script). 'latest' so hosts
-  # pick up new releases (e.g. the record filter).
-  String                      $package_ensure   = 'latest',
-  Stdlib::AbsolutePath        $api_socket       = '/run/dns-updater/api.sock',
-  String                      $resync           = '10m',
-  Enum['debug', 'info', 'warn', 'error'] $log_level = 'info',
-  Boolean                     $watch_interfaces = true,
-  # Never publish records whose address falls in these ranges: the k8s pod CIDR
-  # (10.42.0.0/16) and service CIDR (10.43.0.0/16), the LB VIP pool
-  # (198.18.200.0/24) and 198.18.199.0/24. Keeps kube-lb0/flannel/etc. out of
-  # the authoritative zones and stops NOTAUTH updates for zones we do not host.
-  Array[String]               $deny_ranges     = ['198.18.199.0/24', '198.18.200.0/24', '10.42.0.0/16', '10.43.0.0/16'],
-  Array[String]               $allow_ranges    = [],
-  Array[String]               $deny_domains    = [],
-  Array[String]               $allow_domains   = [],
-) {
-
-  $state_file  = "${state_dir}/applied"
-  $server_file = "${state_dir}/server"
-  $key_file    = "${config_dir}/key"
-
-  if $manage_nsupdate {
-
-    file { $state_dir:
-      ensure => directory,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0755',
-    }
-
-    # Server address, read by the dns_records fact for drift detection.
-    file { $server_file:
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => "${server}\n",
-      require => File[$state_dir],
-    }
-
-    # Records file, assembled from profiles::dns::record fragments.
-    concat { $records_file:
-      ensure         => present,
-      owner          => 'root',
-      group          => 'root',
-      mode           => '0644',
-      ensure_newline => true,
-      warn           => false,
-      require        => File[$state_dir],
-    }
-
-    concat::fragment { 'dns-update-header':
-      target  => $records_file,
-      content => "# Managed by puppet (profiles::dns::record): zone|name|type|ttl|value\n",
-      order   => '00',
-    }
-
-    if $key_secret =~ Undef {
-      notify { 'dns-updater-inert':
-        message  => 'profiles::dns::updater: key_secret unset; records assembled but not applied.',
-        loglevel => 'info',
-      }
-    } else {
-      file { $config_dir:
-        ensure => directory,
-        owner  => 'root',
-        group  => 'root',
-        mode   => '0700',
-      }
-
-      file { $key_file:
-        ensure    => file,
-        owner     => 'root',
-        group     => 'root',
-        mode      => '0600',
-        show_diff => false,
-        content   => Sensitive(epp('profiles/dns/tsig-key.epp', {
-            'name'      => $key_name,
-            'algorithm' => $key_algorithm,
-            'secret'    => $key_secret.unwrap,
-        })),
-      }
-
-      # dns-updater daemon: watches the records file (inotify) and network
-      # interfaces, pushes TSIG-signed RFC2136 updates to $server natively.
-      package { 'dns-updater':
-        ensure => $package_ensure,
-      }
-
-      $deny_ranges_str   = join($deny_ranges, ',')
-      $allow_ranges_str  = join($allow_ranges, ',')
-      $deny_domains_str  = join($deny_domains, ',')
-      $allow_domains_str = join($allow_domains, ',')
-
-      $env_content = @("ENV")
-        # Managed by puppet (profiles::dns::updater).
-        DNS_UPDATER_SERVER=${server}
-        DNS_UPDATER_KEY_FILE=${key_file}
-        DNS_UPDATER_RECORDS_FILE=${records_file}
-        DNS_UPDATER_STATE_FILE=${state_file}
-        DNS_UPDATER_API=${api_socket}
-        DNS_UPDATER_RESYNC=${resync}
-        DNS_UPDATER_WATCH_INTERFACES=${watch_interfaces}
-        DNS_UPDATER_LOG_LEVEL=${log_level}
-        DNS_UPDATER_DENY_RANGES=${deny_ranges_str}
-        DNS_UPDATER_ALLOW_RANGES=${allow_ranges_str}
-        DNS_UPDATER_DENY_DOMAINS=${deny_domains_str}
-        DNS_UPDATER_ALLOW_DOMAINS=${allow_domains_str}
-        | ENV
-
-      file { "${config_dir}/env":
-        ensure  => file,
-        owner   => 'root',
-        group   => 'root',
-        mode    => '0644',
-        content => $env_content,
-        require => [File[$config_dir], Package['dns-updater']],
-      }
-
-      # Restart only on config/key change; records-file changes are picked up by
-      # the daemon's own inotify watch, so no service churn on record edits.
-      service { 'dns-updater':
-        ensure    => running,
-        enable    => true,
-        subscribe => [File["${config_dir}/env"], File[$key_file]],
-        require   => [Package['dns-updater'], Concat[$records_file], File[$key_file]],
-      }
-
-      # Retire the previous shell-based mechanism.
-      file { '/usr/local/bin/dns-update':
-        ensure => absent,
-      }
-
-      systemd::unit_file { 'dns-update.service':
-        ensure => absent,
-        active => false,
-        enable => false,
-      }
-
-      systemd::unit_file { 'dns-update.path':
-        ensure => absent,
-        active => false,
-        enable => false,
-      }
-    }
-  }
-}
@@ -18,12 +18,7 @@ class profiles::etcd::node (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -36,7 +31,7 @@ class profiles::etcd::node (
    $initial_cluster = $servers_array.map |$fqdn| {

      # lookup the ip address for the current fqdn
-      $ip = puppetdb_query("facts[certname,value] { name = 'networking' and certname = '${fqdn}' }").map |$fact| { $fact['value']['ip'] }[0]
+      $ip = query_nodes("networking.fqdn='${fqdn}'", 'networking.ip')[0]

      # construct the string for this server
      "${fqdn}=https://${ip}:${peer_port}"
@@ -1,14 +0,0 @@
-# base fedora settings
-#
-# Fedora hosts share the RedHat-family base profiles (yum/dnf, crypto-policies,
-# firewalld); this class carries the handful of Fedora-specific bits. Kept
-# deliberately small so it can grow into workstation/laptop (e.g. sway) support
-# later without disturbing servers.
-class profiles::fedora::base {
-  # Fedora manages interfaces through NetworkManager. Ensure it is enabled and
-  # running (some minimal and cloud images ship it disabled).
-  service { 'NetworkManager':
-    ensure => running,
-    enable => true,
-  }
-}
@@ -21,10 +21,7 @@ class profiles::haproxy::dns (
    $parts = split($cname, '\.')
    $domain = join($parts[1, $parts.length], '.')
    profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
-      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
-      # ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
-      value  => "${location_environment}-halb.${facts['networking']['domain']}.",
+      value  => "${location_environment}-halb",
      type   => 'CNAME',
      record => "${cname}.",
      zone   => $domain,
@@ -33,14 +30,13 @@ class profiles::haproxy::dns (
  }

  # if it is, find hosts, sort them so they dont cause changes every run
-  $servers_array = sort(puppetdb_query(
-    "facts[certname] {
-      name = 'enc_role' and value = '${facts['enc_role']}' and
-      certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
-      certname in facts[certname] { name = 'region' and value = '${facts['region']}' } and
-      certname in facts[certname] { name = 'environment' and value = '${facts['environment']}' }
-    }"
-  ).map |$fact| { $fact['certname'] })
+  $servers_array = sort(query_nodes(
+    "enc_role='${facts['enc_role']}' and
+      country='${facts['country']}' and
+      region='${facts['region']}' and
+      environment='${facts['environment']}'",
+    'networking.fqdn'
+  ))

  # give enough time for a few hosts to be provisioned
  if length($servers_array) >= 3 {
@@ -61,10 +57,7 @@ class profiles::haproxy::dns (
        $parts = split($cname, '\.')
        $domain = join($parts[1, $parts.length], '.')
        profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-          # Fully-qualified target (trailing dot); see the note on the non-vrrp
-          # cnames above. The matching A record is published in main.unkin.net
-          # and unkin.net just above.
-          value  => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
+          value  => "${location_environment}-halb-vrrp",
          type   => 'CNAME',
          record => "${cname}.",
          zone   => $domain,
@@ -1,28 +1,77 @@
 # profiles::helpers::certmanager
 #
-# renders the config.yaml read by the certmanager binary (RPM-installed)
+# wrapper class for python, pip and venv
 class profiles::helpers::certmanager (
  String                $script_name = 'certmanager',
  Stdlib::AbsolutePath  $base_path = "/opt/${script_name}",
+  Stdlib::AbsolutePath  $venv_path = "${base_path}/venv",
  Stdlib::AbsolutePath  $config_path = "${base_path}/config.yaml",
  Hash                  $vault_config = {},
  String                $owner = 'root',
  String                $group = 'root',
+  Boolean               $systempkgs = false,
+  String                $version = 'system',
+  Array[String[1]]      $packages = ['requests', 'pyyaml'],
 ){

-  file { $base_path:
-    ensure => directory,
-    mode   => '0755',
-    owner  => $owner,
-    group  => $group,
-  }
+  if $::facts['python3_version'] {

-  file { $config_path:
-    ensure  => file,
-    mode    => '0660',
-    owner   => 'puppet',
-    group   => 'root',
-    content => Sensitive(template("profiles/helpers/${script_name}_config.yaml.erb")),
-    require => File[$base_path],
+    $python_version = $version ? {
+      'system' => $::facts['python3_version'],
+      default  => $version,
+    }
+
+    # ensure the base_path exists
+    file { $base_path:
+      ensure => directory,
+      mode   => '0755',
+      owner  => $owner,
+      group  => $group,
+    }
+
+    # create a venv
+    python::pyvenv { $venv_path :
+      ensure     => present,
+      version    => $python_version,
+      systempkgs => $systempkgs,
+      venv_dir   => $venv_path,
+      owner      => $owner,
+      group      => $group,
+      require    => File[$base_path],
+    }
+
+    # install the required pip packages
+    $packages.each |String $package| {
+      python::pip { "${venv_path}_${package}":
+        ensure     => present,
+        pkgname    => $package,
+        virtualenv => $venv_path,
+      }
+    }
+
+    # create the script from a template
+    file { "${base_path}/${script_name}":
+      ensure  => file,
+      mode    => '0755',
+      content => template("profiles/helpers/${script_name}.erb"),
+      require => Python::Pyvenv[$venv_path],
+    }
+
+    # create the config from a template
+    file { $config_path:
+      ensure  => file,
+      mode    => '0660',
+      owner   => 'puppet',
+      group   => 'root',
+      content => Sensitive(template("profiles/helpers/${script_name}_config.yaml.erb")),
+      require => Python::Pyvenv[$venv_path],
+    }
+
+    # create symbolic link in $PATH
+    file { "/usr/local/bin/${script_name}":
+      ensure  => 'link',
+      target  => "${base_path}/${script_name}",
+      require => File["${base_path}/${script_name}"],
+    }
  }
 }
@@ -1,28 +1,77 @@
 # profiles::helpers::sshsignhost
 #
-# renders the config.yaml read by the sshsignhost binary (RPM-installed)
+# wrapper class for python, pip and venv
 class profiles::helpers::sshsignhost (
  String                $script_name = 'sshsignhost',
  Stdlib::AbsolutePath  $base_path = "/opt/${script_name}",
+  Stdlib::AbsolutePath  $venv_path = "${base_path}/venv",
  Stdlib::AbsolutePath  $config_path = "${base_path}/config.yaml",
  Hash                  $vault_config = {},
  String                $owner = 'root',
  String                $group = 'root',
+  Boolean               $systempkgs = false,
+  String                $version = 'system',
+  Array[String[1]]      $packages = ['requests', 'pyyaml'],
 ){

-  file { $base_path:
-    ensure => directory,
-    mode   => '0755',
-    owner  => $owner,
-    group  => $group,
-  }
+  if $::facts['python3_version'] {

-  file { $config_path:
-    ensure  => file,
-    mode    => '0660',
-    owner   => 'puppet',
-    group   => 'root',
-    content => Sensitive(template("profiles/helpers/${script_name}_config.yaml.erb")),
-    require => File[$base_path],
+    $python_version = $version ? {
+      'system' => $::facts['python3_version'],
+      default  => $version,
+    }
+
+    # ensure the base_path exists
+    file { $base_path:
+      ensure => directory,
+      mode   => '0755',
+      owner  => $owner,
+      group  => $group,
+    }
+
+    # create a venv
+    python::pyvenv { $venv_path :
+      ensure     => present,
+      version    => $python_version,
+      systempkgs => $systempkgs,
+      venv_dir   => $venv_path,
+      owner      => $owner,
+      group      => $group,
+      require    => File[$base_path],
+    }
+
+    # install the required pip packages
+    $packages.each |String $package| {
+      python::pip { "${venv_path}_${package}":
+        ensure     => present,
+        pkgname    => $package,
+        virtualenv => $venv_path,
+      }
+    }
+
+    # create the script from a template
+    file { "${base_path}/${script_name}":
+      ensure  => file,
+      mode    => '0755',
+      content => template("profiles/helpers/${script_name}.erb"),
+      require => Python::Pyvenv[$venv_path],
+    }
+
+    # create the config from a template
+    file { $config_path:
+      ensure  => file,
+      mode    => '0660',
+      owner   => 'puppet',
+      group   => 'root',
+      content => Sensitive(template("profiles/helpers/${script_name}_config.yaml.erb")),
+      require => Python::Pyvenv[$venv_path],
+    }
+
+    # create symbolic link in $PATH
+    file { "/usr/local/bin/${script_name}":
+      ensure  => 'link',
+      target  => "${base_path}/${script_name}",
+      require => File["${base_path}/${script_name}"],
+    }
  }
 }
@@ -1,33 +0,0 @@
-# profiles::lldpd
-#
-# Runs lldpd on physical hosts so each machine learns its switch/port topology
-# via LLDP. The `lldp` fact exposes that neighbour data for NetBox. Assigned
-# via hiera_include from hieradata/virtual/physical.yaml (physicals only); the
-# lldpd.service ships disabled, so it is explicitly enabled and started here.
-class profiles::lldpd (
-  Boolean $enabled = true,
-  String  $package = 'lldpd',
-  String  $service = 'lldpd',
-){
-
-  if $enabled {
-    package { $package:
-      ensure => installed,
-    }
-
-    service { $service:
-      ensure    => running,
-      enable    => true,
-      subscribe => Package[$package],
-    }
-  } else {
-    service { $service:
-      ensure => stopped,
-      enable => false,
-    }
-
-    package { $package:
-      ensure => absent,
-    }
-  }
-}
@@ -1,7 +1,6 @@
 # profiles::metrics::grafana
 class profiles::metrics::grafana (
  String    $ldap_bind_pass,
-  String    $version        = 'installed',
  Stdlib::Port $http_port   = 8080,
  String    $app_mode       = 'production',
  Boolean   $allow_sign_up  = false,
@@ -108,7 +107,6 @@ class profiles::metrics::grafana (

  # deploy grafana
  class { 'grafana':
-    version  => $version,
    cfg      => $cfg,
    ldap_cfg => $ldap_cfg,
    plugins  => $plugins,
--- a/Show More
+++ b/Show More