Merge remote-tracking branch 'origin/develop' into benvin/halb-drop-grafana

# Conflicts:
#	hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

hieradata/country/au/region/drw1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
   - syd1

hieradata/country/au/region/syd1.yaml

@@ -7,11 +7,3 @@ profiles_dns_upstream_forwarder_consul:
   - 198.18.19.14
 profiles_dns_upstream_forwarder_k8s:
   - 198.18.19.20
-profiles::consul::client::members_lookup: false
-# static: k8s-compiled hosts can't see the servers in PuppetDB; update when servers change
-profiles::consul::client::consul_servers:
-  - ausyd1nxvm2005.main.unkin.net
-  - ausyd1nxvm2006.main.unkin.net
-  - ausyd1nxvm2007.main.unkin.net
-  - ausyd1nxvm2008.main.unkin.net
-  - ausyd1nxvm2009.main.unkin.net

hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

@@ -20,7 +20,6 @@ profiles::haproxy::mappings:
       - 'jellyfin.main.unkin.net be_jellyfin'
       - 'fafflix.unkin.net be_jellyfin'
       - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
       - 'dashboard.ceph.unkin.net be_ceph_dashboard'
       - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
       - 'autoconfig.main.unkin.net be_stalwart_webadmin'
@@ -40,7 +39,6 @@ profiles::haproxy::mappings:
       - 'jellyfin.main.unkin.net be_jellyfin'
       - 'fafflix.unkin.net be_jellyfin'
       - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
       - 'dashboard.ceph.unkin.net be_ceph_dashboard'
       - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
       - 'autoconfig.main.unkin.net be_stalwart_webadmin'
@@ -65,7 +63,6 @@ profiles::haproxy::frontends:
         - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
         - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
         - 'acl_gitea req.hdr(host) -i git.unkin.net'
-        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
         - 'acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net'
         - 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
         - 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
@@ -87,7 +84,6 @@ profiles::haproxy::frontends:
         - 'set-header X-Frame-Options DENY if acl_jellyfin'
         - 'set-header X-Frame-Options DENY if acl_fafflix'
         - 'set-header X-Frame-Options DENY if acl_gitea'
-        - 'set-header X-Frame-Options DENY if acl_grafana'
         - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
         - 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
         - 'set-header X-Frame-Options DENY if acl_kanidm'
@@ -403,7 +399,6 @@ profiles::haproxy::certlist::certificates:
   - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/vault/certificate.pem
@@ -431,6 +426,5 @@ certbot::client::domains:
   - nzbget.main.unkin.net
   - fafflix.unkin.net
   - git.unkin.net
-  - grafana.unkin.net
   - dashboard.ceph.unkin.net
   - auth.unkin.net

hieradata/country/au/region/syd1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
   - drw1

hieradata/roles/apps/media.yaml

@@ -2,8 +2,6 @@
 hiera_include:
   - profiles::nginx::simpleproxy
 
-profiles::puppet::migrate::enabled: true
-
 profiles::yum::global::repos:
   ceph:
     ensure: present

hieradata/roles/infra/incus/node.yaml

@@ -14,8 +14,6 @@ hiera_include:
   - profiles::storage::cephfsvols
   - exporters::frr_exporter
 
-profiles::puppet::migrate::enabled: true
-
 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
 python::manage_dev_package: false
 

hieradata/roles/infra/k8s.yaml

@@ -8,8 +8,6 @@ hiera_include:
   - frrouting
   - rke2
 
-profiles::puppet::migrate::enabled: true
-
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345

hieradata/roles/infra/pki/certbot.yaml

@@ -14,6 +14,5 @@ certbot::domains:
   - nzbget.main.unkin.net
   - fafflix.unkin.net
   - git.unkin.net
-  - grafana.unkin.net
   - dashboard.ceph.unkin.net
   - auth.unkin.net

hieradata/roles/infra/storage/consul.yaml

@@ -13,19 +13,9 @@ profiles::consul::server::addresses:
   grpc_tls: "%{::networking.ip}"
 profiles::consul::server::ports:
   grpc: 8502
-  grpc_tls: 8503
   dns: 8600
   http: 8500
   https: -1
-profiles::consul::server::tls:
-  defaults:
-    ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
-    cert_file: /etc/pki/tls/vault/full_chain.crt
-    key_file: /etc/pki/tls/vault/private.key
-  internal_rpc:
-    verify_incoming: false
-    verify_outgoing: false
-    verify_server_hostname: false
 profiles::consul::server::acl:
   enabled: true
   default_policy: 'deny'
@@ -41,8 +31,6 @@ profiles::pki::vault::alt_names:
   - consul.service.consul
   - "consul.service.%{facts.country}-%{facts.region}.consul"
   - consul
-  - "server.%{facts.country}-%{facts.region}.consul"
-  - "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"
 
 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'

modules/nzbget/manifests/init.pp

@@ -6,8 +6,8 @@ class nzbget (
   $manage_group       = $nzbget::params::manage_group,
   $service_enable     = $nzbget::params::service_enable,
   $service_name       = $nzbget::params::service_name,
-  $bind_address       = $nzbget::params::bind_address,
-  $port               = $nzbget::params::port,
+  $bind_address       = $sonarr::params::bind_address,
+  $port               = $sonarr::params::port,
 ) inherits nzbget::params {
 
   include nzbget::install

site/profiles/manifests/consul/server.pp

@@ -11,7 +11,6 @@ class profiles::consul::server (
   Hash      $acl = {},
   Hash      $ports = {},
   Hash      $addresses = {},
-  Hash      $tls = {},
   Boolean   $members_lookup     = false,
   String    $members_role       = undef,
   Array     $consul_servers     = [],
@@ -113,8 +112,6 @@ class profiles::consul::server (
           'acl'                  => $acl,
           'ports'                => $ports,
           'addresses'            => $addresses,
-          'tls'                  => $tls,
-          'auto_reload_config'   => true,
           'disable_remote_exec'  => $disable_remote_exec,
           'disable_update_check' => $disable_update_check,
           'domain'               => $domain,
@@ -132,7 +129,7 @@ class profiles::consul::server (
           'advertise_addr'       => $advertise_addr,
           'retry_join'           => $servers_array,
           'retry_join_wan'       => $remote_servers_array,
-          'connect'              => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true },
+          'connect'              => { 'enabled' => true },
           'recursors'            => ['198.18.19.16'],
         },
       }