feat: implement dovecot backend server with postfix virtual mailbox integration

- create profiles::dovecot::backend class for IMAPS server configuration - add virtual mailbox support to profiles::postfix::gateway with enable_dovecot parameter - restructure common hieradata elements into mail.yaml - add virtual mailbox and alias map templates with ERB generation - add comprehensive type validation using Stdlib::Email, Stdlib::Fqdn, Stdlib::IP types - configure vmail user (UID/GID 5000) with shared storage on /shared/apps/maildata - update roles::infra::mail::backend to include both dovecot and postfix profiles
refactor: recreate profiles::postfix::gateway with parameterization and templates (#416 )
2025-11-02 11:53:02 +11:00 · 2025-11-01 17:26:00 +11:00 · 2025-11-01 01:01:55 +11:00 · 2025-11-01 00:43:58 +11:00 · 2025-10-19 19:09:51 +11:00 · 2025-10-18 23:49:51 +11:00
89 changed files with 2351 additions and 114 deletions
@@ -0,0 +1 @@
+sources/
@@ -19,6 +19,7 @@ mod 'puppetlabs-haproxy', '8.2.0'
 mod 'puppetlabs-java', '11.1.0'
 mod 'puppetlabs-reboot', '5.1.0'
 mod 'puppetlabs-docker', '10.2.0'
+mod 'puppetlabs-mailalias_core', '1.2.0'

 # puppet
 mod 'puppet-python', '7.4.0'
@@ -43,6 +44,8 @@ mod 'puppet-letsencrypt', '11.1.0'
 mod 'puppet-rundeck', '9.2.0'
 mod 'puppet-redis', '11.1.0'
 mod 'puppet-nodejs', '11.0.0'
+mod 'puppet-postfix', '5.1.0'
+mod 'puppet-alternatives', '6.0.0'

 # other
 mod 'saz-sudo', '9.0.2'
@@ -60,6 +63,7 @@ mod 'rehan-mkdir', '2.0.0'
 mod 'tailoredautomation-patroni', '2.0.0'
 mod 'ssm-crypto_policies', '0.3.3'
 mod 'thias-sysctl', '1.0.8'
+mod 'cirrax-dovecot', '1.3.3'

 mod 'bind',
  :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',
@@ -29,3 +29,21 @@ these steps are required when adding additional puppet masters, as the subject a

    sudo systemctl start puppetserver
    sudo cp /root/current_crl.pem /etc/puppetlabs/puppet/ssl/crl.pem
+
+
+## troubleshooting
+
+### Issue 1:
+
+    [sysadmin@ausyd1nxvm2056 ~]$ sudo puppet agent -t
+    Error: The CRL issued by 'CN=Puppet CA: prodinf01n01.main.unkin.net' is missing
+
+Find another puppetserver that IS working, copy the `/etc/puppetlabs/puppet/ssl/crl.pem` to this host, run puppet again.
+
+
+### Issue 2:
+
+    [sysadmin@ausyd1nxvm2097 ~]$ sudo puppet agent -t
+    Error: Failed to parse CA certificates as PEM
+
+The puppet-agents CA cert `/etc/puppetlabs/puppet/ssl/certs/ca.pem` is empty or missing. Grab it from any other host. Run puppet again.
@@ -155,6 +155,18 @@ lookup_options:
  zfs::datasets:
    merge:
      strategy: deep
+  rke2::config_hash:
+    merge:
+      strategy: deep
+  postfix::configs:
+    merge:
+      strategy: deep
+  postfix::maps:
+    merge:
+      strategy: deep
+  postfix::virtuals:
+    merge:
+      strategy: deep

 facts_path: '/opt/puppetlabs/facter/facts.d'

@@ -173,9 +185,6 @@ profiles::ntp::client::peers:
  - 2.au.pool.ntp.org
  - 3.au.pool.ntp.org

-profiles::base::puppet_servers:
-  - 'prodinf01n01.main.unkin.net'
-
 consul::install_method: 'package'
 consul::manage_repo: false
 consul::bin_dir: /usr/bin
@@ -368,6 +377,28 @@ profiles::ceph::client::mons:
  - 10.18.15.1
  - 10.18.15.2
  - 10.18.15.3
+
+profiles::ceph::conf::config:
+  global:
+    auth_client_required: 'cephx'
+    auth_cluster_required: 'cephx'
+    auth_service_required: 'cephx'
+    fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
+    mon_allow_pool_delete: true
+    mon_initial_members: 'prodnxsr0009,prodnxsr0010,prodnxsr0011,prodnxsr0012,prodnxsr0013'
+    mon_host: '198.18.23.9,198.18.23.10,198.18.23.11,198.18.23.12,198.18.23.13'
+    ms_bind_ipv4: true
+    ms_bind_ipv6: false
+    osd_crush_chooseleaf_type: 1
+    osd_pool_default_min_size: 2
+    osd_pool_default_size: 3
+    osd_pool_default_pg_num: 128
+    public_network: >
+      198.18.23.1/32,198.18.23.2/32,198.18.23.3/32,198.18.23.4/32,
+      198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,
+      198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,
+      198.18.23.13/32
+
 #profiles::base::hosts::additional_hosts:
 #  - ip: 198.18.17.9
 #    hostname: prodinf01n09.main.unkin.net
@@ -10,6 +10,7 @@ profiles::haproxy::dns::vrrp_cnames:
  - git.unkin.net
  - fafflix.unkin.net
  - grafana.unkin.net
+  - dashboard.ceph.unkin.net

 profiles::haproxy::mappings:
  fe_http:
@@ -27,6 +28,7 @@ profiles::haproxy::mappings:
      - 'fafflix.unkin.net be_jellyfin'
      - 'git.unkin.net be_gitea'
      - 'grafana.unkin.net be_grafana'
+      - 'dashboard.ceph.unkin.net be_ceph_dashboard'
  fe_https:
    ensure: present
    mappings:
@@ -42,6 +44,7 @@ profiles::haproxy::mappings:
      - 'fafflix.unkin.net be_jellyfin'
      - 'git.unkin.net be_gitea'
      - 'grafana.unkin.net be_grafana'
+      - 'dashboard.ceph.unkin.net be_ceph_dashboard'

 profiles::haproxy::frontends:
  fe_http:
@@ -62,6 +65,7 @@ profiles::haproxy::frontends:
        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
        - 'acl_gitea req.hdr(host) -i git.unkin.net'
        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
+        - 'acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net'
        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
      use_backend:
        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -79,6 +83,7 @@ profiles::haproxy::frontends:
        - 'set-header X-Frame-Options DENY if acl_fafflix'
        - 'set-header X-Frame-Options DENY if acl_gitea'
        - 'set-header X-Frame-Options DENY if acl_grafana'
+        - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
        - 'set-header X-Content-Type-Options nosniff'
        - 'set-header X-XSS-Protection 1;mode=block'

@@ -262,6 +267,26 @@ profiles::haproxy::backends:
      redirect: 'scheme https if !{ ssl_fc }'
      stick-table: 'type ip size 200k expire 30m'
      stick: 'on src'
+  be_ceph_dashboard:
+    description: Backend for Ceph Dashboard from Mgr instances
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-check:
+        - expect status 200
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 9443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      stick-table: 'type ip size 200k expire 30m'
+      stick: 'on src'

 profiles::haproxy::certlist::enabled: true
 profiles::haproxy::certlist::certificates:
@@ -276,6 +301,7 @@ profiles::haproxy::certlist::certificates:
  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/vault/certificate.pem

 # additional altnames
@@ -303,3 +329,4 @@ certbot::client::domains:
  - fafflix.unkin.net
  - git.unkin.net
  - grafana.unkin.net
+  - dashboard.ceph.unkin.net
@@ -3,7 +3,8 @@
 profiles::firewall::firewalld::ensure_package: 'absent'
 profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
-profiles::puppet::agent::puppet_version: '7.34.0'
+profiles::puppet::agent::version: '7.37.2'
+profiles::puppet::agent::openvox_enable: true

 hiera_include:
  - profiles::almalinux::base
@@ -53,13 +54,6 @@ profiles::yum::global::repos:
    baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
    gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
    mirrorlist: absent
-  puppet:
-    name: puppet
-    descr: puppet repository
-    target: /etc/yum.repos.d/puppet.repo
-    baseurl: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-puppet-20250406
-    mirrorlist: absent
  unkinben:
    name: unkinben
    descr: unkinben repository
@@ -11,4 +11,4 @@ profiles::apt::components:
  - main
  - non-free

-profiles::puppet::agent::puppet_version: '7.25.0-1bullseye'
+profiles::puppet::agent::version: '7.25.0-1bullseye'
@@ -12,4 +12,4 @@ profiles::apt::components:
  - non-free
  - non-free-firmware

-profiles::puppet::agent::puppet_version: 'latest'
+profiles::puppet::agent::version: 'latest'
@@ -70,7 +70,7 @@ profiles::nginx::simpleproxy::locations:
  arrstack_web_external:
    location_satisfy: any
    location_allow:
-      - 198.18.13.47
-      - 198.18.13.50
-      - 198.18.13.51
-      - 198.18.13.52
+      - 198.18.26.161
+      - 198.18.27.131
+      - 198.18.28.165
+      - 198.18.29.32
@@ -211,6 +211,18 @@ glauth::users:
    loginshell: '/bin/bash'
    homedir: '/home/waewak'
    passsha256: 'd9bb99634215fe031c3bdca94149a165192fe8384ecaa238a19354c2f760a811'
+  debvin:
+    user_name: 'debvin'
+    givenname: 'Debbie'
+    sn: 'Vincent'
+    mail: 'debvin@users.main.unkin.net'
+    uidnumber: 20009
+    primarygroup: 20000
+    othergroups:
+      - 20010 # jelly
+    loginshell: '/bin/bash'
+    homedir: '/home/debvin'
+    passsha256: 'cdac05ddb02e665d4ea65a974995f38a10236bc158731d92d78f6cde89b294a1'

 glauth::services:
  svc_jellyfin:
@@ -0,0 +1,8 @@
+---
+
+profiles::ceph::rgw::ceph_client_keys:
+  ausyd1nxvm2115: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAovOUUtTm/9nXWj6D+kVhmbZedVVkA5N80ULNYqISrv0A+KlXCx/V2sB56SpJ9eL6aPHdC+CKkrtrrdo1h2j2em7wTA5ghhbFVF0NIS7bbn0jzpl5YqbUrNxOtDSpjzX1aCGnyMvw69Lp+NcHwxIj+1XFgK6335138s9wbX3HmYF3jcsQkMqTzynELe1OQPWFXVKTjUfFFLdCQOFryp8UY8L9j/PpV6wd4w6p7R6eXhX21rjSaN4aqN1zjsnF2OVhL8Ge0QxMhePWKGOqsUfi72kh3II028DjqU0DcZQvoxnoqRPyUUjysH0nTKoLeXOGNgJdphY1dHBJ+SJnw2gqQDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB9wA3ZJjmU95W+9r8va5uagDAMAv2APfdzrPnAU7NJPL+IW08osGuQWWamqF+XGVeHRoBmoFKwZ7grYRV2e3aabyc=]
+  ausyd1nxvm2116: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAf5ksy/pyUZSwTh+HiKw+1Uhj16A0DVZEKAbkKUQzXVmc+QpL4Dn7YBoXlEwrY8CcsTrxTQjADvtu9FC3o34QIdh06noSgYYA+7fna2A+9+oYoNtgwC3b8LeglxO/SQ9dKoJ90jRtmlw5P/CtrxA2RelMK6FNRekp1CaWMM4q20fJGgr/E33vgx38UJyp4/q0bTu2lLehCuDUP80j3XGbSNZ2snfYdIo91Cl+nSxLSU2TdnFpWaabsH19HwDnkWGiILlLBVvvhY7copCxs5DS1ueoOTCsqnWSrTrBMJjnu7WZd/s4NLw/0q/UP5xcFA51caY3Kv+sI6bfIYkNoLazwDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDrCF16nrtukRPamx1VbGY+gDAK5dw0kV8MpATpwxTkJG6JtlFlwdpU9THs1bNwqSRD1ZhEWxQeWwsyyTtjUXi4bP8=]
+  ausyd1nxvm2117: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAKtvsgDk2QTmL8flBBE4nA43sRSnroq4I6T2CUAYv/lRdzCCWvE961o/51zyQEz8L5QyDo7L3gcGYIBqthYjRe9Gp5a5d4qds0qskupgQKnb0KR2RLFVUtH5vxHqyJZHjXaP+PQreyRoSIfRWXAdoZu544FeJ9DKKbmEzZaH5B2OdDMrf4Ufuud0maEAw0PJthS//ghCfGi74F1xlJnIWVvMhp66b0iMxC+ACClEHunG3oKx7M/w05HllG0wcxPTg4PFrbnFXjRuIxsykF9aVHJkRnCdgbMXRM4o6FrYyZRR74F1HKRujFCUA7kYWDKLxHxJpYCvCHp4HMhfzjs824zBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBbaSig6kgVVNfmSI53sNimgDDQ5O10Dzfa7S7RdJVLLUFBaZ5TG2g3Bwmy0k3wKZvABYMuYyOxQdfk6eMsKC+sC5w=]
+  ausyd1nxvm2118: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAdKl0ude3ZxW0ihyA758mpQp43qZvzTI2Bp83WzCp2ifJCgAIjRWdd01P64rSHaa4lus/wqB9jxg38g6DrN4ejX56Y/CJ6GQKxz6b1BO5nDfsLx6QEzCt+cfg5d/PPoTtEpz2VSvDfxFUrHiABA6++Sqzb9Og+nQCFMYJD3NHCk67QpkjPGQ/ejZk4MNXZQVCfKOlFqay/fF0jEmQixFOlX/Fdm9UoKttbrKluUmzpaVUzfGRaTTFVgzc3x2t/z1q1k0P7ClI9Uu02kUXpFVs9LPX99Zc2GtrnP06mYqqARhWF1NMK0zlmxtKpfObahRP/HmtI3fgnQsU1Cpwah0emTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAILqpYx3FKY3xXLJRu2oDlgDCIOXeX6hxpu0qpj5c/9jMUSeV2DIydnxO+MiT3mceS50ip8B+zGQy5UedPmLt36Zs=]
+  ausyd1nxvm2119: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEASlZglUxazp+9azfV3QkgRv+ACo+MH0RO5b18blbelgdmr38iwK7MwwEFpEfVJEyc/ph9RunWwrMmofDQHj5bBribfzZ2pH2CGiOrR0i5lZMtN0yQXPBA/+jm1Pi1AWGJLtoquuhMbibuHOTiXwBCBVrHHHaFTR5Xt34ABN/p/mCaG+N9nWux93msHCCextCalKBMmPhmI2q6HodfjanEVgYAe3/5hRPnpsi6IGSDNGygsTC3MG+hjGMpNF8izbwk9Lpzn6kY51aeNxI2ed9Jm8UZ/k+8b+o7ZQyWIBbf7DTFpEzk4G46puaDbXIorBWQ4azCjN3gt8VB91hwihtzcDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB6U+9z4cSzMTA1z9bmoX82gDBfy5zbRPK8GxImJo6evecMOTtaY2c4aEnESXtGBCS02enmxljv9dv1UYQD0/a6S3A=]
@@ -0,0 +1,60 @@
+---
+hiera_include:
+  - profiles::ceph::rgw
+  - profiles::nginx::simpleproxy
+
+profiles::ceph::rgw::enable: true
+
+# FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
+python::manage_dev_package: false
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - radosgw.main.unkin.net
+  - radosgw.service.consul
+  - radosgw.query.consul
+  - "radosgw.service.%{facts.country}-%{facts.region}.consul"
+
+# additional repos
+profiles::yum::global::repos:
+  ceph:
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
+  ceph-noarch:
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
+
+# manage a simple nginx reverse proxy
+profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
+profiles::nginx::simpleproxy::nginx_aliases:
+  - radosgw.service.au-syd1.consul
+profiles::nginx::simpleproxy::proxy_port: 7480
+profiles::nginx::simpleproxy::proxy_path: '/'
+nginx::client_max_body_size: 100M
+
+# manage consul service
+consul::services:
+  radosgw:
+    service_name: 'radosgw'
+    address: "%{facts.networking.ip}"
+    port: 443
+    checks:
+      - id: 'radosgw_https_check'
+        name: 'RADOSGW HTTPS Check'
+        http: "https://%{facts.networking.fqdn}:443"
+        method: 'GET'
+        tls_skip_verify: true
+        interval: '10s'
+        timeout: '1s'
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: radosgw
+    disposition: write
@@ -2,6 +2,7 @@
 hiera_include:
  - docker
  - profiles::gitea::runner
+  - incus::client

 docker::version: latest
 docker::curl_ensure: false
@@ -39,7 +40,8 @@ profiles::gitea::runner::config:
    privileged: false
    options:
    workdir_parent: /workspace
-    valid_volumes: []
+    valid_volumes:
+      - /etc/pki/tls/vault
    docker_host: ""
    force_pull: true
    force_rebuild: false
@@ -6,6 +6,7 @@ hiera_include:
  - zfs
  - profiles::ceph::node
  - profiles::ceph::client
+  - profiles::ceph::dashboard
  - profiles::storage::cephfsvols
  - exporters::frr_exporter

@@ -36,6 +37,7 @@ profiles::ssh::sign::principals:
  - "%{facts.networking.interfaces.enp3s0.ip}"

 # configure consul service
+profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"
 consul::services:
  incus:
    service_name: 'incus'
@@ -121,6 +123,9 @@ profiles::yum::global::repos:
 # dns
 profiles::dns::base::primary_interface: loopback0

+# dashboard/haproxy
+profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback0_ip')}"
+
 # networking
 systemd::manage_networkd: true
 systemd::manage_all_network_files: true
@@ -153,6 +158,8 @@ networking::interfaces:
 # frrouting
 exporters::frr_exporter::enable: true
 frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
+frrouting::ospf_preferred_source_enable: true
+frrouting::ospf_preferred_source: "%{hiera('networking_loopback0_ip')}"
 frrouting::ospfd_redistribute:
  - connected
 frrouting::ospfd_interfaces:
@@ -0,0 +1 @@
+rke2::node_token: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAOD+w5nJFqEYWFj+tZQ65Oi19eDhaWtpLQ0gwEdBtMmY9sPJ63l1q2qH933NH6TOd1UlMDvGfoDLCae+yt/MAW//cJ15X3QbiVQ23DdfCOlUEZN6fjVrveEt/yIeFQmWvnkMS4pRfPbgQu2OHm37PpuPE7s6dUyGItAYjchrRhtQ7ibhXDnN7miG+oVRXP2T8b/V5WPdmA222DSV6r/AnqaWkna9W/oh/I2sNKeEm5q3f8bh8Gxt1dDy3VwaZ3lAh3uR+SUm7P/6PTYw8opxiumFBvos0mRiXIdOwUuqrAS8hafWBhxnDLlTBfz62Nc4wQmQ8gz0bHJZSipH9G6mIEDCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ2WG6ROWFlQdXx0TuO5oABoBwTDtAXIj7y6I1B3zCnFoMHETf5d7ulPGdgwZsENf0UIHpg2l0w503MUHHbu6YDFiDiTE0oDNJPVHid7TO+XwWFgh5v1MWi/XeEBgCs6nMCW8qkX0Z3UXaZdSBUll1M4sRtuqscBnoD/LLs2kKfxrqQg==]
@@ -0,0 +1,168 @@
+---
+hiera_include:
+  - profiles::selinux::setenforce
+  - profiles::ceph::node
+  - profiles::ceph::client
+  - exporters::frr_exporter
+  - frrouting
+  - rke2
+
+# manage rke2
+rke2::bootstrap_node: prodnxsr0001.main.unkin.net
+rke2::join_url: https://join-k8s.service.consul:9345
+rke2::config_hash:
+  bind-address: "%{hiera('networking_loopback0_ip')}"
+  node-ip: "%{hiera('networking_loopback0_ip')}"
+  node-external-ip: "%{hiera('networking_loopback0_ip')}"
+  write-kubeconfig-mode: 644
+  kubelet-arg:
+    - '--node-status-update-frequency=4s'
+    - '--max-pods=100'
+  node-label:
+    - "region=%{facts.region}"
+    - "country=%{facts.country}"
+    - "asset=%{facts.dmi.product.serial_number}"
+    - "zone=%{zone}"
+
+# FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
+python::manage_dev_package: false
+
+profiles::packages::include:
+  bridge-utils: {}
+  cephadm: {}
+
+profiles::selinux::setenforce::mode: disabled
+
+profiles::ceph::client::manage_ceph_conf: false
+profiles::ceph::client::manage_ceph_package: false
+profiles::ceph::client::manage_ceph_paths: false
+profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
+profiles::ceph::client::mons:
+  - 198.18.23.9
+  - 198.18.23.10
+  - 198.18.23.11
+  - 198.18.23.12
+  - 198.18.23.13
+
+# additional repos
+profiles::yum::global::repos:
+  ceph:
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
+  ceph-noarch:
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  rancher-rke2-common-latest:
+    name: rancher-rke2-common-latest
+    descr: rancher-rke2-common-latest
+    target: /etc/yum.repos.d/rke2-common.repo
+    baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/
+    gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/public.key
+    mirrorlist: absent
+  rancher-rke2-1-33-latest:
+    name: rancher-rke2-1-33-latest
+    descr: rancher-rke2-1-33-latest
+    target: /etc/yum.repos.d/rke2-1-33.repo
+    baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/
+    gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/public.key
+    mirrorlist: absent
+
+# dns
+profiles::dns::base::primary_interface: loopback0
+
+# networking
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    type: physical
+    ipaddress: "%{hiera('networking_1000_ip')}"
+    gateway: 198.18.15.254
+    txqueuelen: 10000
+    forwarding: true
+  "%{hiera('networking_2500_iface')}":
+    type: physical
+    ipaddress: "%{hiera('networking_2500_ip')}"
+    mtu: 1500
+    txqueuelen: 10000
+    forwarding: true
+  loopback0:
+    type: dummy
+    ipaddress: "%{hiera('networking_loopback0_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+  loopback1:
+    type: dummy
+    ipaddress: "%{hiera('networking_loopback1_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+  loopback2:
+    type: dummy
+    ipaddress: "%{hiera('networking_loopback2_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# configure consul service
+profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: frr_exporter
+    disposition: write
+
+# frrouting
+exporters::frr_exporter::enable: true
+frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
+frrouting::ospf_preferred_source_enable: true
+frrouting::ospf_preferred_source: "%{hiera('networking_loopback0_ip')}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  "%{hiera('networking_1000_iface')}":
+    area: 0.0.0.0
+  "%{hiera('networking_2500_iface')}":
+    area: 0.0.0.0
+  loopback0:
+    area: 0.0.0.0
+  loopback1:
+    area: 0.0.0.0
+  loopback2:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+frrouting::ospf_exclude_k8s_enable: true
+frrouting::k8s_cluster_cidr: '10.42.0.0/16'  # RKE2 cluster-cidr (pods)
+frrouting::k8s_service_cidr: '10.43.0.0/16'  # RKE2 service-cidr
+
+# add loopback interfaces to ssh list
+ssh::server::options:
+  ListenAddress:
+    - "%{hiera('networking_loopback0_ip')}"
+    - "%{hiera('networking_1000_ip')}"
+    - "%{hiera('networking_2500_ip')}"
+
+profiles::ssh::sign::principals:
+  - "%{hiera('networking_loopback0_ip')}"
+  - "%{hiera('networking_1000_ip')}"
+  - "%{hiera('networking_2500_ip')}"
@@ -1,10 +1,3 @@
 ---
-# networking
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-    mtu: 1500
+# manage rke2
+rke2::node_type: agent
@@ -0,0 +1 @@
+---
@@ -1,42 +1,78 @@
 ---
-profiles::pki::vault::alt_names:
-  - k8s-control.service.consul
-  - k8s-control.query.consul
-  - "k8s-control.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - k8s-control.service.consul
-  - k8s-control.query.consul
-  - "k8s-control.service.%{facts.country}-%{facts.region}.consul"
+# manage rke2
+rke2::node_type: server
+rke2::helm_install: true
+rke2::helm_repos:
+  rancher-stable: https://releases.rancher.com/server-charts/stable
+  purelb: https://gitlab.com/api/v4/projects/20400619/packages/helm/stable
+  jetstack: https://charts.jetstack.io
+  harbor: https://helm.goharbor.io
+  traefik: https://traefik.github.io/charts
+  hashicorp: https://helm.releases.hashicorp.com
+rke2::extra_config_files:
+  - rke2-canal-config
+  - rke2-nginx-ingress-config
+rke2::config_hash:
+  advertise-address: "%{hiera('networking_loopback0_ip')}"
+  tls-san:
+    - "join-k8s.service.consul"
+    - "api-k8s.service.consul"
+    - "api.k8s.unkin.net"
+    - "join.k8s.unkin.net"
+  cni: canal
+  cluster-cidr: 10.42.0.0/16
+  service-cidr: 10.43.0.0/16
+  cluster-dns: 10.43.0.10
+  etcd-arg: "--quota-backend-bytes 2048000000"
+  etcd-snapshot-schedule-cron: "0 3 * * *"
+  etcd-snapshot-retention: 10
+  kube-apiserver-arg:
+    - '--default-not-ready-toleration-seconds=30'
+    - '--default-unreachable-toleration-seconds=30'
+  kube-controller-manager-arg:
+    - '--node-monitor-period=4s'
+  protect-kernel-defaults: true
+  disable-kube-proxy: false

 # configure consul service
 consul::services:
-  k8s-control:
-    service_name: 'k8s-control'
-    tags:
-      - 'k8s'
-      - 'container'
+  api-k8s:
+    service_name: 'api-k8s'
    address: "%{facts.networking.fqdn}"
    port: 6443
    checks:
-      - id: 'k8s-control_https_check'
-        name: 'k8s-control HTTPS Check'
-        http: "https://%{facts.networking.fqdn}:6443"
-        method: 'GET'
-        tls_skip_verify: true
+      - id: 'api-k8s_livez_check'
+        name: 'api-k8s livez Check'
+        args:
+          - sudo
+          - /usr/local/bin/check_k8s_api.sh
+        interval: '10s'
+        timeout: '1s'
+  join-k8s:
+    service_name: 'join-k8s'
+    address: "%{facts.networking.fqdn}"
+    port: 9345
+    checks:
+      - id: 'rke2_tcp_check_9345'
+        name: 'rke2 TCP Check 9345'
+        tcp: "%{hiera('networking_loopback0_ip')}:9345"
        interval: '10s'
        timeout: '1s'
 profiles::consul::client::node_rules:
  - resource: service
-    segment: k8s-control
+    segment: api-k8s
+    disposition: write
+  - resource: service
+    segment: join-k8s
    disposition: write

-# networking
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-    mtu: 1500
+profiles::pki::vault::alt_names:
+  - api-k8s.service.consul
+  - api-k8s.query.consul
+  - "api-k8s.service.%{facts.country}-%{facts.region}.consul"
+
+sudo::configs:
+  consul-checks:
+    priority: 20
+    content: |
+      consul ALL=(ALL) NOPASSWD: /usr/local/bin/check_k8s_api.sh
@@ -5,6 +5,24 @@ hiera_include:
  - profiles::ceph::node
  - profiles::ceph::client
  - exporters::frr_exporter
+  - profiles::rke2::node
+
+# manage rke2
+profiles::rke2::node::servers:
+  - prodnxsr0001.main.unkin.net
+  - prodnxsr0002.main.unkin.net
+  - prodnxsr0003.main.unkin.net
+
+rke2::config_hash:
+  bind-address: "%{hiera('networking_loopback0_ip')}"
+  advertise-address: "%{hiera('networking_loopback0_ip')}"
+  node-ip: "%{hiera('networking_loopback0_ip')}"
+  node-external-ip: "%{hiera('networking_loopback0_ip')}"
+  cluster-domain: "svc.k8s.unkin.net"
+  tls-san:
+    - "api.k8s.unkin.net"
+    - "join.k8s.unkin.net"
+  cni: cilium

 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
 python::manage_dev_package: false
@@ -25,6 +43,7 @@ profiles::ceph::client::mons:
  - 198.18.23.11
  - 198.18.23.12
  - 198.18.23.13
+
 # additional repos
 profiles::yum::global::repos:
  ceph:
@@ -55,6 +74,20 @@ profiles::yum::global::repos:
    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
    mirrorlist: absent
+  rancher-rke2-common-latest:
+    name: rancher-rke2-common-latest
+    descr: rancher-rke2-common-latest
+    target: /etc/yum.repos.d/rke2-common.repo
+    baseurl: https://rpm.rancher.io/rke2/latest/common/centos/%{facts.os.release.major}/noarch
+    gpgkey: https://rpm.rancher.io/public.key
+    mirrorlist: absent
+  rancher-rke2-1-33-latest:
+    name: rancher-rke2-1-33-latest
+    descr: rancher-rke2-1-33-latest
+    target: /etc/yum.repos.d/rke2-1-33.repo
+    baseurl: https://rpm.rancher.io/rke2/latest/1.33/centos/%{facts.os.release.major}/x86_64
+    gpgkey: https://rpm.rancher.io/public.key
+    mirrorlist: absent

 # dns
 profiles::dns::base::primary_interface: loopback0
@@ -91,8 +124,38 @@ networking::interfaces:
    netmask: 255.255.255.255
    mtu: 1500

-# consul
+# configure consul service
+profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"
+consul::services:
+  api-k8s:
+    service_name: 'api-k8s'
+    address: "%{facts.networking.fqdn}"
+    port: 6443
+    checks:
+      - id: 'api-k8s_https_check'
+        name: 'api-k8s HTTPS Check'
+        http: "https://%{facts.networking.fqdn}:6443"
+        method: 'GET'
+        tls_skip_verify: true
+        interval: '10s'
+        timeout: '1s'
+  join-k8s:
+    service_name: 'join-k8s'
+    address: "%{facts.networking.fqdn}"
+    port: 9345
+    checks:
+      - id: 'etcd_tcp_check_9345'
+        name: 'ETCD TCP Check 9345'
+        tcp: "%{facts.networking.fqdn}:9345"
+        interval: '10s'
+        timeout: '1s'
 profiles::consul::client::node_rules:
+  - resource: service
+    segment: api-k8s
+    disposition: write
+  - resource: service
+    segment: join-k8s
+    disposition: write
  - resource: service
    segment: frr_exporter
    disposition: write
@@ -100,6 +163,8 @@ profiles::consul::client::node_rules:
 # frrouting
 exporters::frr_exporter::enable: true
 frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
+frrouting::ospf_preferred_source_enable: true
+frrouting::ospf_preferred_source: "%{hiera('networking_loopback0_ip')}"
 frrouting::ospfd_redistribute:
  - connected
 frrouting::ospfd_interfaces:
@@ -127,3 +192,8 @@ profiles::ssh::sign::principals:
  - "%{hiera('networking_loopback0_ip')}"
  - "%{hiera('networking_1000_ip')}"
  - "%{hiera('networking_2500_ip')}"
+
+profiles::pki::vault::alt_names:
+  - api-k8s.service.consul
+  - api-k8s.query.consul
+  - "api-k8s.service.%{facts.country}-%{facts.region}.consul"
@@ -0,0 +1,20 @@
+---
+
+# Common mail server configuration
+
+# base postfix configuration (passed to postfix class)
+postfix::relayhost: 'direct'
+postfix::myorigin: 'main.unkin.net'
+postfix::manage_aliases: true
+
+# Common postfix virtuals for all mail servers
+postfix::virtuals:
+  'root':
+    ensure: present
+    destination: 'ben@main.unkin.net'
+  'postmaster':
+    ensure: present
+    destination: 'ben@main.unkin.net'
+  'abuse':
+    ensure: present
+    destination: 'ben@main.unkin.net'
@@ -0,0 +1,87 @@
+---
+# additional altnames
+profiles::pki::vault::alt_names:
+  - mail.main.unkin.net
+
+# manage dovecot
+dovecot::install::packages:
+  - dovecot
+  - dovecot-pgsql
+profiles::dovecot::server::maildir_path: "%{hiera('profiles::postfix::gateway::virtual_mailbox_base')}"
+
+#dovecot::config:
+#  auth.conf:
+#    values:
+#      auth_mechanisms: 'plain login'
+#      auth_username_format: '%Lu'
+#      auth_default_realm: 'main.unkin.net'
+#  auth-vmail.conf:
+#    values:
+#      passdb: |
+#        {
+#          driver = pam
+#        }
+#      userdb: |
+#        {
+#          driver = passwd
+#          override_fields = uid=vmail gid=vmail home=/shared/apps/maildata/%u
+#        }
+#  mail.conf:
+#    values:
+#      mail_plugins: '$mail_plugins'
+#      namespace inbox: |
+#        {
+#          inbox = yes
+#          location =
+#          mailbox Drafts {
+#            special_use = \Drafts
+#          }
+#          mailbox Junk {
+#            special_use = \Junk
+#          }
+#          mailbox Sent {
+#            special_use = \Sent
+#          }
+#          mailbox "Sent Messages" {
+#            special_use = \Sent
+#          }
+#          mailbox Trash {
+#            special_use = \Trash
+#          }
+#        }
+#    sections:
+#      - name: 'namespace inbox'
+#        values:
+#          'inbox': 'yes'
+#          'seperator': '.'
+#          'prefix': 'INBOX'
+
+# backend-specific postfix configuration
+postfix::mydestination: 'localhost'
+postfix::mynetworks: '127.0.0.0/8 [::1]/128 10.10.12.0/24'
+postfix::smtp_listen: ['0.0.0.0', '::']
+postfix::use_dovecot_lda: true        # use built-in dovecot LDA support
+postfix::mail_user: 'vmail:vmail'
+profiles::postfix::gateway::enable_postscreen: false  # disable postscreen (backend doesn't need it)
+profiles::postfix::gateway::myhostname: 'mail.main.unkin.net'
+profiles::postfix::gateway::enable_dovecot: true    # enable dovecot integration
+profiles::postfix::gateway::virtual_mailbox_domains:
+  - 'main.unkin.net'
+profiles::postfix::gateway::virtual_mailbox_base: '/shared/apps/maildata'
+
+profiles::postfix::gateway::virtual_mailbox_maps:
+  'ben@main.unkin.net': 'main.unkin.net/ben/'
+  'root@main.unkin.net': 'main.unkin.net/ben/'
+  'postmaster@main.unkin.net': 'main.unkin.net/ben/'
+  'abuse@main.unkin.net': 'main.unkin.net/ben/'
+
+profiles::postfix::gateway::smtpd_client_restrictions:
+  - 'permit_mynetworks'
+  - 'reject_unauth_destination'
+profiles::postfix::gateway::smtpd_sender_restrictions:
+  - 'permit_mynetworks'
+  - 'reject_non_fqdn_sender'
+profiles::postfix::gateway::smtpd_recipient_restrictions:
+  - 'permit_mynetworks'
+  - 'reject_non_fqdn_recipient'
+  - 'reject_unauth_destination'
@@ -0,0 +1,34 @@
+---
+# additional altnames
+profiles::pki::vault::alt_names:
+  - in-mta.main.unkin.net
+
+# gateway-specific postfix configuration
+postfix::mydestination: 'blank'
+postfix::mynetworks: '127.0.0.0/8 [::1]/128'
+postfix::smtp_listen: '0.0.0.0'
+postfix::mta: true
+profiles::postfix::gateway::myhostname: 'in-mta.main.unkin.net'
+
+profiles::postfix::gateway::relay_recipients_maps:
+  '@main.unkin.net': 'OK'
+
+profiles::postfix::gateway::relay_domains_maps:
+  'main.unkin.net': 'OK'
+
+profiles::postfix::gateway::postscreen_access_maps:
+  '127.0.0.1/32': 'permit'
+  '10.10.12.200/32': 'permit'
+
+profiles::postfix::gateway::helo_access_maps:
+  '.dynamic.': 'REJECT'
+  '.dialup.': 'REJECT'
+  'unknown': 'REJECT'
+  'localhost': 'REJECT You are not localhost'
+
+# postfix transports
+postfix::transports:
+  'main.unkin.net':
+    ensure: present
+    destination: 'relay'
+    nexthop: 'ausyd1nxvm2120.main.unkin.net:25'
@@ -11,6 +11,9 @@ profiles::metrics::grafana::db_name: "%{hiera('profiles::sql::postgresdb::dbname
 profiles::metrics::grafana::db_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
 profiles::metrics::grafana::db_pass: "%{hiera('profiles::sql::postgresdb::dbpass')}"
 profiles::metrics::grafana::pgsql_backend: true
+profiles::metrics::grafana::plugins:
+  victoriametrics-logs-datasource:
+    ensure: present

 # additional altnames
 profiles::pki::vault::alt_names:
@@ -15,3 +15,4 @@ certbot::domains:
  - fafflix.unkin.net
  - git.unkin.net
  - grafana.unkin.net
+  - dashboard.ceph.unkin.net
@@ -1,3 +1,3 @@
 ---
 profiles::packages::include:
-  puppetserver: {}
+  openvox-server: {}
@@ -283,6 +283,20 @@ profiles::reposync::repos_list:
    release: 'rhel9'
    baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-9-x86_64/'
    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  rke2_common_el9:
+    repository: 'common'
+    description: 'RKE2 common RHEL 9'
+    osname: 'rke2'
+    release: "rhel9"
+    baseurl: "https://rpm.rancher.io/rke2/latest/common/centos/9/noarch"
+    gpgkey: "https://rpm.rancher.io/public.key"
+  rke2_1_33_el9:
+    repository: '1.33'
+    description: 'RKE2 1.33 RHEL 9'
+    osname: 'rke2'
+    release: "rhel9"
+    baseurl: "https://rpm.rancher.io/rke2/latest/1.33/centos/9/x86_64"
+    gpgkey: "https://rpm.rancher.io/public.key"
  zfs_dkms_rhel8:
    repository: 'dkms'
    description: 'ZFS DKMS RHEL 8'
@@ -4,7 +4,8 @@ profiles::vault::server::members_lookup: true
 profiles::vault::server::data_dir: /data/vault
 profiles::vault::server::manage_storage_dir: true
 profiles::vault::server::tls_disable: false
-vault::download_url: http://repos.main.unkin.net/unkin/8/x86_64/os/Archives/vault_1.15.5_linux_amd64.zip
+vault::package_name: openbao
+vault::package_ensure: 2.4.1

 # additional altnames
 profiles::pki::vault::alt_names:
@@ -16,6 +16,14 @@ class exporters::frr_exporter (
      ensure => installed,
    }

+    # ensure the frr_exporter user can read the directory
+    file { $socket_dir:
+      ensure => directory,
+      owner  => 'frr',
+      group  => 'frr',
+      mode   => '0751',
+    }
+
    # manage the user/group
    if $manage_user {
      group { $group:
@@ -14,8 +14,18 @@ class frrouting (
  Optional[String] $mpls_ldp_router_id       = undef,
  Optional[String] $mpls_ldp_transport_addr  = undef,
  Array[String] $mpls_ldp_interfaces         = [],
+  Boolean $ospf_preferred_source_enable      = false,
+  Optional[Stdlib::IP::Address] $ospf_preferred_source = undef,
+  Boolean $ospf_exclude_k8s_enable           = false,
+  Optional[Stdlib::IP::Address::V4::CIDR] $k8s_cluster_cidr = undef, # pod/cluster CIDR (e.g. 10.42.0.0/16)
+  Optional[Stdlib::IP::Address::V4::CIDR] $k8s_service_cidr = undef, # service CIDR (e.g. 10.43.0.0/16)
 ) {

+    # sanity check
+  if $ospf_exclude_k8s_enable and $k8s_cluster_cidr == undef and $k8s_service_cidr == undef {
+    warning('frrouting: ospf_exclude_k8s_enable is true but no k8s_*_cidr provided; nothing will be filtered.')
+  }
+
  $daemons_defaults = {
    'bgpd'    => false,
    'ospfd'   => true,
@@ -2,6 +2,7 @@
 frr defaults traditional
 hostname <%= @hostname %>
 no ipv6 forwarding
+
 <% @ospfd_interfaces.each do |iface, params| -%>
 interface <%= iface %>
 <% if params['area'] -%>
@@ -12,12 +13,31 @@ interface <%= iface %>
 <% end -%>
 exit
 <% end -%>
+
+<%# ---- K8s exclude (prefix-list + route-map) ---- -%>
+<% if @ospf_exclude_k8s_enable && (@k8s_cluster_cidr || @k8s_service_cidr) -%>
+! Do not redistribute Kubernetes Pod/Service CIDRs
+ip prefix-list K8S-BLOCK seq 5 permit <%= @k8s_cluster_cidr %> le 32<% if !@k8s_cluster_cidr %>  ! (unset)<% end %>
+<% if @k8s_service_cidr -%>
+ip prefix-list K8S-BLOCK seq 10 permit <%= @k8s_service_cidr %> le 32
+<% end -%>
+route-map CONNECTED-NON-K8S deny 5
+ match ip address prefix-list K8S-BLOCK
+exit
+route-map CONNECTED-NON-K8S permit 100
+exit
+<% end -%>
+
 router ospf
 ospf router-id <%= @ospfd_router_id %>
 log-adjacency-changes detail
 <% @ospfd_redistribute.each do |type| -%>
+<% if @ospf_exclude_k8s_enable && type == 'connected' && (@k8s_cluster_cidr || @k8s_service_cidr) -%>
+ redistribute connected route-map CONNECTED-NON-K8S
+<% else -%>
 redistribute <%= type %>
 <% end -%>
+<% end -%>
 <% @ospfd_networks.each do |network| -%>
 network <%= network %>
 <% end -%>
@@ -31,6 +51,8 @@ router ospf
 mpls-te inter-as area 0.0.0.0
 <% end -%>
 exit
+
+<%# ---- MPLS/LDP config ---- -%>
 <% if @mpls_ldp_router_id and @mpls_ldp_transport_addr and @mpls_ldp_interfaces.any? -%>
 mpls ldp
 router-id <%= @mpls_ldp_router_id %>
@@ -43,3 +65,13 @@ mpls ldp
 exit-address-family
 exit
 <% end -%>
+
+<%# ---- Preferred OSPF source ---- -%>
+<% if @ospf_preferred_source_enable && @ospf_preferred_source -%>
+ip prefix-list ANY seq 5 permit 0.0.0.0/0 le 32
+route-map OSPF-SRC permit 10
+ match ip address prefix-list ANY
+ set src <%= @ospf_preferred_source %>
+exit
+ip protocol ospf route-map OSPF-SRC
+<% end -%>
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+# lib/facter/incus_trust_list.rb
+require 'json'
+
+Facter.add(:incus_trust_list) do
+  confine do
+    # Only run on systems that have incus installed and running
+    incus_path = Facter::Util::Resolution.which('incus')
+    incus_path && File.exist?('/var/lib/incus/server.key')
+  end
+
+  setcode do
+    incus_path = Facter::Util::Resolution.which('incus')
+    next {} unless incus_path
+
+    begin
+      # Run incus config trust list --format=json
+      trust_output = Facter::Core::Execution.execute("#{incus_path} config trust list --format=json")
+      next {} if trust_output.empty?
+
+      # Parse the JSON output
+      JSON.parse(trust_output)
+    rescue StandardError
+      {}
+    end
+  end
+end
@@ -0,0 +1,16 @@
+# incus::client
+#
+# This class configures a host as an incus client and exports its certificate
+# for automatic trust management on incus servers.
+#
+class incus::client {
+
+  # Export this client's certificate for collection by incus servers
+  @@incus::client_cert { $facts['networking']['fqdn']:
+    hostname    => $facts['networking']['fqdn'],
+    certificate => $facts['vault_cert_content'],
+    fingerprint => $facts['vault_cert_fingerprint'],
+    tag         => 'incus_client',
+  }
+
+}
@@ -0,0 +1,41 @@
+# Define the exported resource type for incus client certificates
+define incus::client_cert (
+  String $hostname,
+  Optional[String] $certificate = undef,
+  Optional[String] $fingerprint = undef,
+) {
+
+  # Only proceed if we have both certificate and fingerprint
+  if $certificate and $fingerprint {
+
+    $trust_list = $facts['incus_trust_list']
+    $existing_client = $trust_list.filter |$client| { $client['name'] == $hostname }
+
+    if $existing_client.empty {
+      # Add new certificate
+      exec { "incus_trust_add_${hostname}":
+        path    => ['/bin', '/usr/bin'],
+        command => "echo '${certificate}' > /tmp/${hostname}.crt && \
+                    incus config trust add-certificate /tmp/${hostname}.crt --name ${hostname} && \
+                    rm -f /tmp/${hostname}.crt",
+        unless  => "incus config trust list --format=json | grep '\"name\":\"${hostname}\"'",
+      }
+    } else {
+      # Check if fingerprints are different
+      $existing_fingerprint = $existing_client[0]['fingerprint']
+
+      if $existing_fingerprint != $fingerprint {
+        # Remove existing and add new certificate only if fingerprints differ
+        exec { "incus_trust_update_${hostname}":
+          path    => ['/bin', '/usr/bin'],
+          command => "incus config trust remove ${existing_fingerprint} && \
+                      echo '${certificate}' > /tmp/${hostname}.crt && \
+                      incus config trust add-certificate /tmp/${hostname}.crt --name ${hostname} && \
+                      rm -f /tmp/${hostname}.crt",
+          onlyif  => "incus config trust list --format=json | grep '${existing_fingerprint}'",
+        }
+      }
+      # If fingerprints match, do nothing (certificate is already correct)
+    }
+  }
+}
@@ -21,6 +21,10 @@ class incus (
    enable     => true,
    hasstatus  => true,
    hasrestart => true,
+    subscribe  => [
+      File['/var/lib/incus/server.crt'],
+      File['/var/lib/incus/server.key'],
+    ],
  }

  file_line { 'subuid_root':
@@ -55,6 +59,22 @@ class incus (
    }
  }

+  file { '/var/lib/incus/server.crt':
+    ensure => file,
+    source => '/etc/pki/tls/vault/certificate.crt',
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0644',
+  }
+
+  file { '/var/lib/incus/server.key':
+    ensure => file,
+    source => '/etc/pki/tls/vault/private.key',
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0600',
+  }
+
  if $facts['incus'] and $facts['incus']['config'] {
    # set core.https_address
    if $facts['incus']['config']['core.https_address'] != "${server_addr}:${server_port}" {
@@ -72,5 +92,10 @@ class incus (
        }
      }
    }
+
+    # Collect exported client certificates and manage trust
+    Incus::Client_cert <<| tag == 'incus_client' |>> {
+      require => Service['incus'],
+    }
  }
 }
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+# lib/facter/vault_cert_content.rb
+
+Facter.add(:vault_cert_content) do
+  confine kernel: 'Linux'
+  setcode do
+    cert_path = '/etc/pki/tls/vault/certificate.crt'
+    File.read(cert_path) if File.exist?(cert_path) && File.readable?(cert_path)
+  end
+end
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# lib/facter/vault_cert_fingerprint.rb
+
+Facter.add(:vault_cert_fingerprint) do
+  confine kernel: 'Linux'
+  setcode do
+    require 'openssl'
+    require 'digest'
+
+    cert_path = '/etc/pki/tls/vault/certificate.crt'
+    if File.exist?(cert_path) && File.readable?(cert_path)
+      begin
+        cert_content = File.read(cert_path)
+        cert = OpenSSL::X509::Certificate.new(cert_content)
+        # Calculate SHA256 fingerprint like incus does
+        Digest::SHA256.hexdigest(cert.to_der)
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end
@@ -0,0 +1,2 @@
+#!/usr/bin/bash
+/var/lib/rancher/rke2/bin/kubectl --kubeconfig=/etc/rancher/rke2/rke2.yaml get --raw /livez
@@ -0,0 +1,23 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    kubernetes.io/ingress.class: nginx
+spec:
+  tls:
+    - hosts: [rancher.main.unkin.net]
+      secretName: tls-rancher
+  rules:
+    - host: rancher.main.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80
@@ -0,0 +1,45 @@
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  name: common
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
+---
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - subnet: 198.18.199.0/24
+        pool: 198.18.199.0/24
+        aggregation: /32
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  name: common
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - subnet: 198.18.200.0/24
+        pool: 198.18.200.0/24
+        aggregation: /32
@@ -0,0 +1,9 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: rke2-canal
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    flannel:
+      iface: "loopback0"
@@ -0,0 +1,20 @@
+---
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: rke2-ingress-nginx
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    controller:
+      hostPort:
+        enabled: false
+      service:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerClass: purelb.io/purelb
+        allocateLoadBalancerNodePorts: false
+        annotations:
+          purelb.io/service-group: common
+          purelb.io/addresses: "198.18.200.0"
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require 'facter/util/helm'
+
+Facter.add(:helm_repos) do
+  confine kernel: 'Linux'
+  confine enc_role: [
+    'roles::infra::k8s::control',
+    'roles::infra::k8s::compute'
+  ]
+
+  setcode do
+    Facter::Util::Helm.get_helm_repos('/usr/bin/helm')
+  end
+end
@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+
+Facter.add(:k8s_masters) do
+  confine do
+    File.exist?('/etc/rancher/rke2/rke2.yaml') &&
+      File.executable?('/usr/bin/kubectl')
+  end
+
+  setcode do
+    env = { 'KUBECONFIG' => '/etc/rancher/rke2/rke2.yaml' }
+    cmd = ['/usr/bin/kubectl', 'get', 'nodes', '-o', 'json']
+
+    stdout, stderr, status = Open3.capture3(env, *cmd)
+
+    if status.success?
+      json = JSON.parse(stdout)
+
+      master_count = json['items'].count do |item|
+        roles = item.dig('metadata', 'labels') || {}
+
+        # Look for well-known labels assigned to control-plane nodes
+        roles.any? do |key, _|
+          key =~ %r{node-role\.kubernetes\.io/(control-plane|master|etcd)}
+        end
+      end
+
+      master_count
+    else
+      Facter.debug("kubectl error: #{stderr}")
+      0
+    end
+  rescue StandardError => e
+    Facter.debug("Exception in k8s_masters fact: #{e.message}")
+    0
+  end
+end
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+
+Facter.add(:k8s_namespaces) do
+  confine do
+    File.exist?('/etc/rancher/rke2/rke2.yaml') &&
+      File.executable?('/usr/bin/kubectl') # Adjust this path if needed
+  end
+
+  setcode do
+    env = { 'KUBECONFIG' => '/etc/rancher/rke2/rke2.yaml' }
+    cmd = ['/usr/bin/kubectl', 'get', 'namespaces', '-o', 'json']
+
+    stdout, stderr, status = Open3.capture3(env, *cmd)
+
+    if status.success?
+      json = JSON.parse(stdout)
+      json['items'].map { |item| item['metadata']['name'] }
+    else
+      Facter.debug("kubectl error: #{stderr}")
+      []
+    end
+  rescue StandardError => e
+    Facter.debug("Exception in k8s_namespaces fact: #{e.message}")
+    []
+  end
+end
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'facter'
+require 'json'
+
+# a simple helm module
+module Facter::Util::Helm
+  def self.get_helm_repos(helm_cmd)
+    return [] unless File.executable?(helm_cmd)
+
+    output = Facter::Core::Execution.execute(
+      "#{helm_cmd} repo list --output json --repository-config /etc/helm/repositories.yaml",
+      on_fail: nil
+    )
+    return [] if output.to_s.strip.empty?
+
+    parse_helm_output(output)
+  rescue StandardError => e
+    Facter.debug("helm_repos fact error: #{e}")
+    []
+  end
+
+  def self.parse_helm_output(output)
+    JSON.parse(output).map do |repo|
+      {
+        'name' => repo['name'],
+        'url' => repo['url']
+      }
+    end
+  end
+end
@@ -0,0 +1,109 @@
+# config rke2
+class rke2::config (
+  Enum['server', 'agent'] $node_type = $rke2::node_type,
+  Stdlib::Absolutepath    $config_file = $rke2::config_file,
+  Hash                    $config_hash = $rke2::config_hash,
+  Stdlib::HTTPSUrl        $join_url = $rke2::join_url,
+  Stdlib::Fqdn            $bootstrap_node = $rke2::bootstrap_node,
+  String                  $node_token = $rke2::node_token,
+  Array[String[1]]        $extra_config_files = $rke2::extra_config_files,
+){
+
+  # if its not the bootstrap node, add join path to config
+  if $node_type == 'server' {
+    if $trusted['certname'] != $bootstrap_node {
+      $config = merge($config_hash, {
+        server => $join_url,
+        token  => $node_token,
+      } )
+    }else{
+      $config = merge($config_hash, {})
+    }
+  } elsif $node_type == 'agent' {
+      $config = merge($config_hash, {
+        server => $join_url,
+        token  => $node_token,
+      } )
+  }else{
+    $config = $config_hash
+  }
+
+  # create the config file
+  file { $config_file:
+    ensure  => file,
+    content => Sensitive($config.to_yaml),
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    require => Package["rke2-${node_type}"],
+    before  => Service["rke2-${node_type}"],
+  }
+
+  # create a script to verify k8s api is up (used by consul)
+  file {'/usr/local/bin/check_k8s_api.sh':
+    ensure => file,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+    source => 'puppet:///modules/rke2/check_k8s_api.sh',
+  }
+
+  # symlink kubectl to path
+  file {'/usr/bin/kubectl':
+    ensure  => link,
+    target  => '/var/lib/rancher/rke2/bin/kubectl',
+    require => Package["rke2-${node_type}"],
+  }
+
+  # when ProtectKernelDefaults=true
+  sysctl { 'vm.overcommit_memory':
+    value  => '1',
+    before => Service["rke2-${node_type}"],
+  }
+  sysctl { 'kernel.panic':
+    value  => '10',
+    before => Service["rke2-${node_type}"],
+  }
+
+  # on the controller nodes only
+  if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
+
+    # wait for purelb helm to setup namespace
+    if 'purelb' in $facts['k8s_namespaces'] {
+      file {'/var/lib/rancher/rke2/server/manifests/purelb-config.yaml':
+        ensure  => file,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0644',
+        source  => 'puppet:///modules/rke2/purelb-config.yaml',
+        require => Service['rke2-server'],
+      }
+    }
+
+    # wait for rancher helm to setup namespace
+    if 'cattle-system' in $facts['k8s_namespaces'] {
+      file {'/var/lib/rancher/rke2/server/manifests/ingress-route-rancher.yaml':
+        ensure  => file,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0644',
+        source  => 'puppet:///modules/rke2/ingress-route-rancher.yaml',
+        require => Service['rke2-server'],
+      }
+    }
+
+    # manage extra config config (these are not dependent on helm)
+    $extra_config_files.each |$file| {
+
+      file {"/var/lib/rancher/rke2/server/manifests/${file}.yaml":
+        ensure  => file,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0644',
+        source  => "puppet:///modules/rke2/${file}.yaml",
+        require => Service['rke2-server'],
+      }
+    }
+
+  }
+}
@@ -0,0 +1,81 @@
+# manage helm
+class rke2::helm (
+  Enum['server', 'agent'] $node_type = $rke2::node_type,
+  Stdlib::Fqdn            $bootstrap_node = $rke2::bootstrap_node,
+  Boolean                 $helm_install = $rke2::helm_install,
+  Hash                    $helm_repos = $rke2::helm_repos
+){
+
+  # when installing helm, manage the repos
+  if $helm_install {
+
+    package {'helm':
+      ensure => installed,
+    }
+
+    file { '/etc/helm':
+      ensure => directory,
+      owner  => 'root',
+      group  => 'root',
+      mode   => '0755',
+    }
+
+    # on the controller nodes only, and after 3 master nodes exist
+    if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
+
+      # check if the repo already exists
+      $helm_repos.each | String $repo, Stdlib::HTTPSUrl $url | {
+
+        # if repo isnt in repo list from helm, install it
+        if ! $facts['helm_repos'].any |$existing| { $existing['name'] == $repo } {
+
+          exec { "helm_add_repo_${repo}":
+            command     => "helm repo add ${repo} ${url} --repository-config /etc/helm/repositories.yaml",
+            path        => ['/usr/bin'],
+            environment => [
+              'KUBECONFIG=/etc/rancher/rke2/rke2.yaml',
+            ],
+          }
+        }
+      }
+
+      # install specific helm charts to bootstrap environment
+      $plb_cmd = 'helm install purelb purelb/purelb \
+                  --create-namespace \
+                  --namespace=purelb \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_purelb':
+        command     => $plb_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n purelb | grep -q ^purelb',
+      }
+
+      $cm_cmd = 'helm install cert-manager jetstack/cert-manager \
+                  --namespace cert-manager \
+                  --create-namespace \
+                  --set crds.enabled=true \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_cert_manager':
+        command     => $cm_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n cert-manager | grep -q ^cert-manager',
+      }
+
+      $r_cmd = 'helm install rancher rancher-stable/rancher \
+                  --namespace cattle-system \
+                  --create-namespace \
+                  --set hostname=rancher.main.unkin.net \
+                  --set bootstrapPassword=admin \
+                  --set ingress.tls.source=secret \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_rancher':
+        command     => $r_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n cattle-system | grep -q ^rancher',
+      }
+    }
+  }
+}
@@ -0,0 +1,23 @@
+# manage rke2
+class rke2 (
+  Enum['server', 'agent'] $node_type = $rke2::params::node_type,
+  String                  $rke2_version = $rke2::params::rke2_version,
+  String                  $rke2_release = $rke2::params::rke2_release,
+  Stdlib::Absolutepath    $config_file = $rke2::params::config_file,
+  Hash                    $config_hash = $rke2::params::config_hash,
+  Stdlib::HTTPSUrl        $join_url = $rke2::params::join_url,
+  Stdlib::Fqdn            $bootstrap_node = $rke2::params::bootstrap_node,
+  String                  $node_token = $rke2::params::node_token,
+  Boolean                 $helm_install = $rke2::params::helm_install,
+  Hash                    $helm_repos = $rke2::params::helm_repos,
+  Array[String[1]]        $extra_config_files = $rke2::params::extra_config_files,
+  Stdlib::HTTPUrl         $container_archive_source = $rke2::params::container_archive_source,
+) inherits rke2::params {
+
+  include rke2::install
+  include rke2::config
+  include rke2::service
+  include rke2::helm
+
+  Class['rke2::install'] ->  Class['rke2::service'] -> Class['rke2::helm']
+}
@@ -0,0 +1,53 @@
+# install rke2
+class rke2::install (
+  Enum['server', 'agent'] $node_type = $rke2::node_type,
+  String                  $rke2_version = $rke2::rke2_version,
+  String                  $rke2_release = $rke2::rke2_release,
+  Stdlib::HTTPUrl         $container_archive_source = $rke2::container_archive_source,
+){
+
+  # versionlock rke2
+  yum::versionlock{"rke2-${node_type}":
+    ensure  => present,
+    version => "${rke2_version}~${rke2_release}",
+  }
+
+  # install rke2
+  package {"rke2-${node_type}":
+    ensure => "${rke2_version}~${rke2_release}",
+  }
+
+  # ensure images path exists
+  file { ['/var/lib/rancher/rke2/agent', '/var/lib/rancher/rke2/agent/images']:
+    ensure  => 'directory',
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0750',
+    require => Package["rke2-${node_type}"],
+    before  => Service["rke2-${node_type}"],
+  }
+
+  # download required archive of containers
+  archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
+    ensure  => present,
+    source  => "https://github.com/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
+    require => [
+      Package["rke2-${node_type}"],
+      File['/var/lib/rancher/rke2/agent/images'],
+    ],
+    before  => Service["rke2-${node_type}"],
+  }
+
+  # ensure the images cache file exists
+  file {'/var/lib/rancher/rke2/agent/images/.cache.json':
+    ensure  => file,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    require => [
+      Package["rke2-${node_type}"],
+      File['/var/lib/rancher/rke2/agent/images'],
+    ],
+    before  => Service["rke2-${node_type}"],
+  }
+}
@@ -0,0 +1,15 @@
+# rke2 params
+class rke2::params (
+  Enum['server', 'agent'] $node_type = 'agent',
+  String                  $rke2_version = '1.33.4',
+  String                  $rke2_release = 'rke2r1',
+  Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
+  Hash                    $config_hash = {},
+  Stdlib::HTTPSUrl        $join_url = 'https://127.0.0.1:9345',
+  Stdlib::Fqdn            $bootstrap_node = 'localhost.localdomain',
+  String                  $node_token = '',
+  Boolean                 $helm_install = false,
+  Hash                    $helm_repos = {},
+  Array[String[1]]        $extra_config_files = [],
+  Stdlib::HTTPUrl         $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
+) {}
@@ -0,0 +1,13 @@
+# manage rke2 service
+class rke2::service (
+  Enum['server', 'agent'] $node_type = $rke2::node_type,
+  Stdlib::Absolutepath    $config_file = $rke2::config_file,
+){
+
+  service {"rke2-${node_type}":
+    ensure    => true,
+    enable    => true,
+    subscribe => File[$config_file],
+  }
+
+}
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+Facter.add(:zfs_datasets) do
+  confine kernel: 'Linux'
+  setcode do
+    datasets = []
+
+    if Facter::Core::Execution.which('zfs')
+      begin
+        output = Facter::Core::Execution.execute('zfs list -H -o name 2>/dev/null', on_fail: nil)
+        datasets = output.strip.split("\n") if output && !output.empty?
+      rescue StandardError => e
+        Facter.debug("Error getting zfs dataset information: #{e.message}")
+      end
+    end
+
+    datasets.empty? ? nil : datasets
+  end
+end
@@ -3,7 +3,8 @@
 Facter.add('zfs_zpool_cache_present') do
  confine kernel: 'Linux'
  setcode do
-    File.exist?('/etc/zfs/zpool.cache')
+    cache_file = '/etc/zfs/zpool.cache'
+    File.exist?(cache_file) && File.size(cache_file).positive?
  end
 end

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+Facter.add(:zfs_zpools) do
+  confine kernel: 'Linux'
+  setcode do
+    zpools = []
+
+    if Facter::Core::Execution.which('zpool')
+      begin
+        output = Facter::Core::Execution.execute('zpool list -H -o name 2>/dev/null', on_fail: nil)
+        zpools = output.strip.split("\n") if output && !output.empty?
+      rescue StandardError => e
+        Facter.debug("Error getting zpool information: #{e.message}")
+      end
+    end
+
+    zpools.empty? ? nil : zpools
+  end
+end
@@ -38,8 +38,11 @@ class zfs (

  # create zpools
  $zpools.each | $zpool, $data | {
-    zpool { $zpool:
-      * => $data
+    # Only create zpool if it doesn't already exist
+    if $facts['zfs_zpools'] == undef or !($zpool in $facts['zfs_zpools']) {
+      zpool { $zpool:
+        * => $data
+      }
    }
  }

@@ -0,0 +1,54 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+
+postmaster: root
+
+# Many mailers use this address to represent the empty SMTP return path
+MAILER-DAEMON:	postmaster
+
+# Common aliases for system accounts.
+bin:		root
+daemon:		root
+games:		root
+ingres:		root
+nobody:		root
+system:		root
+toor:		root
+foo:		root
+falken:		root
+
+# Well-known aliases.
+admin:		root
+manager:	root
+dumper:		root
+operator:	root
+
+# traps to catch security attacks
+decode:		root
+moof:		root
+moog:		root
+
+# Standard aliases also defined by RFC 2142
+abuse:		postmaster
+
+# reports of network infrastructure difficulties
+noc:		root
+
+# address to report secuirty problems
+security:	root
+
+# DNS administrator (DNS soa records should use this)
+hostmaster:	root
+
+# Usenet news service administrator
+news:		usenet
+usenet:		root
+
+# http/web service administrator
+www:		webmaster
+webmaster:	root
+
+# UUCP service administrator
+uucp:		root
+
+# FTP administrator (especially anon FTP)
+ftp:		root
@@ -1,7 +1,5 @@
 # this is the base class, which will be used by all servers
-class profiles::base (
-  Array  $puppet_servers,
-) {
+class profiles::base () {

  # run a limited set of classes on the first run aimed at bootstrapping the new node
  if $facts['firstrun'] {
@@ -13,11 +11,7 @@ class profiles::base (

    # manage the puppet agent
    include profiles::puppet::agent
-
-    # manage puppet clients
-    if ! member($puppet_servers, $trusted['certname']) {
-      include profiles::puppet::client
-    }
+    include profiles::puppet::client

    # include the base profiles
    include profiles::base::repos
@@ -0,0 +1,36 @@
+class profiles::ceph::conf (
+  Hash $config = {}
+) {
+
+  package {[
+    'ceph',
+    'ceph-common'
+  ]:
+    ensure => installed,
+  }
+
+  file {'/etc/ceph':
+    ensure  => directory,
+    owner   => 'ceph',
+    group   => 'ceph',
+    mode    => '0755',
+    require => Package['ceph'],
+  }
+
+  file {'/var/log/ceph':
+    ensure  => directory,
+    owner   => 'ceph',
+    group   => 'ceph',
+    mode    => '0755',
+    require => Package['ceph'],
+  }
+
+  file { '/etc/ceph/ceph.conf':
+    ensure  => file,
+    owner   => 'ceph',
+    group   => 'ceph',
+    mode    => '0644',
+    content => template('profiles/ceph/conf.erb'),
+    require => Package['ceph-common'],
+  }
+}
@@ -0,0 +1,20 @@
+class profiles::ceph::dashboard (
+  Stdlib::IP::Address $ipaddress = $facts['networking']['ip'],
+){
+
+  # export haproxy balancemember
+  profiles::haproxy::balancemember { "${facts['networking']['fqdn']}_9443":
+    service   => 'be_ceph_dashboard',
+    ipaddress => $ipaddress,
+    ports     => [9443],
+    options   => [
+      "cookie ${facts['networking']['hostname']}",
+      'ssl',
+      'verify none',
+      'check',
+      'inter 2s',
+      'rise 3',
+      'fall 2',
+    ]
+  }
+}
@@ -0,0 +1,41 @@
+class profiles::ceph::rgw (
+  Boolean $enable = true,
+  Hash[String, String] $ceph_client_keys = {},
+  Stdlib::Absolutepath $base_path = '/var/lib/ceph'
+){
+
+  $key = $ceph_client_keys[$facts['networking']['hostname']]
+
+  if $enable {
+
+    include profiles::ceph::conf
+
+    package {'ceph-radosgw':
+      ensure => installed,
+    }
+
+    file { [
+      "${base_path}/radosgw",
+      "${base_path}/radosgw/ceph-${facts['networking']['hostname']}"
+    ]:
+      ensure => directory,
+      owner  => 'ceph',
+      group  => 'ceph',
+      mode   => '0750',
+    }
+
+    file { "${base_path}/radosgw/ceph-${facts['networking']['hostname']}/keyring":
+      ensure  => file,
+      owner   => 'ceph',
+      group   => 'ceph',
+      mode    => '0750',
+      content => Sensitive("[client.${facts['networking']['hostname']}]\n	key = ${key}\n")
+    }
+
+    service {"ceph-radosgw@${facts['networking']['hostname']}":
+      ensure    => true,
+      enable    => true,
+      subscribe => File["${base_path}/radosgw/ceph-${facts['networking']['hostname']}/keyring"]
+    }
+  }
+}
@@ -11,6 +11,7 @@ class profiles::consul::client (
  Stdlib::Absolutepath $data_dir           = '/opt/consul',
  Array[Hash]          $node_rules         = [],
  Hash                 $ports              = {},
+  Stdlib::IP::Address  $host_addr          = $facts['networking']['ip'],
 ) {

  if $facts['enc_role'] != $members_role {
@@ -42,8 +43,8 @@ class profiles::consul::client (
        'log_level'            => 'INFO',
        'node_name'            => $facts['networking']['fqdn'],
        'retry_join'           => $servers_array,
-        'bind_addr'            => $::facts['networking']['ip'],
-        'advertise_addr'       => $::facts['networking']['ip'],
+        'bind_addr'            => $host_addr,
+        'advertise_addr'       => $host_addr,
        'enable_script_checks' => true,
        'ports'                => $ports,
        'acl'                  => {
@@ -11,6 +11,7 @@ class profiles::defaults {
    ensure  => present,
    require => [
      Class['profiles::base::repos'],
+      Exec['dnf_makecache'],
    ]
  }

@@ -47,7 +47,7 @@ class profiles::dns::base (
  $facts['networking']['interfaces'].each | $interface, $data | {

    # exclude those without ipv4 address, lo, docker0 and anycast addresses
-    if $data['ip'] and $interface != 'lo' and $interface != 'docker0' and $interface !~ /^anycast[0-9]$/ {
+    if $data['ip'] and $interface != 'lo' and $interface != 'docker0' and $interface !~ /^anycast[0-9]$/ and $interface !~ /^cilium_/  {

      # use defaults for the primary_interface
      if $interface == $primary_interface {
@@ -0,0 +1,99 @@
+class profiles::dovecot::server (
+  Stdlib::Absolutepath $tls_cert_file = '/etc/pki/tls/vault/certificate.pem',
+  Stdlib::Absolutepath $tls_key_file  = '/etc/pki/tls/vault/certificate.pem',
+  Stdlib::Absolutepath $tls_ca_file   = '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
+  Stdlib::Absolutepath $maildir_path  = '/var/vmail',
+  String $maildir_var                 = '%d/%n',
+  String $hostname                    = $trusted['certname'],
+  Array[String] $listen               = ['*', '::'],
+  Array[String] $protocols            = ['imap'],
+) {
+
+  # Ensure the maildata directory exists
+  file { $maildir_path:
+    ensure => directory,
+    owner  => 'vmail',
+    group  => 'vmail',
+    mode   => '0755',
+  }
+
+  # Create vmail user for dovecot
+  user { 'vmail':
+    ensure     => present,
+    uid        => 5000,
+    gid        => 5000,
+    home       => $maildir_path,
+    shell      => '/usr/sbin/nologin',
+    managehome => false,
+    system     => true,
+  }
+
+  group { 'vmail':
+    ensure => present,
+    gid    => 5000,
+    system => true,
+  }
+
+  # Main dovecot configuration
+  $main_config = {
+    values => {
+      'listen'                    => join($listen, ', '),
+      'protocols'                 => join($protocols, ' '),
+      'default_login_user'        => 'vmail',
+      'default_internal_user'     => 'vmail',
+      'first_valid_uid'           => '5000',
+      'last_valid_uid'            => '5000',
+      'first_valid_gid'           => '5000',
+      'last_valid_gid'            => '5000',
+      'mail_uid'                  => 'vmail',
+      'mail_gid'                  => 'vmail',
+      'mail_location'             => "maildir:${maildir_path}/${maildir_var}/Maildir",
+      'login_trusted_networks'    => '10.0.0.0/8 127.0.0.0/8 [::1]/128',
+      'disable_plaintext_auth'    => 'no',
+      'auth_mechanisms'           => 'cram-md5 plain login',
+      'ssl'                       => 'required',
+      'ssl_cert'                  => $tls_cert_file,
+      'ssl_key'                   => $tls_key_file,
+      'ssl_ca'                    => $tls_ca_file,
+      'ssl_min_protocol'          => 'TLSv1.2',
+      'ssl_cipher_list'           => join([
+        'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES',
+        'ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS'
+      ], ':'),
+      'ssl_prefer_server_ciphers' => 'yes',
+    },
+    sections => [
+      {
+        name   => 'passdb',
+        values => {
+          'driver' => 'passwd-file',
+          'args'   => 'scheme=CRAM-MD5 username_format=%u /etc/dovecot/users',
+        },
+      },
+      {
+        name   => 'userdb',
+        values => {
+          'driver' => 'static',
+          'args'   => "uid=vmail gid=vmail home=${maildir_path}/${maildir_var}",
+        },
+      },
+    ],
+  }
+
+
+  #  # Postfix smtp-auth
+  #  unix_listener /var/spool/postfix/private/auth {
+  #    mode = 0666
+  #    user = postfix
+  #    group = postfix
+  #  }
+
+
+  # Configure dovecot
+  class { 'dovecot':
+    main_config        => $main_config,
+    include_sysdefault => false,
+    require            => [User['vmail'], Group['vmail'], File[$maildir_path]],
+  }
+
+}
@@ -3,6 +3,7 @@ define profiles::haproxy::balancemember (
  String              $service,
  Array[Stdlib::Port] $ports,
  Array               $options = ['check'],
+  Stdlib::IP::Address $ipaddress = $facts['networking']['ip'],
 ) {

  $location_environment = "${facts['country']}-${facts['region']}-${facts['environment']}"
@@ -12,7 +13,7 @@ define profiles::haproxy::balancemember (
    listening_service => $service,
    ports             => $ports,
    server_names      => $facts['networking']['hostname'],
-    ipaddresses       => $facts['networking']['ip'],
+    ipaddresses       => $ipaddress,
    options           => $options,
    tag               => $balancemember_tag,
  }
@@ -11,6 +11,7 @@ class profiles::metrics::grafana (
  String    $db_pass     = fqdn_rand_string(16),
  Stdlib::Host $db_host  = '127.0.0.1',
  Stdlib::Port $db_port  = 5432,
+  Hash      $plugins     = {}
 ) {

  # set the fqdn
@@ -108,6 +109,7 @@ class profiles::metrics::grafana (
  class { 'grafana':
    cfg      => $cfg,
    ldap_cfg => $ldap_cfg,
+    plugins  => $plugins,
  }

  # fix the package provided systemd service
@@ -136,9 +136,10 @@ class profiles::nginx::simpleproxy (
    }

    service { 'nginx':
-      ensure    => true,
-      enable    => true,
-      subscribe => [
+      ensure     => true,
+      enable     => true,
+      hasrestart => true,
+      subscribe  => [
        File[$selected_ssl_cert],
        File[$selected_ssl_key],
        Nginx::Resource::Server[$nginx_vhost]
@@ -0,0 +1,392 @@
+class profiles::postfix::gateway (
+  Stdlib::Absolutepath $tls_cert_file = '/etc/pki/tls/vault/certificate.pem',
+  Stdlib::Absolutepath $tls_key_file  = '/etc/pki/tls/vault/certificate.pem',
+  Stdlib::Absolutepath $tls_ca_file   = '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
+  String $myhostname                  = $trusted['certname'],
+  String $message_size_limit          = '133169152',
+  String $mailbox_size_limit          = '133169152',
+  String $local_transport             = 'error:No local mail delivery',
+  Boolean $enable_postscreen          = true,
+  Array[String] $alias_maps           = [
+    'hash:/etc/aliases',
+    'hash:/etc/postfix/aliases',
+  ],
+  Array[String] $postscreen_dnsbl_sites = [
+    'zen.spamhaus.org*3',
+    'b.barracudacentral.org=127.0.0.[2..11]*2',
+    'bl.spameatingmonkey.net*2',
+    'bl.spamcop.net',
+    'dnsbl.sorbs.net',
+    'swl.spamhaus.org*-4',
+    'list.dnswl.org=127.[0..255].[0..255].0*-2',
+    'list.dnswl.org=127.[0..255].[0..255].1*-4',
+    'list.dnswl.org=127.[0..255].[0..255].[2..3]*-6',
+  ],
+  Array[String] $smtpd_client_restrictions = [
+    'permit_sasl_authenticated',
+    'permit_mynetworks',
+    'reject_rbl_client zen.spamhaus.org',
+  ],
+  Array[String] $smtpd_sender_restrictions = [
+    'permit_sasl_authenticated',
+    'check_sender_access hash:/etc/postfix/sender_access',
+    'reject_non_fqdn_sender',
+    'reject_unknown_sender_domain',
+  ],
+  Array[String] $smtpd_recipient_restrictions = [
+    'permit_sasl_authenticated',
+    'permit_mynetworks',
+    'reject_unauth_destination',
+    'reject_non_fqdn_recipient',
+    'reject_unknown_recipient_domain',
+    'check_recipient_access hash:/etc/postfix/recipient_access',
+    'reject_unverified_recipient',
+  ],
+  Array[String] $smtpd_relay_restrictions = [
+    'permit_sasl_authenticated',
+    'permit_mynetworks',
+    'reject_unauth_destination',
+  ],
+  Hash[Stdlib::Fqdn, String] $smtp_tls_policy_maps = {},
+  Hash[String, String] $sender_canonical_maps = {},
+  Hash[Stdlib::Email, String] $sender_access_maps = {},
+  Hash[String, String] $relay_recipients_maps = {},
+  Hash[Stdlib::Fqdn, String] $relay_domains_maps = {},
+  Hash[String, String] $recipient_canonical_maps = {},
+  Hash[Stdlib::Email, String] $recipient_access_maps = {},
+  Hash[Variant[Stdlib::IP::Address, Stdlib::IP::Address::CIDR], String] $postscreen_access_maps = {},
+  Hash[String, String] $helo_access_maps = {},
+  Hash[Stdlib::Email, String] $virtual_mailbox_maps = {},
+  Hash[Variant[Stdlib::Email, Pattern[/^@.+$/]], Stdlib::Email] $virtual_alias_maps = {},
+  # Dovecot integration
+  Boolean $enable_dovecot = false,
+  Array[Stdlib::Fqdn] $virtual_mailbox_domains = [],
+  String $virtual_uid_maps = 'static:5000',
+  String $virtual_gid_maps = 'static:5000',
+  Stdlib::Absolutepath $virtual_mailbox_base = '/var/vmail',
+  String $virtual_transport = 'dovecot',
+) {
+
+  $alias_maps_string = join($alias_maps, ', ')
+
+  # Set master.cf configuration based on postscreen setting
+  if $enable_postscreen {
+    $master_smtp = 'smtp      inet  n       -       n       -       1       postscreen'
+    $master_entries = [
+      'smtpd     pass  -       -       n       -       -       smtpd',
+      'dnsblog   unix  -       -       n       -       0       dnsblog',
+      'tlsproxy  unix  -       -       n       -       0       tlsproxy',
+    ]
+    $postscreen_configs = {
+      'postscreen_access_list' => {
+        'value' => 'permit_mynetworks, cidr:/etc/postfix/postscreen_access'
+      },
+      'postscreen_blacklist_action' => {
+        'value' => 'enforce'
+      },
+      'postscreen_cache_map' => {
+        'value' => 'btree:$data_directory/postscreen_cache'
+      },
+      'postscreen_dnsbl_action' => {
+        'value' => 'enforce'
+      },
+      'postscreen_dnsbl_sites' => {
+        'value' => join($postscreen_dnsbl_sites, ', ')
+      },
+      'postscreen_dnsbl_threshold' => {
+        'value' => '2'
+      },
+      'postscreen_greet_action' => {
+        'value' => 'enforce'
+      },
+      'postscreen_greet_banner' => {
+        'value' => '$smtpd_banner'
+      },
+      'postscreen_greet_wait' => {
+        'value' => "\${stress?2}\${stress:6}s"
+      },
+    }
+  } else {
+    $master_smtp = undef
+    $master_entries = []
+    $postscreen_configs = {}
+  }
+
+  # Base postfix configuration
+  $base_configs = {
+    'alias_database' => {
+      'value' => $alias_maps_string
+    },
+    'default_destination_recipient_limit' => {
+      'value' => '1'
+    },
+    'disable_vrfy_command' => {
+      'value' => 'yes'
+    },
+    'enable_long_queue_ids' => {
+      'value' => 'yes'
+    },
+    'error_notice_recipient' => {
+      'value' => 'root'
+    },
+    'header_checks' => {
+      'value' => 'regexp:/etc/postfix/header_checks'
+    },
+    'local_recipient_maps' => {
+      'ensure' => 'blank'
+    },
+    'local_transport' => {
+      'value' => $local_transport
+    },
+    'mailbox_size_limit' => {
+      'value' => $mailbox_size_limit
+    },
+    'message_size_limit' => {
+      'value' => $message_size_limit
+    },
+    'myhostname' => {
+      'value' => $myhostname
+    },
+    'non_smtpd_milters' => {
+      'ensure' => 'blank'
+    },
+    'qmqpd_authorized_clients' => {
+      'value' => '127.0.0.1 [::1]'
+    },
+    'recipient_canonical_maps' => {
+      'value' => 'hash:/etc/postfix/recipient_canonical'
+    },
+    'recipient_delimiter' => {
+      'value' => '+'
+    },
+    'relay_domains' => {
+      'value' => 'hash:/etc/postfix/relay_domains'
+    },
+    'relay_recipient_maps' => {
+      'value' => 'hash:/etc/postfix/relay_recipients'
+    },
+    'sender_canonical_maps' => {
+      'value' => 'hash:/etc/postfix/sender_canonical'
+    },
+    'smtp_tls_CAfile' => {
+      'value' => $tls_ca_file
+    },
+    'smtp_tls_mandatory_protocols' => {
+      'value' => '!SSLv2,!SSLv3'
+    },
+    'smtp_tls_note_starttls_offer' => {
+      'value' => 'yes'
+    },
+    'smtp_tls_protocols' => {
+      'value' => '!SSLv2,!SSLv3'
+    },
+    'smtp_tls_security_level' => {
+      'value' => 'may'
+    },
+    'smtp_tls_session_cache_database' => {
+      'value' => 'btree:/var/lib/postfix/smtp_tls_session_cache'
+    },
+    'smtp_use_tls' => {
+      'value' => 'yes'
+    },
+    'smtpd_banner' => {
+      'value' => '$myhostname ESMTP $mail_name'
+    },
+    'smtpd_client_restrictions' => {
+      'value' => join($smtpd_client_restrictions, ', ')
+    },
+    'smtpd_data_restrictions' => {
+      'value' => 'reject_unauth_pipelining'
+    },
+    'smtpd_delay_reject' => {
+      'value' => 'yes'
+    },
+    'smtpd_discard_ehlo_keywords' => {
+      'value' => 'chunking, silent-discard'
+    },
+    'smtpd_forbid_bare_newline' => {
+      'value' => 'yes'
+    },
+    'smtpd_forbid_bare_newline_exclusions' => {
+      'value' => '$mynetworks'
+    },
+    'smtpd_forbid_unauth_pipelining' => {
+      'value' => 'yes'
+    },
+    'smtpd_helo_required' => {
+      'value' => 'yes'
+    },
+    'smtpd_helo_restrictions' => {
+      'value' => 'check_helo_access hash:/etc/postfix/helo_access, reject_invalid_hostname'
+    },
+    'smtpd_milters' => {
+      'value' => 'inet:127.0.0.1:33333'
+    },
+    'smtpd_recipient_restrictions' => {
+      'value' => join($smtpd_recipient_restrictions, ', ')
+    },
+    'smtpd_relay_restrictions' => {
+      'value' => join($smtpd_relay_restrictions, ', ')
+    },
+    'smtpd_sender_restrictions' => {
+      'value' => join($smtpd_sender_restrictions, ', ')
+    },
+    'smtpd_tls_CAfile' => {
+      'value' => $tls_ca_file
+    },
+    'smtpd_tls_cert_file' => {
+      'value' => $tls_cert_file
+    },
+    'smtpd_tls_ciphers' => {
+      'value' => 'medium'
+    },
+    'smtpd_tls_key_file' => {
+      'value' => $tls_key_file
+    },
+    'smtpd_tls_loglevel' => {
+      'value' => '1'
+    },
+    'smtpd_tls_mandatory_protocols' => {
+      'value' => '!SSLv2,!SSLv3'
+    },
+    'smtpd_tls_protocols' => {
+      'value' => '!SSLv2,!SSLv3'
+    },
+    'smtpd_tls_received_header' => {
+      'value' => 'yes'
+    },
+    'smtpd_tls_security_level' => {
+      'value' => 'may'
+    },
+    'smtpd_tls_session_cache_database' => {
+      'value' => 'btree:/var/lib/postfix/smtpd_tls_session_cache'
+    },
+    'smtpd_tls_session_cache_timeout' => {
+      'value' => '3600s'
+    },
+    'smtpd_use_tls' => {
+      'value' => 'yes'
+    },
+    'tls_medium_cipherlist' => {
+      'value' => join([
+        'ECDSA+AESGCM:ECDH+AESGCM:DH+AESGCM:ECDSA+AES:ECDH+AES:DH+AES',
+        'ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS'
+      ], ':')
+    },
+    'tls_preempt_cipherlist' => {
+      'value' => 'yes'
+    },
+    'tls_random_source' => {
+      'value' => 'dev:/dev/urandom'
+    },
+    'unverified_recipient_reject_code' => {
+      'value' => '550'
+    },
+    'unverified_recipient_reject_reason' => {
+      'value' => 'No user at this address'
+    },
+    'smtp_tls_policy_maps' => {
+      'value' => 'hash:/etc/postfix/smtp_tls_policy_maps'
+    },
+  }
+
+
+  # Postfix maps (all using templates now)
+  $postfix_maps = {
+    'postscreen_access' => {
+      'ensure'  => 'present',
+      'type'    => 'cidr',
+      'content' => template('profiles/postfix/gateway/postscreen_access.erb')
+    },
+    'relay_recipients' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/relay_recipients.erb')
+    },
+    'relay_domains' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/relay_domains.erb')
+    },
+    'aliases' => {
+      'ensure' => 'present',
+      'type'   => 'hash',
+      'source' => 'puppet:///modules/profiles/postfix/gateway/aliases'
+    },
+    'helo_access' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/helo_access.erb')
+    },
+    'sender_access' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/sender_access.erb')
+    },
+    'recipient_access' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/recipient_access.erb')
+    },
+    'recipient_canonical' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/recipient_canonical.erb')
+    },
+    'sender_canonical' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/sender_canonical.erb')
+    },
+    'smtp_tls_policy_maps' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/smtp_tls_policy_maps.erb')
+    },
+    'virtual_mailbox_maps' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/virtual_mailbox_maps.erb')
+    },
+    'virtual_alias_maps' => {
+      'ensure'  => 'present',
+      'type'    => 'hash',
+      'content' => template('profiles/postfix/gateway/virtual_alias_maps.erb')
+    },
+  }
+
+  if $enable_dovecot {
+    postfix::config {
+      'virtual_mailbox_domains': value => join($virtual_mailbox_domains, ', ');
+      'virtual_mailbox_maps':    value => 'hash:/etc/postfix/virtual_mailbox_maps';
+      'virtual_alias_maps':      value => 'hash:/etc/postfix/virtual_alias_maps';
+      'virtual_uid_maps':        value => $virtual_uid_maps;
+      'virtual_gid_maps':        value => $virtual_gid_maps;
+      'virtual_mailbox_base':    value => $virtual_mailbox_base;
+      'virtual_transport':       value => $virtual_transport;
+      'home_mailbox':            value => "${virtual_mailbox_base}/%d/%n/Maildir";
+    }
+  } else {
+    postfix::config {
+      'virtual_mailbox_domains': ensure => 'absent';
+      'virtual_mailbox_maps':    ensure => 'absent';
+      'virtual_uid_maps':        ensure => 'absent';
+      'virtual_gid_maps':        ensure => 'absent';
+      'virtual_mailbox_base':    ensure => 'absent';
+      'virtual_transport':       ensure => 'absent';
+      'home_mailbox':            ensure => 'absent';
+    }
+  }
+
+  # Merge base configs with postscreen configs
+  $all_configs = $base_configs + $postscreen_configs
+
+  class { 'postfix':
+    master_smtp    => $master_smtp,
+    master_entries => $master_entries,
+    alias_maps     => $alias_maps_string,
+    configs        => $all_configs,
+    maps           => $postfix_maps,
+  }
+
+}
@@ -1,37 +1,68 @@
 # profiles::puppet::agent
 # This class manages Puppet agent package and service.
 class profiles::puppet::agent (
-  String $puppet_version      = 'latest',
+  String  $version        = 'latest',
+  Boolean $openvox_enable = false,
 ) {

-  # if puppet-version is anything other than latest, set a versionlock
-  $puppet_versionlock_ensure = $puppet_version ? {
+  # set openvox package, yumrepo, service
+  if $openvox_enable {
+    $use_package = 'openvox-agent'
+    $use_yumrepo = 'openvox'
+    $use_service = 'puppet'
+  }else{
+    $use_package = 'puppet-agent'
+    $use_yumrepo = 'puppet'
+    $use_service = 'puppet'
+  }
+
+  # manage the yumrepo for the given package
+  if $openvox_enable and $facts['os']['family'] == 'RedHat' {
+    yumrepo { 'openvox':
+      ensure  => 'present',
+      baseurl => "https://packagerepo.service.consul/openvox7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/",
+      descr   => 'openvox repository',
+      gpgkey  => "https://packagerepo.service.consul/openvox7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/GPG-KEY-openvox.pub",
+      notify  => Exec['dnf_makecache'],
+    }
+  }else{
+    yumrepo { 'puppet':
+      ensure  => 'present',
+      baseurl => "https://packagerepo.service.consul/puppet7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/",
+      descr   => 'puppet repository',
+      gpgkey  => "https://packagerepo.service.consul/puppet7/el/${facts['os']['release']['major']}-daily/${facts['os']['architecture']}/os/RPM-GPG-KEY-puppet-20250406",
+      notify  => Exec['dnf_makecache'],
+    }
+  }
+
+  # if agent-version is anything other than latest, set a versionlock
+  $agent_versionlock_ensure = $version ? {
    'latest' => 'absent',
    default  => 'present',
  }
-  $puppet_versionlock_version = $puppet_version ? {
+  $agent_versionlock_version = $version ? {
    'latest' => undef,
-    default  => $puppet_version,
+    default  => $version,
  }

  case $facts['os']['family'] {
    'RedHat': {
-      # Ensure the puppet-agent package is installed and locked to a specific version
-      package { 'puppet-agent':
-        ensure  => $puppet_version,
-        require => Yumrepo['puppet'],
+      # Ensure the agent package is installed and locked to a specific version
+      package { $use_package:
+        ensure  => $version,
+        require => Yumrepo[$use_yumrepo],
      }

      # versionlock puppet-agent
-      yum::versionlock{'puppet-agent':
-        ensure  => $puppet_versionlock_ensure,
-        version => $puppet_versionlock_version,
+      yum::versionlock{$use_package:
+        ensure  => $agent_versionlock_ensure,
+        version => $agent_versionlock_version,
      }
    }
    'Debian': {
      # Ensure the puppet-agent package is installed and locked to a specific version
-      package { 'puppet-agent':
-        ensure  => $puppet_version,
+      package { $use_package:
+        ensure  => $version,
        require => Class['profiles::apt::puppet7'],
      }
    }
@@ -39,12 +70,11 @@ class profiles::puppet::agent (
  }

  # Ensure the puppet service is running
-  service { 'puppet':
+  service { $use_service:
    ensure     => 'running',
    enable     => true,
    hasrestart => true,
-    require    => Package['puppet-agent'],
+    require    => Package[$use_package],
  }

 }
-
@@ -26,6 +26,12 @@ class profiles::puppet::puppetdb_api (
      before  => Class['puppetdb::server'],
    }

+    # cleanup puppetdb first, this isnt replaced by openvoxdb (conflicts)
+    package { 'puppetdb':
+      ensure => 'purged',
+      before => Class['puppetdb::server'],
+    }
+
    class { 'puppetdb::server':
      manage_firewall        => false,
      ssl_listen_address     => $listen_address,
@@ -44,6 +50,7 @@ class profiles::puppet::puppetdb_api (
      database_name          => $database_name,
      database_password      => Sensitive($database_password),
      database_validate      => $database_validate,
+      puppetdb_package       => 'openvoxdb',
    }

    contain ::puppetdb::server
@@ -20,12 +20,23 @@ class profiles::puppet::puppetmaster (
    include profiles::puppet::puppetca
    include profiles::puppet::eyaml

+    # migration to openvox, cleanup puppetserver/puppetdb-termini
+    package {'puppetdb-termini':
+      ensure => purged,
+      before => Package['openvoxdb-termini'],
+    }
+    package {'puppetserver':
+      ensure => purged,
+      before => Package['openvox-server'],
+    }
+
    class { 'puppetdb::master::config':
      puppetdb_server     => $puppetdb_host,
      manage_storeconfigs => false,
+      terminus_package    => 'openvoxdb-termini',
    }

-    Package['puppetserver']
+    Package['openvox-server']
    -> Class['profiles::puppet::gems']
    -> Class['profiles::puppet::r10k']
    -> Class['profiles::puppet::g10k']
@@ -55,4 +55,7 @@ class profiles::yum::global (
  # setup dnf-autoupdate
  include profiles::yum::autoupdater

+  # ensure dnf makecache runs before packages
+  Yumrepo <| |> -> Exec['dnf_makecache'] -> Package <| |>
+
 }
@@ -0,0 +1,9 @@
+# Managed by Puppet in profiles::ceph::conf
+<% @config.each do |section, settings| -%>
+[<%= section %>]
+<% settings.each do |key, value| -%>
+<%# Convert booleans and numbers to strings, leave strings untouched %>
+<%= key %> = <%= value.is_a?(TrueClass) ? 'true' : value.is_a?(FalseClass) ? 'false' : value %>
+<% end -%>
+
+<% end -%>
@@ -0,0 +1,11 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Controls access based on HELO/EHLO hostnames to block spam patterns
+# HELO/EHLO access controls
+# Format: pattern    action
+# Example: .dynamic.example.com    REJECT
+# Example: localhost    REJECT You are not localhost
+
+<% @helo_access_maps.each do |pattern, action| -%>
+<%= pattern %>             <%= action %>
+<% end -%>
@@ -0,0 +1,10 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Controls which IP addresses/networks are allowed through postscreen
+# Postscreen access controls (CIDR format)
+# Format: network/mask    action
+# Example: 192.168.1.0/24    permit
+
+<% @postscreen_access_maps.each do |network, action| -%>
+<%= network %> <%= action %>
+<% end -%>
@@ -0,0 +1,11 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Controls access based on recipient email addresses or domains
+# Recipient access controls
+# Format: recipient_pattern    action
+# Example: @example.com    OK
+# Example: admin@foo.net    REJECT
+
+<% @recipient_access_maps.each do |recipient, action| -%>
+<%= recipient %>    <%= action %>
+<% end -%>
@@ -0,0 +1,10 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Rewrites recipient addresses before delivery (address normalization)
+# Recipient canonical address mapping
+# Format: original_address    canonical_address
+# Example: user@olddomain.com    user@example.com
+
+<% @recipient_canonical_maps.each do |original, canonical| -%>
+<%= original %>    <%= canonical %>
+<% end -%>
@@ -0,0 +1,10 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Defines which domains are allowed for mail relaying
+# Relay domains control
+# Format: domain    action
+# Example: example.com    OK
+
+<% @relay_domains_maps.each do |domain, action| -%>
+<%= domain %>       <%= action %>
+<% end -%>
@@ -0,0 +1,10 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Defines which recipient addresses are allowed for mail relaying
+# Relay recipients control
+# Format: recipient_pattern    action
+# Example: @example.com    OK
+
+<% @relay_recipients_maps.each do |recipient, action| -%>
+<%= recipient %>       <%= action %>
+<% end -%>
@@ -0,0 +1,11 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Controls access based on sender email addresses or domains
+# Sender access controls
+# Format: sender_pattern    action
+# Example: spammer@foo.net    REJECT
+# Example: @badspammer.com   REJECT
+
+<% @sender_access_maps.each do |sender, action| -%>
+<%= sender %>    <%= action %>
+<% end -%>
@@ -0,0 +1,10 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Rewrites sender addresses before sending (address masquerading)
+# Sender canonical address mapping
+# Format: original_address    canonical_address
+# Example: user@internal.local    user@example.com
+
+<% @sender_canonical_maps.each do |original, canonical| -%>
+<%= original %>    <%= canonical %>
+<% end -%>
@@ -0,0 +1,11 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Enforces TLS security policies for outbound mail per destination domain
+# SMTP TLS policy map for outbound connections
+# Format: destination    policy
+# Example: gmail.com    encrypt
+# Example: secure-bank.example.com    secure
+
+<% @smtp_tls_policy_maps.each do |destination, policy| -%>
+<%= destination %>    <%= policy %>
+<% end -%>
@@ -0,0 +1,9 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Defines virtual alias mappings
+# Maps email addresses or patterns to target addresses
+# Format: alias@foo.net    real@corp.foo.net
+
+<% @virtual_alias_maps.each do |source, target| -%>
+<%= source %>       <%= target %>
+<% end -%>
@@ -0,0 +1,9 @@
+# FILE MANAGED BY PUPPET, CHANGES WILL BE REPLACED
+#
+# Defines virtual mailbox mappings for dovecot delivery
+# Maps email addresses to maildir paths
+# Format: user@domain    maildir/path/
+
+<% @virtual_mailbox_maps.each do |email, path| -%>
+<%= email %>       <%= path %>
+<% end -%>
@@ -1,33 +1,72 @@
 #!/usr/bin/env bash
+set -euo pipefail
+
+: "${DRY_RUN:=}"   # set DRY_RUN=1 to preview deletions
+
+log() { printf '[%(%F %T)T] %s\n' -1 "$*" >&2; }

 # Function to create symlink for snapshots
 create_symlink() {
-  local osname="$1"
-  local release="$2"
-  local repository="$3"
-  local basepath="$4"
-  local label="$5" # 'monthly', 'weekly', or 'daily'
-  local date_format="$6" # Date format for finding the snapshot
+  local osname="$1"     # e.g. almalinux
+  local release="$2"    # e.g. 9.6
+  local repository="$3" # e.g. appstream
+  local basepath="$4"   # e.g. /shared/apps/packagerepo
+  local label="$5"      # monthly|weekly|daily
+  local date_value="$6" # YYYYMMDD for the snapshot to promote

-  # The path where snapshots are stored
-  local snap_path="${basepath}/snap/${osname}/${release}/${repository}-${date_format}"
-
-  # The target path for the symlink
+  local snap_path="${basepath}/snap/${osname}/${release}/${repository}-${date_value}"
  local symlink_target="${basepath}/snap/${osname}/${release}/${repository}-${label}"

-  # Check if the source directory exists
  if [[ -d "$snap_path" ]]; then
-    # Create the symlink, overwrite if it already exists
    ln -sfn "$snap_path" "$symlink_target"
-    echo "Symlink created for $snap_path -> $symlink_target"
+    log "Symlink set: ${symlink_target} -> ${snap_path}"
+    return 0
  else
-    echo "Snapshot path does not exist: $snap_path"
+    log "Snapshot path does not exist: $snap_path"
    return 1
  fi
 }

+# Cleanup snapshot directories older than a cutoff date (YYYYMMDD)
+cleanup_older_than_monthly() {
+  local osname="$1"
+  local release="$2"
+  local repository="$3"
+  local basepath="$4"
+  local cutoff_date="$5"  # newly promoted monthly date, YYYYMMDD
+
+  local root="${basepath}/snap/${osname}/${release}"
+  local pattern="${repository}-"[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]
+
+  shopt -s nullglob
+  for dir in "${root}"/${pattern}; do
+    # Skip symlinks and non-directories
+    [[ -L "$dir" ]] && continue
+    [[ -d "$dir" ]] || continue
+
+    # Extract the date suffix
+    local name base datepart
+    name="$(basename -- "$dir")"
+    base="${name%-????????}"     # remove last 8 chars
+    datepart="${name#${base}-}"  # after "<repo>-"
+
+    # Only act on valid YYYYMMDD dates
+    if [[ "$datepart" =~ ^[0-9]{8}$ ]]; then
+      if [[ "$datepart" -lt "$cutoff_date" ]]; then
+        if [[ -n "${DRY_RUN}" ]]; then
+          log "[DRY_RUN] Would remove: $dir"
+        else
+          log "Removing: $dir"
+          rm -rf --one-file-system -- "$dir"
+        fi
+      fi
+    fi
+  done
+  shopt -u nullglob
+}
+
 # Determine which snapshot to promote based on the passed argument
-case "$1" in
+case "${1:-}" in
  monthly)
    promote_date=$(date --date="$(date +%Y%m01) -1 month" +%Y%m%d)
    ;;
@@ -43,11 +82,26 @@ case "$1" in
    ;;
 esac

-# Call the function with appropriate arguments
-# Iterate over the repositories to create symlinks for each
+label="$1"
+
+# Process each repo conf
 for conf in /etc/reposync/conf.d/*.conf; do
+  # shellcheck disable=SC1090
  source "$conf"

-  # Create symlink based on the provided argument
-  create_symlink "$OSNAME" "$RELEASE" "$REPOSITORY" "$BASEPATH" "$1" "$promote_date"
+  # Expecting these vars in the conf: OSNAME, RELEASE, REPOSITORY, BASEPATH
+  : "${OSNAME:?missing OSNAME in $conf}"
+  : "${RELEASE:?missing RELEASE in $conf}"
+  : "${REPOSITORY:?missing REPOSITORY in $conf}"
+  : "${BASEPATH:?missing BASEPATH in $conf}"
+
+  # 1) Promote the symlink for this label
+  if create_symlink "$OSNAME" "$RELEASE" "$REPOSITORY" "$BASEPATH" "$label" "$promote_date"; then
+    # 2) If monthly, clean up older snapshot dirs for this repo
+    if [[ "$label" == "monthly" ]]; then
+      cleanup_older_than_monthly "$OSNAME" "$RELEASE" "$REPOSITORY" "$BASEPATH" "$promote_date"
+    fi
+  else
+    log "Skipping cleanup for ${OSNAME}/${RELEASE}/${REPOSITORY} due to missing ${REPOSITORY}-${promote_date}"
+  fi
 done
@@ -0,0 +1,10 @@
+# a role to deploy the ceph rgw
+class roles::infra::ceph::rgw {
+  if $facts['firstrun'] {
+    include profiles::defaults
+    include profiles::firstrun::init
+  }else{
+    include profiles::defaults
+    include profiles::base
+  }
+}
@@ -0,0 +1,12 @@
+# a role to deploy a imap/pop3 backend for mail services
+class roles::infra::mail::backend {
+  if $facts['firstrun'] {
+    include profiles::defaults
+    include profiles::firstrun::init
+  }else{
+    include profiles::defaults
+    include profiles::base
+    include profiles::dovecot::server
+    include profiles::postfix::gateway
+  }
+}
@@ -0,0 +1,11 @@
+# a role to deploy a dmz mx gateway for mail services
+class roles::infra::mail::gateway {
+  if $facts['firstrun'] {
+    include profiles::defaults
+    include profiles::firstrun::init
+  }else{
+    include profiles::defaults
+    include profiles::base
+    include profiles::postfix::gateway
+  }
+}
Author	SHA1	Message	Date
unkinben	528fbe4190	feat: implement dovecot backend server with postfix virtual mailbox integration - create profiles::dovecot::backend class for IMAPS server configuration - add virtual mailbox support to profiles::postfix::gateway with enable_dovecot parameter - restructure common hieradata elements into mail.yaml - add virtual mailbox and alias map templates with ERB generation - add comprehensive type validation using Stdlib::Email, Stdlib::Fqdn, Stdlib::IP types - configure vmail user (UID/GID 5000) with shared storage on /shared/apps/maildata - update roles::infra::mail::backend to include both dovecot and postfix profiles	2025-11-02 11:53:02 +11:00
unkinben	78adef0eee	refactor: recreate profiles::postfix::gateway with parameterization and templates (#416 ) - refactor profiles::postfix::gateway as parameterized class - move base postfix parameters, transports, and virtuals to hiera for flexibility - convert SMTP restrictions to arrays for better readability using join() - add postscreen enable/disable boolean with conditional master.cf configuration - add per-domain TLS policy maps (smtp_tls_policy_maps) - convert alias_maps to array parameter for flexibility - convert all postfix map files to ERB templates with parameter hashes - add map parameters: sender_canonical_maps, sender_access_maps, relay_recipients_maps, relay_domains_maps, recipient_canonical_maps, recipient_access_maps, postscreen_access_maps, helo_access_maps - move default map data to hiera while keeping parameters as empty hashes by default This approach balances flexibility with data-driven configuration, allowing easy customization through parameters while keeping transport/virtual maps and default map data in hiera for role-specific overrides. Reviewed-on: #416	2025-11-01 17:26:00 +11:00
unkinben	81f289a185	feat: prepare for dovecot deployment (#415 ) - add dovecot role - import dovecot module via r10k Reviewed-on: #415	2025-11-01 01:01:55 +11:00
unkinben	a2a8edb731	feat: implement comprehensive postfix gateway with eFa5 configuration (#414 ) - add voxpupuli-postfix module to Puppetfile - create profiles::postfix::gateway class with config based on efa5 - add master.cf entries for postscreen, smtpd, dnsblog, and tlsproxy services - create postfix hash files: aliases, access controls, canonical maps - configure TLS with system PKI certificates and strong cipher suites - add transport and virtual alias mappings for mail routing Reviewed-on: #414	2025-11-01 00:43:58 +11:00
unkinben	e129d1cf7a	feat: add mail::gateway role (#413 ) - add a mail::gateway role, more to add later - enables the build of hosts in this role immedately (config later) Reviewed-on: #413	2025-10-19 19:09:51 +11:00
unkinben	e95a59b88a	feat: migrate puppetserver -> openvox-server (#412 ) - enable openvox repo - ensure puppetdb-termini and puppetserver are purged - set openvox-server as the package to install - set termini package to openvoxdb-termini Reviewed-on: #412	2025-10-18 23:49:51 +11:00
unkinben	8bed80eac8	feat: migrate puppetdb -> openvoxdb (#411 ) - ensure the puppetdb package is purged before openvoxdb - ensure the openvoxdb package is installed Reviewed-on: #411	2025-10-18 21:47:33 +11:00
unkinben	5ba483c68a	feat: add ZFS facts to prevent zpool disk changes (#410 ) - add zfs_zpools and zfs_datasets facts to detect existing ZFS resources - skip zpool creation when pools already exist Reviewed-on: #410	2025-10-18 21:24:33 +11:00
unkinben	766233c3e5	fix: check if zfs-cache exists and isnt empty (#409 ) - check the cache file exists, and isnt empty - resolves idempotence for zpool-import-cache service Reviewed-on: #409	2025-10-18 21:15:55 +11:00
unkinben	98b866fce7	feat: migrate puppet-agent to openvox (#408 ) - change from puppet-agent to openvox-agent - upgrade version from 7.34 to 7.36 - ensure workflow of: Yumrepo -> dnf-makecache -> Package Reviewed-on: #408	2025-10-18 19:11:38 +11:00
unkinben	e724326d43	feat: allow access to runner certs (#407 ) - allow access to runner certs, used for mtls auth to incus Reviewed-on: #407	2025-10-17 22:46:45 +11:00
unkinben	d8b354558d	feat: add incus auto-client certificate trust (#406 ) - add fact to export vault public cert from agents - add fact to export list of trusted incus client certs - add method for incus clients to export their client cert to be trusted Reviewed-on: #406	2025-10-17 22:46:26 +11:00
unkinben	fac90c66db	feat: use vault certificates for incus (#405 ) - replace default incus certificates with vault-generated ephemeral certificates - configure incus service to restart on certificate changes Reviewed-on: #405	2025-10-17 17:22:09 +11:00
unkinben	efbbb6bcb1	feat: moderate the k8s install (#403 ) - only install a base config - wait for 3 masters before deploying helm charts - remove cluster-domain - manage nginx ingres via rke2 helmconfig Reviewed-on: #403	2025-10-12 17:50:24 +11:00
unkinben	16e654fdd7	feat: use openbao (#404 ) - change vault role to use openbao Reviewed-on: #404	2025-10-11 20:55:21 +11:00
unkinben	66d8815e16	fix: ensure nginx restarts on certificate changes (#402 ) Add hasrestart => true to nginx service in simpleproxy profile to ensure nginx performs a full restart (not reload) when certificate files change. This is required because nginx reload does not pick up SSL certificate changes from disk. Reviewed-on: #402	2025-09-29 22:38:00 +10:00
unkinben	a9c959d924	fix: remove unicode from ceph-csi-yaml (#400 ) Reviewed-on: #400	2025-09-21 00:41:06 +10:00
unkinben	b224cfb516	fix: cattle-system namespace (#399 ) - cattle-system namespace is created earlier than helm - leave namespaces.yaml to manage cattle-system namespace (required before installing helm/rancher) Reviewed-on: #399	2025-09-21 00:21:41 +10:00
unkinben	4c9204858e	feat: define node-token from puppet (#398 ) - define the token on the bootstrap node too, so node-token is defined for new clusters Reviewed-on: #398	2025-09-20 22:25:56 +10:00
unkinben	571a9b25a7	fix: resolve rke2-server errors (#397 ) - kubectl yaml files must not use underscores - replace unicode hyphen with ascii hyphen Reviewed-on: #397	2025-09-20 18:40:18 +10:00
unkinben	762f415d2d	feat: k8s helm rework (#396 ) - remove helm-generated-yaml, replace with helm execs - template/parameterise ceph csi Reviewed-on: #396	2025-09-20 17:40:41 +10:00
unkinben	4e77fb7ee7	feat: manage rancher, purelb, cert-manager (#395 ) This change will install rancher, purelb and cert-manager, then configure a dmz and common ip pool to be used by loadbalancers. The nginx ingres controller is configured to use 198.18.200.0 (common) and announce the ip from all nodes so that it becomes an anycast ip in ospf. - manage the install of rancher, purelb and cert-manager - add rancher ingress routes - add nginx externalip/loadBalancer Reviewed-on: #395	2025-09-14 20:59:39 +10:00
unkinben	6e4bc9fbc7	feat: adding rke2 (#394 ) - manage rke2 repos - add rke2 module (init, params, install, config, service) - split roles::infra::k8s::node -> control/compute roles - moved common k8s config into k8s.yaml - add bootstrap_node, manage server and token fields in rke2 config - manage install of helm - manage node attributes (from puppet facts) - manage frr exclusions for service/cluster network Reviewed-on: #394	2025-09-14 13:27:49 +10:00
unkinben	012e842d7d	feat: add cleanup to autopromoter (#393 ) - ensure the autopromoter removes hardlinks/replicas for repos older than the current promoted monthly - this is to reduce MDS load for ceph, as hardlinks require memory Reviewed-on: #393	2025-09-13 20:08:32 +10:00
unkinben	98a433d366	feat: mirror rke2 repo for rhel9 (#392 ) - create rhel9 mirrors for rke2 1.33 and common Reviewed-on: #392	2025-09-13 19:49:52 +10:00
unkinben	fcd1b049d6	feat: ensure frr_exporter can read ospf socket (#391 ) - add execute permission to frr socket directory Reviewed-on: #391	2025-09-13 15:08:32 +10:00
unkinben	938a6ac990	feat: update docs for puppet (#390 ) - k8s / metallb / cilium created chaos - broke puppet agent and servers - adding issue/resolution here Reviewed-on: #390	2025-09-13 12:57:44 +10:00
unkinben	0665873dc8	feat: update ospf source for learned routes (#388 ) - enable changing the source address for learned ospf routes - this enables the loopback0 interface to be used as a default src address - ensure k8s nodes use loopback0 as default src - ensure incus nodes use loopback0 as default src Reviewed-on: #388	2025-09-07 16:09:21 +10:00
unkinben	ae4eb3a5eb	fix: set loopback0 as source for consul (#387 ) - fix consul service checks for prodnxsr0001-0008 - ensure the loopback0 interface whats bound too Reviewed-on: #387	2025-09-07 15:48:27 +10:00
unkinben	65fb52da55	chore: add user for jelly (#385 ) Reviewed-on: #385	2025-09-04 20:09:43 +10:00
unkinben	d97cbfd570	chore: update src ips for arr stack (#384 ) - allow the arr stack to reach prowlarr Reviewed-on: #384	2025-08-31 18:52:47 +10:00
unkinben	8f5d102945	feat: enabling changing ip for consul client (#383 ) - enable ability to set consul client bind/advertise ip Reviewed-on: #383	2025-08-14 22:55:35 +10:00
unkinben	62aade77ff	feat: add ceph-dashboard to haproxy (#382 ) - add profile to export haproxy backend - add new cert for dashboard.ceph.unkin.net - extend balancemember with ipaddress attribute Reviewed-on: #382	2025-08-14 11:06:11 +10:00
unkinben	83bb3e1085	chore: increase client body size for s3 (#381 ) - s3 clients send objects too large for the default body size Reviewed-on: #381	2025-08-13 16:41:39 +10:00
unkinben	92728047e7	feat: add ceph rgw (#380 ) - start managing ceph configuration file - manage ceph-radosgw - merge the ceph::conf and ceph::node profiles - ensure the ceph repos exist - mange nginx frontend and consul service Reviewed-on: #380	2025-08-13 12:33:41 +10:00
unkinben	f4af5e7b64	chore: add rados gateway role (#379 ) - just enough role to deploy some containers Reviewed-on: #379	2025-08-10 19:31:39 +10:00
unkinben	308d97d783	feat: enable plugins for grafana (#378 ) - add method to install plugins for grafana - ensure victoriametrics-logs-datasource is installed Reviewed-on: #378	2025-08-09 17:57:49 +10:00
				`@@ -0,0 +1 @@`
				rke2::node_token: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAOD+w5nJFqEYWFj+tZQ65Oi19eDhaWtpLQ0gwEdBtMmY9sPJ63l1q2qH933NH6TOd1UlMDvGfoDLCae+yt/MAW//cJ15X3QbiVQ23DdfCOlUEZN6fjVrveEt/yIeFQmWvnkMS4pRfPbgQu2OHm37PpuPE7s6dUyGItAYjchrRhtQ7ibhXDnN7miG+oVRXP2T8b/V5WPdmA222DSV6r/AnqaWkna9W/oh/I2sNKeEm5q3f8bh8Gxt1dDy3VwaZ3lAh3uR+SUm7P/6PTYw8opxiumFBvos0mRiXIdOwUuqrAS8hafWBhxnDLlTBfz62Nc4wQmQ8gz0bHJZSipH9G6mIEDCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ2WG6ROWFlQdXx0TuO5oABoBwTDtAXIj7y6I1B3zCnFoMHETf5d7ulPGdgwZsENf0UIHpg2l0w503MUHHbu6YDFiDiTE0oDNJPVHid7TO+XwWFgh5v1MWi/XeEBgCs6nMCW8qkX0Z3UXaZdSBUll1M4sRtuqscBnoD/LLs2kKfxrqQg==]