feat: implement nested groups

- use includegroups feature to nest groups
- remove the trailing ',' from includegroups

.gitea/workflows/build.yaml

@@ -1,24 +0,0 @@
-name: Build
-
-on:
-  pull_request:
-
-jobs:
-  precommit:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Install requirements
-        run: |
-          dnf groupinstall -y "Development Tools" -y
-          dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
-
-      - name: Pre-Commit All Files
-        run: |
-          uvx pre-commit run --all-files

.reek.yml

@@ -3,8 +3,3 @@
 detectors:
   FeatureEnvy:
     enabled: false
-  TooManyStatements:
-    enabled: false
-  UncommunicativeVariableName:
-    accept:
-      - e

.rubocop.yml

@@ -8,6 +8,3 @@ Style/Documentation:
 
 Layout/LineLength:
   Max: 140
-
-Metrics/BlockNesting:
-  Max: 4

Puppetfile

@@ -2,54 +2,52 @@ forge 'forge.puppetlabs.com'
 moduledir 'external_modules'
 
 # puppetlabs
-mod 'puppetlabs-stdlib', '9.7.0'
+mod 'puppetlabs-stdlib', '9.1.0'
-mod 'puppetlabs-inifile', '6.2.0'
+mod 'puppetlabs-inifile', '6.0.0'
-mod 'puppetlabs-concat', '9.1.0'
+mod 'puppetlabs-concat', '9.0.0'
-mod 'puppetlabs-vcsrepo', '7.0.0'
+mod 'puppetlabs-vcsrepo', '6.1.0'
-mod 'puppetlabs-yumrepo_core', '2.1.0'
+mod 'puppetlabs-yumrepo_core', '2.0.0'
-mod 'puppetlabs-apt', '10.0.1'
+mod 'puppetlabs-apt', '9.4.0'
-mod 'puppetlabs-lvm', '3.0.1'
+mod 'puppetlabs-lvm', '2.1.0'
-mod 'puppetlabs-puppetdb', '7.14.0'
+mod 'puppetlabs-puppetdb', '7.13.0'
-mod 'puppetlabs-postgresql', '9.2.0'
+mod 'puppetlabs-postgresql', '9.1.0'
-mod 'puppetlabs-firewall', '8.1.4'
+mod 'puppetlabs-firewall', '6.0.0'
-mod 'puppetlabs-accounts', '8.2.2'
+mod 'puppetlabs-accounts', '8.1.0'
-mod 'puppetlabs-mysql', '16.2.0'
+mod 'puppetlabs-mysql', '15.0.0'
 mod 'puppetlabs-xinetd', '3.4.1'
-mod 'puppetlabs-haproxy', '8.2.0'
+mod 'puppetlabs-haproxy', '8.0.0'
-mod 'puppetlabs-java', '11.1.0'
+mod 'puppetlabs-java', '10.1.2'
-mod 'puppetlabs-reboot', '5.1.0'
+mod 'puppetlabs-reboot', '5.0.0'
-mod 'puppetlabs-docker', '10.2.0'
+mod 'puppetlabs-docker', '10.0.1'
 
 # puppet
-mod 'puppet-python', '7.4.0'
+mod 'puppet-python', '7.0.0'
-mod 'puppet-systemd', '8.1.0'
+mod 'puppet-systemd', '5.1.0'
-mod 'puppet-yum', '7.2.0'
+mod 'puppet-yum', '7.0.0'
-mod 'puppet-archive', '7.1.0'
+mod 'puppet-archive', '7.0.0'
-mod 'puppet-chrony', '3.0.0'
+mod 'puppet-chrony', '2.6.0'
-mod 'puppet-puppetboard', '11.0.0'
+mod 'puppet-puppetboard', '9.0.0'
-mod 'puppet-nginx', '6.0.1'
+mod 'puppet-nginx', '5.0.0'
-mod 'puppet-selinux', '5.0.0'
+mod 'puppet-selinux', '4.1.0'
-mod 'puppet-prometheus', '16.0.0'
+mod 'puppet-prometheus', '13.4.0'
-mod 'puppet-grafana', '14.1.0'
+mod 'puppet-grafana', '13.1.0'
-mod 'puppet-consul', '9.1.0'
+mod 'puppet-consul', '8.0.0'
-mod 'puppet-vault', '4.1.1'
+mod 'puppet-vault', '4.1.0'
 mod 'puppet-dhcp', '6.1.0'
 mod 'puppet-keepalived', '5.1.0'
-mod 'puppet-extlib', '7.5.1'
+mod 'puppet-extlib', '7.0.0'
-mod 'puppet-network', '2.2.1'
+mod 'puppet-network', '2.2.0'
-mod 'puppet-kmod', '4.1.0'
+mod 'puppet-kmod', '4.0.1'
 mod 'puppet-filemapper', '4.0.0'
-mod 'puppet-letsencrypt', '11.1.0'
+mod 'puppet-letsencrypt', '11.0.0'
-mod 'puppet-rundeck', '9.2.0'
+mod 'puppet-rundeck', '9.1.0'
-mod 'puppet-redis', '11.1.0'
+mod 'puppet-redis', '11.0.0'
-mod 'puppet-nodejs', '11.0.0'
 
 # other
-mod 'saz-sudo', '9.0.2'
-mod 'saz-ssh', '13.1.0'
-mod 'saz-limits', '5.0.0'
-mod 'ghoneycutt-timezone', '4.0.0'
 mod 'ghoneycutt-puppet', '3.3.0'
+mod 'saz-sudo', '8.0.0'
+mod 'saz-ssh', '12.1.0'
+mod 'ghoneycutt-timezone', '4.0.0'
 mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
@@ -58,8 +56,6 @@ mod 'stm-file_capability', '6.0.0'
 mod 'h0tw1r3-gitea', '3.2.0'
 mod 'rehan-mkdir', '2.0.0'
 mod 'tailoredautomation-patroni', '2.0.0'
-mod 'ssm-crypto_policies', '0.3.3'
-mod 'thias-sysctl', '1.0.8'
 
 mod 'bind',
   :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',

hieradata/common.yaml

@@ -36,12 +36,6 @@ lookup_options:
   profiles::haproxy::server::listeners:
     merge:
       strategy: deep
-  profiles::accounts::root::sshkeys:
-    merge:
-      strategy: deep
-  profiles::accounts::sysadmin::sshkeys:
-    merge:
-      strategy: deep
   haproxy::backend:
     merge:
       strategy: deep
@@ -141,20 +135,6 @@ lookup_options:
   keepalived::vrrp_instance:
     merge:
       strategy: deep
-  profiles::etcd::node::initial_cluster_token:
-    convert_to: Sensitive
-  sysctl::base::values:
-    merge:
-      strategy: deep
-  limits::entries:
-    merge:
-      strategy: deep
-  zfs::zpools:
-    merge:
-      strategy: deep
-  zfs::datasets:
-    merge:
-      strategy: deep
 
 facts_path: '/opt/puppetlabs/facter/facts.d'
 
@@ -163,35 +143,21 @@ hiera_include:
   - networking
   - ssh::server
   - profiles::accounts::rundeck
-  - limits
-  - sysctl::base
-  - exporters::node_exporter
 
+profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
+profiles::ntp::client::use_ntp: 'region'
 profiles::ntp::client::peers:
-  - 0.au.pool.ntp.org
+  - 0.pool.ntp.org
-  - 1.au.pool.ntp.org
+  - 1.pool.ntp.org
-  - 2.au.pool.ntp.org
+  - 2.pool.ntp.org
-  - 3.au.pool.ntp.org
+  - 3.pool.ntp.org
 
 profiles::base::puppet_servers:
   - 'prodinf01n01.main.unkin.net'
 
-consul::install_method: 'package'
-consul::manage_repo: false
-consul::bin_dir: /usr/bin
-
-vault::install_method: 'repo'
-vault::manage_repo: false
-vault::bin_dir: /usr/bin
-vault::manage_service_file: true
-vault::manage_config_dir: true
-vault::disable_mlock: false
-
-profiles::dns::base::nameservers:
-  - 198.18.19.16
 profiles::dns::master::basedir: '/var/named/sources'
-#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
+profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
-#profiles::dns::base::use_ns: 'region'
+profiles::dns::base::use_ns: 'region'
 profiles::consul::server::members_role: roles::infra::storage::consul
 profiles::consul::token::node_editor::accessor_id: '024e27bd-c5bb-41e7-a578-b766509e11bc'
 profiles::consul::client::members_lookup: true
@@ -206,9 +172,6 @@ profiles::consul::client::node_rules:
   - resource: node
     segment: ''
     disposition: read
-  - resource: service
-    segment: node_exporter
-    disposition: write
 
 profiles::packages::include:
   bash-completion: {}
@@ -292,8 +255,7 @@ profiles::puppet::client::dns_alt_names:
 puppetdbapi: puppetdbapi.query.consul
 puppetdbsql: puppetdbsql.service.au-syd1.consul
 
-exporters::node_exporter::enable: true
+prometheus::node_exporter::export_scrape_job: true
-exporters::node_exporter::cleanup_old_node_exporter: true
 prometheus::systemd_exporter::export_scrape_job: true
 
 ssh::server::storeconfigs_enabled: false
@@ -358,11 +320,6 @@ networking::route_defaults:
   netmask: 0.0.0.0
   network: default
 
-# logging:
-victorialogs::client::journald::enable: true
-victorialogs::client::journald::inserturl: https://vlinsert.service.consul:9428/insert/journald
-
-# FIXME these are for the proxmox ceph cluster
 profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
 profiles::ceph::client::mons:
   - 10.18.15.1

hieradata/country/au/region/drw1.yaml

@@ -1,9 +1,2 @@
 ---
 timezone::timezone: 'Australia/Darwin'
-profiles_dns_upstream_forwarder_unkin:
-  - 198.18.17.23
-  - 198.18.17.24
-profiles_dns_upstream_forwarder_consul:
-  - 198.18.17.34
-  - 198.18.17.35
-  - 198.18.17.36

hieradata/country/au/region/drw1/infra/dns/resolver.yaml

@@ -1 +1,52 @@
 ---
+profiles::dns::resolver::zones:
+  main.unkin.net-forward:
+    domain: 'main.unkin.net'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  13.18.198.in-addr.arpa-forward:
+    domain: '13.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  14.18.198.in-addr.arpa-forward:
+    domain: '14.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  15.18.198.in-addr.arpa-forward:
+    domain: '15.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  16.18.198.in-addr.arpa-forward:
+    domain: '16.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  17.18.198.in-addr.arpa-forward:
+    domain: '17.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  consul-forward:
+    domain: 'consul'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.34
+      - 198.18.17.35
+      - 198.18.17.36
+    forward: 'only'

hieradata/country/au/region/syd1.yaml

@@ -1,7 +1,3 @@
 ---
 timezone::timezone: 'Australia/Sydney'
-certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
+certbot::client::webserver: ausyd1nxvm1021.main.unkin.net
-profiles_dns_upstream_forwarder_unkin:
-  - 198.18.19.15
-profiles_dns_upstream_forwarder_consul:
-  - 198.18.19.14

hieradata/country/au/region/syd1/infra/dns/resolver.yaml

@@ -1 +1,52 @@
 ---
+profiles::dns::resolver::zones:
+  main.unkin.net-forward:
+    domain: 'main.unkin.net'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  13.18.198.in-addr.arpa-forward:
+    domain: '13.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  14.18.198.in-addr.arpa-forward:
+    domain: '14.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  15.18.198.in-addr.arpa-forward:
+    domain: '15.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  16.18.198.in-addr.arpa-forward:
+    domain: '16.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  17.18.198.in-addr.arpa-forward:
+    domain: '17.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  consul-forward:
+    domain: 'consul'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.19
+      - 198.18.13.20
+      - 198.18.13.21
+    forward: 'only'

hieradata/country/au/region/syd1/infra/halb/haproxy.yaml

@@ -3,7 +3,7 @@ hiera_include:
   - keepalived
 
 # keepalived
-profiles::haproxy::dns::ipaddr: '198.18.13.250'
+profiles::haproxy::dns::vrrp_ipaddr: '198.18.13.250'
 profiles::haproxy::dns::vrrp_cnames:
   - sonarr.main.unkin.net
   - radarr.main.unkin.net
@@ -260,7 +260,6 @@ profiles::haproxy::dns::cnames:
   - au-syd1-pve-api.main.unkin.net
 
 # letsencrypt certificates
-certbot::client::service: haproxy
 certbot::client::domains:
   - au-syd1-pve.main.unkin.net
   - au-syd1-pve-api.main.unkin.net

hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

@@ -1,305 +0,0 @@
----
-profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
-profiles::haproxy::dns::vrrp_cnames:
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-  - git.unkin.net
-  - fafflix.unkin.net
-  - grafana.unkin.net
-
-profiles::haproxy::mappings:
-  fe_http:
-    ensure: present
-    mappings:
-      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
-      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
-      - 'sonarr.main.unkin.net be_sonarr'
-      - 'radarr.main.unkin.net be_radarr'
-      - 'lidarr.main.unkin.net be_lidarr'
-      - 'readarr.main.unkin.net be_readarr'
-      - 'prowlarr.main.unkin.net be_prowlarr'
-      - 'nzbget.main.unkin.net be_nzbget'
-      - 'jellyfin.main.unkin.net be_jellyfin'
-      - 'fafflix.unkin.net be_jellyfin'
-      - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
-  fe_https:
-    ensure: present
-    mappings:
-      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
-      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
-      - 'sonarr.main.unkin.net be_sonarr'
-      - 'radarr.main.unkin.net be_radarr'
-      - 'lidarr.main.unkin.net be_lidarr'
-      - 'readarr.main.unkin.net be_readarr'
-      - 'prowlarr.main.unkin.net be_prowlarr'
-      - 'nzbget.main.unkin.net be_nzbget'
-      - 'jellyfin.main.unkin.net be_jellyfin'
-      - 'fafflix.unkin.net be_jellyfin'
-      - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
-
-profiles::haproxy::frontends:
-  fe_http:
-    options:
-      use_backend:
-        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_http.map,be_default)]"
-  fe_https:
-    options:
-      acl:
-        - 'acl_ausyd1pve req.hdr(host) -i au-syd1-pve.main.unkin.net'
-        - 'acl_sonarr req.hdr(host) -i sonarr.main.unkin.net'
-        - 'acl_radarr req.hdr(host) -i radarr.main.unkin.net'
-        - 'acl_lidarr req.hdr(host) -i lidarr.main.unkin.net'
-        - 'acl_readarr req.hdr(host) -i readarr.main.unkin.net'
-        - 'acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net'
-        - 'acl_nzbget req.hdr(host) -i nzbget.main.unkin.net'
-        - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
-        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
-        - 'acl_gitea req.hdr(host) -i git.unkin.net'
-        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
-        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
-      use_backend:
-        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
-      http-request:
-        - 'deny if { hdr_dom(host) -i au-syd1-pve.main.unkin.net } !acl_internalsubnets'
-      http-response:
-        - 'set-header X-Frame-Options DENY if acl_ausyd1pve'
-        - 'set-header X-Frame-Options DENY if acl_sonarr'
-        - 'set-header X-Frame-Options DENY if acl_radarr'
-        - 'set-header X-Frame-Options DENY if acl_lidarr'
-        - 'set-header X-Frame-Options DENY if acl_readarr'
-        - 'set-header X-Frame-Options DENY if acl_prowlarr'
-        - 'set-header X-Frame-Options DENY if acl_nzbget'
-        - 'set-header X-Frame-Options DENY if acl_jellyfin'
-        - 'set-header X-Frame-Options DENY if acl_fafflix'
-        - 'set-header X-Frame-Options DENY if acl_gitea'
-        - 'set-header X-Frame-Options DENY if acl_grafana'
-        - 'set-header X-Content-Type-Options nosniff'
-        - 'set-header X-XSS-Protection 1;mode=block'
-
-profiles::haproxy::backends:
-  be_ausyd1pve_web:
-    description: Backend for au-syd1 pve cluster (Web)
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_ausyd1pve_api:
-    description: Backend for au-syd1 pve cluster (API only)
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_sonarr:
-    description: Backend for au-syd1 sonarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_radarr:
-    description: Backend for au-syd1 radarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_lidarr:
-    description: Backend for au-syd1 lidarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_readarr:
-    description: Backend for au-syd1 readarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_prowlarr:
-    description: Backend for au-syd1 prowlarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_nzbget:
-    description: Backend for au-syd1 nzbget
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_jellyfin:
-    description: Backend for au-syd1 jellyfin
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_gitea:
-    description: Backend for gitea cluster
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-  be_grafana:
-    description: Backend for grafana nodes
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-
-profiles::haproxy::certlist::enabled: true
-profiles::haproxy::certlist::certificates:
-  - /etc/pki/tls/letsencrypt/au-syd1-pve.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/au-syd1-pve-api.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/sonarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/radarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/lidarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/readarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/prowlarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/vault/certificate.pem
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-  - jellyfin.main.unkin.net
-
-# additional cnames
-profiles::haproxy::dns::cnames:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-
-# letsencrypt certificates
-certbot::client::service: haproxy
-certbot::client::domains:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-  - fafflix.unkin.net
-  - git.unkin.net
-  - grafana.unkin.net

hieradata/nodes/ausyd1nxvm1000.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.10
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1001.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.11
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1002.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.12
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1003.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.13
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1004.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.14
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1005.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.15
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1006.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.16
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1007.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.17
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1008.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.18
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1009.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.19
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1010.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.20
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1011.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.21
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1012.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.22
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1013.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.23
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1014.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.24
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1015.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.25
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+
+profiles::haproxy::dns::vrrp_master: true
+keepalived::vrrp_instance:
+  VI_250:
+    state: 'MASTER'
+    priority: 101

hieradata/nodes/ausyd1nxvm1016.main.unkin.net.yaml

@@ -0,0 +1,12 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.26
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+
+keepalived::vrrp_instance:
+  VI_250:
+    state: 'BACKUP'
+    priority: 100

hieradata/nodes/ausyd1nxvm1017.main.unkin.net.yaml

@@ -0,0 +1,11 @@
+---
+profiles::cobbler::params::is_cobbler_master: true
+networking::interfaces:
+  ens18:
+    ipaddress: 198.18.13.27
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+    interface: ens18
+
+profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1018.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.28
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1019.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.29
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1020.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.30
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1021.main.unkin.net.yaml

@@ -0,0 +1,10 @@
+---
+networking::interfaces:
+  ens18:
+    ipaddress: 198.18.13.31
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+    interface: ens18
+
+profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1022.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.32
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1023.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.33
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1024.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.34
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1025.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.35
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1026.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.36
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1027.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.37
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1028.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.38
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1029.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.39
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1030.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.40
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1031.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.41
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1032.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.42
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1033.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.43
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1034.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.44
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1035.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.45
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1036.main.unkin.net.yaml

@@ -13,3 +13,9 @@ profiles::ssh::sign::principals:
 
 profiles::puppet::puppetca::is_puppetca: true
 profiles::puppet::puppetca::allow_subject_alt_names: true
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.46
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1037.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.47
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.47
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1038.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.48
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1039.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.49
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1040.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.50
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.50
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1041.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.51
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.51
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1042.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.52
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.52
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1043.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.53
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.53
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1044.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.54
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1045.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.55
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1046.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.56
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1047.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.57
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.57
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1048.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.58
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.58
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1049.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.59
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1050.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.60
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1051.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.61
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1052.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.62
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1053.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.63
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1054.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.64
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1055.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.65
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1056.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.66
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1057.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.67
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1058.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.68
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1059.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.69
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm2098.main.unkin.net.yaml

@@ -1,2 +0,0 @@
----
-profiles::cobbler::params::is_cobbler_master: true

hieradata/nodes/prodinf01n01.main.unkin.net.yaml

@@ -0,0 +1,12 @@
+---
+profiles::puppet::server::dns_alt_names:
+  - puppetca.main.unkin.net
+  - puppetca.service.consul
+  - puppetca.query.consul
+  - puppetca
+
+profiles::puppet::puppetca::is_puppetca: false
+profiles::puppet::puppetca::allow_subject_alt_names: true
+
+hiera_exclude:
+  - networking

hieradata/nodes/prodnxsr0001.main.unkin.net.yaml

@@ -1,13 +1,5 @@
 ---
-networking_loopback0_ip: 198.18.19.1  # management loopback
+profiles::proxmox::params::pve_clusterinit_master: true
-networking_loopback1_ip: 198.18.22.1  # ceph-cluster loopback
+profiles::proxmox::params::pve_ceph_mon: true
-networking_loopback2_ip: 198.18.23.1  # ceph-public loopback
+profiles::proxmox::params::pve_ceph_mgr: true
-networking_1000_ip: 198.18.15.1       # 1gbe network
+profiles::proxmox::params::pve_ceph_osd: true
-networking_2500_ip: 198.18.21.1       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:c3:60
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:50

hieradata/nodes/prodnxsr0002.main.unkin.net.yaml

@@ -1,13 +1,4 @@
 ---
-networking_loopback0_ip: 198.18.19.2  # management loopback
+profiles::proxmox::params::pve_ceph_mon: true
-networking_loopback1_ip: 198.18.22.2  # ceph-cluster loopback
+profiles::proxmox::params::pve_ceph_mgr: true
-networking_loopback2_ip: 198.18.23.2  # ceph-public loopback
+profiles::proxmox::params::pve_ceph_osd: true
-networking_1000_ip: 198.18.15.2       # 1gbe network
-networking_2500_ip: 198.18.21.2       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:74:b6:08
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:08:43

hieradata/nodes/prodnxsr0003.main.unkin.net.yaml

@@ -1,13 +1,4 @@
 ---
-networking_loopback0_ip: 198.18.19.3  # management loopback
+profiles::proxmox::params::pve_ceph_mon: true
-networking_loopback1_ip: 198.18.22.3  # ceph-cluster loopback
+profiles::proxmox::params::pve_ceph_mgr: true
-networking_loopback2_ip: 198.18.23.3  # ceph-public loopback
+profiles::proxmox::params::pve_ceph_osd: true
-networking_1000_ip: 198.18.15.3       # 1gbe network
-networking_2500_ip: 198.18.21.3       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: b8:85:84:a3:25:c5
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:07:82

hieradata/nodes/prodnxsr0004.main.unkin.net.yaml

@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.4  # management loopback
+profiles::proxmox::params::pve_ceph_osd: true
-networking_loopback1_ip: 198.18.22.4  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.4  # ceph-public loopback
-networking_1000_ip: 198.18.15.4       # 1gbe network
-networking_2500_ip: 198.18.21.4       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:d5:00
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:43

hieradata/nodes/prodnxsr0005.main.unkin.net.yaml

@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.5  # management loopback
+profiles::proxmox::params::pve_ceph_osd: true
-networking_loopback1_ip: 198.18.22.5  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.5  # ceph-public loopback
-networking_1000_ip: 198.18.15.5       # 1gbe network
-networking_2500_ip: 198.18.21.5       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: 54:bf:64:a0:08:64
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:07:79

hieradata/nodes/prodnxsr0006.main.unkin.net.yaml

@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.6  # management loopback
+profiles::proxmox::params::pve_ceph_osd: true
-networking_loopback1_ip: 198.18.22.6  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.6  # ceph-public loopback
-networking_1000_ip: 198.18.15.6       # 1gbe network
-networking_2500_ip: 198.18.21.6       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:10:8d
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:53

hieradata/nodes/prodnxsr0007.main.unkin.net.yaml

@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.7  # management loopback
+profiles::proxmox::params::pve_ceph_osd: true
-networking_loopback1_ip: 198.18.22.7  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.7  # ceph-public loopback
-networking_1000_ip: 198.18.15.7       # 1gbe network
-networking_2500_ip: 198.18.21.7       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:74:b4:27
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:5b

hieradata/nodes/prodnxsr0008.main.unkin.net.yaml

@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.8  # management loopback
+profiles::proxmox::params::pve_ceph_osd: true
-networking_loopback1_ip: 198.18.22.8  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.8  # ceph-public loopback
-networking_1000_ip: 198.18.15.8       # 1gbe network
-networking_2500_ip: 198.18.21.8       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:06:18
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:08:4b

hieradata/nodes/prodnxsr0009.main.unkin.net.yaml

@@ -1,18 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.9  # management loopback
-networking_loopback1_ip: 198.18.22.9  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.9  # ceph-public loopback
-networking_br10_ip: 198.18.25.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:8d
-    ipaddress: 198.18.15.9
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:5d
-    ipaddress: 198.18.21.9
-
-#zfs::zpools:
-#  fastpool:
-#    ensure: present
-#    disk: /dev/nvme0n1

hieradata/nodes/prodnxsr0010.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.10  # management loopback
-networking_loopback1_ip: 198.18.22.10  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.10  # ceph-public loopback
-networking_br10_ip: 198.18.26.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:37
-    ipaddress: 198.18.15.10
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:de
-    ipaddress: 198.18.21.10

hieradata/nodes/prodnxsr0011.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.11  # management loopback
-networking_loopback1_ip: 198.18.22.11  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.11  # ceph-public loopback
-networking_br10_ip: 198.18.27.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:0f
-    ipaddress: 198.18.15.11
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:55
-    ipaddress: 198.18.21.11

hieradata/nodes/prodnxsr0012.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.12  # management loopback
-networking_loopback1_ip: 198.18.22.12  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.12  # ceph-public loopback
-networking_br10_ip: 198.18.28.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:4f:05:1e
-    ipaddress: 198.18.15.12
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:e5
-    ipaddress: 198.18.21.12

hieradata/nodes/prodnxsr0013.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.13  # management loopback
-networking_loopback1_ip: 198.18.22.13  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.13  # ceph-public loopback
-networking_br10_ip: 198.18.29.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:4f:04:b0
-    ipaddress: 198.18.15.13
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:36
-    ipaddress: 198.18.21.13

hieradata/os/AlmaLinux/AlmaLinux8.yaml

@@ -1,23 +1,2 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
-crypto_policies::policy: 'DEFAULT'
-
-profiles::packages::include:
-  network-scripts: {}
-
-profiles::yum::global::repos:
-  powertools:
-    name: powertools
-    descr: powertools repository
-    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
-    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el8
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent

hieradata/os/AlmaLinux/AlmaLinux9.yaml

@@ -1,36 +1,2 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
-crypto_policies::policy: 'DEFAULT:SHA1'
-
-profiles::yum::global::repos:
-  baseos:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  extras:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  appstream:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  highavailability:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  crb:
-    name: crb
-    descr: crb repository
-    target: /etc/yum.repos.d/crb.repo
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el9
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent

hieradata/os/AlmaLinux/all_releases.yaml

@@ -3,14 +3,14 @@
 profiles::firewall::firewalld::ensure_package: 'absent'
 profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
-profiles::puppet::agent::puppet_version: '7.34.0'
+profiles::puppet::agent::puppet_version: '7.26.0'
 
 hiera_include:
   - profiles::almalinux::base
 
 profiles::packages::include:
-  crypto-policies-scripts: {}
   lzo: {}
+  network-scripts: {}
   policycoreutils: {}
   unar: {}
   xz: {}
@@ -39,6 +39,13 @@ profiles::yum::global::repos:
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
+  powertools:
+    name: powertools
+    descr: powertools repository
+    target: /etc/yum.repos.d/powertools.repo
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
   highavailability:
     name: highavailability
     descr: highavailability repository
@@ -50,19 +57,19 @@ profiles::yum::global::repos:
     name: epel
     descr: epel repository
     target: /etc/yum.repos.d/epel.repo
-    baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
+    baseurl: https://edgecache.query.consul/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
-    gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
+    gpgkey: http://edgecache.query.consul/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
     mirrorlist: absent
   puppet:
     name: puppet
     descr: puppet repository
     target: /etc/yum.repos.d/puppet.repo
-    baseurl: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/
+    baseurl: https://yum.puppet.com/puppet7/el/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-puppet-20250406
+    gpgkey: https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406
     mirrorlist: absent
-  unkinben:
+  unkin:
-    name: unkinben
+    name: unkin
-    descr: unkinben repository
+    descr: unkin repository
     target: /etc/yum.repos.d/unkin.repo
     baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
     gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key

hieradata/os/Debian/all_releases.yaml

@@ -13,7 +13,3 @@ profiles::packages::include:
 
 lm-sensors::package: lm-sensors
 networking::nwmgr_dns_none: false
-
-consul::install_method: 'url'
-consul::manage_repo: false
-consul::bin_dir: /usr/local/bin

hieradata/roles/apps/jupyter/hub.eyaml

@@ -1 +0,0 @@
-profiles::jupyter::jupyterhub::ldap_bind_pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJspN3e2WzA0uZaLgFZ0Ewqii9dY0tTgbirsW70M2VZtLY+s+C6HE8ZZUtpfnRsFwUUhOj7s25X9xVOZNTpZIGPyfx9MWlSyFw2RFuXSEwaydf1DcBbg8261YrTTysA4Jsa1L4DLsX55q+XJUyeUbimVQkIacVIvzTdnZCBKnVNUh3U2PNAmV7SOL2KH8Jpbfs/EQfBt8XuGMCg3I/4RDyoNERqthW6W2KiMX2Gmd8iQ5+W9udH0lEAMx415oyImmN+dEuThcx9FGMi8BWYtnxH96yWafpT5qltwW6EVzIGWuLhiD1LcWYc5RB8jc3DhbeouChpKsN6c4EHoKt3aWsTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC8jcnqilJgY1/AnHWHfX4bgDCi2a3Rj43Z0dgfB5HaHdpfked3Cx+u94r2S5+Cg3QogU1AIF04rjzOL+bD2HdaMfo=]

hieradata/roles/apps/jupyter/hub.yaml

@@ -1,74 +0,0 @@
----
-profiles::packages::include:
-  python3.12: {}
-  python3.12-pip: {}
-
-hiera_include:
-  - docker
-  - profiles::nginx::simpleproxy
-
-# manage docker
-docker::version: latest
-docker::curl_ensure: false
-docker::root_dir: /data/docker
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'jupyterhub.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - jupyterhub.service.consul
-  - jupyterhub.query.consul
-  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_port: 8000
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-profiles::nginx::simpleproxy::locations:
-  # authorised access from external
-  default:
-    ensure: 'present'
-    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
-    ssl_only: true
-    location: '/'
-    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
-    proxy_set_header:
-      - 'Host $host'
-      - 'X-Real-IP $remote_addr'
-      - 'X-Forwarded-For $proxy_add_x_forwarded_for'
-      - 'X-Forwarded-Host $host'
-      - 'X-Forwarded-Proto $scheme'
-      - 'Upgrade $http_upgrade'
-      - 'Connection $http_connection'
-      - 'X-Scheme $scheme'
-    proxy_redirect: 'off'
-    proxy_http_version: '1.1'
-    proxy_buffering: 'off'
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - jupyterhub.service.consul
-  - jupyterhub.query.consul
-  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  jupyterhub:
-    service_name: 'jupyterhub'
-    tags:
-      - 'jupyterhub'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'jupyterhub_http_check'
-        name: 'jupyterhub HTTP Check'
-        http: "https://%{facts.networking.fqdn}"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: jupyterhub
-    disposition: write

hieradata/roles/apps/media.yaml

@@ -69,7 +69,8 @@ profiles::nginx::simpleproxy::locations:
     location_allow:
       - 127.0.0.1
       - "%{facts.networking.ip}"
-      - 198.18.24.0/24
+      - 198.18.13.25
+      - 198.18.13.26
     location_deny:
       - all
   # authorised access from external

hieradata/roles/apps/media/jellyfin.yaml

@@ -2,12 +2,6 @@
 hiera_include:
   - jellyfin
 
-profiles::packages::include:
-  intel-media-driver: {}
-  libva-intel-driver: {}
-  libva-intel-hybrid-driver: {}
-  intel-mediasdk: {}
-
 # manage jellyfin
 jellyfin::params::service_enable: true
 
@@ -67,11 +61,3 @@ profiles::yum::global::repos:
     baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
     gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
     mirrorlist: absent
-  unkinben:
-    name: unkinben
-    descr: unkinben repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el8
-    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent

hieradata/roles/apps/media/lidarr.yaml

@@ -2,7 +2,6 @@
 hiera_include:
   - lidarr
   - profiles::nginx::ldapauth
-  - profiles::media::lidarr
 
 # manage lidarr
 lidarr::params::user: lidarr

hieradata/roles/apps/media/nzbget.yaml

@@ -4,19 +4,12 @@ hiera_include:
   - nzbget
   - profiles::media::nzbget
   - profiles::nginx::ldapauth
-  - exporters::nzbget_exporter
-
-profiles::packages::include:
-  unrar: {}
 
 # manage nzbget
 nzbget::params::user: nzbget
 nzbget::params::group: media
 nzbget::params::manage_group: false
 
-# nzbget_exporter
-exporters::nzbget_exporter::enable: true
-
 # additional altnames
 profiles::pki::vault::alt_names:
   - nzbget.main.unkin.net
@@ -66,9 +59,6 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: nzbget
     disposition: write
-  - resource: service
-    segment: nzbget_exporter
-    disposition: write
 
 profiles::yum::global::repos:
   rpmfusion-free:

hieradata/roles/apps/media/prowlarr.yaml

@@ -2,8 +2,6 @@
 hiera_include:
   - prowlarr
   - profiles::nginx::ldapauth
-  - profiles::media::prowlarr
-  - exporters::exportarr
 
 # manage prowlarr
 prowlarr::params::user: prowlarr
@@ -12,12 +10,6 @@ prowlarr::params::manage_group: false
 prowlarr::params::archive_version: 1.19.0
 prowlarr::params::port: 8000
 
-# exportarr
-exporters::exportarr::enable: true
-exporters::exportarr::app: prowlarr
-exporters::exportarr::api_key: "%{hiera('prowlarr::api_key')}"
-exporters::exportarr::backfill: true
-
 # additional altnames
 profiles::pki::vault::alt_names:
   - prowlarr.main.unkin.net
@@ -62,9 +54,6 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: prowlarr
     disposition: write
-  - resource: service
-    segment: exportarr
-    disposition: write
 
 profiles::nginx::simpleproxy::locations:
   arrstack_web_external:

hieradata/roles/apps/media/radarr.yaml

@@ -2,8 +2,6 @@
 hiera_include:
   - radarr
   - profiles::nginx::ldapauth
-  - profiles::media::radarr
-  - exporters::exportarr
 
 # manage radarr
 radarr::params::user: radarr
@@ -12,10 +10,6 @@ radarr::params::manage_group: false
 radarr::params::archive_version: 5.7.0
 radarr::params::port: 8000
 
-# exportarr
-exporters::exportarr::enable: true
-exporters::exportarr::app: radarr
-exporters::exportarr::api_key: "%{hiera('radarr::api_key')}"
 
 # additional altnames
 profiles::pki::vault::alt_names:
@@ -61,6 +55,3 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: radarr
     disposition: write
-  - resource: service
-    segment: exportarr
-    disposition: write

hieradata/roles/apps/media/readarr.yaml

@@ -2,7 +2,6 @@
 hiera_include:
   - readarr
   - profiles::nginx::ldapauth
-  - profiles::media::readarr
 
 # manage readarr
 readarr::params::user: readarr

hieradata/roles/apps/media/sonarr.yaml

@@ -2,8 +2,6 @@
 hiera_include:
   - sonarr
   - profiles::nginx::ldapauth
-  - profiles::media::sonarr
-  - exporters::exportarr
 
 # manage sonarr
 sonarr::params::user: sonarr
@@ -12,11 +10,6 @@ sonarr::params::manage_group: false
 sonarr::params::archive_version: 4.0.5
 sonarr::params::port: 8000
 
-# exportarr
-exporters::exportarr::enable: true
-exporters::exportarr::app: sonarr
-exporters::exportarr::api_key: "%{hiera('sonarr::api_key')}"
-
 # additional altnames
 profiles::pki::vault::alt_names:
   - sonarr.main.unkin.net
@@ -61,6 +54,3 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: sonarr
     disposition: write
-  - resource: service
-    segment: exportarr
-    disposition: write