feat: manage route-reflectors

- add route-reflector role and hieradata - enable using dhcp in networkd - add hieradata/node/* entries for route-reflectors
2025-04-26 00:22:49 +10:00
284 changed files with 1561 additions and 5057 deletions
@@ -1,24 +0,0 @@
-name: Build
-
-on:
-  pull_request:
-
-jobs:
-  precommit:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Install requirements
-        run: |
-          dnf groupinstall -y "Development Tools" -y
-          dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
-
-      - name: Pre-Commit All Files
-        run: |
-          uvx pre-commit run --all-files
@@ -8,6 +8,3 @@ Style/Documentation:

 Layout/LineLength:
  Max: 140
-
-Metrics/BlockNesting:
-  Max: 4
@@ -36,12 +36,6 @@ lookup_options:
  profiles::haproxy::server::listeners:
    merge:
      strategy: deep
-  profiles::accounts::root::sshkeys:
-    merge:
-      strategy: deep
-  profiles::accounts::sysadmin::sshkeys:
-    merge:
-      strategy: deep
  haproxy::backend:
    merge:
      strategy: deep
@@ -165,13 +159,14 @@ hiera_include:
  - profiles::accounts::rundeck
  - limits
  - sysctl::base
-  - exporters::node_exporter

+profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
+profiles::ntp::client::use_ntp: 'region'
 profiles::ntp::client::peers:
-  - 0.au.pool.ntp.org
-  - 1.au.pool.ntp.org
-  - 2.au.pool.ntp.org
-  - 3.au.pool.ntp.org
+  - 0.pool.ntp.org
+  - 1.pool.ntp.org
+  - 2.pool.ntp.org
+  - 3.pool.ntp.org

 profiles::base::puppet_servers:
  - 'prodinf01n01.main.unkin.net'
@@ -180,18 +175,9 @@ consul::install_method: 'package'
 consul::manage_repo: false
 consul::bin_dir: /usr/bin

-vault::install_method: 'repo'
-vault::manage_repo: false
-vault::bin_dir: /usr/bin
-vault::manage_service_file: true
-vault::manage_config_dir: true
-vault::disable_mlock: false
-
-profiles::dns::base::nameservers:
-  - 198.18.19.16
 profiles::dns::master::basedir: '/var/named/sources'
-#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
-#profiles::dns::base::use_ns: 'region'
+profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
+profiles::dns::base::use_ns: 'region'
 profiles::consul::server::members_role: roles::infra::storage::consul
 profiles::consul::token::node_editor::accessor_id: '024e27bd-c5bb-41e7-a578-b766509e11bc'
 profiles::consul::client::members_lookup: true
@@ -206,9 +192,6 @@ profiles::consul::client::node_rules:
  - resource: node
    segment: ''
    disposition: read
-  - resource: service
-    segment: node_exporter
-    disposition: write

 profiles::packages::include:
  bash-completion: {}
@@ -292,8 +275,7 @@ profiles::puppet::client::dns_alt_names:
 puppetdbapi: puppetdbapi.query.consul
 puppetdbsql: puppetdbsql.service.au-syd1.consul

-exporters::node_exporter::enable: true
-exporters::node_exporter::cleanup_old_node_exporter: true
+prometheus::node_exporter::export_scrape_job: true
 prometheus::systemd_exporter::export_scrape_job: true

 ssh::server::storeconfigs_enabled: false
@@ -358,11 +340,6 @@ networking::route_defaults:
  netmask: 0.0.0.0
  network: default

-# logging:
-victorialogs::client::journald::enable: true
-victorialogs::client::journald::inserturl: https://vlinsert.service.consul:9428/insert/journald
-
-# FIXME these are for the proxmox ceph cluster
 profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
 profiles::ceph::client::mons:
  - 10.18.15.1
@@ -1,9 +1,2 @@
 ---
 timezone::timezone: 'Australia/Darwin'
-profiles_dns_upstream_forwarder_unkin:
-  - 198.18.17.23
-  - 198.18.17.24
-profiles_dns_upstream_forwarder_consul:
-  - 198.18.17.34
-  - 198.18.17.35
-  - 198.18.17.36
@@ -1 +1,52 @@
 ---
+profiles::dns::resolver::zones:
+  main.unkin.net-forward:
+    domain: 'main.unkin.net'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  13.18.198.in-addr.arpa-forward:
+    domain: '13.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  14.18.198.in-addr.arpa-forward:
+    domain: '14.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  15.18.198.in-addr.arpa-forward:
+    domain: '15.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  16.18.198.in-addr.arpa-forward:
+    domain: '16.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  17.18.198.in-addr.arpa-forward:
+    domain: '17.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  consul-forward:
+    domain: 'consul'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.34
+      - 198.18.17.35
+      - 198.18.17.36
+    forward: 'only'
@@ -1,7 +1,3 @@
 ---
 timezone::timezone: 'Australia/Sydney'
-certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
-profiles_dns_upstream_forwarder_unkin:
-  - 198.18.19.15
-profiles_dns_upstream_forwarder_consul:
-  - 198.18.19.14
+certbot::client::webserver: ausyd1nxvm1021.main.unkin.net
@@ -1 +1,52 @@
 ---
+profiles::dns::resolver::zones:
+  main.unkin.net-forward:
+    domain: 'main.unkin.net'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  13.18.198.in-addr.arpa-forward:
+    domain: '13.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  14.18.198.in-addr.arpa-forward:
+    domain: '14.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  15.18.198.in-addr.arpa-forward:
+    domain: '15.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  16.18.198.in-addr.arpa-forward:
+    domain: '16.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  17.18.198.in-addr.arpa-forward:
+    domain: '17.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  consul-forward:
+    domain: 'consul'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.19
+      - 198.18.13.20
+      - 198.18.13.21
+    forward: 'only'
@@ -3,7 +3,7 @@ hiera_include:
  - keepalived

 # keepalived
-profiles::haproxy::dns::ipaddr: '198.18.13.250'
+profiles::haproxy::dns::vrrp_ipaddr: '198.18.13.250'
 profiles::haproxy::dns::vrrp_cnames:
  - sonarr.main.unkin.net
  - radarr.main.unkin.net
@@ -1,305 +0,0 @@
---
-profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
-profiles::haproxy::dns::vrrp_cnames:
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-  - git.unkin.net
-  - fafflix.unkin.net
-  - grafana.unkin.net
-
-profiles::haproxy::mappings:
-  fe_http:
-    ensure: present
-    mappings:
-      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
-      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
-      - 'sonarr.main.unkin.net be_sonarr'
-      - 'radarr.main.unkin.net be_radarr'
-      - 'lidarr.main.unkin.net be_lidarr'
-      - 'readarr.main.unkin.net be_readarr'
-      - 'prowlarr.main.unkin.net be_prowlarr'
-      - 'nzbget.main.unkin.net be_nzbget'
-      - 'jellyfin.main.unkin.net be_jellyfin'
-      - 'fafflix.unkin.net be_jellyfin'
-      - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
-  fe_https:
-    ensure: present
-    mappings:
-      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
-      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
-      - 'sonarr.main.unkin.net be_sonarr'
-      - 'radarr.main.unkin.net be_radarr'
-      - 'lidarr.main.unkin.net be_lidarr'
-      - 'readarr.main.unkin.net be_readarr'
-      - 'prowlarr.main.unkin.net be_prowlarr'
-      - 'nzbget.main.unkin.net be_nzbget'
-      - 'jellyfin.main.unkin.net be_jellyfin'
-      - 'fafflix.unkin.net be_jellyfin'
-      - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
-
-profiles::haproxy::frontends:
-  fe_http:
-    options:
-      use_backend:
-        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_http.map,be_default)]"
-  fe_https:
-    options:
-      acl:
-        - 'acl_ausyd1pve req.hdr(host) -i au-syd1-pve.main.unkin.net'
-        - 'acl_sonarr req.hdr(host) -i sonarr.main.unkin.net'
-        - 'acl_radarr req.hdr(host) -i radarr.main.unkin.net'
-        - 'acl_lidarr req.hdr(host) -i lidarr.main.unkin.net'
-        - 'acl_readarr req.hdr(host) -i readarr.main.unkin.net'
-        - 'acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net'
-        - 'acl_nzbget req.hdr(host) -i nzbget.main.unkin.net'
-        - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
-        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
-        - 'acl_gitea req.hdr(host) -i git.unkin.net'
-        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
-        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
-      use_backend:
-        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
-      http-request:
-        - 'deny if { hdr_dom(host) -i au-syd1-pve.main.unkin.net } !acl_internalsubnets'
-      http-response:
-        - 'set-header X-Frame-Options DENY if acl_ausyd1pve'
-        - 'set-header X-Frame-Options DENY if acl_sonarr'
-        - 'set-header X-Frame-Options DENY if acl_radarr'
-        - 'set-header X-Frame-Options DENY if acl_lidarr'
-        - 'set-header X-Frame-Options DENY if acl_readarr'
-        - 'set-header X-Frame-Options DENY if acl_prowlarr'
-        - 'set-header X-Frame-Options DENY if acl_nzbget'
-        - 'set-header X-Frame-Options DENY if acl_jellyfin'
-        - 'set-header X-Frame-Options DENY if acl_fafflix'
-        - 'set-header X-Frame-Options DENY if acl_gitea'
-        - 'set-header X-Frame-Options DENY if acl_grafana'
-        - 'set-header X-Content-Type-Options nosniff'
-        - 'set-header X-XSS-Protection 1;mode=block'
-
-profiles::haproxy::backends:
-  be_ausyd1pve_web:
-    description: Backend for au-syd1 pve cluster (Web)
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_ausyd1pve_api:
-    description: Backend for au-syd1 pve cluster (API only)
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_sonarr:
-    description: Backend for au-syd1 sonarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_radarr:
-    description: Backend for au-syd1 radarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_lidarr:
-    description: Backend for au-syd1 lidarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_readarr:
-    description: Backend for au-syd1 readarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_prowlarr:
-    description: Backend for au-syd1 prowlarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_nzbget:
-    description: Backend for au-syd1 nzbget
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_jellyfin:
-    description: Backend for au-syd1 jellyfin
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_gitea:
-    description: Backend for gitea cluster
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-  be_grafana:
-    description: Backend for grafana nodes
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-
-profiles::haproxy::certlist::enabled: true
-profiles::haproxy::certlist::certificates:
-  - /etc/pki/tls/letsencrypt/au-syd1-pve.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/au-syd1-pve-api.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/sonarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/radarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/lidarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/readarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/prowlarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/vault/certificate.pem
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-  - jellyfin.main.unkin.net
-
-# additional cnames
-profiles::haproxy::dns::cnames:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-
-# letsencrypt certificates
-certbot::client::service: haproxy
-certbot::client::domains:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-  - fafflix.unkin.net
-  - git.unkin.net
-  - grafana.unkin.net
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.10
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.11
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.12
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.13
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.14
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.15
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.16
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.17
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.18
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.19
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.20
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.21
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.22
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.23
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.24
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,13 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.25
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+
+profiles::haproxy::dns::vrrp_master: true
+keepalived::vrrp_instance:
+  VI_250:
+    state: 'MASTER'
+    priority: 101
@@ -0,0 +1,12 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.26
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+
+keepalived::vrrp_instance:
+  VI_250:
+    state: 'BACKUP'
+    priority: 100
@@ -0,0 +1,11 @@
+---
+profiles::cobbler::params::is_cobbler_master: true
+networking::interfaces:
+  ens18:
+    ipaddress: 198.18.13.27
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+    interface: ens18
+
+profiles::almalinux::base::remove_ens18: false
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.28
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.29
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.30
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,10 @@
+---
+networking::interfaces:
+  ens18:
+    ipaddress: 198.18.13.31
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+    interface: ens18
+
+profiles::almalinux::base::remove_ens18: false
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.32
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.33
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.34
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.35
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.36
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.37
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.38
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.39
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.40
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.41
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.42
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.43
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.44
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.45
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -13,3 +13,9 @@ profiles::ssh::sign::principals:

 profiles::puppet::puppetca::is_puppetca: true
 profiles::puppet::puppetca::allow_subject_alt_names: true
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.46
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.47
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.47
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.48
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.49
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.50
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.50
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.51
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.51
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.52
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.52
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.53
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.53
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.54
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.55
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.56
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.57
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.57
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.58
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.58
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.59
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.60
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.61
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.62
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.63
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.64
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.65
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.66
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.67
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.68
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.69
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.70
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.71
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.72
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.73
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.74
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.74
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.64.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.75
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.75
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.65.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.76
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.76
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.66.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.77
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.77
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.67.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.78
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.78
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.68.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.79
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.79
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.69.254/24'
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.80
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.81
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.14  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:69:0f:3b
@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.15  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:55:46:bd
@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.16  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:6a:25:6b
@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.17  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:63:89:f2
@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.18  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:ca:e1:51
@@ -1,2 +0,0 @@
---
-profiles::cobbler::params::is_cobbler_master: true
@@ -0,0 +1,12 @@
+---
+profiles::puppet::server::dns_alt_names:
+  - puppetca.main.unkin.net
+  - puppetca.service.consul
+  - puppetca.query.consul
+  - puppetca
+
+profiles::puppet::puppetca::is_puppetca: false
+profiles::puppet::puppetca::allow_subject_alt_names: true
+
+hiera_exclude:
+  - networking
@@ -1,13 +1,5 @@
 ---
-networking_loopback0_ip: 198.18.19.1  # management loopback
-networking_loopback1_ip: 198.18.22.1  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.1  # ceph-public loopback
-networking_1000_ip: 198.18.15.1       # 1gbe network
-networking_2500_ip: 198.18.21.1       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:c3:60
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:50
+profiles::proxmox::params::pve_clusterinit_master: true
+profiles::proxmox::params::pve_ceph_mon: true
+profiles::proxmox::params::pve_ceph_mgr: true
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,4 @@
 ---
-networking_loopback0_ip: 198.18.19.2  # management loopback
-networking_loopback1_ip: 198.18.22.2  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.2  # ceph-public loopback
-networking_1000_ip: 198.18.15.2       # 1gbe network
-networking_2500_ip: 198.18.21.2       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:74:b6:08
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:08:43
+profiles::proxmox::params::pve_ceph_mon: true
+profiles::proxmox::params::pve_ceph_mgr: true
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,4 @@
 ---
-networking_loopback0_ip: 198.18.19.3  # management loopback
-networking_loopback1_ip: 198.18.22.3  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.3  # ceph-public loopback
-networking_1000_ip: 198.18.15.3       # 1gbe network
-networking_2500_ip: 198.18.21.3       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: b8:85:84:a3:25:c5
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:07:82
+profiles::proxmox::params::pve_ceph_mon: true
+profiles::proxmox::params::pve_ceph_mgr: true
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.4  # management loopback
-networking_loopback1_ip: 198.18.22.4  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.4  # ceph-public loopback
-networking_1000_ip: 198.18.15.4       # 1gbe network
-networking_2500_ip: 198.18.21.4       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:d5:00
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:43
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.5  # management loopback
-networking_loopback1_ip: 198.18.22.5  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.5  # ceph-public loopback
-networking_1000_ip: 198.18.15.5       # 1gbe network
-networking_2500_ip: 198.18.21.5       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: 54:bf:64:a0:08:64
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:07:79
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.6  # management loopback
-networking_loopback1_ip: 198.18.22.6  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.6  # ceph-public loopback
-networking_1000_ip: 198.18.15.6       # 1gbe network
-networking_2500_ip: 198.18.21.6       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:10:8d
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:53
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.7  # management loopback
-networking_loopback1_ip: 198.18.22.7  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.7  # ceph-public loopback
-networking_1000_ip: 198.18.15.7       # 1gbe network
-networking_2500_ip: 198.18.21.7       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:74:b4:27
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:5b
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.8  # management loopback
-networking_loopback1_ip: 198.18.22.8  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.8  # ceph-public loopback
-networking_1000_ip: 198.18.15.8       # 1gbe network
-networking_2500_ip: 198.18.21.8       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:06:18
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:08:4b
+profiles::proxmox::params::pve_ceph_osd: true
@@ -9,7 +9,6 @@ hiera_include:
  - profiles::almalinux::base

 profiles::packages::include:
-  crypto-policies-scripts: {}
  lzo: {}
  policycoreutils: {}
  unar: {}
@@ -50,8 +49,8 @@ profiles::yum::global::repos:
    name: epel
    descr: epel repository
    target: /etc/yum.repos.d/epel.repo
-    baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
+    baseurl: https://edgecache.query.consul/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
+    gpgkey: http://edgecache.query.consul/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
    mirrorlist: absent
  puppet:
    name: puppet
@@ -69,7 +69,8 @@ profiles::nginx::simpleproxy::locations:
    location_allow:
      - 127.0.0.1
      - "%{facts.networking.ip}"
-      - 198.18.24.0/24
+      - 198.18.13.25
+      - 198.18.13.26
    location_deny:
      - all
  # authorised access from external
@@ -2,12 +2,6 @@
 hiera_include:
  - jellyfin

-profiles::packages::include:
-  intel-media-driver: {}
-  libva-intel-driver: {}
-  libva-intel-hybrid-driver: {}
-  intel-mediasdk: {}
-
 # manage jellyfin
 jellyfin::params::service_enable: true

@@ -67,11 +61,3 @@ profiles::yum::global::repos:
    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
    mirrorlist: absent
-  unkinben:
-    name: unkinben
-    descr: unkinben repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el8
-    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent
@@ -2,7 +2,6 @@
 hiera_include:
  - lidarr
  - profiles::nginx::ldapauth
-  - profiles::media::lidarr

 # manage lidarr
 lidarr::params::user: lidarr
--- a/Show More
+++ b/Show More