dns: keep VM consul forwarder as fallback

Forward syd1 .consul DNS to the k8s consul LoadBalancer
Add consul server federation SANs to consul server certs (#547 )
2026-10-09 23:06:43 +11:00 · 2026-10-09 23:01:36 +11:00 · 2026-10-09 21:51:43 +11:00 · 2026-10-05 22:10:50 +11:00 · 2026-10-05 22:03:30 +11:00 · 2026-10-05 21:33:03 +11:00
6 changed files with 19 additions and 2 deletions
@@ -4,6 +4,15 @@ certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
 profiles_dns_upstream_forwarder_unkin:
  - 198.18.200.7
 profiles_dns_upstream_forwarder_consul:
+  - 198.18.200.5
  - 198.18.19.14
 profiles_dns_upstream_forwarder_k8s:
  - 198.18.19.20
+profiles::consul::client::members_lookup: false
+# static: k8s-compiled hosts can't see the servers in PuppetDB; update when servers change
+profiles::consul::client::consul_servers:
+  - ausyd1nxvm2005.main.unkin.net
+  - ausyd1nxvm2006.main.unkin.net
+  - ausyd1nxvm2007.main.unkin.net
+  - ausyd1nxvm2008.main.unkin.net
+  - ausyd1nxvm2009.main.unkin.net
@@ -2,6 +2,8 @@
 hiera_include:
  - profiles::nginx::simpleproxy

+profiles::puppet::migrate::enabled: true
+
 profiles::yum::global::repos:
  ceph:
    ensure: present
@@ -14,6 +14,8 @@ hiera_include:
  - profiles::storage::cephfsvols
  - exporters::frr_exporter

+profiles::puppet::migrate::enabled: true
+
 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
 python::manage_dev_package: false

@@ -8,6 +8,8 @@ hiera_include:
  - frrouting
  - rke2

+profiles::puppet::migrate::enabled: true
+
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345
@@ -31,6 +31,8 @@ profiles::pki::vault::alt_names:
  - consul.service.consul
  - "consul.service.%{facts.country}-%{facts.region}.consul"
  - consul
+  - "server.%{facts.country}-%{facts.region}.consul"
+  - "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"

 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'
@@ -6,8 +6,8 @@ class nzbget (
  $manage_group       = $nzbget::params::manage_group,
  $service_enable     = $nzbget::params::service_enable,
  $service_name       = $nzbget::params::service_name,
-  $bind_address       = $sonarr::params::bind_address,
-  $port               = $sonarr::params::port,
+  $bind_address       = $nzbget::params::bind_address,
+  $port               = $nzbget::params::port,
 ) inherits nzbget::params {

  include nzbget::install
Author	SHA1	Message	Date
unkin-agent	6bc79dd09c	dns: keep VM consul forwarder as fallback ci/woodpecker/pr/puppet-lint Pipeline was successful Details ci/woodpecker/pr/ruby-validate Pipeline was successful Details ci/woodpecker/pr/bolt-validate Pipeline was successful Details ci/woodpecker/pr/yamllint Pipeline was successful Details ci/woodpecker/pr/erb-validate Pipeline was successful Details ci/woodpecker/pr/epp-validate Pipeline was successful Details ci/woodpecker/pr/ruby-check Pipeline was successful Details ci/woodpecker/pr/puppet-validate Pipeline was successful Details	2026-10-09 23:06:43 +11:00
unkin-agent	53af06c974	Forward syd1 .consul DNS to the k8s consul LoadBalancer ci/woodpecker/pr/ruby-validate Pipeline was successful Details ci/woodpecker/pr/puppet-lint Pipeline was successful Details ci/woodpecker/pr/erb-validate Pipeline was successful Details ci/woodpecker/pr/bolt-validate Pipeline was successful Details ci/woodpecker/pr/yamllint Pipeline was successful Details ci/woodpecker/pr/epp-validate Pipeline was successful Details ci/woodpecker/pr/puppet-validate Pipeline was successful Details ci/woodpecker/pr/ruby-check Pipeline was successful Details	2026-10-09 23:01:36 +11:00
unkin-agent	6c880d9794	Add consul server federation SANs to consul server certs (#547 ) WAN federation through mesh gateways makes Consul verify server certs against `server.<dc>.consul` and `<node_name>.server.<dc>.consul`. Node names are FQDNs, so each server needs its exact SAN. This adds the SANs ahead of Consul server TLS, which a stacked follow-up enables once the reissued certs are verified. - add `server.<country>-<region>.consul` to consul server alt_names - add `<fqdn>.server.<country>-<region>.consul` to consul server alt_names Reviewed-on: #547 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-09 21:51:43 +11:00
unkin-agent	2e95cd00d7	Migrate k8s roles to puppet-on-k8s (#545 ) Move the k8s roles to the puppet-on-k8s compilers. Their role code (rke2, frrouting, ceph) has no exported resources or PuppetDB queries; the base consul lookup is covered by the static syd1 server list. - enable profiles::puppet::migrate in the shared roles::infra::k8s hieradata (compute, control, node) Reviewed-on: #545 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-05 22:10:50 +11:00
unkin-agent	171cf23a93	Migrate incus nodes to puppet-on-k8s (#546 ) Incus nodes still run against the VM puppetservers; move them to the k8s compilers as part of the puppet-on-k8s migration. - enable profiles::puppet::migrate for roles::infra::incus::node Reviewed-on: #546 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-05 22:03:30 +11:00
unkin-agent	83cb039b97	consul: use static server list for clients (#544 ) Hosts compiled on the k8s puppetservers can't see the consul servers in PuppetDB, so the members lookup returns nothing and syd1 clients get no retry_join targets. - set a static consul server list for syd1 and disable the members lookup there - keep the PuppetDB members lookup for all other regions Reviewed-on: #544 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-05 21:33:03 +11:00
unkin-agent	fc26d3cc4a	nzbget: fix params lookup copied from sonarr (#543 ) nzbget defaulted bind_address and port from sonarr::params, which is not loaded on nzbget-only nodes, so catalog compilation failed with "Unknown variable". - default bind_address/port from nzbget::params Reviewed-on: #543 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-05 13:36:52 +11:00
unkin-agent	5fe9f7a9da	Migrate media roles to puppet-on-k8s (#540 ) The ausyd1nxvm2120 canary is healthy on the puppet-on-k8s servers, so move the next role wave across: the media nodes (ausyd1nxvm2045-2051: nzbget, sonarr, radarr, lidarr, readarr, prowlarr, jellyfin). - enable `profiles::puppet::migrate` in `roles/apps/media.yaml` Reviewed-on: #540 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-05 12:10:31 +11:00