feat: deploy ceph

- cleanup subnet_facts, add transit links - cleanup role::ceph::* - add openstack-ceph module - add ceph-mon profile
2025-05-15 07:14:04 +10:00
312 changed files with 1817 additions and 6075 deletions
@@ -1,24 +0,0 @@
-name: Build
-
-on:
-  pull_request:
-
-jobs:
-  precommit:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Install requirements
-        run: |
-          dnf groupinstall -y "Development Tools" -y
-          dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
-
-      - name: Pre-Commit All Files
-        run: |
-          uvx pre-commit run --all-files
@@ -8,6 +8,3 @@ Style/Documentation:

 Layout/LineLength:
  Max: 140
-
-Metrics/BlockNesting:
-  Max: 4
@@ -60,6 +60,8 @@ mod 'rehan-mkdir', '2.0.0'
 mod 'tailoredautomation-patroni', '2.0.0'
 mod 'ssm-crypto_policies', '0.3.3'
 mod 'thias-sysctl', '1.0.8'
+mod 'openstack-ceph', '7.0.0'
+

 mod 'bind',
  :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',
@@ -29,21 +29,3 @@ these steps are required when adding additional puppet masters, as the subject a

    sudo systemctl start puppetserver
    sudo cp /root/current_crl.pem /etc/puppetlabs/puppet/ssl/crl.pem
-
-
-## troubleshooting
-
-### Issue 1:
-
-    [sysadmin@ausyd1nxvm2056 ~]$ sudo puppet agent -t
-    Error: The CRL issued by 'CN=Puppet CA: prodinf01n01.main.unkin.net' is missing
-
-Find another puppetserver that IS working, copy the `/etc/puppetlabs/puppet/ssl/crl.pem` to this host, run puppet again.
-
-
-### Issue 2:
-
-    [sysadmin@ausyd1nxvm2097 ~]$ sudo puppet agent -t
-    Error: Failed to parse CA certificates as PEM
-
-The puppet-agents CA cert `/etc/puppetlabs/puppet/ssl/certs/ca.pem` is empty or missing. Grab it from any other host. Run puppet again.
@@ -36,12 +36,6 @@ lookup_options:
  profiles::haproxy::server::listeners:
    merge:
      strategy: deep
-  profiles::accounts::root::sshkeys:
-    merge:
-      strategy: deep
-  profiles::accounts::sysadmin::sshkeys:
-    merge:
-      strategy: deep
  haproxy::backend:
    merge:
      strategy: deep
@@ -155,9 +149,6 @@ lookup_options:
  zfs::datasets:
    merge:
      strategy: deep
-  rke2::config_hash:
-    merge:
-      strategy: deep

 facts_path: '/opt/puppetlabs/facter/facts.d'

@@ -168,13 +159,14 @@ hiera_include:
  - profiles::accounts::rundeck
  - limits
  - sysctl::base
-  - exporters::node_exporter

+profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
+profiles::ntp::client::use_ntp: 'region'
 profiles::ntp::client::peers:
-  - 0.au.pool.ntp.org
-  - 1.au.pool.ntp.org
-  - 2.au.pool.ntp.org
-  - 3.au.pool.ntp.org
+  - 0.pool.ntp.org
+  - 1.pool.ntp.org
+  - 2.pool.ntp.org
+  - 3.pool.ntp.org

 profiles::base::puppet_servers:
  - 'prodinf01n01.main.unkin.net'
@@ -209,9 +201,6 @@ profiles::consul::client::node_rules:
  - resource: node
    segment: ''
    disposition: read
-  - resource: service
-    segment: node_exporter
-    disposition: write

 profiles::packages::include:
  bash-completion: {}
@@ -295,8 +284,7 @@ profiles::puppet::client::dns_alt_names:
 puppetdbapi: puppetdbapi.query.consul
 puppetdbsql: puppetdbsql.service.au-syd1.consul

-exporters::node_exporter::enable: true
-exporters::node_exporter::cleanup_old_node_exporter: true
+prometheus::node_exporter::export_scrape_job: true
 prometheus::systemd_exporter::export_scrape_job: true

 ssh::server::storeconfigs_enabled: false
@@ -361,38 +349,11 @@ networking::route_defaults:
  netmask: 0.0.0.0
  network: default

-# logging:
-victorialogs::client::journald::enable: true
-victorialogs::client::journald::inserturl: https://vlinsert.service.consul:9428/insert/journald
-
-# FIXME these are for the proxmox ceph cluster
 profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
 profiles::ceph::client::mons:
  - 10.18.15.1
  - 10.18.15.2
  - 10.18.15.3
-
-profiles::ceph::conf::config:
-  global:
-    auth_client_required: 'cephx'
-    auth_cluster_required: 'cephx'
-    auth_service_required: 'cephx'
-    fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
-    mon_allow_pool_delete: true
-    mon_initial_members: 'prodnxsr0009,prodnxsr0010,prodnxsr0011,prodnxsr0012,prodnxsr0013'
-    mon_host: '198.18.23.9,198.18.23.10,198.18.23.11,198.18.23.12,198.18.23.13'
-    ms_bind_ipv4: true
-    ms_bind_ipv6: false
-    osd_crush_chooseleaf_type: 1
-    osd_pool_default_min_size: 2
-    osd_pool_default_size: 3
-    osd_pool_default_pg_num: 128
-    public_network: >
-      198.18.23.1/32,198.18.23.2/32,198.18.23.3/32,198.18.23.4/32,
-      198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,
-      198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,
-      198.18.23.13/32
-
 #profiles::base::hosts::additional_hosts:
 #  - ip: 198.18.17.9
 #    hostname: prodinf01n09.main.unkin.net
@@ -1,6 +1,6 @@
 ---
 timezone::timezone: 'Australia/Sydney'
-certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
+certbot::client::webserver: ausyd1nxvm1021.main.unkin.net
 profiles_dns_upstream_forwarder_unkin:
  - 198.18.19.15
 profiles_dns_upstream_forwarder_consul:
@@ -3,7 +3,7 @@ hiera_include:
  - keepalived

 # keepalived
-profiles::haproxy::dns::ipaddr: '198.18.13.250'
+profiles::haproxy::dns::vrrp_ipaddr: '198.18.13.250'
 profiles::haproxy::dns::vrrp_cnames:
  - sonarr.main.unkin.net
  - radarr.main.unkin.net
@@ -1,332 +0,0 @@
---
-profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
-profiles::haproxy::dns::vrrp_cnames:
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-  - git.unkin.net
-  - fafflix.unkin.net
-  - grafana.unkin.net
-  - dashboard.ceph.unkin.net
-
-profiles::haproxy::mappings:
-  fe_http:
-    ensure: present
-    mappings:
-      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
-      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
-      - 'sonarr.main.unkin.net be_sonarr'
-      - 'radarr.main.unkin.net be_radarr'
-      - 'lidarr.main.unkin.net be_lidarr'
-      - 'readarr.main.unkin.net be_readarr'
-      - 'prowlarr.main.unkin.net be_prowlarr'
-      - 'nzbget.main.unkin.net be_nzbget'
-      - 'jellyfin.main.unkin.net be_jellyfin'
-      - 'fafflix.unkin.net be_jellyfin'
-      - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
-      - 'dashboard.ceph.unkin.net be_ceph_dashboard'
-  fe_https:
-    ensure: present
-    mappings:
-      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
-      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
-      - 'sonarr.main.unkin.net be_sonarr'
-      - 'radarr.main.unkin.net be_radarr'
-      - 'lidarr.main.unkin.net be_lidarr'
-      - 'readarr.main.unkin.net be_readarr'
-      - 'prowlarr.main.unkin.net be_prowlarr'
-      - 'nzbget.main.unkin.net be_nzbget'
-      - 'jellyfin.main.unkin.net be_jellyfin'
-      - 'fafflix.unkin.net be_jellyfin'
-      - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
-      - 'dashboard.ceph.unkin.net be_ceph_dashboard'
-
-profiles::haproxy::frontends:
-  fe_http:
-    options:
-      use_backend:
-        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_http.map,be_default)]"
-  fe_https:
-    options:
-      acl:
-        - 'acl_ausyd1pve req.hdr(host) -i au-syd1-pve.main.unkin.net'
-        - 'acl_sonarr req.hdr(host) -i sonarr.main.unkin.net'
-        - 'acl_radarr req.hdr(host) -i radarr.main.unkin.net'
-        - 'acl_lidarr req.hdr(host) -i lidarr.main.unkin.net'
-        - 'acl_readarr req.hdr(host) -i readarr.main.unkin.net'
-        - 'acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net'
-        - 'acl_nzbget req.hdr(host) -i nzbget.main.unkin.net'
-        - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
-        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
-        - 'acl_gitea req.hdr(host) -i git.unkin.net'
-        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
-        - 'acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net'
-        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
-      use_backend:
-        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
-      http-request:
-        - 'deny if { hdr_dom(host) -i au-syd1-pve.main.unkin.net } !acl_internalsubnets'
-      http-response:
-        - 'set-header X-Frame-Options DENY if acl_ausyd1pve'
-        - 'set-header X-Frame-Options DENY if acl_sonarr'
-        - 'set-header X-Frame-Options DENY if acl_radarr'
-        - 'set-header X-Frame-Options DENY if acl_lidarr'
-        - 'set-header X-Frame-Options DENY if acl_readarr'
-        - 'set-header X-Frame-Options DENY if acl_prowlarr'
-        - 'set-header X-Frame-Options DENY if acl_nzbget'
-        - 'set-header X-Frame-Options DENY if acl_jellyfin'
-        - 'set-header X-Frame-Options DENY if acl_fafflix'
-        - 'set-header X-Frame-Options DENY if acl_gitea'
-        - 'set-header X-Frame-Options DENY if acl_grafana'
-        - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
-        - 'set-header X-Content-Type-Options nosniff'
-        - 'set-header X-XSS-Protection 1;mode=block'
-
-profiles::haproxy::backends:
-  be_ausyd1pve_web:
-    description: Backend for au-syd1 pve cluster (Web)
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_ausyd1pve_api:
-    description: Backend for au-syd1 pve cluster (API only)
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_sonarr:
-    description: Backend for au-syd1 sonarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_radarr:
-    description: Backend for au-syd1 radarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_lidarr:
-    description: Backend for au-syd1 lidarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_readarr:
-    description: Backend for au-syd1 readarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_prowlarr:
-    description: Backend for au-syd1 prowlarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_nzbget:
-    description: Backend for au-syd1 nzbget
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_jellyfin:
-    description: Backend for au-syd1 jellyfin
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_gitea:
-    description: Backend for gitea cluster
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-  be_grafana:
-    description: Backend for grafana nodes
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-  be_ceph_dashboard:
-    description: Backend for Ceph Dashboard from Mgr instances
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-check:
-        - expect status 200
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 9443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-
-profiles::haproxy::certlist::enabled: true
-profiles::haproxy::certlist::certificates:
-  - /etc/pki/tls/letsencrypt/au-syd1-pve.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/au-syd1-pve-api.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/sonarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/radarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/lidarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/readarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/prowlarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/vault/certificate.pem
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-  - jellyfin.main.unkin.net
-
-# additional cnames
-profiles::haproxy::dns::cnames:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-
-# letsencrypt certificates
-certbot::client::service: haproxy
-certbot::client::domains:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-  - fafflix.unkin.net
-  - git.unkin.net
-  - grafana.unkin.net
-  - dashboard.ceph.unkin.net
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.10
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.11
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.12
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.13
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.14
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.15
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.16
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.17
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.18
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.19
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.20
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.21
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.22
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.23
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.24
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,13 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.25
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+
+profiles::haproxy::dns::vrrp_master: true
+keepalived::vrrp_instance:
+  VI_250:
+    state: 'MASTER'
+    priority: 101
@@ -0,0 +1,12 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.26
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+
+keepalived::vrrp_instance:
+  VI_250:
+    state: 'BACKUP'
+    priority: 100
@@ -0,0 +1,11 @@
+---
+profiles::cobbler::params::is_cobbler_master: true
+networking::interfaces:
+  ens18:
+    ipaddress: 198.18.13.27
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+    interface: ens18
+
+profiles::almalinux::base::remove_ens18: false
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.28
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.29
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.30
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,10 @@
+---
+networking::interfaces:
+  ens18:
+    ipaddress: 198.18.13.31
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+    interface: ens18
+
+profiles::almalinux::base::remove_ens18: false
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.32
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.33
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.34
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.35
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.36
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.37
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.38
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.39
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.40
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.41
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.42
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.43
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.44
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.45
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -13,3 +13,9 @@ profiles::ssh::sign::principals:

 profiles::puppet::puppetca::is_puppetca: true
 profiles::puppet::puppetca::allow_subject_alt_names: true
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.46
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.47
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.47
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.48
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.49
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.50
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.50
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.51
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.51
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.52
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.52
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.53
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.53
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.54
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.55
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.56
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.57
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.57
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.58
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.58
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.59
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.60
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.61
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.62
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.63
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.64
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.65
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.66
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.67
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.68
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.69
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.70
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.71
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.72
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.73
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.74
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.74
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.64.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.75
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.75
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.65.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.76
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.76
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.66.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.77
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.77
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.67.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.78
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.78
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.68.254/24'
@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.79
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.79
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.69.254/24'
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.80
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.81
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.82
+networking::routes:
+  default:
+    gateway: 198.18.13.254
@@ -3,6 +3,7 @@ hiera_include:
  - frrouting

 # networking
+profiles::consul::server::anycast_ip: 198.18.19.14
 systemd::manage_networkd: true
 systemd::manage_all_network_files: true
 networking::interfaces:
@@ -10,9 +11,9 @@ networking::interfaces:
    type: physical
    forwarding: true
    dhcp: true
-  loopback0:
+  anycast0:
    type: dummy
-    ipaddress: "%{hiera('networking_loopback0_ip')}" # ceph public network
+    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
    netmask: 255.255.255.255
    mtu: 1500

@@ -23,27 +24,13 @@ frrouting::ospfd_redistribute:
 frrouting::ospfd_interfaces:
  eth0:
    area: 0.0.0.0
-  loopback0:
+  anycast0:
    area: 0.0.0.0
 frrouting::daemons:
  ospfd: true

 # additional repos
 profiles::yum::global::repos:
-  ceph:
-    name: ceph
-    descr: ceph repository
-    target: /etc/yum.repos.d/ceph.repo
-    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://download.ceph.com/keys/release.asc
-    mirrorlist: absent
-  ceph-noarch:
-    name: ceph-noarch
-    descr: ceph-noarch repository
-    target: /etc/yum.repos.d/ceph-noarch.repo
-    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
-    gpgkey: https://download.ceph.com/keys/release.asc
-    mirrorlist: absent
  frr-extras:
    name: frr-extras
    descr: frr-extras repository
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+profiles::consul::server::anycast_ip: 198.18.19.14
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+profiles::consul::server::anycast_ip: 198.18.19.14
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+profiles::consul::server::anycast_ip: 198.18.19.14
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+profiles::consul::server::anycast_ip: 198.18.19.14
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+dns_master_anycast_ip: 198.18.19.15
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('dns_master_anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+dns_master_anycast_ip: 198.18.19.15
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('dns_master_anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+dns_master_anycast_ip: 198.18.19.15
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('dns_master_anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+dns_resolver_anycast_ip: 198.18.19.16
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('dns_resolver_anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+dns_resolver_anycast_ip: 198.18.19.16
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('dns_resolver_anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -0,0 +1,47 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+dns_resolver_anycast_ip: 198.18.19.16
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  anycast0:
+    type: dummy
+    ipaddress: "%{hiera('dns_resolver_anycast_ip')}"
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  anycast0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -1,2 +0,0 @@
---
-profiles::cobbler::params::is_cobbler_master: true
@@ -0,0 +1,12 @@
+---
+profiles::puppet::server::dns_alt_names:
+  - puppetca.main.unkin.net
+  - puppetca.service.consul
+  - puppetca.query.consul
+  - puppetca
+
+profiles::puppet::puppetca::is_puppetca: false
+profiles::puppet::puppetca::allow_subject_alt_names: true
+
+hiera_exclude:
+  - networking
@@ -1,13 +1,5 @@
 ---
-networking_loopback0_ip: 198.18.19.1  # management loopback
-networking_loopback1_ip: 198.18.22.1  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.1  # ceph-public loopback
-networking_1000_ip: 198.18.15.1       # 1gbe network
-networking_2500_ip: 198.18.21.1       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:c3:60
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:50
+profiles::proxmox::params::pve_clusterinit_master: true
+profiles::proxmox::params::pve_ceph_mon: true
+profiles::proxmox::params::pve_ceph_mgr: true
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,4 @@
 ---
-networking_loopback0_ip: 198.18.19.2  # management loopback
-networking_loopback1_ip: 198.18.22.2  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.2  # ceph-public loopback
-networking_1000_ip: 198.18.15.2       # 1gbe network
-networking_2500_ip: 198.18.21.2       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:74:b6:08
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:08:43
+profiles::proxmox::params::pve_ceph_mon: true
+profiles::proxmox::params::pve_ceph_mgr: true
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,4 @@
 ---
-networking_loopback0_ip: 198.18.19.3  # management loopback
-networking_loopback1_ip: 198.18.22.3  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.3  # ceph-public loopback
-networking_1000_ip: 198.18.15.3       # 1gbe network
-networking_2500_ip: 198.18.21.3       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: b8:85:84:a3:25:c5
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:07:82
+profiles::proxmox::params::pve_ceph_mon: true
+profiles::proxmox::params::pve_ceph_mgr: true
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.4  # management loopback
-networking_loopback1_ip: 198.18.22.4  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.4  # ceph-public loopback
-networking_1000_ip: 198.18.15.4       # 1gbe network
-networking_2500_ip: 198.18.21.4       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:d5:00
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:43
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.5  # management loopback
-networking_loopback1_ip: 198.18.22.5  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.5  # ceph-public loopback
-networking_1000_ip: 198.18.15.5       # 1gbe network
-networking_2500_ip: 198.18.21.5       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: 54:bf:64:a0:08:64
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:e0:4c:68:07:79
+profiles::proxmox::params::pve_ceph_osd: true
@@ -1,13 +1,2 @@
 ---
-networking_loopback0_ip: 198.18.19.6  # management loopback
-networking_loopback1_ip: 198.18.22.6  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.6  # ceph-public loopback
-networking_1000_ip: 198.18.15.6       # 1gbe network
-networking_2500_ip: 198.18.21.6       # 2.5gbe network
-networking_1000_iface: enp2s0
-networking_2500_iface: enp3s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: d8:9e:f3:75:10:8d
-  "%{hiera('networking_2500_iface')}":
-    mac: 00:ac:d0:00:00:53
+profiles::proxmox::params::pve_ceph_osd: true
--- a/Show More
+++ b/Show More