fix: helm before rke2 managed manifests

- add fact to list namespaces - require namespace before adding additional config - renamed some files to better match what they are
2025-09-20 23:49:10 +10:00
161 changed files with 1591 additions and 3759 deletions
@@ -0,0 +1,24 @@
+name: Build
+
+on:
+  pull_request:
+
+jobs:
+  precommit:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Install requirements
+        run: |
+          dnf groupinstall -y "Development Tools" -y
+          dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
+
+      - name: Pre-Commit All Files
+        run: |
+          uvx pre-commit run --all-files
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: bolt-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/bolt-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: epp-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/epp-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: erb-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/erb-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: puppet-lint
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/puppet-lint.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: puppet-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/puppet-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 2
-          limits:
-            memory: 2Gi
-            cpu: 2
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: ruby-check
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/ruby-check.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: ruby-validate
-    image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
-    commands:
-      - uvx pre-commit run --all-files --config ci/ruby-validate.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -1,18 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: yamllint
-    image: git.unkin.net/unkin/almalinux9-base:20260606
-    commands:
-      - uvx pre-commit run --all-files --config ci/yamllint.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 1
@@ -19,7 +19,6 @@ mod 'puppetlabs-haproxy', '8.2.0'
 mod 'puppetlabs-java', '11.1.0'
 mod 'puppetlabs-reboot', '5.1.0'
 mod 'puppetlabs-docker', '10.2.0'
-mod 'puppetlabs-mailalias_core', '1.2.0'

 # puppet
 mod 'puppet-python', '7.4.0'
@@ -44,8 +43,6 @@ mod 'puppet-letsencrypt', '11.1.0'
 mod 'puppet-rundeck', '9.2.0'
 mod 'puppet-redis', '11.1.0'
 mod 'puppet-nodejs', '11.0.0'
-mod 'puppet-postfix', '5.1.0'
-mod 'puppet-alternatives', '6.0.0'

 # other
 mod 'saz-sudo', '9.0.2'
@@ -53,6 +50,7 @@ mod 'saz-ssh', '13.1.0'
 mod 'saz-limits', '5.0.0'
 mod 'ghoneycutt-timezone', '4.0.0'
 mod 'ghoneycutt-puppet', '3.3.0'
+mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
 mod 'broadinstitute-certs', '3.0.1'
@@ -62,8 +60,7 @@ mod 'rehan-mkdir', '2.0.0'
 mod 'tailoredautomation-patroni', '2.0.0'
 mod 'ssm-crypto_policies', '0.3.3'
 mod 'thias-sysctl', '1.0.8'
-mod 'cirrax-dovecot', '1.3.3'

 mod 'bind',
-  :git => 'https://git.unkin.net/unkinben/puppet-bind.git',
+  :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',
  :tag => '1.0'
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: bolt-validate
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: epp-validate
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: erb-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: puppet-lint
-        args:
-          - --no-80chars-check
-          - --no-documentation-check
-          - --no-puppet_url_without_modules-check
-          - --fail-on-warnings
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: puppet-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: ruby-validate
-  - repo: 'https://github.com/jumanjihouse/pre-commit-hooks'
-    rev: 3.0.0
-    hooks:
-      - id: reek
-      - id: rubocop
@@ -1,5 +0,0 @@
-repos:
-  - repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
-    rev: v2.2.0
-    hooks:
-      - id: ruby-validate
@@ -1,10 +0,0 @@
-repos:
-  - repo: 'https://github.com/adrienverge/yamllint'
-    rev: v1.32.0
-    hooks:
-      - id: 'yamllint'
-        args:
-          [
-            "-d {extends: relaxed, rules: {line-length: disable}, ignore: chart}",
-            "-s",
-          ]
@@ -28,98 +28,6 @@ Always refer back to the official documentation at https://docs.ceph.com/en/late
    sudo ceph fs set mediafs max_mds 2
 ```

-
-## managing cephfs with subvolumes
-
-Create erasure code profiles. The K and M values are equivalent to the number of data disks (K) and parity disks (M) in RAID5, RAID6, etc.
-
-    sudo ceph osd erasure-code-profile set ec_6_2 k=6 m=2
-    sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
-
-Create data pools using the erasure-code-profile, set some required options
-
-    sudo ceph osd pool create cephfs_data_ssd_ec_6_2 erasure ec_6_2
-    sudo ceph osd pool set cephfs_data_ssd_ec_6_2 allow_ec_overwrites true
-    sudo ceph osd pool set cephfs_data_ssd_ec_6_2 bulk true
-
-    sudo ceph osd pool create cephfs_data_ssd_ec_4_1 erasure ec_4_1
-    sudo ceph osd pool set cephfs_data_ssd_ec_4_1 allow_ec_overwrites true
-    sudo ceph osd pool set cephfs_data_ssd_ec_4_1 bulk true
-
-Add the pool to the fs `cephfs`
-
-    sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_6_2
-    sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_4_1
-
-Create a subvolumegroup using the new data pool
-
-    sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_6_2 --pool_layout cephfs_data_ssd_ec_6_2
-    sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_4_1 --pool_layout cephfs_data_ssd_ec_4_1
-
-All together:
-
-    sudo ceph osd erasure-code-profile set ec_6_2 k=6 m=2
-    sudo ceph osd pool create cephfs_data_ssd_ec_6_2 erasure ec_6_2
-    sudo ceph osd pool set cephfs_data_ssd_ec_6_2 allow_ec_overwrites true
-    sudo ceph osd pool set cephfs_data_ssd_ec_6_2 bulk true
-    sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_6_2
-    sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_6_2 --pool_layout cephfs_data_ssd_ec_6_2
-
-    sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
-    sudo ceph osd pool create cephfs_data_ssd_ec_4_1 erasure ec_4_1
-    sudo ceph osd pool set cephfs_data_ssd_ec_4_1 allow_ec_overwrites true
-    sudo ceph osd pool set cephfs_data_ssd_ec_4_1 bulk true
-    sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_4_1
-    sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_4_1 --pool_layout cephfs_data_ssd_ec_4_1
-
-Create a key with access to the new subvolume groups. Check if the user already exists first:
-
-    sudo ceph auth get client.kubernetes-cephfs
-
-If it doesnt:
-
-    sudo ceph auth get-or-create client.kubernetes-cephfs \
-      mgr 'allow rw' \
-      osd 'allow rw tag cephfs metadata=cephfs, allow rw tag cephfs data=cephfs' \
-      mds 'allow r fsname=cephfs path=/volumes, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_6_2, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_4_1' \
-      mon 'allow r fsname=cephfs'
-
-If it does, use `sudo ceph auth caps client.kubernetes-cephfs ...` instead to update existing capabilities.
-
-## removing a cephfs subvolumegroup from cephfs
-
-This will cleanup the subvolumegroup, and subvolumes if they exist, then remove the pool.
-
-Check for subvolumegroups first, then for subvolumes in it
-
-    sudo ceph fs subvolumegroup ls cephfs
-    sudo ceph fs subvolume ls cephfs --group_name csi_raid6
-
-
-If subvolumes exist, remove each one-by-one:
-
-    sudo ceph fs subvolume rm cephfs <subvol_name> --group_name csi_raid6
-
-If you have snapshots, remove snapshots first:
-
-    sudo ceph fs subvolume snapshot ls cephfs <subvol_name> --group_name csi_raid6
-    sudo ceph fs subvolume snapshot rm cephfs <subvol_name> <snap_name> --group_name csi_raid6
-
-Once the group is empty, remove it:
-
-    sudo ceph fs subvolumegroup rm cephfs csi_raid6
-
-If it complains it’s not empty, go back as there’s still a subvolume or snapshot.
-
-If you added it with `ceph fs add_data_pool`. Undo with `rm_data_pool`:
-
-    sudo ceph fs rm_data_pool cephfs cephfs_data_csi_raid6
-
-After it’s detached from CephFS, you can delete it.
-
-    sudo ceph osd pool rm cephfs_data_csi_raid6 cephfs_data_csi_raid6 --yes-i-really-really-mean-it
-
-
 ## creating authentication tokens

 - this will create a client keyring named media
@@ -150,78 +58,3 @@ this will overwrite the current capabilities of a given client.user
      mon 'allow r' \
      mds 'allow rw path=/' \
      osd 'allow rw pool=media_data'
-
-## adding a new osd on new node
-
-create the ceph conf (automate this?)
-
-    cat <<EOF | sudo tee /etc/ceph/ceph.conf
-    [global]
-      auth_client_required = cephx
-      auth_cluster_required = cephx
-      auth_service_required = cephx
-      fsid = de96a98f-3d23-465a-a899-86d3d67edab8
-      mon_allow_pool_delete = true
-      mon_initial_members = prodnxsr0009,prodnxsr0010,prodnxsr0011,prodnxsr0012,prodnxsr0013
-      mon_host = 198.18.23.9,198.18.23.10,198.18.23.11,198.18.23.12,198.18.23.13
-      ms_bind_ipv4 = true
-      ms_bind_ipv6 = false
-      osd_crush_chooseleaf_type = 1
-      osd_pool_default_min_size = 2
-      osd_pool_default_size = 3
-      osd_pool_default_pg_num = 128
-      public_network = 198.18.23.1/32,198.18.23.2/32,198.18.23.3/32,198.18.23.4/32,198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,198.18.23.13/32
-    EOF
-
-ssh to one of the monitor hosts, then transfer the keys required
-
-    sudo cat /etc/ceph/ceph.client.admin.keyring | ssh prodnxsr0003 'sudo tee /etc/ceph/ceph.client.admin.keyring'
-    sudo cat /var/lib/ceph/bootstrap-osd/ceph.keyring | ssh prodnxsr0003 'sudo tee /var/lib/ceph/bootstrap-osd/ceph.keyring'
-
-assuming we are adding /dev/sda to the cluster, first zap the disk to remove partitions/lvm/metadata
-
-    sudo ceph-volume lvm zap /dev/sda --destroy
-
-then add it to the cluster
-
-    sudo ceph-volume lvm create --data /dev/sda
-
-## removing an osd
-
-check what OSD IDs were on this host (if you know it)
-
-    sudo ceph osd tree
-
-or check for any DOWN osds
-
-    sudo ceph osd stat
-    sudo ceph health detail
-
-once you identify the old OSD ID, remove it with these steps, replace X with the actual OSD ID:
-
-    sudo ceph osd out osd.X
-    sudo ceph osd down osd.X
-    sudo ceph osd crush remove osd.X
-    sudo ceph auth del osd.X
-    sudo ceph osd rm osd.X
-
-
-## maintenance mode for the cluster
-
-from one node in the cluster disable recovery
-
-    sudo ceph osd set noout
-    sudo ceph osd set nobackfill
-    sudo ceph osd set norecover
-    sudo ceph osd set norebalance
-    sudo ceph osd set nodown
-    sudo ceph osd set pause
-
-to undo the change, use unset
-
-    sudo ceph osd unset noout
-    sudo ceph osd unset nobackfill
-    sudo ceph osd unset norecover
-    sudo ceph osd unset norebalance
-    sudo ceph osd unset nodown
-    sudo ceph osd unset pause
@@ -30,7 +30,6 @@ hierarchy:
      - "roles/%{::enc_role_tier1}.eyaml"
      - "roles/%{::enc_role_tier1}.yaml"
      - "virtual/%{facts.virtual}.yaml"
-      - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.%{facts.os.release.minor}.yaml"
      - "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"
      - "os/%{facts.os.name}/all_releases.yaml"
      - "common.eyaml"
@@ -1,6 +1,6 @@
 ---
 profiles::accounts::sysadmin::password: ENC[PKCS7,MIIBqQYJKoZIhvcNAQcDoIIBmjCCAZYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAoS7GyofFaXBNTWU+GtSiz4eCX/9j/sh3fDDRgOgNv1qpcQ87ZlTTenbHo9lxeURxKQ2HVVt7IsrBo/SC/WgipAKnliRkkIvo7nfAs+i+kEE8wakjAs0DcB4mhqtIZRuBkLG2Nay//DcG6cltVkbKEEKmKLMkDFZgTWreOZal8nDljpVe1S8QwtwP4/6hKTef5xsOnrisxuffWTXvwYJhj/VXrjdoH7EhtHGLybzEalglkVHEGft/WrrD/0bwJpmR0RegWI4HTsSvGiHgvf5DZJx8fXPZNPnicGtlfA9ccQPuVo17bY4Qf/WIc1A8Ssv4kHSbNIYJKRymI3UFb0Z4wzBsBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBBxDLb6pCGbittkcX6asd/gEBmMcUNupDjSECq5H09YA70eVwWWe0fBqxTxrr2cXCXtRKFvOk8SJmL0xHAWodaLN9+krTWHJcWbAK8JXEPC7rn]
-profiles::accounts::root::password: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAIgzGQLoHrm7JSnWG4vdAtxSuETmnqbV7kUsQS8WCRUwFGenDFkps+OGMnOGEHLzMJzXihLfgfdWwTAI4fp48M+zhTMo9TQkdzZqtbFk3+RjV2jDF0wfe4kVUIpReOq+EkaDSkoRSG8V6hWvszhDHUrJBC9eDhomL0f3xNAWxmy5EIX/uMEvg9Ux5YX+E6k2pEIKnHNoVIaWDojlofSIzIqTSS7l3jQtJhs3YqBzLL1DsoF1kdn+Rwl5kcsKkhV+vzl76wEbpYVZW8lu4bFfP6QHMLPcep2tuUDMCDvARRXD7YyZcAtS7aMuqll+BLAszpWxAA7EU2hgvdr6t2uyVCTCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ4D5oDoyE6LPdjpVtGPoJD4BwfnQ9ORjYFPvHQmt+lgU4jMqh6BhqP0VN3lqVfUpOmiVMIqkO/cYtlwVLKEg36TPCHBSpqvhuahSF5saCVr8JY3xWOAmTSgnNjQOPlGrPnYWYbuRLxVRsU+KUkpAzR0c6VN0wYi6bI85Pcv8yHF3UYA==]
+profiles::accounts::root::password: ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAM79PRxeAZHrDcSm4eSFqU94/LjuSbdUmJWivX/Pa8GumoW2e/PT9nGHW3p98zHthMgCglk52PECQ+TBKjxr+9dTyNK5ePG6ZJEqSHNRqsPGm+kfQj/hlTmq8vOBaFM5GapD1iTHs5JFbGngI56swKBEVXW9+Z37BjQb2xJuyLsu5Bo/tA0BaOKuCtjq1a6E38bOX+nJ+YF1uZgV9ofAEh1YvkcTmnEWYXFRPWd7AaNcWn03V2pfhGqxc+xydak620I47P+FE+qIY72+aQ6tmLU3X9vyA1HLF2Tv572l4a2i+YIk6nAgQdi+hQKznqNL9M9YV+s1AcmcKLT7cfLrjsjA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCMWrdCWBQgtW3NOEpERwP+gBA3KDiqe4pQq6DwRfsEXQNZ]
 profiles::consul::client::secret_id_salt: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAS7pNFRX4onccFaR87zB/eFFORuF22j6xqjyeAqqjgEduYhkt6w5kkz+YfUoHUesU0Q6F2p6HrCSZ8yAsx5M25NCiud9P4hIpjKmOZ4zCNO7uhATh4AQDYw3BrdRwfO+c6jOl5wOiNLCfDBJ0sFT3akCvcuPS1xIoRJq4Gyn+uCbOsMbvSl25ld2xKt1/cqs8gc1d8mkpjwWto7t+qZSUFMCehTbehH3G4a3Q5rvfBoNwv42Wbs676BDcCurDaAzHNqE7pDbOWhGuVOBl+q+BU0Ri/CRkGcTViN9fr8Dc9SveVC6EPsMbw+05/8/NlfzQse3KAwQ34nR9tR2PQw5qEzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB7LywscQtF7cG2nomfEsu9gDDVqJBFP1jAX2eGZ2crYS5gnBcsRwhc0HNo2/WWdhZprMW+vEJOOGXDelI53NxA3o0=]
 profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAO8IIF2r18dFf0bVKEwjJUe1TmXHH0AIzsQHxkHwV7d37kvH1cY9rYw0TtdHn7GTxvotJG7GZbWvbunpBs1g2p2RPADiM6TMhbO8mJ0tAWLnMk7bQ221xu8Pc7KceqWmU17dmgNhVCohyfwJNqbA756TlHVgxGA0LtNrKoLOmgKGXAL1VYZoKEQnWq7xOpO+z3e1UfjoO6CvX/Od2hGYfUkHdro8mwRw4GFKzU7XeKFdAMUGpn5rVmY3xe+1ARXwGFaSrTHzk2n85pvwhPRlQ+OwqzyT19Qo2FNeAO6RoCRIFTtqbsjTWPUlseHIhw4Q5bHO1I0Mrlm5IHDESw/22IzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCEe9wD72qxnpeq5nCi/d7BgDCP29sDFObkFTabt2uZ/nF9MT1g+QOrrdFKgnG6ThnwH1hwpZPsSVgIs+yRQH8laB4=]
 profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
@@ -129,9 +129,6 @@ lookup_options:
  profiles::ceph::client::keyrings:
    merge:
      strategy: deep
-  profiles::ceph::conf::config:
-    merge:
-      strategy: deep
  profiles::nginx::simpleproxy::locations:
    merge:
      strategy: deep
@@ -161,21 +158,6 @@ lookup_options:
  rke2::config_hash:
    merge:
      strategy: deep
-  postfix::configs:
-    merge:
-      strategy: deep
-  postfix::maps:
-    merge:
-      strategy: deep
-  postfix::virtuals:
-    merge:
-      strategy: deep
-  stalwart::postgresql_password:
-    convert_to: Sensitive
-  stalwart::s3_secret_key:
-    convert_to: Sensitive
-  stalwart::fallback_admin_password:
-    convert_to: Sensitive

 facts_path: '/opt/puppetlabs/facter/facts.d'

@@ -194,6 +176,9 @@ profiles::ntp::client::peers:
  - 2.au.pool.ntp.org
  - 3.au.pool.ntp.org

+profiles::base::puppet_servers:
+  - 'prodinf01n01.main.unkin.net'
+
 consul::install_method: 'package'
 consul::manage_repo: false
 consul::bin_dir: /usr/bin
@@ -407,49 +392,6 @@ profiles::ceph::conf::config:
      198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,
      198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,
      198.18.23.13/32
-  client.rgw.ausyd1nxvm2115:
-    rgw_realm: unkin
-    rgw_zonegroup: au
-    rgw_zone: syd1
-  client.rgw.ausyd1nxvm2116:
-    rgw_realm: unkin
-    rgw_zonegroup: au
-    rgw_zone: syd1
-  client.rgw.ausyd1nxvm2117:
-    rgw_realm: unkin
-    rgw_zonegroup: au
-    rgw_zone: syd1
-  client.rgw.ausyd1nxvm2118:
-    rgw_realm: unkin
-    rgw_zonegroup: au
-    rgw_zone: syd1
-  client.rgw.ausyd1nxvm2119:
-    rgw_realm: unkin
-    rgw_zonegroup: au
-    rgw_zone: syd1
-  mds:
-    keyring: /var/lib/ceph/mds/ceph-$id/keyring
-    mds_standby_replay: true
-  mds.prodnxsr0009-1:
-    host: prodnxsr0009
-  mds.prodnxsr0009-2:
-    host: prodnxsr0009
-  mds.prodnxsr0010-1:
-    host: prodnxsr0010
-  mds.prodnxsr0010-2:
-    host: prodnxsr0010
-  mds.prodnxsr0011-1:
-    host: prodnxsr0011
-  mds.prodnxsr0011-2:
-    host: prodnxsr0011
-  mds.prodnxsr0012-1:
-    host: prodnxsr0012
-  mds.prodnxsr0012-2:
-    host: prodnxsr0012
-  mds.prodnxsr0013-1:
-    host: prodnxsr0013
-  mds.prodnxsr0013-2:
-    host: prodnxsr0013

 #profiles::base::hosts::additional_hosts:
 #  - ip: 198.18.17.9
@@ -5,5 +5,3 @@ profiles_dns_upstream_forwarder_unkin:
  - 198.18.19.15
 profiles_dns_upstream_forwarder_consul:
  - 198.18.19.14
-profiles_dns_upstream_forwarder_k8s:
-  - 198.18.19.20
@@ -1,7 +1,4 @@
 ---
-haproxy_server_k8s_syd1_traefik_internal: 'k8s-traefik-internal 198.18.200.4:443 ssl verify none check inter 2s rise 3 fall 2'
-haproxy_server_k8s_syd1_traefik_external: 'k8s-traefik-external 198.18.199.0:443 ssl verify none check inter 2s rise 3 fall 2'
-
 profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
 profiles::haproxy::dns::vrrp_cnames:
  - sonarr.main.unkin.net
@@ -14,12 +11,6 @@ profiles::haproxy::dns::vrrp_cnames:
  - fafflix.unkin.net
  - grafana.unkin.net
  - dashboard.ceph.unkin.net
-  - mail-webadmin.main.unkin.net
-  - mail-in.main.unkin.net
-  - mail.main.unkin.net
-  - autoconfig.main.unkin.net
-  - autodiscover.main.unkin.net
-  - auth.unkin.net

 profiles::haproxy::mappings:
  fe_http:
@@ -38,10 +29,6 @@ profiles::haproxy::mappings:
      - 'git.unkin.net be_gitea'
      - 'grafana.unkin.net be_grafana'
      - 'dashboard.ceph.unkin.net be_ceph_dashboard'
-      - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
-      - 'autoconfig.main.unkin.net be_stalwart_webadmin'
-      - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
-      - 'auth.unkin.net be_k8s_kanidm'
  fe_https:
    ensure: present
    mappings:
@@ -58,10 +45,6 @@ profiles::haproxy::mappings:
      - 'git.unkin.net be_gitea'
      - 'grafana.unkin.net be_grafana'
      - 'dashboard.ceph.unkin.net be_ceph_dashboard'
-      - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
-      - 'autoconfig.main.unkin.net be_stalwart_webadmin'
-      - 'autodiscovery.main.unkin.net be_stalwart_webadmin'
-      - 'auth.unkin.net be_k8s_kanidm'

 profiles::haproxy::frontends:
  fe_http:
@@ -83,10 +66,6 @@ profiles::haproxy::frontends:
        - 'acl_gitea req.hdr(host) -i git.unkin.net'
        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
        - 'acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net'
-        - 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
-        - 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
-        - 'acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net'
-        - 'acl_kanidm req.hdr(host) -i auth.unkin.net'
        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
      use_backend:
        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -105,8 +84,6 @@ profiles::haproxy::frontends:
        - 'set-header X-Frame-Options DENY if acl_gitea'
        - 'set-header X-Frame-Options DENY if acl_grafana'
        - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
-        - 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
-        - 'set-header X-Frame-Options DENY if acl_kanidm'
        - 'set-header X-Content-Type-Options nosniff'
        - 'set-header X-XSS-Protection 1;mode=block'

@@ -309,103 +286,7 @@ profiles::haproxy::backends:
        - add-header X-Forwarded-Proto https if { dst_port 9443 }
      redirect: 'scheme https if !{ ssl_fc }'
      stick-table: 'type ip size 200k expire 30m'
-  be_stalwart_webadmin:
-    description: Backend for Stalwart Webadmin
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-check:
-        - expect status 200
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 9443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      stick-table: 'type ip size 200k expire 30m'
-  be_k8s_kanidm:
-    description: Backend for Kanidm (auth.unkin.net via Kubernetes internal Traefik)
-    collect_exported: false
-    options:
-      balance: roundrobin
-      option:
-        - httpchk
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      http-check:
-        - 'connect ssl sni auth.unkin.net'
-        - 'send meth GET uri /status ver HTTP/1.1 hdr Host auth.unkin.net'
-        - 'expect status 200'
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-      server: "%{lookup('haproxy_server_k8s_syd1_traefik_internal')} sni str(auth.unkin.net)"
-  be_stalwart_imap:
-    description: Backend for Stalwart IMAP (STARTTLS)
-    collect_exported: false
-    options:
-      mode: tcp
-      balance: roundrobin
-      option:
-        - tcp-check
-        - prefer-last-server
-      stick-table: 'type ip size 200k expire 30m'
      stick: 'on src'
-      tcp-check:
-        - connect port 143 send-proxy
-        - expect string "* OK"
-        - send "A001 STARTTLS\r\n"
-        - expect rstring "A001 (OK|2.0.0)"
-  be_stalwart_imaps:
-    description: Backend for Stalwart IMAPS (implicit TLS)
-    collect_exported: false
-    options:
-      mode: tcp
-      balance: roundrobin
-      option:
-        - tcp-check
-        - prefer-last-server
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-      tcp-check:
-        - connect ssl send-proxy
-        - expect string "* OK"
-  be_stalwart_smtp:
-    description: Backend for Stalwart SMTP
-    collect_exported: false
-    options:
-      mode: tcp
-      balance: roundrobin
-      option:
-        - tcp-check
-        - prefer-last-server
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-      tcp-check:
-        - connect port 25 send-proxy
-        - expect string "220 "
-  be_stalwart_submission:
-    description: Backend for Stalwart SMTP Submission
-    collect_exported: false
-    options:
-      mode: tcp
-      balance: roundrobin
-      option:
-        - tcp-check
-        - prefer-last-server
-      stick-table: 'type ip size 200k expire 30m'
-      stick: 'on src'
-      tcp-check:
-        - connect port 587 send-proxy
-        - expect string "220 "

 profiles::haproxy::certlist::enabled: true
 profiles::haproxy::certlist::certificates:
@@ -421,7 +302,6 @@ profiles::haproxy::certlist::certificates:
  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
  - /etc/pki/tls/vault/certificate.pem

 # additional altnames
@@ -429,7 +309,6 @@ profiles::pki::vault::alt_names:
  - au-syd1-pve.main.unkin.net
  - au-syd1-pve-api.main.unkin.net
  - jellyfin.main.unkin.net
-  - mail-webadmin.main.unkin.net

 # additional cnames
 profiles::haproxy::dns::cnames:
@@ -451,4 +330,3 @@ certbot::client::domains:
  - git.unkin.net
  - grafana.unkin.net
  - dashboard.ceph.unkin.net
-  - auth.unkin.net
@@ -1,10 +1,23 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
 crypto_policies::policy: 'DEFAULT'
-almalinux-base-repo: almalinux
+
 profiles::packages::include:
  network-scripts: {}

 profiles::yum::global::repos:
  powertools:
-    ensure: present
+    name: powertools
+    descr: powertools repository
+    target: /etc/yum.repos.d/powertools.repo
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el8
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent
@@ -1,2 +0,0 @@
---
-almalinux-base-repo: almalinux-vault
@@ -1,7 +1,36 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
 crypto_policies::policy: 'DEFAULT:SHA1'
-almalinux-base-repo: almalinux
+
 profiles::yum::global::repos:
+  baseos:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  extras:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  appstream:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  highavailability:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
  crb:
-    ensure: present
+    name: crb
+    descr: crb repository
+    target: /etc/yum.repos.d/crb.repo
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el9
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent
@@ -3,8 +3,7 @@
 profiles::firewall::firewalld::ensure_package: 'absent'
 profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
-profiles::puppet::agent::version: '7.37.2'
-profiles::puppet::agent::openvox_enable: true
+profiles::puppet::agent::puppet_version: '7.34.0'

 hiera_include:
  - profiles::almalinux::base
@@ -23,52 +22,43 @@ profiles::yum::global::repos:
    name: baseos
    descr: baseos repository
    target: /etc/yum.repos.d/baseos.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  extras:
    name: extras
    descr: extras repository
    target: /etc/yum.repos.d/extras.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  appstream:
    name: appstream
    descr: appstream repository
    target: /etc/yum.repos.d/appstream.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  highavailability:
    name: highavailability
    descr: highavailability repository
    target: /etc/yum.repos.d/highavailability.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
-  crb:
-    ensure: absent
-    name: crb
-    descr: crb repository
-    target: /etc/yum.repos.d/crb.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
-  powertools:
-    ensure: absent
-    name: powertools
-    descr: powertools repository
-    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
  epel:
    name: epel
    descr: epel repository
    target: /etc/yum.repos.d/epel.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
+    baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
+    mirrorlist: absent
+  puppet:
+    name: puppet
+    descr: puppet repository
+    target: /etc/yum.repos.d/puppet.repo
+    baseurl: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-puppet-20250406
    mirrorlist: absent
  unkinben:
    name: unkinben
@@ -78,193 +68,3 @@ profiles::yum::global::repos:
    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
    gpgcheck: false
    mirrorlist: absent
-
-  # Additional repositories - default to absent, roles can override with ensure: present
-  # FRRouting repositories
-  frr-extras:
-    ensure: absent
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/frr/el%{facts.os.release.major}/extras
-    gpgcheck: false
-    mirrorlist: absent
-  frr-stable:
-    ensure: absent
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/frr/el%{facts.os.release.major}/frr
-    gpgcheck: false
-    mirrorlist: absent
-
-  # PostgreSQL repositories
-  postgresql-15:
-    ensure: absent
-    name: postgresql-15
-    descr: postgresql-15 repository
-    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/15/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
-  postgresql-17:
-    ensure: absent
-    name: postgresql-17
-    descr: postgresql-17 repository
-    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/17/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
-  postgresql-common:
-    ensure: absent
-    name: postgresql-common
-    descr: postgresql-common repository
-    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/common/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
-
-  # Ceph repositories
-  ceph:
-    ensure: absent
-    name: ceph
-    descr: ceph repository
-    target: /etc/yum.repos.d/ceph.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/ceph-reef/el%{facts.os.release.major}/%{facts.os.architecture}
-    gpgcheck: false
-    mirrorlist: absent
-  ceph-noarch:
-    ensure: absent
-    name: ceph-noarch
-    descr: ceph noarch repository
-    target: /etc/yum.repos.d/ceph.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/ceph-reef/el%{facts.os.release.major}/noarch
-    gpgcheck: false
-    mirrorlist: absent
-
-  # Rancher RKE2 repositories
-  rancher-rke2-common-latest:
-    ensure: absent
-    name: rancher-rke2-common
-    descr: rancher-rke2-common repository
-    target: /etc/yum.repos.d/rancher-rke2-common.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/rke2/latest/common/centos/%{facts.os.release.major}/noarch
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/public.key
-    gpgcheck: 1
-    mirrorlist: absent
-  rancher-rke2-1-33-latest:
-    ensure: absent
-    name: rancher-rke2-1.33-latest
-    descr: rancher-rke2-1.33-latest repository
-    target: /etc/yum.repos.d/rancher-rke2.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/rke2/latest/1.33/centos/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/public.key
-    gpgcheck: 1
-    mirrorlist: absent
-
-  # CentOS repositories for legacy systems
-  centos_8_advanced_virtualization:
-    ensure: absent
-    name: centos_8_advanced_virtualization
-    descr: centos_8_advanced_virtualization repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/virt/x86_64/advanced-virtualization
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Virtualization
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_ceph_pacific:
-    ensure: absent
-    name: centos_8_ceph_pacific
-    descr: centos_8_ceph_pacific repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/storage/x86_64/ceph-pacific
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Storage
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_rabbitmq_38:
-    ensure: absent
-    name: centos_8_rabbitmq_38
-    descr: centos_8_rabbitmq_38 repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/messaging/x86_64/rabbitmq-38
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Messaging
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_nfv_openvswitch:
-    ensure: absent
-    name: centos_8_nfv_openvswitch
-    descr: centos_8_nfv_openvswitch repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/nfv/x86_64/openvswitch-2
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-NFV
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_openstack_xena:
-    ensure: absent
-    name: centos_8_openstack_xena
-    descr: centos_8_openstack_xena repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/cloud/x86_64/openstack-xena
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Cloud
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_opstools:
-    ensure: absent
-    name: centos_8_opstools
-    descr: centos_8_opstools repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/opstools/x86_64/collectd-5
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-OpsTools
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_ovirt45:
-    ensure: absent
-    name: centos_8_ovirt45
-    descr: centos_8_ovirt45 repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8/virt/x86_64/ovirt-45
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Virtualization
-    gpgcheck: 1
-    mirrorlist: absent
-  centos_8_stream_gluster10:
-    ensure: absent
-    name: centos_8_stream_gluster10
-    descr: centos_8_stream_gluster10 repository
-    target: /etc/yum.repos.d/centos.repo
-    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
-    gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Storage
-    gpgcheck: 1
-    mirrorlist: absent
-
-  # Additional repositories
-  zfs-kmod:
-    ensure: absent
-    name: zfs-kmod
-    descr: zfs-kmod repository
-    target: /etc/yum.repos.d/zfs.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/zfs/epel/%{facts.os.release.major}/kmod/%{facts.os.architecture}/
-    gpgcheck: false
-    mirrorlist: absent
-  rpmfusion-free:
-    ensure: absent
-    name: rpmfusion-free
-    descr: rpmfusion-free repository
-    target: /etc/yum.repos.d/rpmfusion-free.repo
-    baseurl: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/
-    gpgkey: https://packagerepo.service.consul/rpmfusion-free-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
-    gpgcheck: 1
-    mirrorlist: absent
-  rpmfusion-nonfree:
-    ensure: absent
-    name: rpmfusion-nonfree
-    descr: rpmfusion-nonfree repository
-    target: /etc/yum.repos.d/rpmfusion-nonfree.repo
-    baseurl: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/
-    gpgkey: https://packagerepo.service.consul/rpmfusion-nonfree-el%{facts.os.release.major}-%{facts.os.architecture}/repodata/repomd.xml.key
-    gpgcheck: 1
-    mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el%{facts.os.release.major}
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent
@@ -11,4 +11,4 @@ profiles::apt::components:
  - main
  - non-free

-profiles::puppet::agent::version: '7.25.0-1bullseye'
+profiles::puppet::agent::puppet_version: '7.25.0-1bullseye'
@@ -12,4 +12,4 @@ profiles::apt::components:
  - non-free
  - non-free-firmware

-profiles::puppet::agent::version: 'latest'
+profiles::puppet::agent::puppet_version: 'latest'
@@ -3,8 +3,13 @@ hiera_include:
  - profiles::nginx::simpleproxy

 profiles::yum::global::repos:
-  ceph:
-    ensure: present
+  ceph-reef:
+    name: ceph-reef
+    descr: ceph reef repository
+    target: /etc/yum.repos.d/ceph-reef.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgcheck: 0,
+    mirrorlist: absent

 profiles::ceph::client::keyrings:
  media:
@@ -54,8 +54,24 @@ profiles::consul::client::node_rules:

 profiles::yum::global::repos:
  rpmfusion-free:
-    ensure: present
+    name: rpmfusion-free
+    descr: rpmfusion-free repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    mirrorlist: absent
  rpmfusion-nonfree:
-    ensure: present
+    name: rpmfusion-nonfree
+    descr: rpmfusion-nonfree repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    mirrorlist: absent
  unkinben:
-    ensure: present
+    name: unkinben
+    descr: unkinben repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el8
+    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent
@@ -72,6 +72,16 @@ profiles::consul::client::node_rules:

 profiles::yum::global::repos:
  rpmfusion-free:
-    ensure: present
+    name: rpmfusion-free
+    descr: rpmfusion-free repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    mirrorlist: absent
  rpmfusion-nonfree:
-    ensure: present
+    name: rpmfusion-nonfree
+    descr: rpmfusion-nonfree repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    mirrorlist: absent
@@ -31,10 +31,30 @@ frrouting::daemons:
 # additional repos
 profiles::yum::global::repos:
  ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -66,9 +66,6 @@ glauth::users:
      - 20025   # jupyterhub_admin
      - 20026   # jupyterhub_user
      - 20027   # grafana_user
-      - 20028   # k8s/au/syd1 operator
-      - 20029   # k8s/au/syd1 admin
-      - 20030   # k8s/au/syd1 root
    loginshell: '/bin/bash'
    homedir: '/home/benvin'
    passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
@@ -226,24 +223,6 @@ glauth::users:
    loginshell: '/bin/bash'
    homedir: '/home/debvin'
    passsha256: 'cdac05ddb02e665d4ea65a974995f38a10236bc158731d92d78f6cde89b294a1'
-  jassol:
-    user_name: 'jassol'
-    givenname: 'Jason'
-    sn: 'Solomon'
-    mail: 'jassol@users.main.unkin.net'
-    uidnumber: 20010
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-      - 20027 # grafana user
-    loginshell: '/bin/bash'
-    homedir: '/home/jassol'
-    passsha256: 'd8e215d3c94b954e1318c9c7243ce72713f2fb1d006037724fe857c1fb7e88e9'

 glauth::services:
  svc_jellyfin:
@@ -388,12 +367,3 @@ glauth::groups:
  grafana_user:
    group_name: 'grafana_user'
    gidnumber: 20027
-  kubernetes_au_syd1_cluster_operator:
-    group_name: 'kubernetes_au_syd1_cluster_operator'
-    gidnumber: 20028
-  kubernetes_au_syd1_cluster_admin:
-    group_name: 'kubernetes_au_syd1_cluster_admin'
-    gidnumber: 20029
-  kubernetes_au_syd1_cluster_root:
-    group_name: 'kubernetes_au_syd1_cluster_root'
-    gidnumber: 20030
@@ -18,9 +18,19 @@ profiles::pki::vault::alt_names:
 # additional repos
 profiles::yum::global::repos:
  ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent

 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
@@ -28,7 +38,7 @@ profiles::nginx::simpleproxy::nginx_aliases:
  - radosgw.service.au-syd1.consul
 profiles::nginx::simpleproxy::proxy_port: 7480
 profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 5000M
+nginx::client_max_body_size: 100M

 # manage consul service
 consul::services:
@@ -57,9 +57,19 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent

 # cobbler settings
 profiles::cobbler::params::service_cname: 'cobbler.main.unkin.net'
@@ -41,9 +41,19 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent

 profiles::dhcp::server::ntpservers:
  - 0.au.pool.ntp.org
@@ -1,2 +0,0 @@
---
-externaldns::externaldns_key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEABqbZiK1NDTU+w2k7orz2HrB0EXwun7hn4pR6TeCHMp2IfrkPxlQT+f1J9c0PqJaAKvnyz+Cx0xNCrlnONqk+J57f48kYKYV+Vw+L0AYHYFj8/TizY5CwLpJS2XKyfRd4iEsWMonvfIYn71t3+YuXm4dkoEqGekW93qCr/KFtjAu0K3e+ypyl4EJqWokiUs7IbcSBNvrjUkP4yR8F/wHVKM1E5yfr+D1+nmMmt7Ob/J+am14492TppE2C7Xadg4us+kdYtuBsv9kTSi1GwwqUDjbeJVmfK3pKHjXdF+PI07AFLzo5bBZTJOzQfQ4SywpH8R5BDQoUCyHiaskB5wrmSDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB2LU9ZhefSg9PqqkwnfV65gDBvXuXco0moKCGjHqm5KcojWCK1BoS/+mltlr8kw9grZjN9jxHRLn1FjgBlq418c8w=]
@@ -1,55 +0,0 @@
---
-hiera_include:
-  - externaldns
-  - frrouting
-  - exporters::frr_exporter
-
-externaldns::bind_master_hostname: 'ausyd1nxvm2127.main.unkin.net'
-externaldns::k8s_zones:
-  - 'k8s.syd1.au.unkin.net'
-  - '200.18.198.in-addr.arpa'
-externaldns::slave_servers:
-  - 'ausyd1nxvm2128.main.unkin.net'
-  - 'ausyd1nxvm2129.main.unkin.net'
-externaldns::externaldns_key_algorithm: 'hmac-sha256'
-
-# networking
-anycast_ip: 198.18.19.20
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-exporters::frr_exporter::enable: true
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# consul
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: frr_exporter
-    disposition: write
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    ensure: present
-  frr-stable:
-    ensure: present
@@ -200,6 +200,16 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -6,10 +6,8 @@ hiera_include:
 profiles::dns::resolver::acls:
  acl-main.unkin.net:
    addresses:
-      - 198.18.1.10/32
-      - 198.18.2.160/27
+      - 10.10.8.1/32
      - 198.18.21.160/27
-      - 198.18.2.192/27
      - 198.18.21.192/27
      - 198.18.13.0/24
      - 198.18.14.0/24
@@ -84,11 +82,6 @@ profiles::dns::resolver::zones:
      - 10.10.16.32
      - 10.10.16.33
    forward: 'only'
-  k8s.syd1.au.unkin.net-forward:
-    domain: 'k8s.syd1.au.unkin.net'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_k8s')}"
-    forward: 'only'
  unkin.net-forward:
    domain: 'unkin.net'
    zone_type: 'forward'
@@ -179,11 +172,6 @@ profiles::dns::resolver::zones:
    zone_type: 'forward'
    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
    forward: 'only'
-  200.18.198.in-addr.arpa-forward:
-    domain: '200.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_k8s')}"
-    forward: 'only'
  consul-forward:
    domain: 'consul'
    zone_type: 'forward'
@@ -200,7 +188,6 @@ profiles::dns::resolver::views:
      - network.unkin.net-forward
      - prod.unkin.net-forward
      - consul-forward
-      - k8s.syd1.au.unkin.net-forward
      - 13.18.198.in-addr.arpa-forward
      - 14.18.198.in-addr.arpa-forward
      - 15.18.198.in-addr.arpa-forward
@@ -263,6 +250,16 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -2,15 +2,14 @@
 hiera_include:
  - docker
  - profiles::gitea::runner
-  - incus::client

 docker::version: latest
 docker::curl_ensure: false
 docker::root_dir: /data/docker

-profiles::gitea::runner::instance: https://git.unkin.net
 profiles::gitea::runner::home: /data/runner
-profiles::gitea::runner::version: '0.2.12'
+profiles::gitea::runner::version: '0.2.10'
+profiles::gitea::runner::source: "https://gitea.com/gitea/act_runner/releases/download/v%{hiera('profiles::gitea::runner::version')}/act_runner-%{hiera('profiles::gitea::runner::version')}-linux-amd64"
 profiles::gitea::runner::config:
  log:
    level: info
@@ -40,8 +39,7 @@ profiles::gitea::runner::config:
    privileged: false
    options:
    workdir_parent: /workspace
-    valid_volumes:
-      - /etc/pki/tls/vault
+    valid_volumes: []
    docker_host: ""
    force_pull: true
    force_rebuild: false
@@ -71,7 +71,7 @@ profiles::nginx::simpleproxy::nginx_aliases:

 profiles::nginx::simpleproxy::proxy_port: 3000
 profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 5144M
+nginx::client_max_body_size: 1024M

 # enable external access via haproxy
 profiles::gitea::haproxy::enable: true
@@ -82,14 +82,8 @@ profiles::sql::postgresdb::dbname: gitea
 profiles::sql::postgresdb::dbuser: gitea

 # deploy gitea
-gitea::base_url: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/gitea'
-gitea::install::checksums:
-  1.26.2:
-    linux:
-      amd64: 5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a
-
-gitea::ensure: '1.26.2'
-gitea::checksum: '5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a'
+gitea::ensure: '1.22.4'
+gitea::checksum: 'd549104f55067e6fb156e7ba060c9af488f36e12d5e747db7563fcc99eaf8532'
 gitea::manage_user: false
 gitea::manage_group: false
 gitea::manage_home: false
@@ -35,9 +35,19 @@ frrouting::daemons:
 # additional repos
 profiles::yum::global::repos:
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent

 # haproxy metrics
 consul::services:
@@ -153,50 +163,6 @@ profiles::haproxy::frontends:
        - 'set-header X-Forwarded-Proto https'
        - 'set-header X-Real-IP %[src]'
        - 'use-service prometheus-exporter if { path /metrics }'
-  fe_imap:
-    description: 'Frontend for Stalwart IMAP (STARTTLS)'
-    bind:
-      0.0.0.0:143: []
-    mode: 'tcp'
-    options:
-      log: global
-      default_backend: be_stalwart_imap
-      tcp-request:
-        - inspect-delay 5s
-        - content accept if { req_len 0 }
-  fe_imaps:
-    description: 'Frontend for Stalwart IMAPS (implicit TLS)'
-    bind:
-      0.0.0.0:993: []
-    mode: 'tcp'
-    options:
-      log: global
-      default_backend: be_stalwart_imaps
-      tcp-request:
-        - inspect-delay 5s
-        - content accept if { req_len 0 }
-  fe_smtp:
-    description: 'Frontend for Stalwart SMTP'
-    bind:
-      0.0.0.0:25: []
-    mode: 'tcp'
-    options:
-      log: global
-      default_backend: be_stalwart_smtp
-      tcp-request:
-        - inspect-delay 5s
-        - content accept if { req_len 0 }
-  fe_submission:
-    description: 'Frontend for Stalwart SMTP Submission'
-    bind:
-      0.0.0.0:587: []
-    mode: 'tcp'
-    options:
-      log: global
-      default_backend: be_stalwart_submission
-      tcp-request:
-        - inspect-delay 5s
-        - content accept if { req_len 0 }

 profiles::haproxy::backends:
  be_letsencrypt:
@@ -5,10 +5,6 @@ hiera_include:
  - incus
  - zfs
  - profiles::ceph::node
-  - profiles::ceph::mon
-  - profiles::ceph::mgr
-  - profiles::ceph::mds
-  - profiles::ceph::osd
  - profiles::ceph::client
  - profiles::ceph::dashboard
  - profiles::storage::cephfsvols
@@ -89,21 +85,46 @@ profiles::consul::client::node_rules:
 # additional repos
 profiles::yum::global::repos:
  ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  zfs-kmod:
-    ensure: present
+    name: zfs-kmod
+    descr: zfs-kmod repository
+    target: /etc/yum.repos.d/zfs-kmod.repo
+    baseurl: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-openzfs-2022
+    mirrorlist: absent

 # dns
 profiles::dns::base::primary_interface: loopback0

 # dashboard/haproxy
-profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback2_ip')}"
+profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback0_ip')}"

 # networking
 systemd::manage_networkd: true
@@ -1 +1 @@
-rke2::node_token: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAOD+w5nJFqEYWFj+tZQ65Oi19eDhaWtpLQ0gwEdBtMmY9sPJ63l1q2qH933NH6TOd1UlMDvGfoDLCae+yt/MAW//cJ15X3QbiVQ23DdfCOlUEZN6fjVrveEt/yIeFQmWvnkMS4pRfPbgQu2OHm37PpuPE7s6dUyGItAYjchrRhtQ7ibhXDnN7miG+oVRXP2T8b/V5WPdmA222DSV6r/AnqaWkna9W/oh/I2sNKeEm5q3f8bh8Gxt1dDy3VwaZ3lAh3uR+SUm7P/6PTYw8opxiumFBvos0mRiXIdOwUuqrAS8hafWBhxnDLlTBfz62Nc4wQmQ8gz0bHJZSipH9G6mIEDCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ2WG6ROWFlQdXx0TuO5oABoBwTDtAXIj7y6I1B3zCnFoMHETf5d7ulPGdgwZsENf0UIHpg2l0w503MUHHbu6YDFiDiTE0oDNJPVHid7TO+XwWFgh5v1MWi/XeEBgCs6nMCW8qkX0Z3UXaZdSBUll1M4sRtuqscBnoD/LLs2kKfxrqQg==]
+rke2::node_token: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAVPo7WjzlJQQhxefhV1bu1/+Jo/LY3gMmVGicDnDloGQd1jbdDtNz9wi6Hqqht1xQPdn22XmvvrVXtPhsdjDCGqWxmfZ0qWQVl1Ju2WIh5WsyyZgdE96k2+y7Cg5Dl0brX2m9YSZfow5BF8J8EnCDdRZncOCtFl/SU8ipPEq2uJJR+Y9sJv6aJflnFLCEYgJNbZY9ljMcs5ssJ21VpIqWYA0Z6vKVqOUeIWWKbYZUIoEml7sj3ktmw3loMYA6ED0/nzyYvRVizTvtGXl3IWGVDSt8rQ/kNhzKqURVOsgwfbt7un4n2Kxkreiydj3R6PbLdkpHdtu25dbjue8HLQkc4zCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQMmIatr2oBei35+evghIkLIBwWT6F1WPDV3PA/QYNusfYcI1KrMRYFlDYyEkg/Tf+0gOpty9rdnYL+MQO2fTU9Br+INTr1oJcxJp/Lqap2+NibmBfZcLUIMn3q1S/jZp9BGQTk6RSwODqQ2x5GxDATinrtiUR4TXIIaiaP3KWlP8A7g==]
@@ -2,7 +2,6 @@
 hiera_include:
  - profiles::selinux::setenforce
  - profiles::ceph::node
-  - profiles::ceph::osd
  - profiles::ceph::client
  - exporters::frr_exporter
  - frrouting
@@ -11,62 +10,6 @@ hiera_include:
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345
-rke2::manage_registries: true
-rke2::registries:
-  docker.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "dockerhub/$1"
-    disable-default-registry-endpoint: true
-  ghcr.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "ghcr/$1"
-    disable-default-registry-endpoint: true
-  quay.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "quay/$1"
-    disable-default-registry-endpoint: true
-  registry.k8s.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "k8s-registry/$1"
-    disable-default-registry-endpoint: true
-  registry.gitlab.com:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "gitlab/$1"
-    disable-default-registry-endpoint: true
-  docker.elastic.co:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "elastic/$1"
-    disable-default-registry-endpoint: true
-  gcr.io:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "gcr/$1"
-    disable-default-registry-endpoint: true
-  docker.litellm.ai:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "litellm/$1"
-    disable-default-registry-endpoint: true
-  public.ecr.aws:
-    endpoint:
-      - "https://artifactapi.k8s.syd1.au.unkin.net"
-    rewrite:
-      "^(.*)$": "ecr-public/$1"
-    disable-default-registry-endpoint: true
 rke2::config_hash:
  bind-address: "%{hiera('networking_loopback0_ip')}"
  node-ip: "%{hiera('networking_loopback0_ip')}"
@@ -104,17 +47,47 @@ profiles::ceph::client::mons:
 # additional repos
 profiles::yum::global::repos:
  ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  rancher-rke2-common-latest:
-    ensure: present
+    name: rancher-rke2-common-latest
+    descr: rancher-rke2-common-latest
+    target: /etc/yum.repos.d/rke2-common.repo
+    baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/
+    gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/public.key
+    mirrorlist: absent
  rancher-rke2-1-33-latest:
-    ensure: present
+    name: rancher-rke2-1-33-latest
+    descr: rancher-rke2-1-33-latest
+    target: /etc/yum.repos.d/rke2-1-33.repo
+    baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/
+    gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/public.key
+    mirrorlist: absent

 # dns
 profiles::dns::base::primary_interface: loopback0
@@ -182,17 +155,6 @@ frrouting::ospf_exclude_k8s_enable: true
 frrouting::k8s_cluster_cidr: '10.42.0.0/16'  # RKE2 cluster-cidr (pods)
 frrouting::k8s_service_cidr: '10.43.0.0/16'  # RKE2 service-cidr

-# sysctl recommendations
-sysctl::base::values:
-  net.ipv4.conf.default.rp_filter:
-    value: '0'
-  net.ipv4.conf.all.rp_filter:
-    value: '0'
-  fs.inotify.max_user_watches:
-    value: '524288'
-  fs.inotify.max_user_instances:
-    value: '512'
-
 # add loopback interfaces to ssh list
 ssh::server::options:
  ListenAddress:
@@ -1 +1,2 @@
 ---
+rke2::csi_ceph_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEApQ371O4nGSrFB5tOZFTSJP+kJj3wJyEcWiNfonYA5LmbaMnQ6pUortec1519WHMICpSWdpq3O8frivm2CK3taYoKczeTzbsFTxvVp7s6gIZJUsCeqGHuq81YyjPtJE+Yy5IOBJjhe/8ECkEFNr0JlhwKBPWfTx5hHOzRdkGlN464weGFQtCI8UgdGe7AWEePG+u3e4RL+xCriw5tfuqMeeo+isDwVf30nK9NxsnmliOd/+jNW+GrtzycHAeokQOKnxfgrKll5Y5+npy5WueuSCEw1E+Io0NI/4Jthi7zu24UQu0KT8iRsqhuD5mr1ymvCNREnvCcVWt8VVRTGXQV+TBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDS8VXZM3wEAFRALB/Fa19dgDCTRYhU8YY4g9zREP7epY9x2MRWaTT84Jx9w5Dc/XWaRrmL4yL2sK+QHSy2057jHzo=]
@@ -3,14 +3,35 @@
 rke2::node_type: server
 rke2::helm_install: true
 rke2::helm_repos:
+  rancher-stable: https://releases.rancher.com/server-charts/stable
+  purelb: https://gitlab.com/api/v4/projects/20400619/packages/helm/stable
+  jetstack: https://charts.jetstack.io
  harbor: https://helm.goharbor.io
  traefik: https://traefik.github.io/charts
  hashicorp: https://helm.releases.hashicorp.com
+rke2::csi_ceph_enable: true
+rke2::csi_ceph_clusterid: de96a98f-3d23-465a-a899-86d3d67edab8
+rke2::csi_ceph_poolname: kubernetes
+rke2::csi_ceph_monitors:
+  - 198.18.23.9:6789
+  - 198.18.23.10:6789
+  - 198.18.23.11:6789
+  - 198.18.23.12:6789
+  - 198.18.23.13:6789
+rke2::csi_ceph_files:
+  - ceph-csi-nodeplugin-rbac
+  - ceph-csi-provisioner-rbac
+  - ceph-csi-rbdplugin-provisioner
+  - ceph-csi-rbdplugin
+rke2::csi_ceph_templates:
+  - ceph-csi-config
+  - ceph-csi-secret
 rke2::extra_config_files:
  - rke2-canal-config
-  - rke2-nginx-ingress-config
+  - service-loadbalancer-nginx
 rke2::config_hash:
  advertise-address: "%{hiera('networking_loopback0_ip')}"
+  cluster-domain: "svc.k8s.unkin.net"
  tls-san:
    - "join-k8s.service.consul"
    - "api-k8s.service.consul"
@@ -55,12 +76,6 @@ consul::services:
        tcp: "%{hiera('networking_loopback0_ip')}:9345"
        interval: '10s'
        timeout: '1s'
-      - id: 'rke2_server_ping_check'
-        name: 'rke2 Server Ping Check'
-        http: "https://%{hiera('networking_loopback0_ip')}:9345/ping"
-        interval: '10s'
-        timeout: '3s'
-        tls_skip_verify: true
 profiles::consul::client::node_rules:
  - resource: service
    segment: api-k8s
@@ -47,17 +47,47 @@ profiles::ceph::client::mons:
 # additional repos
 profiles::yum::global::repos:
  ceph:
-    ensure: present
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  ceph-noarch:
-    ensure: present
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  rancher-rke2-common-latest:
-    ensure: present
+    name: rancher-rke2-common-latest
+    descr: rancher-rke2-common-latest
+    target: /etc/yum.repos.d/rke2-common.repo
+    baseurl: https://rpm.rancher.io/rke2/latest/common/centos/%{facts.os.release.major}/noarch
+    gpgkey: https://rpm.rancher.io/public.key
+    mirrorlist: absent
  rancher-rke2-1-33-latest:
-    ensure: present
+    name: rancher-rke2-1-33-latest
+    descr: rancher-rke2-1-33-latest
+    target: /etc/yum.repos.d/rke2-1-33.repo
+    baseurl: https://rpm.rancher.io/rke2/latest/1.33/centos/%{facts.os.release.major}/x86_64
+    gpgkey: https://rpm.rancher.io/public.key
+    mirrorlist: absent

 # dns
 profiles::dns::base::primary_interface: loopback0
@@ -14,8 +14,6 @@ victorialogs::node::options:
  envflag.enable: 'true'
  select.disable: 'undef'
  storageNode.tls: 'undef'
-  syslog.listenAddr.tcp: ':21514'
-  syslog.timezone: 'Australia/Sydney'
  storageNode:
    - ausyd1nxvm2108.main.unkin.net:9428
    - ausyd1nxvm2109.main.unkin.net:9428
@@ -47,20 +45,7 @@ consul::services:
        tls_skip_verify: true
        interval: '10s'
        timeout: '1s'
-  syslog:
-    service_name: 'syslog'
-    address: "%{facts.networking.ip}"
-    port: 21514
-    checks:
-      - id: 'vlinsert_syslog_tcp_check'
-        name: 'VictoriaLogs Syslog TCP Check'
-        tcp: "%{facts.networking.fqdn}:21514"
-        interval: '30s'
-        timeout: '5s'
 profiles::consul::client::node_rules:
  - resource: service
    segment: vlinsert
    disposition: write
-  - resource: service
-    segment: syslog
-    disposition: write
@@ -1,5 +0,0 @@
---
-profiles::sql::postgresdb::dbpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEZkKX2ThGom2PffofEuRBHbyiq68PCsq0+19eSa02fpVPKgZ/5BEjzBhwvrt0BWZWsjYGhccFQ69DR+lTuqS50GcRSAiNQ2LDX2a3J1pu39oIKsNVmcJTza0f5T0VeI3A7sZkn7jL+NVz5ANp8V0EMfAjaduGQ7Jac+8dBsvTrLbJ+1AZVrjaKPxOI1+5tpE7qx35mM0oDVy0NwmlaVf8vbK6jyzyUJRs4Sb+mpioPi5sDxHgClzsQnu93HqqAIqR5UzsUv7MDMljOGYUF5ITyPU836I1LEZ9UfiVO7AikQ3A31LaSUWvwsxRHKxiQXJ7v6W/O+Nt3jdIR0eoqC5xTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC11+SUDLmz6bBrGyfYT9DPgDB3UhuhJ3kUruMTdRCW0Y6hoSBBQYCO+ZRFJToGTkz/BcxVw2Xtwjc7UmKmLodsDAo=]
-stalwart::s3_access_key: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAm1fkuVcAt4UKFnpljH0o3eb3x1r2ieEU4NUzuSx8DDdOv4rh8rkqghPGn1xs6LGd9zLprc9ZWFowXCP4I2L0gZ4PekI04rV4lL02xYechIah1JAntdwECEks7rmI4BbPabIUIkaHW4i/WtntRNvv38g9JjiWrvOoJSABEsiIVZL0ct6NykLgQk27r4rcP8j7ukNQqPCAA02d4y9CB/5g6RKtYkv6FwZfLA/rFTUIXhKJsNtTa9Gm1yhvb/Y859X4qvsSFymCm/B8+2Bz5H57lE0r6xOBBBS5PfpeQ2YRxmedlkj0HxRFpl2e1W94OazMbbI6dlXa5ceHqHXDZL78EzBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDhiBSQPgE+fwD1Y9Gc1wQ3gCCGeGdA4BKCvIhYaQmzv9wUFuNaO75qHrub0vY8Od1ilQ==]
-stalwart::s3_secret_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAdFOGR2axfPIksXExnW8vAZBSBm8V/QqPtIMtuzleDLOGsOuyLgJAbHPZJoj/w5bBV9bBKMGfWs94GGbKZ2PafiJeCtqfFJnUAIpVBTZ5cfUhQXERAHcketMvKUi1J8jKLSFc9I3uTjIVcIasjk0oe7WmCPnoikjl1qJZ/lVDH0cXHevjMuohxEyyka5jzC0ixCOkxyqOV2LOqSc6J5d0WSsSWqw0lDmY7vJAtqNtH6y6ghKZo5zdLQOsF2Bseg3oVejRNqYwfUsaDnfiRwJS/Rm/TmtXb4i6Jn8coYplDaJHtxQSXJ+KvOy6LS7M8X5sQ/UZSRqcwM647Yg4pwVWqDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBKBF7hTs0e0FKdRpFYbx4kgDB0xkNe78n6VLbUTHX7vTw6J+K/mxf+XCV95/EIkvBbWBYuU8ZMHNQKMEExmci4C4o=]
-stalwart::fallback_admin_password: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAMp9wmIhRwj5kxfUcvc+/q/oUs/vBhSqP19ZfErM4vLDK20VOBTnPhSP2lfVh9pqO0c2hpWFeuqBWMynghO+HUBJfAn29Vrc8a9iSBxQ3XuF/uiRq1inOKCQpdsU18TyCrYV9AJFNf9U20JuUoav79m7EKLHS07PHAZ0osqIYy93eXdCFhwXAGHijp4wMMQz/5z1F1mZoSrc1cXe3y8iBeAvvjnRfpw14gOKZBjmEGUbo7AIyc3wax5hbOQYf/v+Hd90JarvAufxGytg9WKO20cChWYbmYDnIkytVt3vHdHf4RT8M635l6qwLr/70O1MdE7bkrVRKP8M3KLyH072pJTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDSJwptBDvPd0WpxiIovZsjgDBBwesNW+UNo4b0idhyqsyWL2rtO7wLStWHgUIvRFJACCrTKKqlu7sta6mhu/ZsnF0=]
@@ -1,46 +0,0 @@
---
-hiera_include:
-  - stalwart
-  - profiles::sql::postgresdb
-  - profiles::stalwart::haproxy
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - mail.main.unkin.net
-  - mail-webadmin.main.unkin.net
-  - main-in.main.unkin.net
-  - autoconfig.main.unkin.net
-  - autodiscovery.main.unkin.net
-
-# manage a pgsql database + user
-profiles::sql::postgresdb::cluster_name: "patroni-shared-%{facts.environment}"
-profiles::sql::postgresdb::dbname: stalwart
-profiles::sql::postgresdb::dbuser: stalwart
-
-# export backends to haproxy
-profiles::stalwart::haproxy::enable: true
-
-# Cluster role for node discovery
-stalwart::cluster_role: "%{facts.enc_role}"
-
-# PostgreSQL connection
-stalwart::postgresql_host: "master.%{hiera('profiles::sql::postgresdb::cluster_name')}.service.%{facts.country}-%{facts.region}.consul"
-stalwart::postgresql_database: "%{hiera('profiles::sql::postgresdb::dbname')}"
-stalwart::postgresql_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
-stalwart::postgresql_password: "%{hiera('profiles::sql::postgresdb::dbpass')}"
-
-# S3/Ceph-RGW connection
-stalwart::s3_endpoint: 'https://radosgw.service.consul'
-stalwart::s3_bucket: 'stalwart-maildata'
-stalwart::s3_region: "%{facts.region}"
-
-# Domains and relay
-stalwart::domains:
-  - 'mail.unkin.net'
-stalwart::postfix_relay_host: 'out-mta.main.unkin.net'
-stalwart::service_hostname: 'mail.main.unkin.net'
-stalwart::manage_dns_records: false
-
-## With load balancer:
-#stalwart::manage_dns_records: true
-#stalwart::loadbalancer_host: 'mail-lb.example.com'
@@ -1,52 +0,0 @@
---
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - in-mta.main.unkin.net
-
-# base postfix configuration (passed to postfix class)
-postfix::relayhost: 'direct'
-postfix::myorigin: 'main.unkin.net'
-postfix::mydestination: 'blank'
-postfix::mynetworks: '127.0.0.0/8 [::1]/128'
-postfix::mta: true
-postfix::manage_aliases: true
-
-# profile parameters for customization
-profiles::postfix::gateway::myhostname: 'in-mta.main.unkin.net'
-
-# postfix map content (templates)
-profiles::postfix::gateway::relay_recipients_maps:
-  '@main.unkin.net': 'OK'
-
-profiles::postfix::gateway::relay_domains_maps:
-  'main.unkin.net': 'OK'
-
-profiles::postfix::gateway::postscreen_access_maps:
-  '127.0.0.1/32': 'permit'
-  '10.10.12.200/32': 'permit'
-
-profiles::postfix::gateway::helo_access_maps:
-  '.dynamic.': 'REJECT'
-  '.dialup.': 'REJECT'
-  'unknown': 'REJECT'
-  'localhost': 'REJECT You are not localhost'
-
-# postfix transports
-postfix::transports:
-  'main.unkin.net':
-    ensure: present
-    destination: 'relay'
-    nexthop: 'mail-in.main.unkin.net:25'
-
-# postfix virtuals
-postfix::virtuals:
-  'root':
-    ensure: present
-    destination: 'ben@main.unkin.net'
-  'postmaster':
-    ensure: present
-    destination: 'ben@main.unkin.net'
-  'abuse':
-    ensure: present
-    destination: 'ben@main.unkin.net'
@@ -11,7 +11,6 @@ profiles::metrics::grafana::db_name: "%{hiera('profiles::sql::postgresdb::dbname
 profiles::metrics::grafana::db_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
 profiles::metrics::grafana::db_pass: "%{hiera('profiles::sql::postgresdb::dbpass')}"
 profiles::metrics::grafana::pgsql_backend: true
-profiles::metrics::grafana::version: '13.0.2'
 profiles::metrics::grafana::plugins:
  victoriametrics-logs-datasource:
    ensure: present
@@ -3,16 +3,6 @@ hiera_include:
  - vmcluster::vmagent

 vmcluster::vmagent::enable: true
-vmcluster::vmagent::static_targets:
-  vyos_node:
-    targets:
-      - '198.18.21.160:9100'
-    scrape_interval: '15s'
-    metrics_path: '/metrics'
-    scheme: 'http'
-    labels:
-      instance: 'syrtvm0001.main.unkin.net'
-      job: 'vyos_node'
 vmcluster::vmagent::options:
  tls: 'true'
  tlsCertFile: '/etc/pki/tls/vault/certificate.crt'
@@ -24,8 +24,13 @@ frrouting::ospfd_interfaces:
    area: 0.0.0.1

 profiles::yum::global::repos:
-  ceph:
-    ensure: present
+  ceph-reef:
+    name: ceph-reef
+    descr: ceph reef repository
+    target: /etc/yum.repos.d/ceph-reef.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgcheck: 0,
+    mirrorlist: absent

 profiles::ceph::client::keyrings:
  nomad:
@@ -1,18 +1,50 @@
 ---
 profiles::yum::global::repos:
  centos_8_advanced_virtualization:
-    ensure: present
+    name: 'virt-advanced-virtualization'
+    descr: 'CentOS Advanced Virtualization'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/advancedvirt-common
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
  centos_8_ceph_pacific:
-    ensure: present
+    name: 'storage-ceph-pacific'
+    descr: 'CentOS Ceph Pacific'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/ceph-pacific
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
  centos_8_rabbitmq_38:
-    ensure: present
+    name: 'messaging-rabbitmq-38'
+    descr: 'CentOS RabbitMQ 38'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/messaging/x86_64/rabbitmq-38
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
  centos_8_nfv_openvswitch:
-    ensure: present
+    name: 'nfv-openvswitch-2'
+    descr: 'CentOS NFV OpenvSwitch'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/nfv/x86_64/openvswitch-2
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
  centos_8_openstack_xena:
-    ensure: present
+    name: 'cloud-openstack-xena'
+    descr: 'CentOS OpenStack Xena'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/cloud/x86_64/openstack-xena
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
  centos_8_opstools:
-    ensure: present
+    name: 'opstools-collectd-5'
+    descr: 'CentOS OpsTools - collectd'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/opstools/x86_64/collectd-5
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
  centos_8_ovirt45:
-    ensure: present
+    name: 'virt-ovirt-45'
+    descr: 'CentOS oVirt 4.5'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/ovirt-45
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
  centos_8_stream_gluster10:
-    ensure: present
+    name: 'storage-gluster-10'
+    descr: 'CentOS oVirt 4.5 - Glusterfs 10'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
@@ -9,18 +9,50 @@ sudo::purge_ignore:

 profiles::yum::global::repos:
  centos_8_advanced_virtualization:
-    ensure: present
+    name: 'virt-advanced-virtualization'
+    descr: 'CentOS Advanced Virtualization'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/advancedvirt-common
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
  centos_8_ceph_pacific:
-    ensure: present
+    name: 'storage-ceph-pacific'
+    descr: 'CentOS Ceph Pacific'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/ceph-pacific
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
  centos_8_rabbitmq_38:
-    ensure: present
+    name: 'messaging-rabbitmq-38'
+    descr: 'CentOS RabbitMQ 38'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/messaging/x86_64/rabbitmq-38
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
  centos_8_nfv_openvswitch:
-    ensure: present
+    name: 'nfv-openvswitch-2'
+    descr: 'CentOS NFV OpenvSwitch'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/nfv/x86_64/openvswitch-2
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
  centos_8_openstack_xena:
-    ensure: present
+    name: 'cloud-openstack-xena'
+    descr: 'CentOS OpenStack Xena'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/cloud/x86_64/openstack-xena
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
  centos_8_opstools:
-    ensure: present
+    name: 'opstools-collectd-5'
+    descr: 'CentOS OpsTools - collectd'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/opstools/x86_64/collectd-5
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
  centos_8_ovirt45:
-    ensure: present
+    name: 'virt-ovirt-45'
+    descr: 'CentOS oVirt 4.5'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/ovirt-45
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
  centos_8_stream_gluster10:
-    ensure: present
+    name: 'storage-gluster-10'
+    descr: 'CentOS oVirt 4.5 - Glusterfs 10'
+    target: /etc/yum.repos.d/ovirt.repo
+    baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
@@ -16,4 +16,3 @@ certbot::domains:
  - git.unkin.net
  - grafana.unkin.net
  - dashboard.ceph.unkin.net
-  - auth.unkin.net
@@ -1,3 +1,3 @@
 ---
 profiles::packages::include:
-  openvox-server: {}
+  puppetserver: {}
@@ -26,7 +26,7 @@ profiles::puppet::cobbler_enc::packages:
  - 'requests'
  - 'PyYAML'
 profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
-profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
+profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkin/puppet-r10k.git
 profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
 profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
 profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
@@ -62,6 +62,14 @@ profiles::consul::client::node_rules:

 profiles::yum::global::repos:
  postgresql-17:
-    ensure: present
+    name: postgresql-17
+    descr: postgresql-17 repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
  postgresql-common:
-    ensure: present
+    name: postgresql-common
+    descr: postgresql-common repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
@@ -3,6 +3,90 @@ profiles::packages::include:
  createrepo: {}

 profiles::reposync::repos_list:
+  almalinux_9.6_baseos:
+    repository: 'baseos'
+    description: 'AlmaLinux 9.6 BaseOS'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/baseos'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_appstream:
+    repository: 'appstream'
+    description: 'AlmaLinux 9.6 AppStream'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/appstream'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_crb:
+    repository: 'crb'
+    description: 'AlmaLinux 9.6 CRB'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/crb'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_ha:
+    repository: 'ha'
+    description: 'AlmaLinux 9.6 HighAvailability'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/highavailability'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9.6_extras:
+    repository: 'extras'
+    description: 'AlmaLinux 9.6 extras'
+    osname: 'almalinux'
+    release: '9.6'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/extras'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_baseos:
+    repository: 'baseos'
+    description: 'AlmaLinux 9.5 BaseOS'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/baseos'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_appstream:
+    repository: 'appstream'
+    description: 'AlmaLinux 9.5 AppStream'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/appstream'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_crb:
+    repository: 'crb'
+    description: 'AlmaLinux 9.5 CRB'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/crb'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_ha:
+    repository: 'ha'
+    description: 'AlmaLinux 9.5 HighAvailability'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/highavailability'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  almalinux_9_5_extras:
+    repository: 'extras'
+    description: 'AlmaLinux 9.5 extras'
+    osname: 'almalinux'
+    release: '9.5'
+    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/extras'
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
+  epel_8:
+    repository: 'everything'
+    description: 'EPEL8'
+    osname: 'epel'
+    release: '8'
+    mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-8&arch=x86_64'
+    gpgkey: 'https://epel.mirror.digitalpacific.com.au/RPM-GPG-KEY-EPEL-8'
+  epel_9:
+    repository: 'everything'
+    description: 'EPEL9'
+    osname: 'epel'
+    release: '9'
+    mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-9&arch=x86_64'
+    gpgkey: 'https://epel.mirror.digitalpacific.com.au/RPM-GPG-KEY-EPEL-9'
  docker_stable_el8:
    repository: 'stable'
    description: 'Docker CE Stable EL8'
@@ -17,6 +101,34 @@ profiles::reposync::repos_list:
    release: 'el9'
    baseurl: 'https://download.docker.com/linux/centos/9/x86_64/stable/'
    gpgkey: 'https://download.docker.com/linux/centos/gpg'
+  frr_stable_el8:
+    repository: 'stable'
+    description: 'FRR Stable EL8'
+    osname: 'frr'
+    release: 'el8'
+    baseurl: 'https://rpm.frrouting.org/repo/el8/frr/'
+    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
+  frr_extras_el8:
+    repository: 'extras'
+    description: 'FRR Extras EL8'
+    osname: 'frr'
+    release: 'el8'
+    baseurl: 'https://rpm.frrouting.org/repo/el8/extras/'
+    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
+  frr_stable_el9:
+    repository: 'stable'
+    description: 'FRR Stable EL9'
+    osname: 'frr'
+    release: 'el9'
+    baseurl: 'https://rpm.frrouting.org/repo/el9/frr/'
+    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
+  frr_extras_el9:
+    repository: 'extras'
+    description: 'FRR Extras el9'
+    osname: 'frr'
+    release: 'el9'
+    baseurl: 'https://rpm.frrouting.org/repo/el9/extras/'
+    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
  k8s_1.32:
    repository: '1.32'
    description: 'Kubernetes 1.32'
@@ -31,6 +143,62 @@ profiles::reposync::repos_list:
    release: '1.33'
    baseurl: 'https://pkgs.k8s.io/core:/stable:/v1.33/rpm/'
    gpgkey: 'https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key'
+  mariadb_11_8_el8:
+    repository: 'el8'
+    description: 'MariaDB 11.8'
+    osname: 'mariadb'
+    release: '11.8'
+    baseurl: 'http://mariadb.mirror.digitalpacific.com.au/yum/11.8/rhel8-amd64/'
+    gpgkey: 'https://mariadb.mirror.digitalpacific.com.au/yum/RPM-GPG-KEY-MariaDB'
+  mariadb_11_8_el9:
+    repository: 'el9'
+    description: 'MariaDB 11.8'
+    osname: 'mariadb'
+    release: '11.8'
+    baseurl: 'http://mariadb.mirror.digitalpacific.com.au/yum/11.8/rhel9-amd64/'
+    gpgkey: 'https://mariadb.mirror.digitalpacific.com.au/yum/RPM-GPG-KEY-MariaDB'
+  openvox7_el8:
+    repository: '8'
+    description: 'openvox 7 EL8'
+    osname: 'openvox7'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox7/el/8/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox7_el9:
+    repository: '9'
+    description: 'openvox 7 EL9'
+    osname: 'openvox7'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox7/el/9/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox7_el10:
+    repository: '10'
+    description: 'openvox 7 EL10'
+    osname: 'openvox7'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox7/el/10/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox8_el8:
+    repository: '8'
+    description: 'openvox 8 EL8'
+    osname: 'openvox8'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox8/el/8/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox8_el9:
+    repository: '9'
+    description: 'openvox 8 EL9'
+    osname: 'openvox8'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox8/el/9/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
+  openvox8_el10:
+    repository: '10'
+    description: 'openvox 8 EL10'
+    osname: 'openvox8'
+    release: 'el'
+    baseurl: 'https://yum.voxpupuli.org/openvox8/el/10/x86_64/'
+    gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
  puppet7_el8:
    repository: '8'
    description: 'Puppet 7 EL8'
@@ -59,6 +227,76 @@ profiles::reposync::repos_list:
    release: 'el'
    baseurl: 'https://yum.puppet.com/puppet8/el/9/x86_64/'
    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
+  postgresql_rhel8_common:
+    repository: 'common'
+    description: 'PostgreSQL Common RHEL 8'
+    osname: 'postgresql'
+    release: 'rhel8'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-8-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel9_common:
+    repository: 'common'
+    description: 'PostgreSQL Common RHEL 9'
+    osname: 'postgresql'
+    release: 'rhel9'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-9-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel8_15:
+    repository: '15'
+    description: 'PostgreSQL 15 RHEL 8'
+    osname: 'postgresql'
+    release: 'rhel8'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/15/redhat/rhel-8-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel9_15:
+    repository: '15'
+    description: 'PostgreSQL 15 RHEL 9'
+    osname: 'postgresql'
+    release: 'rhel9'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/15/redhat/rhel-9-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel8_16:
+    repository: '16'
+    description: 'PostgreSQL 16 RHEL 8'
+    osname: 'postgresql'
+    release: 'rhel8'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel9_16:
+    repository: '16'
+    description: 'PostgreSQL 16 RHEL 9'
+    osname: 'postgresql'
+    release: 'rhel9'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-9-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel8_17:
+    repository: '17'
+    description: 'PostgreSQL 17 RHEL 8'
+    osname: 'postgresql'
+    release: 'rhel8'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-8-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  postgresql_rhel9_17:
+    repository: '17'
+    description: 'PostgreSQL 17 RHEL 9'
+    osname: 'postgresql'
+    release: 'rhel9'
+    baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-9-x86_64/'
+    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
+  rke2_common_el9:
+    repository: 'common'
+    description: 'RKE2 common RHEL 9'
+    osname: 'rke2'
+    release: "rhel9"
+    baseurl: "https://rpm.rancher.io/rke2/latest/common/centos/9/noarch"
+    gpgkey: "https://rpm.rancher.io/public.key"
+  rke2_1_33_el9:
+    repository: '1.33'
+    description: 'RKE2 1.33 RHEL 9'
+    osname: 'rke2'
+    release: "rhel9"
+    baseurl: "https://rpm.rancher.io/rke2/latest/1.33/centos/9/x86_64"
+    gpgkey: "https://rpm.rancher.io/public.key"
  zfs_dkms_rhel8:
    repository: 'dkms'
    description: 'ZFS DKMS RHEL 8'
@@ -1,9 +1,17 @@
 ---
 profiles::yum::global::repos:
  postgresql-15:
-    ensure: present
+    name: postgresql-15
+    descr: postgresql-15 repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
  postgresql-common:
-    ensure: present
+    name: postgresql-common
+    descr: postgresql-common repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL

 profiles::sql::patroni::cluster_name: "patroni-%{facts.environment}"
 profiles::sql::patroni::postgres_exporter_enabled: true
@@ -47,6 +47,14 @@ profiles::consul::client::node_rules:

 profiles::yum::global::repos:
  postgresql-17:
-    ensure: present
+    name: postgresql-17
+    descr: postgresql-17 repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
  postgresql-common:
-    ensure: present
+    name: postgresql-common
+    descr: postgresql-common repository
+    target: /etc/yum.repos.d/postgresql.repo
+    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
@@ -29,7 +29,6 @@ profiles::consul::server::acl:
 profiles::pki::vault::alt_names:
  - consul.main.unkin.net
  - consul.service.consul
-  - "consul.service.%{facts.country}-%{facts.region}.consul"
  - consul

 # manage a simple nginx reverse proxy
@@ -39,7 +38,6 @@ profiles::nginx::simpleproxy::nginx_aliases:
  - consul.main.unkin.net
 profiles::nginx::simpleproxy::proxy_port: 8500
 profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 512M

 # consul
 profiles::consul::client::node_rules:
@@ -136,9 +134,19 @@ frrouting::ospfd_interfaces:
 frrouting::daemons:
  ospfd: true

-# additional repos - enable needed repositories
+# additional repos
 profiles::yum::global::repos:
  frr-extras:
-    ensure: present
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
  frr-stable:
-    ensure: present
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
@@ -2,12 +2,9 @@
 profiles::vault::server::members_role: roles::infra::storage::vault
 profiles::vault::server::members_lookup: true
 profiles::vault::server::data_dir: /data/vault
-profiles::vault::server::plugin_dir: /opt/openbao-plugins
 profiles::vault::server::manage_storage_dir: true
 profiles::vault::server::tls_disable: false
-profiles::vault::server::package_name: openbao
-profiles::vault::server::package_ensure: 2.4.4
-profiles::vault::server::disable_openbao: false
+vault::download_url: http://repos.main.unkin.net/unkin/8/x86_64/os/Archives/vault_1.15.5_linux_amd64.zip

 # additional altnames
 profiles::pki::vault::alt_names:
@@ -25,6 +22,3 @@ profiles::nginx::simpleproxy::proxy_scheme: 'http'
 profiles::nginx::simpleproxy::proxy_host: '127.0.0.1'
 profiles::nginx::simpleproxy::proxy_port: 8200
 profiles::nginx::simpleproxy::proxy_path: '/'
-
-profiles::packages::include:
-  openbao-plugins: {}
@@ -1,15 +0,0 @@
-# ExternalDNS BIND module - automatically configures master or slave
-class externaldns (
-  Stdlib::Fqdn $bind_master_hostname,
-  Array[Stdlib::Fqdn] $k8s_zones = [],
-  Array[Stdlib::Fqdn] $slave_servers = [],
-  String $externaldns_key_secret = '',
-  String $externaldns_key_algorithm = 'hmac-sha256',
-) {
-
-  if $trusted['certname'] == $bind_master_hostname {
-    include externaldns::master
-  } else {
-    include externaldns::slave
-  }
-}
@@ -1,45 +0,0 @@
-# ExternalDNS BIND master server class
-class externaldns::master inherits externaldns {
-
-  include bind
-
-  # Query PuppetDB for slave server IP addresses
-  $slave_ips = $externaldns::slave_servers.map |$fqdn| {
-    puppetdb_query("inventory[facts.networking.ip] { certname = '${fqdn}' }")[0]['facts.networking.ip']
-  }.filter |$ip| { $ip != undef }
-
-  # Create TSIG key for ExternalDNS authentication
-  bind::key { 'externaldns-key':
-    algorithm => $externaldns::externaldns_key_algorithm,
-    secret    => $externaldns::externaldns_key_secret,
-  }
-
-  # Create ACL for slave servers
-  if !empty($slave_ips) {
-    bind::acl { 'dns-slaves':
-      addresses => $slave_ips,
-    }
-  }
-
-  # Create master zones for each Kubernetes domain
-  $externaldns::k8s_zones.each |$zone| {
-    bind::zone { $zone:
-      zone_type       => 'master',
-      dynamic         => true,
-      allow_updates   => ['key externaldns-key'],
-      allow_transfers => empty($slave_ips) ? {
-        true  => ['key externaldns-key'],
-        false => ['key externaldns-key','dns-slaves'],
-      },
-      ns_notify       => !empty($slave_ips),
-      also_notify     => $slave_ips,
-      dnssec          => false,
-    }
-  }
-
-  # Create default view to include the zones
-  bind::view { 'externaldns':
-    recursion => false,
-    zones     => $externaldns::k8s_zones,
-  }
-}
@@ -1,36 +0,0 @@
-# ExternalDNS BIND slave server class
-class externaldns::slave inherits externaldns {
-
-  include bind
-
-  # Query PuppetDB for master server IP address
-  $query = "inventory[facts.networking.ip] { certname = '${externaldns::bind_master_hostname}' }"
-  $master_ip = puppetdb_query($query)[0]['facts.networking.ip']
-
-  # Create TSIG key for zone transfers (same as master)
-  bind::key { 'externaldns-key':
-    algorithm => $externaldns::externaldns_key_algorithm,
-    secret    => $externaldns::externaldns_key_secret,
-  }
-
-  # Create ACL for master server
-  bind::acl { 'dns-master':
-    addresses => [$master_ip],
-  }
-
-  # Create slave zones for each Kubernetes domain
-  $externaldns::k8s_zones.each |$zone| {
-    bind::zone { $zone:
-      zone_type    => 'slave',
-      masters      => [$master_ip],
-      allow_notify => ['dns-master'],
-      ns_notify    => false,
-    }
-  }
-
-  # Create default view to include the zones
-  bind::view { 'externaldns':
-    recursion => false,
-    zones     => $externaldns::k8s_zones,
-  }
-}
@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-
-# lib/facter/incus_trust_list.rb
-require 'json'
-
-Facter.add(:incus_trust_list) do
-  confine do
-    # Only run on systems that have incus installed and running
-    incus_path = Facter::Util::Resolution.which('incus')
-    incus_path && File.exist?('/var/lib/incus/server.key')
-  end
-
-  setcode do
-    incus_path = Facter::Util::Resolution.which('incus')
-    next {} unless incus_path
-
-    begin
-      # Run incus config trust list --format=json
-      trust_output = Facter::Core::Execution.execute("#{incus_path} config trust list --format=json")
-      next {} if trust_output.empty?
-
-      # Parse the JSON output
-      JSON.parse(trust_output)
-    rescue StandardError
-      {}
-    end
-  end
-end
@@ -1,16 +0,0 @@
-# incus::client
-#
-# This class configures a host as an incus client and exports its certificate
-# for automatic trust management on incus servers.
-#
-class incus::client {
-
-  # Export this client's certificate for collection by incus servers
-  @@incus::client_cert { $facts['networking']['fqdn']:
-    hostname    => $facts['networking']['fqdn'],
-    certificate => $facts['vault_cert_content'],
-    fingerprint => $facts['vault_cert_fingerprint'],
-    tag         => 'incus_client',
-  }
-
-}
@@ -1,41 +0,0 @@
-# Define the exported resource type for incus client certificates
-define incus::client_cert (
-  String $hostname,
-  Optional[String] $certificate = undef,
-  Optional[String] $fingerprint = undef,
-) {
-
-  # Only proceed if we have both certificate and fingerprint
-  if $certificate and $fingerprint {
-
-    $trust_list = $facts['incus_trust_list']
-    $existing_client = $trust_list.filter |$client| { $client['name'] == $hostname }
-
-    if $existing_client.empty {
-      # Add new certificate
-      exec { "incus_trust_add_${hostname}":
-        path    => ['/bin', '/usr/bin'],
-        command => "echo '${certificate}' > /tmp/${hostname}.crt && \
-                    incus config trust add-certificate /tmp/${hostname}.crt --name ${hostname} && \
-                    rm -f /tmp/${hostname}.crt",
-        unless  => "incus config trust list --format=json | grep '\"name\":\"${hostname}\"'",
-      }
-    } else {
-      # Check if fingerprints are different
-      $existing_fingerprint = $existing_client[0]['fingerprint']
-
-      if $existing_fingerprint != $fingerprint {
-        # Remove existing and add new certificate only if fingerprints differ
-        exec { "incus_trust_update_${hostname}":
-          path    => ['/bin', '/usr/bin'],
-          command => "incus config trust remove ${existing_fingerprint} && \
-                      echo '${certificate}' > /tmp/${hostname}.crt && \
-                      incus config trust add-certificate /tmp/${hostname}.crt --name ${hostname} && \
-                      rm -f /tmp/${hostname}.crt",
-          onlyif  => "incus config trust list --format=json | grep '${existing_fingerprint}'",
-        }
-      }
-      # If fingerprints match, do nothing (certificate is already correct)
-    }
-  }
-}
@@ -22,12 +22,7 @@ class incus::cluster (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -21,10 +21,6 @@ class incus (
    enable     => true,
    hasstatus  => true,
    hasrestart => true,
-    subscribe  => [
-      File['/var/lib/incus/server.crt'],
-      File['/var/lib/incus/server.key'],
-    ],
  }

  file_line { 'subuid_root':
@@ -59,22 +55,6 @@ class incus (
    }
  }

-  file { '/var/lib/incus/server.crt':
-    ensure => file,
-    source => '/etc/pki/tls/vault/certificate.crt',
-    owner  => 'root',
-    group  => 'root',
-    mode   => '0644',
-  }
-
-  file { '/var/lib/incus/server.key':
-    ensure => file,
-    source => '/etc/pki/tls/vault/private.key',
-    owner  => 'root',
-    group  => 'root',
-    mode   => '0600',
-  }
-
  if $facts['incus'] and $facts['incus']['config'] {
    # set core.https_address
    if $facts['incus']['config']['core.https_address'] != "${server_addr}:${server_port}" {
@@ -92,10 +72,5 @@ class incus (
        }
      }
    }
-
-    # Collect exported client certificates and manage trust
-    Incus::Client_cert <<| tag == 'incus_client' |>> {
-      require => Service['incus'],
-    }
  }
 }
@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-
-require 'facter'
-
-# Detects active ceph service instances via systemctl and exposes facts
-# for use in ceph service management profiles.
-# rubocop:disable Style/ClassAndModuleChildren
-module Unkin
-  module Ceph
-    # Detects active ceph service instances via systemctl and exposes Facter facts.
-    module Utils
-      TYPES = %w[mon mgr mds osd].freeze
-
-      def self.services
-        output = Facter::Core::Execution.execute(
-          'systemctl list-units "ceph*" --no-legend --plain --all 2>/dev/null',
-          on_fail: ''
-        )
-        parse_units(output)
-      end
-
-      def self.parse_units(output)
-        result = TYPES.each_with_object({}) { |type, hash| hash[type] = [] }
-        output.each_line do |line|
-          unit = line.split.first
-          next unless unit
-
-          match_unit(result, unit)
-        end
-        result
-      end
-
-      def self.match_unit(result, unit)
-        TYPES.each do |type|
-          match = unit.match(/\Aceph-#{type}@(.+)\.service\z/)
-          result[type] << "ceph-#{type}@#{match[1]}" if match
-        end
-      end
-
-      TYPES.each do |type|
-        define_singleton_method(:"#{type}?") { !services[type].empty? }
-      end
-    end
-  end
-end
-# rubocop:enable Style/ClassAndModuleChildren
-
-Facter.add('ceph_services') do
-  setcode { Unkin::Ceph::Utils.services }
-end
-
-Unkin::Ceph::Utils::TYPES.each do |type|
-  Facter.add("is_ceph_#{type}") do
-    setcode { Unkin::Ceph::Utils.public_send(:"#{type}?") }
-  end
-end
@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-# lib/facter/vault_cert_content.rb
-
-Facter.add(:vault_cert_content) do
-  confine kernel: 'Linux'
-  setcode do
-    cert_path = '/etc/pki/tls/vault/certificate.crt'
-    File.read(cert_path) if File.exist?(cert_path) && File.readable?(cert_path)
-  end
-end
@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-# lib/facter/vault_cert_fingerprint.rb
-
-Facter.add(:vault_cert_fingerprint) do
-  confine kernel: 'Linux'
-  setcode do
-    require 'openssl'
-    require 'digest'
-
-    cert_path = '/etc/pki/tls/vault/certificate.crt'
-    if File.exist?(cert_path) && File.readable?(cert_path)
-      begin
-        cert_content = File.read(cert_path)
-        cert = OpenSSL::X509::Certificate.new(cert_content)
-        # Calculate SHA256 fingerprint like incus does
-        Digest::SHA256.hexdigest(cert.to_der)
-      rescue StandardError
-        nil
-      end
-    end
-  end
-end
@@ -20,12 +20,7 @@ class redisha::redis (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${redisha_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -23,12 +23,7 @@ class redisha::sentinel (
    }

    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(puppetdb_query(
-      "facts[certname] {
-        name = 'enc_role' and value = '${redisha_members_role}' and
-        certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
-      }"
-    ).map |$fact| { $fact['certname'] })
+    $servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))

  # else use provided array from params
  }else{
@@ -0,0 +1,48 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rbd-csi-nodeplugin
+  namespace: ceph-csi
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-csi-nodeplugin
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments"]
+    verbs: ["list", "get"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    verbs: ["create"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-csi-nodeplugin
+subjects:
+  - kind: ServiceAccount
+    name: rbd-csi-nodeplugin
+    namespace: ceph-csi
+roleRef:
+  kind: ClusterRole
+  name: rbd-csi-nodeplugin
+  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,125 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rbd-csi-provisioner
+  namespace: ceph-csi
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-external-provisioner-runner
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims/status"]
+    verbs: ["update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["get", "list", "watch", "update", "patch", "create"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots/status"]
+    verbs: ["get", "list", "patch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents"]
+    verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments/status"]
+    verbs: ["patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["csinodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents/status"]
+    verbs: ["update", "patch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    verbs: ["create"]
+  - apiGroups: ["groupsnapshot.storage.k8s.io"]
+    resources: ["volumegroupsnapshotclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["groupsnapshot.storage.k8s.io"]
+    resources: ["volumegroupsnapshotcontents"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["groupsnapshot.storage.k8s.io"]
+    resources: ["volumegroupsnapshotcontents/status"]
+    verbs: ["update", "patch"]
+  - apiGroups: ["replication.storage.openshift.io"]
+    resources: ["volumegroupreplicationcontents"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["replication.storage.openshift.io"]
+    resources: ["volumegroupreplicationclasses"]
+    verbs: ["get", "list", "watch"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-csi-provisioner-role
+subjects:
+  - kind: ServiceAccount
+    name: rbd-csi-provisioner
+    namespace: ceph-csi
+roleRef:
+  kind: ClusterRole
+  name: rbd-external-provisioner-runner
+  apiGroup: rbac.authorization.k8s.io
+
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-external-provisioner-cfg
+  namespace: ceph-csi
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "delete"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "watch", "list", "delete", "update", "create"]
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-csi-provisioner-role-cfg
+  namespace: ceph-csi
+subjects:
+  - kind: ServiceAccount
+    name: rbd-csi-provisioner
+    namespace: ceph-csi
+roleRef:
+  kind: Role
+  name: rbd-external-provisioner-cfg
+  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,124 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: csi-rbdplugin-provisioner
+  namespace: ceph-csi
+  labels:
+    app: csi‑metrics
+spec:
+  selector:
+    app: csi‑rbdplugin‑provisioner
+  ports:
+    - name: http‑metrics
+      port: 8080
+      protocol: TCP
+      targetPort: 8680
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: csi‑rbdplugin‑provisioner
+  namespace: ceph-csi
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: csi‑rbdplugin‑provisioner
+  template:
+    metadata:
+      labels:
+        app: csi‑rbdplugin‑provisioner
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - csi‑rbdplugin‑provisioner
+              topologyKey: "kubernetes.io/hostname"
+      serviceAccountName: rbd‑csi‑provisioner
+      priorityClassName: system‑cluster‑critical
+      containers:
+        - name: csi‑rbdplugin
+          image: quay.io/cephcsi/cephcsi:v3.15
+          args:
+            - "--nodeid=$(NODE_ID)"
+            - "--type=rbd"
+            - "--controllerserver=true"
+            - "--endpoint=$(CSI_ENDPOINT)"
+            - "--csi-addons-endpoint=$(CSI_ADDONS_ENDPOINT)"
+            - "--v=5"
+            - "--drivername=rbd.csi.ceph.com"
+            - "--pidlimit=-1"
+            - "--rbdhardmaxclonedepth=8"
+            - "--rbdsoftmaxclonedepth=4"
+            - "--enableprofiling=false"
+            - "--setmetadata=true"
+          env:
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CSI_ENDPOINT
+              value: unix:///csi/csi-provisioner.sock
+            - name: CSI_ADDONS_ENDPOINT
+              value: unix:///csi/csi-addons.sock
+          imagePullPolicy: IfNotPresent
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /csi
+            - name: host-dev
+              mountPath: /dev
+            - name: host-sys
+              mountPath: /sys
+            - name: lib-modules
+              mountPath: /lib/modules
+              readOnly: true
+            - name: ceph-csi-config
+              mountPath: /etc/ceph-csi-config/
+            - name: ceph-csi-encryption-kms-config
+              mountPath: /etc/ceph-csi-encryption-kms-config/
+            - name: ceph-config
+              mountPath: /etc/ceph/
+            - name: keys-tmp-dir
+              mountPath: /tmp/csi/keys
+        # snapshotter & other sidecars omitted in this snippet for brevity
+      volumes:
+        - name: socket-dir
+          emptyDir:
+            medium: Memory
+        - name: host-dev
+          hostPath:
+            path: /dev
+        - name: host-sys
+          hostPath:
+            path: /sys
+        - name: lib-modules
+          hostPath:
+            path: /lib/modules
+        - name: ceph-csi-config
+          configMap:
+            name: ceph-csi-config
+        - name: ceph-csi-encryption-kms-config
+          configMap:
+            name: ceph-csi-encryption-kms-config
+        - name: ceph-config
+          configMap:
+            name: ceph-config
+        - name: keys-tmp-dir
+          emptyDir:
+            medium: Memory
+        # and other volumes as in the original
@@ -0,0 +1,155 @@
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: csi‑rbdplugin
+  namespace: ceph-csi
+spec:
+  selector:
+    matchLabels:
+      app: csi‑rbdplugin
+  template:
+    metadata:
+      labels:
+        app: csi‑rbdplugin
+    spec:
+      serviceAccountName: rbd‑csi‑nodeplugin
+      hostNetwork: true
+      hostPID: true
+      priorityClassName: system‑node‑critical
+      dnsPolicy: ClusterFirstWithHostNet
+      containers:
+        - name: csi‑rbdplugin
+          securityContext:
+            privileged: true
+          capabilities:
+            add: ["SYS_ADMIN"]
+          allowPrivilegeEscalation: true
+          image: quay.io/cephcsi/cephcsi:v3.15
+          args:
+            - "--nodeid=$(NODE_ID)"
+            - "--pluginpath=/var/lib/kubelet/plugins"
+            - "--stagingpath=/var/lib/kubelet/plugins/kubernetes.io/csi/"
+            - "--type=rbd"
+            - "--nodeserver=true"
+            - "--endpoint=$(CSI_ENDPOINT)"
+            - "--csi-addons-endpoint=$(CSI_ADDONS_ENDPOINT)"
+            - "--v=5"
+            - "--drivername=rbd.csi.ceph.com"
+            - "--enableprofiling=false"
+          env:
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CSI_ENDPOINT
+              value: unix:///csi/csi.sock
+            - name: CSI_ADDONS_ENDPOINT
+              value: unix:///csi/csi-addons.sock
+          imagePullPolicy: IfNotPresent
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /csi
+            - name: host-dev
+              mountPath: /dev
+            - name: host-sys
+              mountPath: /sys
+            - name: host-mount
+              mountPath: /run/mount
+            - name: etc-selinux
+              mountPath: /etc/selinux
+              readOnly: true
+            - name: lib-modules
+              mountPath: /lib/modules
+              readOnly: true
+            - name: plugin-dir
+              mountPath: /var/lib/kubelet/plugins
+              mountPropagation: "Bidirectional"
+            - name: mountpoint-dir
+              mountPath: /var/lib/kubelet/pods
+              mountPropagation: "Bidirectional"
+            - name: keys-tmp-dir
+              mountPath: /tmp/csi/keys
+            - name: ceph-logdir
+              mountPath: /var/log/ceph
+            - name: ceph-config
+              mountPath: /etc/ceph/
+            - name: ceph-csi-config
+              mountPath: /etc/ceph-csi-config/
+            - name: ceph-csi-encryption-kms-config
+              mountPath: /etc/ceph-csi-encryption-kms-config/
+            - name: oidc-token
+              mountPath: /run/secrets/tokens
+              readOnly: true
+        # possibly sidecars like driver‑registrar, liveness, etc.
+      volumes:
+        - name: socket-dir
+          hostPath:
+            path: /var/lib/kubelet/plugins/rbd.csi.ceph.com
+            type: DirectoryOrCreate
+        - name: plugin-dir
+          hostPath:
+            path: /var/lib/kubelet/plugins
+            type: Directory
+        - name: mountpoint-dir
+          hostPath:
+            path: /var/lib/kubelet/pods
+            type: DirectoryOrCreate
+        - name: ceph-logdir
+          hostPath:
+            path: /var/log/ceph
+            type: DirectoryOrCreate
+        - name: host-dev
+          hostPath:
+            path: /dev
+        - name: host-sys
+          hostPath:
+            path: /sys
+        - name: etc-selinux
+          hostPath:
+            path: /etc/selinux
+            type: DirectoryOrCreate
+        - name: host-mount
+          hostPath:
+            path: /run/mount
+        - name: lib-modules
+          hostPath:
+            path: /lib/modules
+            type: DirectoryOrCreate
+        - name: ceph-config
+          configMap:
+            name: ceph-config
+        - name: ceph-csi-config
+          configMap:
+            name: ceph-csi-config
+        - name: ceph-csi-encryption-kms-config
+          configMap:
+            name: ceph-csi-encryption-kms-config
+        - name: keys-tmp-dir
+          emptyDir:
+            medium: Memory
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: csi-metrics-rbdplugin
+  namespace: ceph-csi
+  labels:
+    app: csi‑metrics
+spec:
+  ports:
+    - name: http‑metrics
+      port: 8080
+      protocol: TCP
+      targetPort: 8680
+  selector:
+    app: csi‑rbdplugin
@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    kubernetes.io/ingress.class: nginx
+spec:
+  tls:
+    - hosts: [rancher.main.unkin.net]
+      secretName: tls-rancher
+  rules:
+    - host: rancher.main.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80
@@ -0,0 +1,45 @@
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  name: common
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
+---
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - subnet: 198.18.199.0/24
+        pool: 198.18.199.0/24
+        aggregation: /32
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  name: common
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - subnet: 198.18.200.0/24
+        pool: 198.18.200.0/24
+        aggregation: /32
@@ -1,20 +0,0 @@
---
-apiVersion: helm.cattle.io/v1
-kind: HelmChartConfig
-metadata:
-  name: rke2-ingress-nginx
-  namespace: kube-system
-spec:
-  valuesContent: |-
-    controller:
-      hostPort:
-        enabled: false
-      service:
-        enabled: true
-        type: LoadBalancer
-        externalTrafficPolicy: Local
-        loadBalancerClass: purelb.io/purelb
-        allocateLoadBalancerNodePorts: false
-        annotations:
-          purelb.io/service-group: common
-          purelb.io/addresses: "198.18.200.0"
@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rke2-ingress-nginx-controller
+  namespace: kube-system
+  annotations:
+    purelb.io/service-group: common
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+    - name: https
+      port: 443
+      targetPort: https
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: rke2-ingress-nginx
+    loadBalancerIP: 198.18.200.0
+---
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: rke2-ingress-nginx
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    controller:
+      hostPort:
+        enabled: false
+      service:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        annotations:
+          purelb.io/service-group: common
@@ -1,39 +0,0 @@
-# frozen_string_literal: true
-
-require 'json'
-require 'open3'
-
-Facter.add(:k8s_masters) do
-  confine do
-    File.exist?('/etc/rancher/rke2/rke2.yaml') &&
-      File.executable?('/usr/bin/kubectl')
-  end
-
-  setcode do
-    env = { 'KUBECONFIG' => '/etc/rancher/rke2/rke2.yaml' }
-    cmd = ['/usr/bin/kubectl', 'get', 'nodes', '-o', 'json']
-
-    stdout, stderr, status = Open3.capture3(env, *cmd)
-
-    if status.success?
-      json = JSON.parse(stdout)
-
-      master_count = json['items'].count do |item|
-        roles = item.dig('metadata', 'labels') || {}
-
-        # Look for well-known labels assigned to control-plane nodes
-        roles.any? do |key, _|
-          key =~ %r{node-role\.kubernetes\.io/(control-plane|master|etcd)}
-        end
-      end
-
-      master_count
-    else
-      Facter.debug("kubectl error: #{stderr}")
-      0
-    end
-  rescue StandardError => e
-    Facter.debug("Exception in k8s_masters fact: #{e.message}")
-    0
-  end
-end
@@ -7,8 +7,13 @@ class rke2::config (
  Stdlib::Fqdn            $bootstrap_node = $rke2::bootstrap_node,
  String                  $node_token = $rke2::node_token,
  Array[String[1]]        $extra_config_files = $rke2::extra_config_files,
-  Boolean                 $manage_registries = $rke2::manage_registries,
-  Hash                    $registries = $rke2::registries,
+  Boolean                 $csi_ceph_enable = $rke2::csi_ceph_enable,
+  Array[String]           $csi_ceph_files = $rke2::csi_ceph_files,
+  Array[String]           $csi_ceph_templates = $rke2::csi_ceph_templates,
+  Optional[String[1]]     $csi_ceph_key = $rke2::csi_ceph_key,
+  Optional[String[1] ]    $csi_ceph_clusterid = $rke2::csi_ceph_clusterid,
+  Optional[Array[String]] $csi_ceph_monitors = $rke2::csi_ceph_monitors,
+  Optional[String[1]]     $csi_ceph_poolname = $rke2::csi_ceph_poolname,
 ){

  # if its not the bootstrap node, add join path to config
@@ -19,7 +24,9 @@ class rke2::config (
        token  => $node_token,
      } )
    }else{
-      $config = merge($config_hash, {})
+      $config = merge($config_hash, {
+        token  => $node_token,
+      } )
    }
  } elsif $node_type == 'agent' {
      $config = merge($config_hash, {
@@ -30,24 +37,6 @@ class rke2::config (
    $config = $config_hash
  }

-  if $manage_registries {
-    file { '/etc/rancher/rke2/registries.yaml':
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => epp('rke2/registries.yaml.epp', { registries => $registries }),
-      require => Package["rke2-${node_type}"],
-      notify  => Service["rke2-${node_type}"],
-    }
-  }else{
-    file { '/etc/rancher/rke2/registries.yaml':
-      ensure  => absent,
-      require => Package["rke2-${node_type}"],
-      notify  => Service["rke2-${node_type}"],
-    }
-  }
-
  # create the config file
  file { $config_file:
    ensure  => file,
@@ -86,7 +75,31 @@ class rke2::config (
  }

  # on the controller nodes only
-  if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
+  if $node_type == 'server' {
+
+    # wait for purelb helm to setup namespace
+    if 'purelb' in $facts['k8s_namespaces'] {
+      file {'/var/lib/rancher/rke2/server/manifests/purelb-config.yaml':
+        ensure  => file,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0644',
+        source  => 'puppet:///modules/rke2/purelb-config.yaml',
+        require => Service['rke2-server'],
+      }
+    }
+
+    # wait for rancher helm to setup namespace
+    if 'cattle-system' in $facts['k8s_namespaces'] {
+      file {'/var/lib/rancher/rke2/server/manifests/ingress-route-rancher.yaml':
+        ensure  => file,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0644',
+        source  => 'puppet:///modules/rke2/ingress-route-rancher.yaml',
+        require => Service['rke2-server'],
+      }
+    }

    # manage extra config config (these are not dependent on helm)
    $extra_config_files.each |$file| {
@@ -101,5 +114,32 @@ class rke2::config (
      }
    }

+    # manage ceph files
+    if $csi_ceph_enable {
+
+      $csi_ceph_files.each |$file| {
+
+        file {"/var/lib/rancher/rke2/server/manifests/${file}.yaml":
+          ensure  => file,
+          owner   => 'root',
+          group   => 'root',
+          mode    => '0644',
+          source  => "puppet:///modules/rke2/${file}.yaml",
+          require => Service['rke2-server'],
+        }
+      }
+
+      $csi_ceph_templates.each |$file| {
+
+        file {"/var/lib/rancher/rke2/server/manifests/${file}.yaml":
+          ensure  => file,
+          owner   => 'root',
+          group   => 'root',
+          mode    => '0644',
+          content => template("rke2/${file}.yaml.erb"),
+          require => Service['rke2-server'],
+        }
+      }
+    }
  }
 }
@@ -20,8 +20,8 @@ class rke2::helm (
      mode   => '0755',
    }

-    # on the controller nodes only, and after 3 master nodes exist
-    if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
+    # on the controller nodes only
+    if $node_type == 'server' {

      # check if the repo already exists
      $helm_repos.each | String $repo, Stdlib::HTTPSUrl $url | {
@@ -38,6 +38,44 @@ class rke2::helm (
          }
        }
      }
+
+      # install specific helm charts to bootstrap environment
+      $plb_cmd = 'helm install purelb purelb/purelb \
+                  --create-namespace \
+                  --namespace=purelb \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_purelb':
+        command     => $plb_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n purelb | grep -q ^purelb',
+      }
+
+      $cm_cmd = 'helm install cert-manager jetstack/cert-manager \
+                  --namespace cert-manager \
+                  --create-namespace \
+                  --set crds.enabled=true \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_cert_manager':
+        command     => $cm_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n cert-manager | grep -q ^cert-manager',
+      }
+
+      $r_cmd = 'helm install rancher rancher-stable/rancher \
+                  --namespace cattle-system \
+                  --create-namespace \
+                  --set hostname=rancher.main.unkin.net \
+                  --set bootstrapPassword=admin \
+                  --set ingress.tls.source=secret \
+                  --repository-config /etc/helm/repositories.yaml'
+      exec { 'install_rancher':
+        command     => $r_cmd,
+        path        => ['/usr/bin', '/bin'],
+        environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
+        unless      => 'helm list -n cattle-system | grep -q ^rancher',
+      }
    }
  }
 }
@@ -12,8 +12,13 @@ class rke2 (
  Hash                    $helm_repos = $rke2::params::helm_repos,
  Array[String[1]]        $extra_config_files = $rke2::params::extra_config_files,
  Stdlib::HTTPUrl         $container_archive_source = $rke2::params::container_archive_source,
-  Boolean                 $manage_registries = $rke2::params::manage_registries,
-  Hash                    $registries = $rke2::params::registries,
+  Boolean                 $csi_ceph_enable = $rke2::params::csi_ceph_enable,
+  Array[String]           $csi_ceph_files = $rke2::params::csi_ceph_files,
+  Array[String]           $csi_ceph_templates = $rke2::params::csi_ceph_templates,
+  Optional[String[1]]     $csi_ceph_key = $rke2::params::csi_ceph_key,
+  Optional[String[1] ]    $csi_ceph_clusterid = $rke2::params::csi_ceph_clusterid,
+  Optional[Array[String]] $csi_ceph_monitors = $rke2::params::csi_ceph_monitors,
+  Optional[String[1]]     $csi_ceph_poolname = $rke2::params::csi_ceph_poolname,
 ) inherits rke2::params {

  include rke2::install
@@ -30,7 +30,7 @@ class rke2::install (
  # download required archive of containers
  archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
    ensure  => present,
-    source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
+    source  => "https://github.com/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
    require => [
      Package["rke2-${node_type}"],
      File['/var/lib/rancher/rke2/agent/images'],
@@ -12,6 +12,11 @@ class rke2::params (
  Hash                    $helm_repos = {},
  Array[String[1]]        $extra_config_files = [],
  Stdlib::HTTPUrl         $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
-  Boolean                 $manage_registries = false,
-  Hash                    $registries = {},
+  Boolean                 $csi_ceph_enable = false,
+  Array[String]           $csi_ceph_files = [],
+  Array[String]           $csi_ceph_templates = [],
+  Optional[String[1]]     $csi_ceph_key = undef,
+  Optional[String[1] ]    $csi_ceph_clusterid = undef,
+  Optional[Array[String]] $csi_ceph_monitors = undef,
+  Optional[String[1]]     $csi_ceph_poolname = undef,
 ) {}
@@ -0,0 +1,65 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ceph-csi
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ceph-csi-config
+  namespace: ceph-csi
+data:
+  config.json: |-
+    [
+      {
+        "clusterID": "<%= @csi_ceph_clusterid %>",
+        "monitors": [
+        <% @csi_ceph_monitors.each_with_index do |mon, index| -%>
+          "<%= mon %>"<% if index < @csi_ceph_monitors.length - 1 %>,<% end %>
+        <% end -%>
+        ]
+      }
+    ]
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ceph-csi-encryption-kms-config
+  namespace: ceph-csi
+data:
+  config.json: |-
+    {}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ceph-config
+  namespace: ceph-csi
+data:
+  ceph.conf: |
+    [global]
+    auth_cluster_required = cephx
+    auth_service_required = cephx
+    auth_client_required = cephx
+  keyring: |
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: csi-rbd-sc
+provisioner: rbd.csi.ceph.com
+parameters:
+  clusterID: <%= @csi_ceph_clusterid %>
+  pool: <%= @csi_ceph_poolname %>
+  imageFeatures: layering
+  csi.storage.k8s.io/provisioner-secret-name: csi-rbd-secret
+  csi.storage.k8s.io/provisioner-secret-namespace: ceph-csi
+  csi.storage.k8s.io/controller-expand-secret-name: csi-rbd-secret
+  csi.storage.k8s.io/controller-expand-secret-namespace: ceph-csi
+  csi.storage.k8s.io/node-stage-secret-name: csi-rbd-secret
+  csi.storage.k8s.io/node-stage-secret-namespace: ceph-csi
+reclaimPolicy: Delete
+allowVolumeExpansion: true
+mountOptions:
+  - discard
@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: csi-rbd-secret
+  namespace: ceph-csi
+stringData:
+  userID: kubernetes
+  userKey: <%= @csi_ceph_key %>
+
@@ -1,20 +0,0 @@
-<%- | Hash $registries | -%>
---
-# DO NOT MODIFY - MANAGED BY PUPPET
-mirrors:
-<%- $registries.each |$registry, $config| { -%>
-  <%= $registry %>:
-    endpoint:
-<%- $config['endpoint'].each |$ep| { -%>
-      - "<%= $ep %>"
-<%- } -%>
-<%- if $config['rewrite'] { -%>
-    rewrite:
-<%- $config['rewrite'].each |$pattern, $replacement| { -%>
-      "<%= $pattern %>": "<%= $replacement %>"
-<%- } -%>
-<%- } -%>
-<%- if $config['disable-default-registry-endpoint'] { -%>
-    disable-default-registry-endpoint: true
-<%- } -%>
-<%- } -%>
@@ -1,230 +0,0 @@
-# Stalwart Mail Server Module
-
-This Puppet module manages Stalwart Mail Server, a modern, secure, and scalable mail server implementation that supports IMAP, JMAP, WebDAV, and SMTP protocols.
-
-## Overview
-
-The `stalwart` module provides a comprehensive solution for deploying Stalwart Mail Server in a clustered environment with:
-
- **PostgreSQL backend** for data, full-text search, and in-memory storage
- **S3/Ceph-RGW backend** for blob storage (emails, attachments, sieve scripts)
- **Automatic cluster discovery** using `query_nodes()`
- **DNS autodiscovery records** for email client configuration
- **TLS certificate management** integration
- **Postfix relay integration** for SMTP routing
-
-## Features
-
- ✅ **Multi-node clustering** with peer-to-peer coordination
- ✅ **PostgreSQL authentication** with SQL directory backend
- ✅ **S3 blob storage** with compression support
- ✅ **IMAP/IMAPS protocols** for email access
- ✅ **HTTP/HTTPS protocols** for JMAP, WebDAV, and autodiscovery
- ✅ **SMTP relay** for postfix integration
- ✅ **DNS autodiscovery** record management
- ✅ **Automatic role distribution** across cluster nodes
- ✅ **TLS security** with Vault PKI integration
-
-## Requirements
-
- **Puppet 6+** with `query_nodes()` function support
- **Stalwart RPM package** (creates user, directories, systemd service)
- **PostgreSQL cluster** for data storage
- **S3-compatible storage** (Ceph-RGW, MinIO, AWS S3)
- **DNS management** via `profiles::dns::record`
- **PKI management** via `profiles::pki::vault::alt_names`
-
-## Usage
-
-### Recommended Usage with Role
-
-The recommended way to use this module is via the `roles::infra::mail::backend` role with hieradata configuration:
-
-```puppet
-include roles::infra::mail::backend
-```
-
-Configure all parameters in `hieradata/roles/infra/mail/backend.yaml` - see `examples/role-hieradata.yaml` for a complete example.
-
-### Direct Class Usage
-
-```puppet
-class { 'stalwart':
-  node_id             => 1,
-  cluster_role        => 'mail-backend',
-  postgresql_host     => 'pgsql.example.com',
-  postgresql_database => 'stalwart',
-  postgresql_user     => 'stalwart',
-  postgresql_password => Sensitive('secretpassword'),
-  s3_endpoint         => 'https://ceph-rgw.example.com',
-  s3_bucket           => 'stalwart-blobs',
-  s3_access_key       => 'accesskey',
-  s3_secret_key       => Sensitive('secretkey'),
-  domains             => ['example.com'],
-  postfix_relay_host  => 'postfix.example.com',
-}
-```
-
-## Hieradata Configuration
-
-See `examples/role-hieradata.yaml` for a complete example of role-based hieradata configuration.
-
-### Required Parameters
-
-```yaml
-# Cluster role for node discovery
-stalwart::cluster_role: 'mail-backend'
-
-# Optional: Unique node identifier (auto-calculated if not specified)
-# stalwart::node_id: 1
-
-# PostgreSQL connection
-stalwart::postgresql_host: 'pgsql.example.com'
-stalwart::postgresql_database: 'stalwart'
-stalwart::postgresql_user: 'stalwart'
-stalwart::postgresql_password: >
-  ENC[PKCS7,encrypted_password...]
-
-# S3/Ceph-RGW connection
-stalwart::s3_endpoint: 'https://ceph-rgw.example.com'
-stalwart::s3_bucket: 'stalwart-blobs'
-stalwart::s3_access_key: 'access_key'
-stalwart::s3_secret_key: >
-  ENC[PKCS7,encrypted_secret...]
-
-# Domains and relay
-stalwart::domains:
-  - 'example.com'
-stalwart::postfix_relay_host: 'postfix.example.com'
-```
-
-## Architecture
-
-### Cluster Setup
-
-The module automatically discovers cluster members using `query_nodes()` based on:
- `enc_role` matching `cluster_role` parameter
- `country` fact matching the node's country fact
- `region` fact matching the node's region fact
-
-**Node ID Assignment:**
- Node IDs are **automatically extracted** from the last 4 digits of the hostname
- Example: `ausyd1nxvm1234` → node ID `1234`
- Manual override available via `stalwart::node_id` parameter if needed
- Hostname must end with 4 digits for automatic extraction to work
- Ensures unique IDs when following consistent hostname patterns
-
-### Storage Layout
-
- **Data Store**: PostgreSQL (metadata, folders, settings)
- **Full-Text Search**: PostgreSQL (search indexes)
- **In-Memory Store**: PostgreSQL (caching, sessions)
- **Blob Store**: S3/Ceph-RGW (emails, attachments, files)
-
-### Directory Structure (Created by RPM)
-
- **Config**: `/opt/stalwart/etc/config.toml`
- **Data**: `/var/lib/stalwart/` (queue, reports)
- **Logs**: `/var/log/stalwart/stalwart.log`
- **Binary**: `/opt/stalwart/bin/stalwart`
- **User**: `stalwart:stalwart` (system user)
-
-### Network Ports
-
- **143**: IMAP (STARTTLS)
- **993**: IMAPS (implicit TLS)
- **443**: HTTPS (JMAP, WebDAV, autodiscovery)
- **2525**: SMTP relay (postfix communication)
- **11200**: Cluster coordination (peer-to-peer)
- **9090**: Prometheus metrics
-
-### DNS Records
-
-When `manage_dns_records: true`, the module creates:
- `autoconfig.domain.com` → server FQDN (Thunderbird)
- `autodiscover.domain.com` → server FQDN (Outlook)
- `_imap._tcp.domain.com` SRV record
- `_imaps._tcp.domain.com` SRV record
- `_caldav._tcp.domain.com` SRV record
- `_carddav._tcp.domain.com` SRV record
-
-## PostgreSQL Schema
-
-The module expects these tables in the PostgreSQL database:
-
-```sql
-CREATE TABLE accounts (
-  name TEXT PRIMARY KEY,
-  secret TEXT,
-  description TEXT,
-  type TEXT NOT NULL,
-  quota INTEGER DEFAULT 0,
-  active BOOLEAN DEFAULT true
-);
-
-CREATE TABLE group_members (
-  name TEXT NOT NULL,
-  member_of TEXT NOT NULL,
-  PRIMARY KEY (name, member_of)
-);
-
-CREATE TABLE emails (
-  name TEXT NOT NULL,
-  address TEXT NOT NULL,
-  type TEXT,
-  PRIMARY KEY (name, address)
-);
-```
-
-## Security
-
- **TLS required** for all connections
- **PostgreSQL SSL** enabled by default
- **S3 HTTPS** endpoints required
- **Password hashing** supported (SHA512, BCRYPT, etc.)
- **Certificate management** via Vault PKI
-
-### Fallback Administrator
-
-Stalwart includes a fallback administrator account for initial setup and emergency access:
-
- **Default username**: `admin` (configurable via `stalwart::fallback_admin_user`)
- **Default password**: `admin` (configurable via `stalwart::fallback_admin_password`)
- **Purpose**: Initial server configuration and emergency access when directory services are unavailable
- **Security**: Password is automatically hashed using SHA-512 crypt format
-
-**Important**: Change the default password in production by setting different hieradata values:
-
-```yaml
-stalwart::fallback_admin_password: "your-secure-password"
-```
-
-The fallback admin should only be used for initial setup and emergencies. Create regular admin accounts in PostgreSQL for day-to-day management.
-
-## Monitoring
-
- **Prometheus metrics** on port 9090
- **Log files** in `/var/log/stalwart/`
- **Queue monitoring** in `/var/lib/stalwart/queue/`
- **Service status** via systemd (`stalwart.service`)
-
-## Troubleshooting
-
-### Cluster Formation Issues
- Verify `query_nodes()` returns expected nodes
- Check `country` and `region` facts are consistent
- Ensure `cluster_role` matches across all nodes
-
-### Storage Connection Issues
- Test PostgreSQL connectivity and credentials
- Verify S3 endpoint accessibility and credentials
- Check network connectivity between nodes
-
-### TLS Certificate Issues
- Ensure PKI alt_names include all required domains
- Verify certificate paths exist and are readable
- Check certificate expiration dates
-
-## License
-
-This module is part of the internal infrastructure management system.
--- a/Show More
+++ b/Show More