Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
528fbe4190 |
@@ -0,0 +1,24 @@
|
|||||||
|
name: Build
|
||||||
|
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
precommit:
|
||||||
|
runs-on: almalinux-8
|
||||||
|
container:
|
||||||
|
image: git.unkin.net/unkin/almalinux9-actionsdind:latest
|
||||||
|
options: --privileged
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout code
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
|
||||||
|
- name: Install requirements
|
||||||
|
run: |
|
||||||
|
dnf groupinstall -y "Development Tools" -y
|
||||||
|
dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
|
||||||
|
|
||||||
|
- name: Pre-Commit All Files
|
||||||
|
run: |
|
||||||
|
uvx pre-commit run --all-files
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
sources/
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: pull_request
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: bolt-validate
|
|
||||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
|
||||||
commands:
|
|
||||||
- uvx pre-commit run --all-files --config ci/bolt-validate.yaml
|
|
||||||
backend_options:
|
|
||||||
kubernetes:
|
|
||||||
serviceAccountName: default
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: 512Mi
|
|
||||||
cpu: 250m
|
|
||||||
limits:
|
|
||||||
memory: 2Gi
|
|
||||||
cpu: 1
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: pull_request
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: epp-validate
|
|
||||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
|
||||||
commands:
|
|
||||||
- uvx pre-commit run --all-files --config ci/epp-validate.yaml
|
|
||||||
backend_options:
|
|
||||||
kubernetes:
|
|
||||||
serviceAccountName: default
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: 512Mi
|
|
||||||
cpu: 250m
|
|
||||||
limits:
|
|
||||||
memory: 2Gi
|
|
||||||
cpu: 1
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: pull_request
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: erb-validate
|
|
||||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
|
||||||
commands:
|
|
||||||
- uvx pre-commit run --all-files --config ci/erb-validate.yaml
|
|
||||||
backend_options:
|
|
||||||
kubernetes:
|
|
||||||
serviceAccountName: default
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: 512Mi
|
|
||||||
cpu: 250m
|
|
||||||
limits:
|
|
||||||
memory: 2Gi
|
|
||||||
cpu: 1
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: pull_request
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: puppet-lint
|
|
||||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
|
||||||
commands:
|
|
||||||
- uvx pre-commit run --all-files --config ci/puppet-lint.yaml
|
|
||||||
backend_options:
|
|
||||||
kubernetes:
|
|
||||||
serviceAccountName: default
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: 512Mi
|
|
||||||
cpu: 250m
|
|
||||||
limits:
|
|
||||||
memory: 2Gi
|
|
||||||
cpu: 1
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: pull_request
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: puppet-validate
|
|
||||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
|
||||||
commands:
|
|
||||||
- uvx pre-commit run --all-files --config ci/puppet-validate.yaml
|
|
||||||
backend_options:
|
|
||||||
kubernetes:
|
|
||||||
serviceAccountName: default
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: 512Mi
|
|
||||||
cpu: 1
|
|
||||||
limits:
|
|
||||||
memory: 2Gi
|
|
||||||
cpu: 2
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: pull_request
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: ruby-check
|
|
||||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
|
||||||
commands:
|
|
||||||
- uvx pre-commit run --all-files --config ci/ruby-check.yaml
|
|
||||||
backend_options:
|
|
||||||
kubernetes:
|
|
||||||
serviceAccountName: default
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: 512Mi
|
|
||||||
cpu: 250m
|
|
||||||
limits:
|
|
||||||
memory: 2Gi
|
|
||||||
cpu: 1
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: pull_request
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: ruby-validate
|
|
||||||
image: git.unkin.net/unkin/almalinux9-puppet-pr-validator:20260317
|
|
||||||
commands:
|
|
||||||
- uvx pre-commit run --all-files --config ci/ruby-validate.yaml
|
|
||||||
backend_options:
|
|
||||||
kubernetes:
|
|
||||||
serviceAccountName: default
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: 512Mi
|
|
||||||
cpu: 250m
|
|
||||||
limits:
|
|
||||||
memory: 2Gi
|
|
||||||
cpu: 1
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: pull_request
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: yamllint
|
|
||||||
image: git.unkin.net/unkin/almalinux9-base:20260606
|
|
||||||
commands:
|
|
||||||
- uvx pre-commit run --all-files --config ci/yamllint.yaml
|
|
||||||
backend_options:
|
|
||||||
kubernetes:
|
|
||||||
serviceAccountName: default
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: 512Mi
|
|
||||||
cpu: 250m
|
|
||||||
limits:
|
|
||||||
memory: 2Gi
|
|
||||||
cpu: 1
|
|
||||||
+2
-1
@@ -53,6 +53,7 @@ mod 'saz-ssh', '13.1.0'
|
|||||||
mod 'saz-limits', '5.0.0'
|
mod 'saz-limits', '5.0.0'
|
||||||
mod 'ghoneycutt-timezone', '4.0.0'
|
mod 'ghoneycutt-timezone', '4.0.0'
|
||||||
mod 'ghoneycutt-puppet', '3.3.0'
|
mod 'ghoneycutt-puppet', '3.3.0'
|
||||||
|
mod 'dalen-puppetdbquery', '3.0.1'
|
||||||
mod 'markt-galera', '3.1.0'
|
mod 'markt-galera', '3.1.0'
|
||||||
mod 'kogitoapp-minio', '1.1.4'
|
mod 'kogitoapp-minio', '1.1.4'
|
||||||
mod 'broadinstitute-certs', '3.0.1'
|
mod 'broadinstitute-certs', '3.0.1'
|
||||||
@@ -65,5 +66,5 @@ mod 'thias-sysctl', '1.0.8'
|
|||||||
mod 'cirrax-dovecot', '1.3.3'
|
mod 'cirrax-dovecot', '1.3.3'
|
||||||
|
|
||||||
mod 'bind',
|
mod 'bind',
|
||||||
:git => 'https://git.unkin.net/unkinben/puppet-bind.git',
|
:git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',
|
||||||
:tag => '1.0'
|
:tag => '1.0'
|
||||||
|
|||||||
@@ -1,5 +0,0 @@
|
|||||||
repos:
|
|
||||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
|
||||||
rev: v2.2.0
|
|
||||||
hooks:
|
|
||||||
- id: bolt-validate
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
repos:
|
|
||||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
|
||||||
rev: v2.2.0
|
|
||||||
hooks:
|
|
||||||
- id: epp-validate
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
repos:
|
|
||||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
|
||||||
rev: v2.2.0
|
|
||||||
hooks:
|
|
||||||
- id: erb-validate
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
repos:
|
|
||||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
|
||||||
rev: v2.2.0
|
|
||||||
hooks:
|
|
||||||
- id: puppet-lint
|
|
||||||
args:
|
|
||||||
- --no-80chars-check
|
|
||||||
- --no-documentation-check
|
|
||||||
- --no-puppet_url_without_modules-check
|
|
||||||
- --fail-on-warnings
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
repos:
|
|
||||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
|
||||||
rev: v2.2.0
|
|
||||||
hooks:
|
|
||||||
- id: puppet-validate
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
repos:
|
|
||||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
|
||||||
rev: v2.2.0
|
|
||||||
hooks:
|
|
||||||
- id: ruby-validate
|
|
||||||
- repo: 'https://github.com/jumanjihouse/pre-commit-hooks'
|
|
||||||
rev: 3.0.0
|
|
||||||
hooks:
|
|
||||||
- id: reek
|
|
||||||
- id: rubocop
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
repos:
|
|
||||||
- repo: 'https://github.com/chriskuehl/puppet-pre-commit-hooks.git'
|
|
||||||
rev: v2.2.0
|
|
||||||
hooks:
|
|
||||||
- id: ruby-validate
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
repos:
|
|
||||||
- repo: 'https://github.com/adrienverge/yamllint'
|
|
||||||
rev: v1.32.0
|
|
||||||
hooks:
|
|
||||||
- id: 'yamllint'
|
|
||||||
args:
|
|
||||||
[
|
|
||||||
"-d {extends: relaxed, rules: {line-length: disable}, ignore: chart}",
|
|
||||||
"-s",
|
|
||||||
]
|
|
||||||
@@ -28,98 +28,6 @@ Always refer back to the official documentation at https://docs.ceph.com/en/late
|
|||||||
sudo ceph fs set mediafs max_mds 2
|
sudo ceph fs set mediafs max_mds 2
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## managing cephfs with subvolumes
|
|
||||||
|
|
||||||
Create erasure code profiles. The K and M values are equivalent to the number of data disks (K) and parity disks (M) in RAID5, RAID6, etc.
|
|
||||||
|
|
||||||
sudo ceph osd erasure-code-profile set ec_6_2 k=6 m=2
|
|
||||||
sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
|
|
||||||
|
|
||||||
Create data pools using the erasure-code-profile, set some required options
|
|
||||||
|
|
||||||
sudo ceph osd pool create cephfs_data_ssd_ec_6_2 erasure ec_6_2
|
|
||||||
sudo ceph osd pool set cephfs_data_ssd_ec_6_2 allow_ec_overwrites true
|
|
||||||
sudo ceph osd pool set cephfs_data_ssd_ec_6_2 bulk true
|
|
||||||
|
|
||||||
sudo ceph osd pool create cephfs_data_ssd_ec_4_1 erasure ec_4_1
|
|
||||||
sudo ceph osd pool set cephfs_data_ssd_ec_4_1 allow_ec_overwrites true
|
|
||||||
sudo ceph osd pool set cephfs_data_ssd_ec_4_1 bulk true
|
|
||||||
|
|
||||||
Add the pool to the fs `cephfs`
|
|
||||||
|
|
||||||
sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_6_2
|
|
||||||
sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_4_1
|
|
||||||
|
|
||||||
Create a subvolumegroup using the new data pool
|
|
||||||
|
|
||||||
sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_6_2 --pool_layout cephfs_data_ssd_ec_6_2
|
|
||||||
sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_4_1 --pool_layout cephfs_data_ssd_ec_4_1
|
|
||||||
|
|
||||||
All together:
|
|
||||||
|
|
||||||
sudo ceph osd erasure-code-profile set ec_6_2 k=6 m=2
|
|
||||||
sudo ceph osd pool create cephfs_data_ssd_ec_6_2 erasure ec_6_2
|
|
||||||
sudo ceph osd pool set cephfs_data_ssd_ec_6_2 allow_ec_overwrites true
|
|
||||||
sudo ceph osd pool set cephfs_data_ssd_ec_6_2 bulk true
|
|
||||||
sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_6_2
|
|
||||||
sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_6_2 --pool_layout cephfs_data_ssd_ec_6_2
|
|
||||||
|
|
||||||
sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
|
|
||||||
sudo ceph osd pool create cephfs_data_ssd_ec_4_1 erasure ec_4_1
|
|
||||||
sudo ceph osd pool set cephfs_data_ssd_ec_4_1 allow_ec_overwrites true
|
|
||||||
sudo ceph osd pool set cephfs_data_ssd_ec_4_1 bulk true
|
|
||||||
sudo ceph fs add_data_pool cephfs cephfs_data_ssd_ec_4_1
|
|
||||||
sudo ceph fs subvolumegroup create cephfs csi_ssd_ec_4_1 --pool_layout cephfs_data_ssd_ec_4_1
|
|
||||||
|
|
||||||
Create a key with access to the new subvolume groups. Check if the user already exists first:
|
|
||||||
|
|
||||||
sudo ceph auth get client.kubernetes-cephfs
|
|
||||||
|
|
||||||
If it doesnt:
|
|
||||||
|
|
||||||
sudo ceph auth get-or-create client.kubernetes-cephfs \
|
|
||||||
mgr 'allow rw' \
|
|
||||||
osd 'allow rw tag cephfs metadata=cephfs, allow rw tag cephfs data=cephfs' \
|
|
||||||
mds 'allow r fsname=cephfs path=/volumes, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_6_2, allow rws fsname=cephfs path=/volumes/csi_ssd_ec_4_1' \
|
|
||||||
mon 'allow r fsname=cephfs'
|
|
||||||
|
|
||||||
If it does, use `sudo ceph auth caps client.kubernetes-cephfs ...` instead to update existing capabilities.
|
|
||||||
|
|
||||||
## removing a cephfs subvolumegroup from cephfs
|
|
||||||
|
|
||||||
This will cleanup the subvolumegroup, and subvolumes if they exist, then remove the pool.
|
|
||||||
|
|
||||||
Check for subvolumegroups first, then for subvolumes in it
|
|
||||||
|
|
||||||
sudo ceph fs subvolumegroup ls cephfs
|
|
||||||
sudo ceph fs subvolume ls cephfs --group_name csi_raid6
|
|
||||||
|
|
||||||
|
|
||||||
If subvolumes exist, remove each one-by-one:
|
|
||||||
|
|
||||||
sudo ceph fs subvolume rm cephfs <subvol_name> --group_name csi_raid6
|
|
||||||
|
|
||||||
If you have snapshots, remove snapshots first:
|
|
||||||
|
|
||||||
sudo ceph fs subvolume snapshot ls cephfs <subvol_name> --group_name csi_raid6
|
|
||||||
sudo ceph fs subvolume snapshot rm cephfs <subvol_name> <snap_name> --group_name csi_raid6
|
|
||||||
|
|
||||||
Once the group is empty, remove it:
|
|
||||||
|
|
||||||
sudo ceph fs subvolumegroup rm cephfs csi_raid6
|
|
||||||
|
|
||||||
If it complains it’s not empty, go back as there’s still a subvolume or snapshot.
|
|
||||||
|
|
||||||
If you added it with `ceph fs add_data_pool`. Undo with `rm_data_pool`:
|
|
||||||
|
|
||||||
sudo ceph fs rm_data_pool cephfs cephfs_data_csi_raid6
|
|
||||||
|
|
||||||
After it’s detached from CephFS, you can delete it.
|
|
||||||
|
|
||||||
sudo ceph osd pool rm cephfs_data_csi_raid6 cephfs_data_csi_raid6 --yes-i-really-really-mean-it
|
|
||||||
|
|
||||||
|
|
||||||
## creating authentication tokens
|
## creating authentication tokens
|
||||||
|
|
||||||
- this will create a client keyring named media
|
- this will create a client keyring named media
|
||||||
@@ -150,78 +58,3 @@ this will overwrite the current capabilities of a given client.user
|
|||||||
mon 'allow r' \
|
mon 'allow r' \
|
||||||
mds 'allow rw path=/' \
|
mds 'allow rw path=/' \
|
||||||
osd 'allow rw pool=media_data'
|
osd 'allow rw pool=media_data'
|
||||||
|
|
||||||
## adding a new osd on new node
|
|
||||||
|
|
||||||
create the ceph conf (automate this?)
|
|
||||||
|
|
||||||
cat <<EOF | sudo tee /etc/ceph/ceph.conf
|
|
||||||
[global]
|
|
||||||
auth_client_required = cephx
|
|
||||||
auth_cluster_required = cephx
|
|
||||||
auth_service_required = cephx
|
|
||||||
fsid = de96a98f-3d23-465a-a899-86d3d67edab8
|
|
||||||
mon_allow_pool_delete = true
|
|
||||||
mon_initial_members = prodnxsr0009,prodnxsr0010,prodnxsr0011,prodnxsr0012,prodnxsr0013
|
|
||||||
mon_host = 198.18.23.9,198.18.23.10,198.18.23.11,198.18.23.12,198.18.23.13
|
|
||||||
ms_bind_ipv4 = true
|
|
||||||
ms_bind_ipv6 = false
|
|
||||||
osd_crush_chooseleaf_type = 1
|
|
||||||
osd_pool_default_min_size = 2
|
|
||||||
osd_pool_default_size = 3
|
|
||||||
osd_pool_default_pg_num = 128
|
|
||||||
public_network = 198.18.23.1/32,198.18.23.2/32,198.18.23.3/32,198.18.23.4/32,198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,198.18.23.13/32
|
|
||||||
EOF
|
|
||||||
|
|
||||||
ssh to one of the monitor hosts, then transfer the keys required
|
|
||||||
|
|
||||||
sudo cat /etc/ceph/ceph.client.admin.keyring | ssh prodnxsr0003 'sudo tee /etc/ceph/ceph.client.admin.keyring'
|
|
||||||
sudo cat /var/lib/ceph/bootstrap-osd/ceph.keyring | ssh prodnxsr0003 'sudo tee /var/lib/ceph/bootstrap-osd/ceph.keyring'
|
|
||||||
|
|
||||||
assuming we are adding /dev/sda to the cluster, first zap the disk to remove partitions/lvm/metadata
|
|
||||||
|
|
||||||
sudo ceph-volume lvm zap /dev/sda --destroy
|
|
||||||
|
|
||||||
then add it to the cluster
|
|
||||||
|
|
||||||
sudo ceph-volume lvm create --data /dev/sda
|
|
||||||
|
|
||||||
## removing an osd
|
|
||||||
|
|
||||||
check what OSD IDs were on this host (if you know it)
|
|
||||||
|
|
||||||
sudo ceph osd tree
|
|
||||||
|
|
||||||
or check for any DOWN osds
|
|
||||||
|
|
||||||
sudo ceph osd stat
|
|
||||||
sudo ceph health detail
|
|
||||||
|
|
||||||
once you identify the old OSD ID, remove it with these steps, replace X with the actual OSD ID:
|
|
||||||
|
|
||||||
sudo ceph osd out osd.X
|
|
||||||
sudo ceph osd down osd.X
|
|
||||||
sudo ceph osd crush remove osd.X
|
|
||||||
sudo ceph auth del osd.X
|
|
||||||
sudo ceph osd rm osd.X
|
|
||||||
|
|
||||||
|
|
||||||
## maintenance mode for the cluster
|
|
||||||
|
|
||||||
from one node in the cluster disable recovery
|
|
||||||
|
|
||||||
sudo ceph osd set noout
|
|
||||||
sudo ceph osd set nobackfill
|
|
||||||
sudo ceph osd set norecover
|
|
||||||
sudo ceph osd set norebalance
|
|
||||||
sudo ceph osd set nodown
|
|
||||||
sudo ceph osd set pause
|
|
||||||
|
|
||||||
to undo the change, use unset
|
|
||||||
|
|
||||||
sudo ceph osd unset noout
|
|
||||||
sudo ceph osd unset nobackfill
|
|
||||||
sudo ceph osd unset norecover
|
|
||||||
sudo ceph osd unset norebalance
|
|
||||||
sudo ceph osd unset nodown
|
|
||||||
sudo ceph osd unset pause
|
|
||||||
|
|||||||
+31
-8
@@ -88,13 +88,36 @@
|
|||||||
|
|
||||||
# SSH Hostkey Signing
|
# SSH Hostkey Signing
|
||||||
|
|
||||||
The `sshca` ssh engine, its `signhost` role, the `sshca/sign/signhost` policy and
|
## create ssh engine, key, set ttl
|
||||||
the `sshsigner` approle are managed in terraform-vault:
|
vault secrets enable -path=ssh-host-signer ssh
|
||||||
|
vault write ssh-host-signer/config/ca generate_signing_key=true
|
||||||
|
vault secrets tune -max-lease-ttl=87600h ssh-host-signer
|
||||||
|
|
||||||
- `config/ssh_secret_backend/sshca.yaml`
|
## create role
|
||||||
- `config/ssh_secret_backend_role/sshca/signhost.yaml`
|
vault write ssh-host-signer/roles/hostrole \
|
||||||
- `config/auth_approle_role/approle/sshsigner.yaml`
|
key_type=ca \
|
||||||
- `policies/sshca/sign/signhost.yaml`
|
algorithm_signer=rsa-sha2-256 \
|
||||||
|
ttl=87600h \
|
||||||
|
allow_host_certificates=true \
|
||||||
|
allowed_domains="unkin.net" \
|
||||||
|
allow_subdomains=true \
|
||||||
|
allow_baredomains=true
|
||||||
|
|
||||||
## get the sshsigner approle id
|
## create policy to use hostrole
|
||||||
vault read -field=role_id auth/approle/role/sshsigner/role-id
|
cat <<EOF > sshsign-host.hcl
|
||||||
|
path "ssh-host-signer/sign/hostrole" {
|
||||||
|
capabilities = ["create", "update"]
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
vault policy write sshsign-host-policy sshsign-host.hcl
|
||||||
|
|
||||||
|
vault write auth/approle/role/sshsign-host-role \
|
||||||
|
bind_secret_id=false \
|
||||||
|
token_policies="sshsign-host-policy" \
|
||||||
|
token_ttl=30s \
|
||||||
|
token_max_ttl=30s \
|
||||||
|
token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32"
|
||||||
|
|
||||||
|
## get the sshsign-host-role approle id
|
||||||
|
vault read -field=role_id auth/approle/role/sshsign-host-role/role-id
|
||||||
|
|||||||
@@ -30,7 +30,6 @@ hierarchy:
|
|||||||
- "roles/%{::enc_role_tier1}.eyaml"
|
- "roles/%{::enc_role_tier1}.eyaml"
|
||||||
- "roles/%{::enc_role_tier1}.yaml"
|
- "roles/%{::enc_role_tier1}.yaml"
|
||||||
- "virtual/%{facts.virtual}.yaml"
|
- "virtual/%{facts.virtual}.yaml"
|
||||||
- "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.%{facts.os.release.minor}.yaml"
|
|
||||||
- "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"
|
- "os/%{facts.os.name}/%{facts.os.name}%{facts.os.release.major}.yaml"
|
||||||
- "os/%{facts.os.name}/all_releases.yaml"
|
- "os/%{facts.os.name}/all_releases.yaml"
|
||||||
- "common.eyaml"
|
- "common.eyaml"
|
||||||
|
|||||||
@@ -1,9 +1,8 @@
|
|||||||
---
|
---
|
||||||
profiles::accounts::sysadmin::password: ENC[PKCS7,MIIBqQYJKoZIhvcNAQcDoIIBmjCCAZYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAoS7GyofFaXBNTWU+GtSiz4eCX/9j/sh3fDDRgOgNv1qpcQ87ZlTTenbHo9lxeURxKQ2HVVt7IsrBo/SC/WgipAKnliRkkIvo7nfAs+i+kEE8wakjAs0DcB4mhqtIZRuBkLG2Nay//DcG6cltVkbKEEKmKLMkDFZgTWreOZal8nDljpVe1S8QwtwP4/6hKTef5xsOnrisxuffWTXvwYJhj/VXrjdoH7EhtHGLybzEalglkVHEGft/WrrD/0bwJpmR0RegWI4HTsSvGiHgvf5DZJx8fXPZNPnicGtlfA9ccQPuVo17bY4Qf/WIc1A8Ssv4kHSbNIYJKRymI3UFb0Z4wzBsBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBBxDLb6pCGbittkcX6asd/gEBmMcUNupDjSECq5H09YA70eVwWWe0fBqxTxrr2cXCXtRKFvOk8SJmL0xHAWodaLN9+krTWHJcWbAK8JXEPC7rn]
|
profiles::accounts::sysadmin::password: ENC[PKCS7,MIIBqQYJKoZIhvcNAQcDoIIBmjCCAZYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAoS7GyofFaXBNTWU+GtSiz4eCX/9j/sh3fDDRgOgNv1qpcQ87ZlTTenbHo9lxeURxKQ2HVVt7IsrBo/SC/WgipAKnliRkkIvo7nfAs+i+kEE8wakjAs0DcB4mhqtIZRuBkLG2Nay//DcG6cltVkbKEEKmKLMkDFZgTWreOZal8nDljpVe1S8QwtwP4/6hKTef5xsOnrisxuffWTXvwYJhj/VXrjdoH7EhtHGLybzEalglkVHEGft/WrrD/0bwJpmR0RegWI4HTsSvGiHgvf5DZJx8fXPZNPnicGtlfA9ccQPuVo17bY4Qf/WIc1A8Ssv4kHSbNIYJKRymI3UFb0Z4wzBsBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBBxDLb6pCGbittkcX6asd/gEBmMcUNupDjSECq5H09YA70eVwWWe0fBqxTxrr2cXCXtRKFvOk8SJmL0xHAWodaLN9+krTWHJcWbAK8JXEPC7rn]
|
||||||
profiles::accounts::root::password: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAIgzGQLoHrm7JSnWG4vdAtxSuETmnqbV7kUsQS8WCRUwFGenDFkps+OGMnOGEHLzMJzXihLfgfdWwTAI4fp48M+zhTMo9TQkdzZqtbFk3+RjV2jDF0wfe4kVUIpReOq+EkaDSkoRSG8V6hWvszhDHUrJBC9eDhomL0f3xNAWxmy5EIX/uMEvg9Ux5YX+E6k2pEIKnHNoVIaWDojlofSIzIqTSS7l3jQtJhs3YqBzLL1DsoF1kdn+Rwl5kcsKkhV+vzl76wEbpYVZW8lu4bFfP6QHMLPcep2tuUDMCDvARRXD7YyZcAtS7aMuqll+BLAszpWxAA7EU2hgvdr6t2uyVCTCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ4D5oDoyE6LPdjpVtGPoJD4BwfnQ9ORjYFPvHQmt+lgU4jMqh6BhqP0VN3lqVfUpOmiVMIqkO/cYtlwVLKEg36TPCHBSpqvhuahSF5saCVr8JY3xWOAmTSgnNjQOPlGrPnYWYbuRLxVRsU+KUkpAzR0c6VN0wYi6bI85Pcv8yHF3UYA==]
|
profiles::accounts::root::password: ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAM79PRxeAZHrDcSm4eSFqU94/LjuSbdUmJWivX/Pa8GumoW2e/PT9nGHW3p98zHthMgCglk52PECQ+TBKjxr+9dTyNK5ePG6ZJEqSHNRqsPGm+kfQj/hlTmq8vOBaFM5GapD1iTHs5JFbGngI56swKBEVXW9+Z37BjQb2xJuyLsu5Bo/tA0BaOKuCtjq1a6E38bOX+nJ+YF1uZgV9ofAEh1YvkcTmnEWYXFRPWd7AaNcWn03V2pfhGqxc+xydak620I47P+FE+qIY72+aQ6tmLU3X9vyA1HLF2Tv572l4a2i+YIk6nAgQdi+hQKznqNL9M9YV+s1AcmcKLT7cfLrjsjA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCMWrdCWBQgtW3NOEpERwP+gBA3KDiqe4pQq6DwRfsEXQNZ]
|
||||||
profiles::consul::client::secret_id_salt: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAS7pNFRX4onccFaR87zB/eFFORuF22j6xqjyeAqqjgEduYhkt6w5kkz+YfUoHUesU0Q6F2p6HrCSZ8yAsx5M25NCiud9P4hIpjKmOZ4zCNO7uhATh4AQDYw3BrdRwfO+c6jOl5wOiNLCfDBJ0sFT3akCvcuPS1xIoRJq4Gyn+uCbOsMbvSl25ld2xKt1/cqs8gc1d8mkpjwWto7t+qZSUFMCehTbehH3G4a3Q5rvfBoNwv42Wbs676BDcCurDaAzHNqE7pDbOWhGuVOBl+q+BU0Ri/CRkGcTViN9fr8Dc9SveVC6EPsMbw+05/8/NlfzQse3KAwQ34nR9tR2PQw5qEzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB7LywscQtF7cG2nomfEsu9gDDVqJBFP1jAX2eGZ2crYS5gnBcsRwhc0HNo2/WWdhZprMW+vEJOOGXDelI53NxA3o0=]
|
profiles::consul::client::secret_id_salt: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAS7pNFRX4onccFaR87zB/eFFORuF22j6xqjyeAqqjgEduYhkt6w5kkz+YfUoHUesU0Q6F2p6HrCSZ8yAsx5M25NCiud9P4hIpjKmOZ4zCNO7uhATh4AQDYw3BrdRwfO+c6jOl5wOiNLCfDBJ0sFT3akCvcuPS1xIoRJq4Gyn+uCbOsMbvSl25ld2xKt1/cqs8gc1d8mkpjwWto7t+qZSUFMCehTbehH3G4a3Q5rvfBoNwv42Wbs676BDcCurDaAzHNqE7pDbOWhGuVOBl+q+BU0Ri/CRkGcTViN9fr8Dc9SveVC6EPsMbw+05/8/NlfzQse3KAwQ34nR9tR2PQw5qEzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB7LywscQtF7cG2nomfEsu9gDDVqJBFP1jAX2eGZ2crYS5gnBcsRwhc0HNo2/WWdhZprMW+vEJOOGXDelI53NxA3o0=]
|
||||||
profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAO8IIF2r18dFf0bVKEwjJUe1TmXHH0AIzsQHxkHwV7d37kvH1cY9rYw0TtdHn7GTxvotJG7GZbWvbunpBs1g2p2RPADiM6TMhbO8mJ0tAWLnMk7bQ221xu8Pc7KceqWmU17dmgNhVCohyfwJNqbA756TlHVgxGA0LtNrKoLOmgKGXAL1VYZoKEQnWq7xOpO+z3e1UfjoO6CvX/Od2hGYfUkHdro8mwRw4GFKzU7XeKFdAMUGpn5rVmY3xe+1ARXwGFaSrTHzk2n85pvwhPRlQ+OwqzyT19Qo2FNeAO6RoCRIFTtqbsjTWPUlseHIhw4Q5bHO1I0Mrlm5IHDESw/22IzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCEe9wD72qxnpeq5nCi/d7BgDCP29sDFObkFTabt2uZ/nF9MT1g+QOrrdFKgnG6ThnwH1hwpZPsSVgIs+yRQH8laB4=]
|
profiles::consul::token::node_editor::secret_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAO8IIF2r18dFf0bVKEwjJUe1TmXHH0AIzsQHxkHwV7d37kvH1cY9rYw0TtdHn7GTxvotJG7GZbWvbunpBs1g2p2RPADiM6TMhbO8mJ0tAWLnMk7bQ221xu8Pc7KceqWmU17dmgNhVCohyfwJNqbA756TlHVgxGA0LtNrKoLOmgKGXAL1VYZoKEQnWq7xOpO+z3e1UfjoO6CvX/Od2hGYfUkHdro8mwRw4GFKzU7XeKFdAMUGpn5rVmY3xe+1ARXwGFaSrTHzk2n85pvwhPRlQ+OwqzyT19Qo2FNeAO6RoCRIFTtqbsjTWPUlseHIhw4Q5bHO1I0Mrlm5IHDESw/22IzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCEe9wD72qxnpeq5nCi/d7BgDCP29sDFObkFTabt2uZ/nF9MT1g+QOrrdFKgnG6ThnwH1hwpZPsSVgIs+yRQH8laB4=]
|
||||||
profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
|
profiles::consul::server::acl_tokens_initial_management: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAi1UH7AZirJ1PdxWy+KEgS5ufm0wbn2xy9rkg14hKYpcVjBa4pOZpSLMGMiiUpBIqBytDMZM4ezYa/luktpkBImJbM/TE16beGtsacQGA+9eZk2Tihs9GR2qbAQiu5lLITiDlwNnf0GeWdqHM8CTeD68DczQF320d9U14/k6pG/7z+w/MGLcjsQoSuOFTm42JVn1BI46t1CYSCHMXQc/9Tfs+FzI+vumohI8DxAYBIuyzU5HBX/MntAsvD/yixMJS1pZL9WwgqZJC/wK34rVRB39DpxWf/WROrI+WLuSJwr7WBjaeF9Ju+89WKCgsI53EWhFTj8GgDZm/jqPoE478NjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAoACRzJdQKNYXZv6cghFIIgDAzB81DMcuY815nb8POtZpiA06jT/068AoZmSctHoFK/zW9tY229N5r1Tb+WHElqLk=]
|
||||||
profiles::consul::server::acl_tokens_default: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAh4Ag95xgkIZHL0gP9OLnZauih0dB1/2l9Jzw8mP3OiIv7fw23otHYONlS3Emtj7oxW8MKcZGKDCzwCT6T2p+V5wx1n15wr2J+FmL24VbclJwrMPQ4AdgP359B9h21uoyo7Zdy7RuuvLfkU1fWXbs3SeWbi2HJs1Ed1/oI1jzr3OgwMbVtbyzd1VuAXeZ9bHQG3IA8z+w/k5m61th0HTyHjw7eldQulbohDuwv545z9axHEoHKCRT2a3ZwBufV2ST6Dm3g9GERzXE9Adp9DQC5adqM74wfsujOMLK2QFJSSIOj2uCs1CpEnrNrQ8zjP3fudM2z3l7KdSHZazEamCSxTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBY/Tn9tzEKYc5dxnzP2rP7gDBWKgVP3lf2T4Q0WPQt3ns0E6RUSO6OtBegb/5qDyohY2nsDeJTnMKOYzYt/J1PhnY=]
|
profiles::consul::server::acl_tokens_default: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAh4Ag95xgkIZHL0gP9OLnZauih0dB1/2l9Jzw8mP3OiIv7fw23otHYONlS3Emtj7oxW8MKcZGKDCzwCT6T2p+V5wx1n15wr2J+FmL24VbclJwrMPQ4AdgP359B9h21uoyo7Zdy7RuuvLfkU1fWXbs3SeWbi2HJs1Ed1/oI1jzr3OgwMbVtbyzd1VuAXeZ9bHQG3IA8z+w/k5m61th0HTyHjw7eldQulbohDuwv545z9axHEoHKCRT2a3ZwBufV2ST6Dm3g9GERzXE9Adp9DQC5adqM74wfsujOMLK2QFJSSIOj2uCs1CpEnrNrQ8zjP3fudM2z3l7KdSHZazEamCSxTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBY/Tn9tzEKYc5dxnzP2rP7gDBWKgVP3lf2T4Q0WPQt3ns0E6RUSO6OtBegb/5qDyohY2nsDeJTnMKOYzYt/J1PhnY=]
|
||||||
profiles::consul::server::acl_tokens_replication: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzTIxbaAR/TZYnC671aBhiahsfwf3ieyeSHpD5hQm40sMEF/fXlEDijq9i2ykPikm94074j1Uo4HNzv/V9GTf0NSC/64t61jJ/Ya3QKa5f/36+DcRj3lcETsSIyhWwmU+E+zkY8I2r68MtXAuvSoMSMZdpgWSkPx/3FFgZlrsg//bzDu69jS9cx4UK582N3A6QN4Uy/qwYtJcm+2iTQlqqgGRWGqnSgTirxhegxPbJGWTDoAEpAL4/DyF5/hqcUn6mgoSfAsHF3loPHOqN30lG+9o0THWJ9B8Gf4W/1X2UWA/avmUnqBnumGoz0p7AYdNgpW+qLl2rk4lyGYa4kvQjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD9KSLH3Pn/1EIzgVJM+8VOgDDpKWzHfSVsfUMyTD0XIRPGclTdmxqCnsdhKNqmUfSjkYIf2nI9rQtSK6n42TYuO4k=]
|
profiles::consul::server::acl_tokens_replication: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzTIxbaAR/TZYnC671aBhiahsfwf3ieyeSHpD5hQm40sMEF/fXlEDijq9i2ykPikm94074j1Uo4HNzv/V9GTf0NSC/64t61jJ/Ya3QKa5f/36+DcRj3lcETsSIyhWwmU+E+zkY8I2r68MtXAuvSoMSMZdpgWSkPx/3FFgZlrsg//bzDu69jS9cx4UK582N3A6QN4Uy/qwYtJcm+2iTQlqqgGRWGqnSgTirxhegxPbJGWTDoAEpAL4/DyF5/hqcUn6mgoSfAsHF3loPHOqN30lG+9o0THWJ9B8Gf4W/1X2UWA/avmUnqBnumGoz0p7AYdNgpW+qLl2rk4lyGYa4kvQjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD9KSLH3Pn/1EIzgVJM+8VOgDDpKWzHfSVsfUMyTD0XIRPGclTdmxqCnsdhKNqmUfSjkYIf2nI9rQtSK6n42TYuO4k=]
|
||||||
profiles::dns::updater::key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJ4GrN3W4zGfVygfji1MeGyAlmlFN45TVP5st6b66jSKeDYNg9BwdnXahUzkmKvFIYdPWyvXqJdvuyUNz7lWr1dw/pTNHrvqUKSvI0C5TOwmtrTwXtTvucDGs7c7FZDfgUxvLs/Vrp0ZdW3C81QXWNBI8vBfVZyiegPNq+5mX7mtcrFE7jZj1g1qwpg/30lrlCguPyXqnmdtBa7VAyU2Al1UZwkrKIYSAOb9GTnvM6bk5L26pW/NXGj+ffacwf58b4AiKCak5lhoCIInVnlogPuThxULN4RF+MYAVIlgwk159CR1abjWjioxvmP7XgjQUwUuTlgoLh9fDZa0amDeFZTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBEb1BTjhuTN9wGrxc2rdQVgDCctNdt72UR/Hj4wteK7XIX6fF43+7FYKBZnPtyWIWalwDniH//H3gfsJ+ULqSb82w=]
|
|
||||||
|
|||||||
+2
-118
@@ -129,9 +129,6 @@ lookup_options:
|
|||||||
profiles::ceph::client::keyrings:
|
profiles::ceph::client::keyrings:
|
||||||
merge:
|
merge:
|
||||||
strategy: deep
|
strategy: deep
|
||||||
profiles::ceph::conf::config:
|
|
||||||
merge:
|
|
||||||
strategy: deep
|
|
||||||
profiles::nginx::simpleproxy::locations:
|
profiles::nginx::simpleproxy::locations:
|
||||||
merge:
|
merge:
|
||||||
strategy: deep
|
strategy: deep
|
||||||
@@ -146,8 +143,6 @@ lookup_options:
|
|||||||
strategy: deep
|
strategy: deep
|
||||||
profiles::etcd::node::initial_cluster_token:
|
profiles::etcd::node::initial_cluster_token:
|
||||||
convert_to: Sensitive
|
convert_to: Sensitive
|
||||||
profiles::dns::updater::key_secret:
|
|
||||||
convert_to: Sensitive
|
|
||||||
sysctl::base::values:
|
sysctl::base::values:
|
||||||
merge:
|
merge:
|
||||||
strategy: deep
|
strategy: deep
|
||||||
@@ -172,14 +167,6 @@ lookup_options:
|
|||||||
postfix::virtuals:
|
postfix::virtuals:
|
||||||
merge:
|
merge:
|
||||||
strategy: deep
|
strategy: deep
|
||||||
stalwart::postgresql_password:
|
|
||||||
convert_to: Sensitive
|
|
||||||
stalwart::s3_secret_key:
|
|
||||||
convert_to: Sensitive
|
|
||||||
stalwart::fallback_admin_password:
|
|
||||||
convert_to: Sensitive
|
|
||||||
wireguard::interfaces:
|
|
||||||
convert_to: Sensitive
|
|
||||||
|
|
||||||
facts_path: '/opt/puppetlabs/facter/facts.d'
|
facts_path: '/opt/puppetlabs/facter/facts.d'
|
||||||
|
|
||||||
@@ -210,28 +197,8 @@ vault::manage_config_dir: true
|
|||||||
vault::disable_mlock: false
|
vault::disable_mlock: false
|
||||||
|
|
||||||
profiles::dns::base::nameservers:
|
profiles::dns::base::nameservers:
|
||||||
- 198.18.200.7
|
- 198.18.19.16
|
||||||
profiles::dns::master::basedir: '/var/named/sources'
|
profiles::dns::master::basedir: '/var/named/sources'
|
||||||
|
|
||||||
# dns record publishing. During the k8s cutover both methods run; set
|
|
||||||
# manage_export false once k8s is authoritative.
|
|
||||||
# - export: legacy exported-resources -> puppet DNS master
|
|
||||||
# - nsupdate: RFC2136 to the k8s bind-authoritative write endpoint (.9),
|
|
||||||
# inert until the TSIG key is set in eyaml:
|
|
||||||
# profiles::dns::updater::key_secret: ENC[...]
|
|
||||||
# (must match the key the bind-authoritative zones allow-update
|
|
||||||
# with; algorithm hmac-sha256)
|
|
||||||
# k8s is now authoritative: clients resolve via the k8s bind-resolvers
|
|
||||||
# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the
|
|
||||||
# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s
|
|
||||||
# bind-authoritative cluster fed by the nsupdate path below. The legacy
|
|
||||||
# exported-resources -> VM-master /var/named/sources files are no longer in any
|
|
||||||
# client's resolution path, so stop exporting them. Rollback: set back to true.
|
|
||||||
profiles::dns::updater::manage_export: false
|
|
||||||
profiles::dns::updater::manage_nsupdate: true
|
|
||||||
profiles::dns::updater::server: '198.18.200.9'
|
|
||||||
profiles::dns::updater::key_name: 'client-update'
|
|
||||||
profiles::dns::updater::key_algorithm: 'hmac-sha256'
|
|
||||||
#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
|
#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
|
||||||
#profiles::dns::base::use_ns: 'region'
|
#profiles::dns::base::use_ns: 'region'
|
||||||
profiles::consul::server::members_role: roles::infra::storage::consul
|
profiles::consul::server::members_role: roles::infra::storage::consul
|
||||||
@@ -369,7 +336,6 @@ ssh::server::options:
|
|||||||
|
|
||||||
profiles::ssh::knownhosts::lines:
|
profiles::ssh::knownhosts::lines:
|
||||||
- '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1HD97vYxLTniE4qNpGuftUlvmkEXIuX8+7nbENv/IzsGUghEDRtyThjQ7ojNKIsQ7f8wXr0gMcI+fAPfrbcOMHCAoYMomikwL0b3h95SZI40q3CyM+0DMnwiVVDX6C1QxkO2Rv9cszSkCa85NotJhXiUuTBI9BFcRPy+mAhbpAru+bfypYofI0wW97XNTl8Jgwmni5MgutBIQAokFIn5ux8iWxndCH3AqDtmkwC5DfQeQ+wZx7rkwqJEpJffQzrjb1gIM6P9hDCVBBVPh/3o80IJ69rFWrJAZUb+JpG4cXJH0NcSW+wqc3JCT/x3q8VlHwOTXSlNNKtOJCRx73mB8e1XTTy2a9FgpKDDg5XQXWHAViJDz1RTRL9gRefMylRgKz4bXoTuY9kJWM8hPTyUejtukbJThlBJc3OmDxBZBF7F0iqB11pHexok43OCEiANodVa36eWu9/5X032Vm48fZ1/akDPY/NSy3wAn7kwut+A0/JAHFHASrq+1mt9YurkJegI+YHXO6eEWpBIpmI7ORHJbGL4MhkHrxYzVamuP8CkU7tXzsv138+wpOcRHNp9yJY4PT40BZkRf/O3O+jt3pj9Dj8rvgywF2W6hFzywh3Y78upOprRkQlQtHfsI8EyrYI8/hUw2u3H+3yPXh3YjWfqvWVG1BRLRHBV7m90uaw=='
|
- '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1HD97vYxLTniE4qNpGuftUlvmkEXIuX8+7nbENv/IzsGUghEDRtyThjQ7ojNKIsQ7f8wXr0gMcI+fAPfrbcOMHCAoYMomikwL0b3h95SZI40q3CyM+0DMnwiVVDX6C1QxkO2Rv9cszSkCa85NotJhXiUuTBI9BFcRPy+mAhbpAru+bfypYofI0wW97XNTl8Jgwmni5MgutBIQAokFIn5ux8iWxndCH3AqDtmkwC5DfQeQ+wZx7rkwqJEpJffQzrjb1gIM6P9hDCVBBVPh/3o80IJ69rFWrJAZUb+JpG4cXJH0NcSW+wqc3JCT/x3q8VlHwOTXSlNNKtOJCRx73mB8e1XTTy2a9FgpKDDg5XQXWHAViJDz1RTRL9gRefMylRgKz4bXoTuY9kJWM8hPTyUejtukbJThlBJc3OmDxBZBF7F0iqB11pHexok43OCEiANodVa36eWu9/5X032Vm48fZ1/akDPY/NSy3wAn7kwut+A0/JAHFHASrq+1mt9YurkJegI+YHXO6eEWpBIpmI7ORHJbGL4MhkHrxYzVamuP8CkU7tXzsv138+wpOcRHNp9yJY4PT40BZkRf/O3O+jt3pj9Dj8rvgywF2W6hFzywh3Y78upOprRkQlQtHfsI8EyrYI8/hUw2u3H+3yPXh3YjWfqvWVG1BRLRHBV7m90uaw=='
|
||||||
- '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDi80G0GtKMdRj4azPwxbJW46NG0y8seSVSnvFm2Ka/nckdUb/3lRlQuPYf1tkbqqFlcXjDM8+u0tzM2kLsgfn0Dpujm1fuoA66yGGweBjtxLFErH5+6+/KND5I9w8LMY2AtVztnBk/CVx8RwgrooABDRZiBH7OOAOpJqqFI7LvEsv61zC0nAqbYJ8uxfx+r4lJ9dUhK1woitEqC4npSRUn5KJK+KAEd7AzcUkZb6TO9A3oRPz1nQ/qU+QNMmVUi+wRj9kJR18mxErugyLLTNcFDBqSdHNun3eUNBUmoS2cAa8ZVscOLzbUGejVK9UY06Q7wu+J34Fzl8CN5tBqRHGZ3ykqGZ6gG+O0Egr9Rm3Obgkujpio2uTh27LhBy72vjgJ8kTFmPlzANTJFpKlsy91usSFPh8WZeIo6VpPLqnC32rjfNkfqHyPAeJ3+rdOkUZoDjMoZc3wxxLZTgMU5ud1w4LxQNRkNiaT/tRRNQF8o+pygkS7xxKduBBMzYdRS1OifaS4gyvP82oOyquWywhyFNtG7ph8FQwc34puM7FyxfaJ0XL/+zAfPMhDoOojvofADJo73R+FgVyer+mCJw4KtWJ4JzZrNTYz1Xl8WlhF8RDzOYfSH46qzJFa9FcRqgP4LUkgzdvcQ+1hBFpvpHtw3vl3DiqtZDDbK9SyrEtdnw=='
|
|
||||||
|
|
||||||
profiles::base::groups::local:
|
profiles::base::groups::local:
|
||||||
admins:
|
admins:
|
||||||
@@ -403,7 +369,7 @@ networking::route_defaults:
|
|||||||
|
|
||||||
# logging:
|
# logging:
|
||||||
victorialogs::client::journald::enable: true
|
victorialogs::client::journald::enable: true
|
||||||
victorialogs::client::journald::inserturl: https://logs-ingest.k8s.syd1.au.unkin.net:443/insert/journald
|
victorialogs::client::journald::inserturl: https://vlinsert.service.consul:9428/insert/journald
|
||||||
|
|
||||||
# FIXME these are for the proxmox ceph cluster
|
# FIXME these are for the proxmox ceph cluster
|
||||||
profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
|
profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
|
||||||
@@ -412,45 +378,6 @@ profiles::ceph::client::mons:
|
|||||||
- 10.18.15.2
|
- 10.18.15.2
|
||||||
- 10.18.15.3
|
- 10.18.15.3
|
||||||
|
|
||||||
# de96a98f cluster topology (prodnxsr0001-0019) - single source of truth for
|
|
||||||
# /etc/ceph/ceph.conf rendered by profiles::ceph::client on the k8s (osd) and
|
|
||||||
# incus (mon/mgr/mds) roles. fsid/mons are overridden per-role in the role hiera.
|
|
||||||
# public_network is the /32 of every ceph host's ceph-public loopback.
|
|
||||||
profiles::ceph::client::cluster_public_ips:
|
|
||||||
- 198.18.23.1
|
|
||||||
- 198.18.23.2
|
|
||||||
- 198.18.23.3
|
|
||||||
- 198.18.23.4
|
|
||||||
- 198.18.23.5
|
|
||||||
- 198.18.23.6
|
|
||||||
- 198.18.23.7
|
|
||||||
- 198.18.23.8
|
|
||||||
- 198.18.23.9
|
|
||||||
- 198.18.23.10
|
|
||||||
- 198.18.23.11
|
|
||||||
- 198.18.23.12
|
|
||||||
- 198.18.23.13
|
|
||||||
- 198.18.23.14
|
|
||||||
- 198.18.23.15
|
|
||||||
- 198.18.23.16
|
|
||||||
- 198.18.23.17
|
|
||||||
- 198.18.23.18
|
|
||||||
- 198.18.23.19
|
|
||||||
profiles::ceph::client::mon_initial_members:
|
|
||||||
- prodnxsr0009
|
|
||||||
- prodnxsr0010
|
|
||||||
- prodnxsr0011
|
|
||||||
- prodnxsr0012
|
|
||||||
- prodnxsr0013
|
|
||||||
# two mds daemon instances per mon/mgr/mds host (rendered only where
|
|
||||||
# render_mds_config is true, i.e. the incus node role).
|
|
||||||
profiles::ceph::client::mds_instances:
|
|
||||||
prodnxsr0009: 2
|
|
||||||
prodnxsr0010: 2
|
|
||||||
prodnxsr0011: 2
|
|
||||||
prodnxsr0012: 2
|
|
||||||
prodnxsr0013: 2
|
|
||||||
|
|
||||||
profiles::ceph::conf::config:
|
profiles::ceph::conf::config:
|
||||||
global:
|
global:
|
||||||
auth_client_required: 'cephx'
|
auth_client_required: 'cephx'
|
||||||
@@ -471,49 +398,6 @@ profiles::ceph::conf::config:
|
|||||||
198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,
|
198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,
|
||||||
198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,
|
198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,
|
||||||
198.18.23.13/32
|
198.18.23.13/32
|
||||||
client.rgw.ausyd1nxvm2115:
|
|
||||||
rgw_realm: unkin
|
|
||||||
rgw_zonegroup: au
|
|
||||||
rgw_zone: syd1
|
|
||||||
client.rgw.ausyd1nxvm2116:
|
|
||||||
rgw_realm: unkin
|
|
||||||
rgw_zonegroup: au
|
|
||||||
rgw_zone: syd1
|
|
||||||
client.rgw.ausyd1nxvm2117:
|
|
||||||
rgw_realm: unkin
|
|
||||||
rgw_zonegroup: au
|
|
||||||
rgw_zone: syd1
|
|
||||||
client.rgw.ausyd1nxvm2118:
|
|
||||||
rgw_realm: unkin
|
|
||||||
rgw_zonegroup: au
|
|
||||||
rgw_zone: syd1
|
|
||||||
client.rgw.ausyd1nxvm2119:
|
|
||||||
rgw_realm: unkin
|
|
||||||
rgw_zonegroup: au
|
|
||||||
rgw_zone: syd1
|
|
||||||
mds:
|
|
||||||
keyring: /var/lib/ceph/mds/ceph-$id/keyring
|
|
||||||
mds_standby_replay: true
|
|
||||||
mds.prodnxsr0009-1:
|
|
||||||
host: prodnxsr0009
|
|
||||||
mds.prodnxsr0009-2:
|
|
||||||
host: prodnxsr0009
|
|
||||||
mds.prodnxsr0010-1:
|
|
||||||
host: prodnxsr0010
|
|
||||||
mds.prodnxsr0010-2:
|
|
||||||
host: prodnxsr0010
|
|
||||||
mds.prodnxsr0011-1:
|
|
||||||
host: prodnxsr0011
|
|
||||||
mds.prodnxsr0011-2:
|
|
||||||
host: prodnxsr0011
|
|
||||||
mds.prodnxsr0012-1:
|
|
||||||
host: prodnxsr0012
|
|
||||||
mds.prodnxsr0012-2:
|
|
||||||
host: prodnxsr0012
|
|
||||||
mds.prodnxsr0013-1:
|
|
||||||
host: prodnxsr0013
|
|
||||||
mds.prodnxsr0013-2:
|
|
||||||
host: prodnxsr0013
|
|
||||||
|
|
||||||
#profiles::base::hosts::additional_hosts:
|
#profiles::base::hosts::additional_hosts:
|
||||||
# - ip: 198.18.17.9
|
# - ip: 198.18.17.9
|
||||||
|
|||||||
@@ -2,16 +2,6 @@
|
|||||||
timezone::timezone: 'Australia/Sydney'
|
timezone::timezone: 'Australia/Sydney'
|
||||||
certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
|
certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
|
||||||
profiles_dns_upstream_forwarder_unkin:
|
profiles_dns_upstream_forwarder_unkin:
|
||||||
- 198.18.200.7
|
- 198.18.19.15
|
||||||
profiles_dns_upstream_forwarder_consul:
|
profiles_dns_upstream_forwarder_consul:
|
||||||
- 198.18.19.14
|
- 198.18.19.14
|
||||||
profiles_dns_upstream_forwarder_k8s:
|
|
||||||
- 198.18.19.20
|
|
||||||
profiles::consul::client::members_lookup: false
|
|
||||||
# static: k8s-compiled hosts can't see the servers in PuppetDB; update when servers change
|
|
||||||
profiles::consul::client::consul_servers:
|
|
||||||
- ausyd1nxvm2005.main.unkin.net
|
|
||||||
- ausyd1nxvm2006.main.unkin.net
|
|
||||||
- ausyd1nxvm2007.main.unkin.net
|
|
||||||
- ausyd1nxvm2008.main.unkin.net
|
|
||||||
- ausyd1nxvm2009.main.unkin.net
|
|
||||||
|
|||||||
@@ -1,9 +1,16 @@
|
|||||||
---
|
---
|
||||||
haproxy_server_k8s_syd1_traefik_internal: 'k8s-traefik-internal 198.18.200.4:443 ssl verify none check inter 2s rise 3 fall 2'
|
|
||||||
haproxy_server_k8s_syd1_traefik_external: 'k8s-traefik-external 198.18.199.0:443 ssl verify none check inter 2s rise 3 fall 2'
|
|
||||||
|
|
||||||
profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
|
profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
|
||||||
profiles::haproxy::dns::vrrp_cnames: []
|
profiles::haproxy::dns::vrrp_cnames:
|
||||||
|
- sonarr.main.unkin.net
|
||||||
|
- radarr.main.unkin.net
|
||||||
|
- lidarr.main.unkin.net
|
||||||
|
- readarr.main.unkin.net
|
||||||
|
- prowlarr.main.unkin.net
|
||||||
|
- nzbget.main.unkin.net
|
||||||
|
- git.unkin.net
|
||||||
|
- fafflix.unkin.net
|
||||||
|
- grafana.unkin.net
|
||||||
|
- dashboard.ceph.unkin.net
|
||||||
|
|
||||||
profiles::haproxy::mappings:
|
profiles::haproxy::mappings:
|
||||||
fe_http:
|
fe_http:
|
||||||
@@ -22,10 +29,6 @@ profiles::haproxy::mappings:
|
|||||||
- 'git.unkin.net be_gitea'
|
- 'git.unkin.net be_gitea'
|
||||||
- 'grafana.unkin.net be_grafana'
|
- 'grafana.unkin.net be_grafana'
|
||||||
- 'dashboard.ceph.unkin.net be_ceph_dashboard'
|
- 'dashboard.ceph.unkin.net be_ceph_dashboard'
|
||||||
- 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
|
|
||||||
- 'autoconfig.main.unkin.net be_stalwart_webadmin'
|
|
||||||
- 'autodiscovery.main.unkin.net be_stalwart_webadmin'
|
|
||||||
- 'auth.unkin.net be_k8s_kanidm'
|
|
||||||
fe_https:
|
fe_https:
|
||||||
ensure: present
|
ensure: present
|
||||||
mappings:
|
mappings:
|
||||||
@@ -42,10 +45,6 @@ profiles::haproxy::mappings:
|
|||||||
- 'git.unkin.net be_gitea'
|
- 'git.unkin.net be_gitea'
|
||||||
- 'grafana.unkin.net be_grafana'
|
- 'grafana.unkin.net be_grafana'
|
||||||
- 'dashboard.ceph.unkin.net be_ceph_dashboard'
|
- 'dashboard.ceph.unkin.net be_ceph_dashboard'
|
||||||
- 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
|
|
||||||
- 'autoconfig.main.unkin.net be_stalwart_webadmin'
|
|
||||||
- 'autodiscovery.main.unkin.net be_stalwart_webadmin'
|
|
||||||
- 'auth.unkin.net be_k8s_kanidm'
|
|
||||||
|
|
||||||
profiles::haproxy::frontends:
|
profiles::haproxy::frontends:
|
||||||
fe_http:
|
fe_http:
|
||||||
@@ -67,10 +66,6 @@ profiles::haproxy::frontends:
|
|||||||
- 'acl_gitea req.hdr(host) -i git.unkin.net'
|
- 'acl_gitea req.hdr(host) -i git.unkin.net'
|
||||||
- 'acl_grafana req.hdr(host) -i grafana.unkin.net'
|
- 'acl_grafana req.hdr(host) -i grafana.unkin.net'
|
||||||
- 'acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net'
|
- 'acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net'
|
||||||
- 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
|
|
||||||
- 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
|
|
||||||
- 'acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net'
|
|
||||||
- 'acl_kanidm req.hdr(host) -i auth.unkin.net'
|
|
||||||
- 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
|
- 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
|
||||||
use_backend:
|
use_backend:
|
||||||
- "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
|
- "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
|
||||||
@@ -89,8 +84,6 @@ profiles::haproxy::frontends:
|
|||||||
- 'set-header X-Frame-Options DENY if acl_gitea'
|
- 'set-header X-Frame-Options DENY if acl_gitea'
|
||||||
- 'set-header X-Frame-Options DENY if acl_grafana'
|
- 'set-header X-Frame-Options DENY if acl_grafana'
|
||||||
- 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
|
- 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
|
||||||
- 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
|
|
||||||
- 'set-header X-Frame-Options DENY if acl_kanidm'
|
|
||||||
- 'set-header X-Content-Type-Options nosniff'
|
- 'set-header X-Content-Type-Options nosniff'
|
||||||
- 'set-header X-XSS-Protection 1;mode=block'
|
- 'set-header X-XSS-Protection 1;mode=block'
|
||||||
|
|
||||||
@@ -293,103 +286,7 @@ profiles::haproxy::backends:
|
|||||||
- add-header X-Forwarded-Proto https if { dst_port 9443 }
|
- add-header X-Forwarded-Proto https if { dst_port 9443 }
|
||||||
redirect: 'scheme https if !{ ssl_fc }'
|
redirect: 'scheme https if !{ ssl_fc }'
|
||||||
stick-table: 'type ip size 200k expire 30m'
|
stick-table: 'type ip size 200k expire 30m'
|
||||||
be_stalwart_webadmin:
|
|
||||||
description: Backend for Stalwart Webadmin
|
|
||||||
collect_exported: false # handled in custom function
|
|
||||||
options:
|
|
||||||
balance: roundrobin
|
|
||||||
option:
|
|
||||||
- httpchk GET /
|
|
||||||
- forwardfor
|
|
||||||
- http-keep-alive
|
|
||||||
- prefer-last-server
|
|
||||||
cookie: SRVNAME insert indirect nocache
|
|
||||||
http-reuse: always
|
|
||||||
http-check:
|
|
||||||
- expect status 200
|
|
||||||
http-request:
|
|
||||||
- set-header X-Forwarded-Port %[dst_port]
|
|
||||||
- add-header X-Forwarded-Proto https if { dst_port 9443 }
|
|
||||||
redirect: 'scheme https if !{ ssl_fc }'
|
|
||||||
stick-table: 'type ip size 200k expire 30m'
|
|
||||||
be_k8s_kanidm:
|
|
||||||
description: Backend for Kanidm (auth.unkin.net via Kubernetes internal Traefik)
|
|
||||||
collect_exported: false
|
|
||||||
options:
|
|
||||||
balance: roundrobin
|
|
||||||
option:
|
|
||||||
- httpchk
|
|
||||||
- forwardfor
|
|
||||||
- http-keep-alive
|
|
||||||
- prefer-last-server
|
|
||||||
http-check:
|
|
||||||
- 'connect ssl sni auth.unkin.net'
|
|
||||||
- 'send meth GET uri /status ver HTTP/1.1 hdr Host auth.unkin.net'
|
|
||||||
- 'expect status 200'
|
|
||||||
http-reuse: always
|
|
||||||
http-request:
|
|
||||||
- set-header X-Forwarded-Port %[dst_port]
|
|
||||||
- add-header X-Forwarded-Proto https if { dst_port 443 }
|
|
||||||
redirect: 'scheme https if !{ ssl_fc }'
|
|
||||||
server: "%{lookup('haproxy_server_k8s_syd1_traefik_internal')} sni str(auth.unkin.net)"
|
|
||||||
be_stalwart_imap:
|
|
||||||
description: Backend for Stalwart IMAP (STARTTLS)
|
|
||||||
collect_exported: false
|
|
||||||
options:
|
|
||||||
mode: tcp
|
|
||||||
balance: roundrobin
|
|
||||||
option:
|
|
||||||
- tcp-check
|
|
||||||
- prefer-last-server
|
|
||||||
stick-table: 'type ip size 200k expire 30m'
|
|
||||||
stick: 'on src'
|
stick: 'on src'
|
||||||
tcp-check:
|
|
||||||
- connect port 143 send-proxy
|
|
||||||
- expect string "* OK"
|
|
||||||
- send "A001 STARTTLS\r\n"
|
|
||||||
- expect rstring "A001 (OK|2.0.0)"
|
|
||||||
be_stalwart_imaps:
|
|
||||||
description: Backend for Stalwart IMAPS (implicit TLS)
|
|
||||||
collect_exported: false
|
|
||||||
options:
|
|
||||||
mode: tcp
|
|
||||||
balance: roundrobin
|
|
||||||
option:
|
|
||||||
- tcp-check
|
|
||||||
- prefer-last-server
|
|
||||||
stick-table: 'type ip size 200k expire 30m'
|
|
||||||
stick: 'on src'
|
|
||||||
tcp-check:
|
|
||||||
- connect ssl send-proxy
|
|
||||||
- expect string "* OK"
|
|
||||||
be_stalwart_smtp:
|
|
||||||
description: Backend for Stalwart SMTP
|
|
||||||
collect_exported: false
|
|
||||||
options:
|
|
||||||
mode: tcp
|
|
||||||
balance: roundrobin
|
|
||||||
option:
|
|
||||||
- tcp-check
|
|
||||||
- prefer-last-server
|
|
||||||
stick-table: 'type ip size 200k expire 30m'
|
|
||||||
stick: 'on src'
|
|
||||||
tcp-check:
|
|
||||||
- connect port 25 send-proxy
|
|
||||||
- expect string "220 "
|
|
||||||
be_stalwart_submission:
|
|
||||||
description: Backend for Stalwart SMTP Submission
|
|
||||||
collect_exported: false
|
|
||||||
options:
|
|
||||||
mode: tcp
|
|
||||||
balance: roundrobin
|
|
||||||
option:
|
|
||||||
- tcp-check
|
|
||||||
- prefer-last-server
|
|
||||||
stick-table: 'type ip size 200k expire 30m'
|
|
||||||
stick: 'on src'
|
|
||||||
tcp-check:
|
|
||||||
- connect port 587 send-proxy
|
|
||||||
- expect string "220 "
|
|
||||||
|
|
||||||
profiles::haproxy::certlist::enabled: true
|
profiles::haproxy::certlist::enabled: true
|
||||||
profiles::haproxy::certlist::certificates:
|
profiles::haproxy::certlist::certificates:
|
||||||
@@ -405,7 +302,6 @@ profiles::haproxy::certlist::certificates:
|
|||||||
- /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
|
- /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
|
||||||
- /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
|
- /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
|
||||||
- /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
|
- /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
|
||||||
- /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
|
|
||||||
- /etc/pki/tls/vault/certificate.pem
|
- /etc/pki/tls/vault/certificate.pem
|
||||||
|
|
||||||
# additional altnames
|
# additional altnames
|
||||||
@@ -413,10 +309,11 @@ profiles::pki::vault::alt_names:
|
|||||||
- au-syd1-pve.main.unkin.net
|
- au-syd1-pve.main.unkin.net
|
||||||
- au-syd1-pve-api.main.unkin.net
|
- au-syd1-pve-api.main.unkin.net
|
||||||
- jellyfin.main.unkin.net
|
- jellyfin.main.unkin.net
|
||||||
- mail-webadmin.main.unkin.net
|
|
||||||
|
|
||||||
# additional cnames
|
# additional cnames
|
||||||
profiles::haproxy::dns::cnames: []
|
profiles::haproxy::dns::cnames:
|
||||||
|
- au-syd1-pve.main.unkin.net
|
||||||
|
- au-syd1-pve-api.main.unkin.net
|
||||||
|
|
||||||
# letsencrypt certificates
|
# letsencrypt certificates
|
||||||
certbot::client::service: haproxy
|
certbot::client::service: haproxy
|
||||||
@@ -433,4 +330,3 @@ certbot::client::domains:
|
|||||||
- git.unkin.net
|
- git.unkin.net
|
||||||
- grafana.unkin.net
|
- grafana.unkin.net
|
||||||
- dashboard.ceph.unkin.net
|
- dashboard.ceph.unkin.net
|
||||||
- auth.unkin.net
|
|
||||||
|
|||||||
@@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
profiles::postfix::gateway::myhostname: 'mta2.edge.unkin.net'
|
|
||||||
profiles::pki::vault::alt_names:
|
|
||||||
- mta2.edge.unkin.net
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
---
|
|
||||||
# Canary for the puppet-on-k8s migration (roles::base test host).
|
|
||||||
profiles::puppet::migrate::enabled: true
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
profiles::postfix::gateway::myhostname: 'mta1.edge.unkin.net'
|
|
||||||
profiles::pki::vault::alt_names:
|
|
||||||
- mta1.edge.unkin.net
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
networking_loopback0_ip: 198.18.19.21 # management loopback
|
|
||||||
networking_loopback1_ip: 198.18.22.14 # ceph-cluster loopback
|
|
||||||
networking_loopback2_ip: 198.18.23.14 # ceph-public loopback
|
|
||||||
networking_1000_ip: 198.18.15.14 # 1gbe network
|
|
||||||
networking_2500_ip: 198.18.21.14 # 2.5gbe network
|
|
||||||
networking_1000_iface: enp1s0
|
|
||||||
networking_2500_iface: enp2s0
|
|
||||||
networking::interfaces:
|
|
||||||
"%{hiera('networking_1000_iface')}":
|
|
||||||
mac: a4:bb:6d:a4:e5:c1
|
|
||||||
"%{hiera('networking_2500_iface')}":
|
|
||||||
mac: c4:62:37:0d:50:03
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
networking_loopback0_ip: 198.18.19.22 # management loopback
|
|
||||||
networking_loopback1_ip: 198.18.22.15 # ceph-cluster loopback
|
|
||||||
networking_loopback2_ip: 198.18.23.15 # ceph-public loopback
|
|
||||||
networking_1000_ip: 198.18.15.15 # 1gbe network
|
|
||||||
networking_2500_ip: 198.18.21.15 # 2.5gbe network
|
|
||||||
networking_1000_iface: enp1s0
|
|
||||||
networking_2500_iface: enp2s0
|
|
||||||
networking::interfaces:
|
|
||||||
"%{hiera('networking_1000_iface')}":
|
|
||||||
mac: a4:bb:6d:a6:30:c4
|
|
||||||
"%{hiera('networking_2500_iface')}":
|
|
||||||
mac: c4:62:37:0d:4f:f4
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
networking_loopback0_ip: 198.18.19.23 # management loopback
|
|
||||||
networking_loopback1_ip: 198.18.22.16 # ceph-cluster loopback
|
|
||||||
networking_loopback2_ip: 198.18.23.16 # ceph-public loopback
|
|
||||||
networking_1000_ip: 198.18.15.16 # 1gbe network
|
|
||||||
networking_2500_ip: 198.18.21.16 # 2.5gbe network
|
|
||||||
networking_1000_iface: enp1s0
|
|
||||||
networking_2500_iface: enp2s0
|
|
||||||
networking::interfaces:
|
|
||||||
"%{hiera('networking_1000_iface')}":
|
|
||||||
mac: a4:bb:6d:9f:22:13
|
|
||||||
"%{hiera('networking_2500_iface')}":
|
|
||||||
mac: c4:62:37:0d:50:0c
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
networking_loopback0_ip: 198.18.19.24 # management loopback
|
|
||||||
networking_loopback1_ip: 198.18.22.17 # ceph-cluster loopback
|
|
||||||
networking_loopback2_ip: 198.18.23.17 # ceph-public loopback
|
|
||||||
networking_1000_ip: 198.18.15.17 # 1gbe network
|
|
||||||
networking_2500_ip: 198.18.21.17 # 2.5gbe network
|
|
||||||
networking_1000_iface: enp1s0
|
|
||||||
networking_2500_iface: enp2s0
|
|
||||||
networking::interfaces:
|
|
||||||
"%{hiera('networking_1000_iface')}":
|
|
||||||
mac: 8c:04:ba:9c:b6:08
|
|
||||||
"%{hiera('networking_2500_iface')}":
|
|
||||||
mac: c4:62:37:0d:50:12
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
networking_loopback0_ip: 198.18.19.25 # management loopback
|
|
||||||
networking_loopback1_ip: 198.18.22.18 # ceph-cluster loopback
|
|
||||||
networking_loopback2_ip: 198.18.23.18 # ceph-public loopback
|
|
||||||
networking_1000_ip: 198.18.15.18 # 1gbe network
|
|
||||||
networking_2500_ip: 198.18.21.18 # 2.5gbe network
|
|
||||||
networking_1000_iface: enp1s0
|
|
||||||
networking_2500_iface: enp2s0
|
|
||||||
networking::interfaces:
|
|
||||||
"%{hiera('networking_1000_iface')}":
|
|
||||||
mac: a4:bb:6d:a4:db:94
|
|
||||||
"%{hiera('networking_2500_iface')}":
|
|
||||||
mac: c4:62:37:0d:4f:fa
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
networking_loopback0_ip: 198.18.19.26 # management loopback
|
|
||||||
networking_loopback1_ip: 198.18.22.19 # ceph-cluster loopback
|
|
||||||
networking_loopback2_ip: 198.18.23.19 # ceph-public loopback
|
|
||||||
networking_1000_ip: 198.18.15.19 # 1gbe network
|
|
||||||
networking_2500_ip: 198.18.21.19 # 2.5gbe network
|
|
||||||
networking_1000_iface: enp1s0
|
|
||||||
networking_2500_iface: enp2s0
|
|
||||||
networking::interfaces:
|
|
||||||
"%{hiera('networking_1000_iface')}":
|
|
||||||
mac: a4:bb:6d:a4:56:11
|
|
||||||
"%{hiera('networking_2500_iface')}":
|
|
||||||
mac: c4:62:37:0d:50:00
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
---
|
|
||||||
# primary interface is the WAN uplink; pin host identity to the dum0 loopback
|
|
||||||
networking_loopback0_ip: 198.18.2.160
|
|
||||||
networking_loopback1_ip: 198.18.21.160
|
|
||||||
|
|
||||||
# dns: keep the local dnsmasq resolver
|
|
||||||
profiles::dns::base::nameservers:
|
|
||||||
- 127.0.0.1
|
|
||||||
profiles::dns::base::search:
|
|
||||||
- main.unkin.net
|
|
||||||
profiles::dns::base::primary_interface: dum0
|
|
||||||
profiles::dns::updater::deny_ranges:
|
|
||||||
- 198.18.199.0/24
|
|
||||||
- 198.18.200.0/24
|
|
||||||
- 10.42.0.0/16
|
|
||||||
- 10.43.0.0/16
|
|
||||||
- 10.10.12.0/24 # wg0
|
|
||||||
- 103.216.190.0/23 # wan uplink
|
|
||||||
profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"
|
|
||||||
|
|
||||||
# ssh: listen on localhost and dum0 only; knock out the common wan primary ip
|
|
||||||
lookup_options:
|
|
||||||
ssh::server::options:
|
|
||||||
merge:
|
|
||||||
strategy: deep
|
|
||||||
knockout_prefix: '--'
|
|
||||||
ssh::server::options:
|
|
||||||
ListenAddress:
|
|
||||||
- "--%{facts.networking.ip}"
|
|
||||||
- 127.0.0.1
|
|
||||||
- "%{hiera('networking_loopback0_ip')}"
|
|
||||||
profiles::ssh::sign::principals:
|
|
||||||
- "%{hiera('networking_loopback0_ip')}"
|
|
||||||
|
|
||||||
# frrouting
|
|
||||||
frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
|
|
||||||
frrouting::ospfd_interfaces:
|
|
||||||
dum0:
|
|
||||||
area: 0.0.0.0
|
|
||||||
dum1:
|
|
||||||
area: 0.0.0.0
|
|
||||||
bond0.201:
|
|
||||||
area: 0.0.0.0
|
|
||||||
frrouting::ospf_preferred_source_enable: true
|
|
||||||
frrouting::ospf_preferred_source: "%{hiera('networking_loopback1_ip')}"
|
|
||||||
@@ -1,10 +1,23 @@
|
|||||||
# hieradata/os/AlmaLinux/AlmaLinux8.yaml
|
# hieradata/os/AlmaLinux/AlmaLinux8.yaml
|
||||||
---
|
---
|
||||||
crypto_policies::policy: 'DEFAULT'
|
crypto_policies::policy: 'DEFAULT'
|
||||||
almalinux-base-repo: almalinux
|
|
||||||
profiles::packages::include:
|
profiles::packages::include:
|
||||||
network-scripts: {}
|
network-scripts: {}
|
||||||
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
powertools:
|
powertools:
|
||||||
ensure: present
|
name: powertools
|
||||||
|
descr: powertools repository
|
||||||
|
target: /etc/yum.repos.d/powertools.repo
|
||||||
|
baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
|
||||||
|
gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||||
|
mirrorlist: absent
|
||||||
|
unkin:
|
||||||
|
name: unkin
|
||||||
|
descr: unkin repository
|
||||||
|
target: /etc/yum.repos.d/unkin.repo
|
||||||
|
baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el8
|
||||||
|
gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
|
||||||
|
gpgcheck: false
|
||||||
|
mirrorlist: absent
|
||||||
|
|||||||
@@ -1,2 +0,0 @@
|
|||||||
---
|
|
||||||
almalinux-base-repo: almalinux-vault
|
|
||||||
@@ -1,7 +1,36 @@
|
|||||||
# hieradata/os/AlmaLinux/AlmaLinux9.yaml
|
# hieradata/os/AlmaLinux/AlmaLinux9.yaml
|
||||||
---
|
---
|
||||||
crypto_policies::policy: 'DEFAULT:SHA1'
|
crypto_policies::policy: 'DEFAULT:SHA1'
|
||||||
almalinux-base-repo: almalinux
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
|
baseos:
|
||||||
|
baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os/
|
||||||
|
gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
|
||||||
|
mirrorlist: absent
|
||||||
|
extras:
|
||||||
|
baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os/
|
||||||
|
gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
|
||||||
|
mirrorlist: absent
|
||||||
|
appstream:
|
||||||
|
baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os/
|
||||||
|
gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
|
||||||
|
mirrorlist: absent
|
||||||
|
highavailability:
|
||||||
|
baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os/
|
||||||
|
gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
|
||||||
|
mirrorlist: absent
|
||||||
crb:
|
crb:
|
||||||
ensure: present
|
name: crb
|
||||||
|
descr: crb repository
|
||||||
|
target: /etc/yum.repos.d/crb.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os/
|
||||||
|
gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
|
||||||
|
mirrorlist: absent
|
||||||
|
unkin:
|
||||||
|
name: unkin
|
||||||
|
descr: unkin repository
|
||||||
|
target: /etc/yum.repos.d/unkin.repo
|
||||||
|
baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el9
|
||||||
|
gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
|
||||||
|
gpgcheck: false
|
||||||
|
mirrorlist: absent
|
||||||
|
|||||||
@@ -23,278 +23,42 @@ profiles::yum::global::repos:
|
|||||||
name: baseos
|
name: baseos
|
||||||
descr: baseos repository
|
descr: baseos repository
|
||||||
target: /etc/yum.repos.d/baseos.repo
|
target: /etc/yum.repos.d/baseos.repo
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/
|
baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||||
mirrorlist: absent
|
mirrorlist: absent
|
||||||
extras:
|
extras:
|
||||||
name: extras
|
name: extras
|
||||||
descr: extras repository
|
descr: extras repository
|
||||||
target: /etc/yum.repos.d/extras.repo
|
target: /etc/yum.repos.d/extras.repo
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/
|
baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/extras/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||||
mirrorlist: absent
|
mirrorlist: absent
|
||||||
appstream:
|
appstream:
|
||||||
name: appstream
|
name: appstream
|
||||||
descr: appstream repository
|
descr: appstream repository
|
||||||
target: /etc/yum.repos.d/appstream.repo
|
target: /etc/yum.repos.d/appstream.repo
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/
|
baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||||
mirrorlist: absent
|
mirrorlist: absent
|
||||||
highavailability:
|
highavailability:
|
||||||
name: highavailability
|
name: highavailability
|
||||||
descr: highavailability repository
|
descr: highavailability repository
|
||||||
target: /etc/yum.repos.d/highavailability.repo
|
target: /etc/yum.repos.d/highavailability.repo
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/
|
baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
||||||
mirrorlist: absent
|
|
||||||
crb:
|
|
||||||
ensure: absent
|
|
||||||
name: crb
|
|
||||||
descr: crb repository
|
|
||||||
target: /etc/yum.repos.d/crb.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/CRB/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
|
||||||
mirrorlist: absent
|
|
||||||
powertools:
|
|
||||||
ensure: absent
|
|
||||||
name: powertools
|
|
||||||
descr: powertools repository
|
|
||||||
target: /etc/yum.repos.d/powertools.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/%{lookup('almalinux-base-repo')}/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
|
|
||||||
mirrorlist: absent
|
mirrorlist: absent
|
||||||
epel:
|
epel:
|
||||||
name: epel
|
name: epel
|
||||||
descr: epel repository
|
descr: epel repository
|
||||||
target: /etc/yum.repos.d/epel.repo
|
target: /etc/yum.repos.d/epel.repo
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
|
baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
|
gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
|
||||||
mirrorlist: absent
|
mirrorlist: absent
|
||||||
rpm-internal:
|
unkinben:
|
||||||
name: rpm-internal
|
name: unkinben
|
||||||
descr: rpm-internal repository
|
descr: unkinben repository
|
||||||
target: /etc/yum.repos.d/rpm-internal.repo
|
target: /etc/yum.repos.d/unkin.repo
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
|
baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
|
||||||
|
gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
|
||||||
gpgcheck: false
|
gpgcheck: false
|
||||||
mirrorlist: absent
|
mirrorlist: absent
|
||||||
metadata_expire: '60'
|
|
||||||
rpm-vendor:
|
|
||||||
name: rpm-vendor
|
|
||||||
descr: rpm-vendor repository
|
|
||||||
target: /etc/yum.repos.d/rpm-vendor.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
metadata_expire: '60'
|
|
||||||
# Per-release variants, resolved from the host's EL major version so el8
|
|
||||||
# hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
|
|
||||||
rpm-internal-release:
|
|
||||||
name: rpm-internal-el%{facts.os.release.major}
|
|
||||||
descr: rpm-internal-el%{facts.os.release.major} repository
|
|
||||||
target: /etc/yum.repos.d/rpm-internal-release.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
metadata_expire: '60'
|
|
||||||
rpm-vendor-release:
|
|
||||||
name: rpm-vendor-el%{facts.os.release.major}
|
|
||||||
descr: rpm-vendor-el%{facts.os.release.major} repository
|
|
||||||
target: /etc/yum.repos.d/rpm-vendor-release.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
metadata_expire: '60'
|
|
||||||
|
|
||||||
# Additional repositories - default to absent, roles can override with ensure: present
|
|
||||||
# FRRouting repositories
|
|
||||||
frr-extras:
|
|
||||||
ensure: absent
|
|
||||||
name: frr-extras
|
|
||||||
descr: frr-extras repository
|
|
||||||
target: /etc/yum.repos.d/frr-extras.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/frr/el%{facts.os.release.major}/extras
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
frr-stable:
|
|
||||||
ensure: absent
|
|
||||||
name: frr-stable
|
|
||||||
descr: frr-stable repository
|
|
||||||
target: /etc/yum.repos.d/frr-stable.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/frr/el%{facts.os.release.major}/frr
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
|
|
||||||
# PostgreSQL repositories
|
|
||||||
postgresql-15:
|
|
||||||
ensure: absent
|
|
||||||
name: postgresql-15
|
|
||||||
descr: postgresql-15 repository
|
|
||||||
target: /etc/yum.repos.d/postgresql.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/15/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
|
|
||||||
postgresql-17:
|
|
||||||
ensure: absent
|
|
||||||
name: postgresql-17
|
|
||||||
descr: postgresql-17 repository
|
|
||||||
target: /etc/yum.repos.d/postgresql.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/17/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
|
|
||||||
postgresql-common:
|
|
||||||
ensure: absent
|
|
||||||
name: postgresql-common
|
|
||||||
descr: postgresql-common repository
|
|
||||||
target: /etc/yum.repos.d/postgresql.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/common/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
|
|
||||||
|
|
||||||
# Rspamd repositories
|
|
||||||
rspamd:
|
|
||||||
ensure: absent
|
|
||||||
name: rspamd
|
|
||||||
descr: rspamd repository
|
|
||||||
target: /etc/yum.repos.d/rspamd.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm-stable/centos-%{facts.os.release.major}/x86_64
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm/rspamd.asc
|
|
||||||
gpgcheck: 1
|
|
||||||
repo_gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
|
|
||||||
# Ceph repositories
|
|
||||||
ceph:
|
|
||||||
ensure: absent
|
|
||||||
name: ceph
|
|
||||||
descr: ceph repository
|
|
||||||
target: /etc/yum.repos.d/ceph.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/ceph-reef/el%{facts.os.release.major}/%{facts.os.architecture}
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
ceph-noarch:
|
|
||||||
ensure: absent
|
|
||||||
name: ceph-noarch
|
|
||||||
descr: ceph noarch repository
|
|
||||||
target: /etc/yum.repos.d/ceph.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/ceph-reef/el%{facts.os.release.major}/noarch
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
|
|
||||||
# Rancher RKE2 repositories
|
|
||||||
rancher-rke2-common-latest:
|
|
||||||
ensure: absent
|
|
||||||
name: rancher-rke2-common
|
|
||||||
descr: rancher-rke2-common repository
|
|
||||||
target: /etc/yum.repos.d/rancher-rke2-common.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/rke2/latest/common/centos/%{facts.os.release.major}/noarch
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/public.key
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
rancher-rke2-1-33-latest:
|
|
||||||
ensure: absent
|
|
||||||
name: rancher-rke2-1.33-latest
|
|
||||||
descr: rancher-rke2-1.33-latest repository
|
|
||||||
target: /etc/yum.repos.d/rancher-rke2.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/rke2/latest/1.33/centos/%{facts.os.release.major}/%{facts.os.architecture}
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rke2/public.key
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
|
|
||||||
# CentOS repositories for legacy systems
|
|
||||||
centos_8_advanced_virtualization:
|
|
||||||
ensure: absent
|
|
||||||
name: centos_8_advanced_virtualization
|
|
||||||
descr: centos_8_advanced_virtualization repository
|
|
||||||
target: /etc/yum.repos.d/centos.repo
|
|
||||||
baseurl: https://edgecache.query.consul/centos/8/virt/x86_64/advanced-virtualization
|
|
||||||
gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Virtualization
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
centos_8_ceph_pacific:
|
|
||||||
ensure: absent
|
|
||||||
name: centos_8_ceph_pacific
|
|
||||||
descr: centos_8_ceph_pacific repository
|
|
||||||
target: /etc/yum.repos.d/centos.repo
|
|
||||||
baseurl: https://edgecache.query.consul/centos/8/storage/x86_64/ceph-pacific
|
|
||||||
gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Storage
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
centos_8_rabbitmq_38:
|
|
||||||
ensure: absent
|
|
||||||
name: centos_8_rabbitmq_38
|
|
||||||
descr: centos_8_rabbitmq_38 repository
|
|
||||||
target: /etc/yum.repos.d/centos.repo
|
|
||||||
baseurl: https://edgecache.query.consul/centos/8/messaging/x86_64/rabbitmq-38
|
|
||||||
gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Messaging
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
centos_8_nfv_openvswitch:
|
|
||||||
ensure: absent
|
|
||||||
name: centos_8_nfv_openvswitch
|
|
||||||
descr: centos_8_nfv_openvswitch repository
|
|
||||||
target: /etc/yum.repos.d/centos.repo
|
|
||||||
baseurl: https://edgecache.query.consul/centos/8/nfv/x86_64/openvswitch-2
|
|
||||||
gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-NFV
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
centos_8_openstack_xena:
|
|
||||||
ensure: absent
|
|
||||||
name: centos_8_openstack_xena
|
|
||||||
descr: centos_8_openstack_xena repository
|
|
||||||
target: /etc/yum.repos.d/centos.repo
|
|
||||||
baseurl: https://edgecache.query.consul/centos/8/cloud/x86_64/openstack-xena
|
|
||||||
gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Cloud
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
centos_8_opstools:
|
|
||||||
ensure: absent
|
|
||||||
name: centos_8_opstools
|
|
||||||
descr: centos_8_opstools repository
|
|
||||||
target: /etc/yum.repos.d/centos.repo
|
|
||||||
baseurl: https://edgecache.query.consul/centos/8/opstools/x86_64/collectd-5
|
|
||||||
gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-OpsTools
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
centos_8_ovirt45:
|
|
||||||
ensure: absent
|
|
||||||
name: centos_8_ovirt45
|
|
||||||
descr: centos_8_ovirt45 repository
|
|
||||||
target: /etc/yum.repos.d/centos.repo
|
|
||||||
baseurl: https://edgecache.query.consul/centos/8/virt/x86_64/ovirt-45
|
|
||||||
gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Virtualization
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
centos_8_stream_gluster10:
|
|
||||||
ensure: absent
|
|
||||||
name: centos_8_stream_gluster10
|
|
||||||
descr: centos_8_stream_gluster10 repository
|
|
||||||
target: /etc/yum.repos.d/centos.repo
|
|
||||||
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
|
|
||||||
gpgkey: http://edgecache.query.consul/centos/RPM-GPG-KEY-CentOS-SIG-Storage
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
|
|
||||||
# Additional repositories
|
|
||||||
zfs-kmod:
|
|
||||||
ensure: absent
|
|
||||||
name: zfs-kmod
|
|
||||||
descr: zfs-kmod repository
|
|
||||||
target: /etc/yum.repos.d/zfs.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/zfs/epel/%{facts.os.release.major}/kmod/%{facts.os.architecture}/
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
rpmfusion-free:
|
|
||||||
ensure: absent
|
|
||||||
name: rpmfusion-free
|
|
||||||
descr: rpmfusion-free repository
|
|
||||||
target: /etc/yum.repos.d/rpmfusion-free.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
rpmfusion-nonfree:
|
|
||||||
ensure: absent
|
|
||||||
name: rpmfusion-nonfree
|
|
||||||
descr: rpmfusion-nonfree repository
|
|
||||||
target: /etc/yum.repos.d/rpmfusion-nonfree.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}/
|
|
||||||
gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
|
|
||||||
gpgcheck: 1
|
|
||||||
mirrorlist: absent
|
|
||||||
|
|||||||
@@ -1,71 +0,0 @@
|
|||||||
# hieradata/os/Fedora/all_releases.yaml
|
|
||||||
---
|
|
||||||
# Fedora reuses the RedHat osfamily code paths (dnf/yum, crypto-policies,
|
|
||||||
# firewalld, openvox). Everything here keys off facts.os.release.major so a
|
|
||||||
# future Fedora release only needs its artifactapi local repos created, not new
|
|
||||||
# hieradata.
|
|
||||||
|
|
||||||
# crypto-policies: use the distro default. Kept here (not per-release) so newer
|
|
||||||
# Fedora releases inherit it for free.
|
|
||||||
crypto_policies::policy: 'DEFAULT'
|
|
||||||
|
|
||||||
# Puppet agent via OpenVox. RedHat-family builds for Fedora live under
|
|
||||||
# openvox7/fedora/<major> (see profiles::puppet::agent).
|
|
||||||
profiles::puppet::agent::openvox_enable: true
|
|
||||||
|
|
||||||
lm-sensors::package: lm_sensors
|
|
||||||
|
|
||||||
# Fedora-specific base setup (NetworkManager, future workstation/laptop hooks).
|
|
||||||
hiera_include:
|
|
||||||
- profiles::fedora::base
|
|
||||||
|
|
||||||
# Base package set adjustments for Fedora:
|
|
||||||
# - p7zip was dropped from Fedora; the real 7-Zip ships as "7zip"
|
|
||||||
# - dstat was removed from Fedora with no drop-in successor in the base set
|
|
||||||
# - iotop is provided by the C rewrite package "iotop-c"
|
|
||||||
profiles::packages::exclude:
|
|
||||||
- p7zip
|
|
||||||
- dstat
|
|
||||||
- iotop
|
|
||||||
profiles::packages::include:
|
|
||||||
7zip: {}
|
|
||||||
iotop-c: {}
|
|
||||||
crypto-policies-scripts: {}
|
|
||||||
lzo: {}
|
|
||||||
policycoreutils: {}
|
|
||||||
unar: {}
|
|
||||||
xz: {}
|
|
||||||
|
|
||||||
profiles::yum::global::repos:
|
|
||||||
fedora:
|
|
||||||
name: fedora
|
|
||||||
descr: Fedora %{facts.os.release.major} - %{facts.os.architecture}
|
|
||||||
target: /etc/yum.repos.d/fedora.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/%{facts.os.release.major}/Everything/%{facts.os.architecture}/os/
|
|
||||||
gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
|
|
||||||
metalink: absent
|
|
||||||
mirrorlist: absent
|
|
||||||
updates:
|
|
||||||
name: updates
|
|
||||||
descr: Fedora %{facts.os.release.major} - %{facts.os.architecture} - Updates
|
|
||||||
target: /etc/yum.repos.d/fedora-updates.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/%{facts.os.release.major}/Everything/%{facts.os.architecture}/
|
|
||||||
gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%{facts.os.release.major}-%{facts.os.architecture}
|
|
||||||
metalink: absent
|
|
||||||
mirrorlist: absent
|
|
||||||
rpm-internal:
|
|
||||||
name: rpm-internal-f%{facts.os.release.major}
|
|
||||||
descr: rpm-internal-f%{facts.os.release.major} repository
|
|
||||||
target: /etc/yum.repos.d/rpm-internal.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f%{facts.os.release.major}/
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
metadata_expire: '60'
|
|
||||||
rpm-vendor:
|
|
||||||
name: rpm-vendor-f%{facts.os.release.major}
|
|
||||||
descr: rpm-vendor-f%{facts.os.release.major} repository
|
|
||||||
target: /etc/yum.repos.d/rpm-vendor.repo
|
|
||||||
baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f%{facts.os.release.major}/
|
|
||||||
gpgcheck: false
|
|
||||||
mirrorlist: absent
|
|
||||||
metadata_expire: '60'
|
|
||||||
@@ -2,11 +2,14 @@
|
|||||||
hiera_include:
|
hiera_include:
|
||||||
- profiles::nginx::simpleproxy
|
- profiles::nginx::simpleproxy
|
||||||
|
|
||||||
profiles::puppet::migrate::enabled: true
|
|
||||||
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
ceph:
|
ceph-reef:
|
||||||
ensure: present
|
name: ceph-reef
|
||||||
|
descr: ceph reef repository
|
||||||
|
target: /etc/yum.repos.d/ceph-reef.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgcheck: 0,
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
profiles::ceph::client::keyrings:
|
profiles::ceph::client::keyrings:
|
||||||
media:
|
media:
|
||||||
@@ -67,9 +70,6 @@ profiles::nginx::simpleproxy::locations:
|
|||||||
- 127.0.0.1
|
- 127.0.0.1
|
||||||
- "%{facts.networking.ip}"
|
- "%{facts.networking.ip}"
|
||||||
- 198.18.24.0/24
|
- 198.18.24.0/24
|
||||||
- 198.18.21.0/24
|
|
||||||
- 198.18.15.0/24
|
|
||||||
- 198.18.19.0/24
|
|
||||||
location_deny:
|
location_deny:
|
||||||
- all
|
- all
|
||||||
# authorised access from external
|
# authorised access from external
|
||||||
|
|||||||
@@ -54,6 +54,24 @@ profiles::consul::client::node_rules:
|
|||||||
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
rpmfusion-free:
|
rpmfusion-free:
|
||||||
ensure: present
|
name: rpmfusion-free
|
||||||
|
descr: rpmfusion-free repository
|
||||||
|
target: /etc/yum.repos.d/rpmfusion.repo
|
||||||
|
baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
|
||||||
|
mirrorlist: absent
|
||||||
rpmfusion-nonfree:
|
rpmfusion-nonfree:
|
||||||
ensure: present
|
name: rpmfusion-nonfree
|
||||||
|
descr: rpmfusion-nonfree repository
|
||||||
|
target: /etc/yum.repos.d/rpmfusion.repo
|
||||||
|
baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
|
||||||
|
mirrorlist: absent
|
||||||
|
unkinben:
|
||||||
|
name: unkinben
|
||||||
|
descr: unkinben repository
|
||||||
|
target: /etc/yum.repos.d/unkin.repo
|
||||||
|
baseurl: https://git.query.consul/api/packages/unkinben/rpm/el8
|
||||||
|
gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
|
||||||
|
gpgcheck: false
|
||||||
|
mirrorlist: absent
|
||||||
|
|||||||
@@ -72,6 +72,16 @@ profiles::consul::client::node_rules:
|
|||||||
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
rpmfusion-free:
|
rpmfusion-free:
|
||||||
ensure: present
|
name: rpmfusion-free
|
||||||
|
descr: rpmfusion-free repository
|
||||||
|
target: /etc/yum.repos.d/rpmfusion.repo
|
||||||
|
baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
|
||||||
|
mirrorlist: absent
|
||||||
rpmfusion-nonfree:
|
rpmfusion-nonfree:
|
||||||
ensure: present
|
name: rpmfusion-nonfree
|
||||||
|
descr: rpmfusion-nonfree repository
|
||||||
|
target: /etc/yum.repos.d/rpmfusion.repo
|
||||||
|
baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
|
||||||
|
mirrorlist: absent
|
||||||
|
|||||||
@@ -31,10 +31,30 @@ frrouting::daemons:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
ceph:
|
ceph:
|
||||||
ensure: present
|
name: ceph
|
||||||
|
descr: ceph repository
|
||||||
|
target: /etc/yum.repos.d/ceph.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
ceph-noarch:
|
ceph-noarch:
|
||||||
ensure: present
|
name: ceph-noarch
|
||||||
|
descr: ceph-noarch repository
|
||||||
|
target: /etc/yum.repos.d/ceph-noarch.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
|
|||||||
@@ -66,9 +66,6 @@ glauth::users:
|
|||||||
- 20025 # jupyterhub_admin
|
- 20025 # jupyterhub_admin
|
||||||
- 20026 # jupyterhub_user
|
- 20026 # jupyterhub_user
|
||||||
- 20027 # grafana_user
|
- 20027 # grafana_user
|
||||||
- 20028 # k8s/au/syd1 operator
|
|
||||||
- 20029 # k8s/au/syd1 admin
|
|
||||||
- 20030 # k8s/au/syd1 root
|
|
||||||
loginshell: '/bin/bash'
|
loginshell: '/bin/bash'
|
||||||
homedir: '/home/benvin'
|
homedir: '/home/benvin'
|
||||||
passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
|
passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
|
||||||
@@ -226,24 +223,6 @@ glauth::users:
|
|||||||
loginshell: '/bin/bash'
|
loginshell: '/bin/bash'
|
||||||
homedir: '/home/debvin'
|
homedir: '/home/debvin'
|
||||||
passsha256: 'cdac05ddb02e665d4ea65a974995f38a10236bc158731d92d78f6cde89b294a1'
|
passsha256: 'cdac05ddb02e665d4ea65a974995f38a10236bc158731d92d78f6cde89b294a1'
|
||||||
jassol:
|
|
||||||
user_name: 'jassol'
|
|
||||||
givenname: 'Jason'
|
|
||||||
sn: 'Solomon'
|
|
||||||
mail: 'jassol@users.main.unkin.net'
|
|
||||||
uidnumber: 20010
|
|
||||||
primarygroup: 20000
|
|
||||||
othergroups:
|
|
||||||
- 20010 # jelly
|
|
||||||
- 20011 # sonarr
|
|
||||||
- 20012 # radarr
|
|
||||||
- 20013 # lidarr
|
|
||||||
- 20014 # readarr
|
|
||||||
- 20016 # nzbget
|
|
||||||
- 20027 # grafana user
|
|
||||||
loginshell: '/bin/bash'
|
|
||||||
homedir: '/home/jassol'
|
|
||||||
passsha256: 'd8e215d3c94b954e1318c9c7243ce72713f2fb1d006037724fe857c1fb7e88e9'
|
|
||||||
|
|
||||||
glauth::services:
|
glauth::services:
|
||||||
svc_jellyfin:
|
svc_jellyfin:
|
||||||
@@ -388,12 +367,3 @@ glauth::groups:
|
|||||||
grafana_user:
|
grafana_user:
|
||||||
group_name: 'grafana_user'
|
group_name: 'grafana_user'
|
||||||
gidnumber: 20027
|
gidnumber: 20027
|
||||||
kubernetes_au_syd1_cluster_operator:
|
|
||||||
group_name: 'kubernetes_au_syd1_cluster_operator'
|
|
||||||
gidnumber: 20028
|
|
||||||
kubernetes_au_syd1_cluster_admin:
|
|
||||||
group_name: 'kubernetes_au_syd1_cluster_admin'
|
|
||||||
gidnumber: 20029
|
|
||||||
kubernetes_au_syd1_cluster_root:
|
|
||||||
group_name: 'kubernetes_au_syd1_cluster_root'
|
|
||||||
gidnumber: 20030
|
|
||||||
|
|||||||
@@ -14,26 +14,31 @@ profiles::pki::vault::alt_names:
|
|||||||
- radosgw.service.consul
|
- radosgw.service.consul
|
||||||
- radosgw.query.consul
|
- radosgw.query.consul
|
||||||
- "radosgw.service.%{facts.country}-%{facts.region}.consul"
|
- "radosgw.service.%{facts.country}-%{facts.region}.consul"
|
||||||
# S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
|
|
||||||
# on the cert so TLS validates for that hostname.
|
|
||||||
- s3.ceph.unkin.net
|
|
||||||
|
|
||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
ceph:
|
ceph:
|
||||||
ensure: present
|
name: ceph
|
||||||
|
descr: ceph repository
|
||||||
|
target: /etc/yum.repos.d/ceph.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
ceph-noarch:
|
ceph-noarch:
|
||||||
ensure: present
|
name: ceph-noarch
|
||||||
|
descr: ceph-noarch repository
|
||||||
|
target: /etc/yum.repos.d/ceph-noarch.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
# manage a simple nginx reverse proxy
|
# manage a simple nginx reverse proxy
|
||||||
profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
|
profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
|
||||||
profiles::nginx::simpleproxy::nginx_aliases:
|
profiles::nginx::simpleproxy::nginx_aliases:
|
||||||
- radosgw.service.au-syd1.consul
|
- radosgw.service.au-syd1.consul
|
||||||
# nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
|
|
||||||
- s3.ceph.unkin.net
|
|
||||||
profiles::nginx::simpleproxy::proxy_port: 7480
|
profiles::nginx::simpleproxy::proxy_port: 7480
|
||||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||||
nginx::client_max_body_size: 5000M
|
nginx::client_max_body_size: 100M
|
||||||
|
|
||||||
# manage consul service
|
# manage consul service
|
||||||
consul::services:
|
consul::services:
|
||||||
|
|||||||
@@ -57,9 +57,19 @@ profiles::consul::client::node_rules:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el%{facts.os.release.major}/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
# cobbler settings
|
# cobbler settings
|
||||||
profiles::cobbler::params::service_cname: 'cobbler.main.unkin.net'
|
profiles::cobbler::params::service_cname: 'cobbler.main.unkin.net'
|
||||||
|
|||||||
@@ -41,9 +41,19 @@ profiles::consul::client::node_rules:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
profiles::dhcp::server::ntpservers:
|
profiles::dhcp::server::ntpservers:
|
||||||
- 0.au.pool.ntp.org
|
- 0.au.pool.ntp.org
|
||||||
|
|||||||
@@ -1,2 +0,0 @@
|
|||||||
---
|
|
||||||
externaldns::externaldns_key_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEABqbZiK1NDTU+w2k7orz2HrB0EXwun7hn4pR6TeCHMp2IfrkPxlQT+f1J9c0PqJaAKvnyz+Cx0xNCrlnONqk+J57f48kYKYV+Vw+L0AYHYFj8/TizY5CwLpJS2XKyfRd4iEsWMonvfIYn71t3+YuXm4dkoEqGekW93qCr/KFtjAu0K3e+ypyl4EJqWokiUs7IbcSBNvrjUkP4yR8F/wHVKM1E5yfr+D1+nmMmt7Ob/J+am14492TppE2C7Xadg4us+kdYtuBsv9kTSi1GwwqUDjbeJVmfK3pKHjXdF+PI07AFLzo5bBZTJOzQfQ4SywpH8R5BDQoUCyHiaskB5wrmSDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB2LU9ZhefSg9PqqkwnfV65gDBvXuXco0moKCGjHqm5KcojWCK1BoS/+mltlr8kw9grZjN9jxHRLn1FjgBlq418c8w=]
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
---
|
|
||||||
hiera_include:
|
|
||||||
- externaldns
|
|
||||||
- frrouting
|
|
||||||
- exporters::frr_exporter
|
|
||||||
|
|
||||||
externaldns::bind_master_hostname: 'ausyd1nxvm2127.main.unkin.net'
|
|
||||||
externaldns::k8s_zones:
|
|
||||||
- 'k8s.syd1.au.unkin.net'
|
|
||||||
- '200.18.198.in-addr.arpa'
|
|
||||||
externaldns::slave_servers:
|
|
||||||
- 'ausyd1nxvm2128.main.unkin.net'
|
|
||||||
- 'ausyd1nxvm2129.main.unkin.net'
|
|
||||||
externaldns::externaldns_key_algorithm: 'hmac-sha256'
|
|
||||||
|
|
||||||
# networking
|
|
||||||
anycast_ip: 198.18.19.20
|
|
||||||
systemd::manage_networkd: true
|
|
||||||
systemd::manage_all_network_files: true
|
|
||||||
networking::interfaces:
|
|
||||||
eth0:
|
|
||||||
type: physical
|
|
||||||
forwarding: true
|
|
||||||
dhcp: true
|
|
||||||
anycast0:
|
|
||||||
type: dummy
|
|
||||||
ipaddress: "%{hiera('anycast_ip')}"
|
|
||||||
netmask: 255.255.255.255
|
|
||||||
mtu: 1500
|
|
||||||
|
|
||||||
# frrouting
|
|
||||||
exporters::frr_exporter::enable: true
|
|
||||||
frrouting::ospfd_router_id: "%{facts.networking.ip}"
|
|
||||||
frrouting::ospfd_redistribute:
|
|
||||||
- connected
|
|
||||||
frrouting::ospfd_interfaces:
|
|
||||||
eth0:
|
|
||||||
area: 0.0.0.0
|
|
||||||
anycast0:
|
|
||||||
area: 0.0.0.0
|
|
||||||
frrouting::daemons:
|
|
||||||
ospfd: true
|
|
||||||
|
|
||||||
# consul
|
|
||||||
profiles::consul::client::node_rules:
|
|
||||||
- resource: service
|
|
||||||
segment: frr_exporter
|
|
||||||
disposition: write
|
|
||||||
|
|
||||||
# additional repos
|
|
||||||
profiles::yum::global::repos:
|
|
||||||
frr-extras:
|
|
||||||
ensure: present
|
|
||||||
frr-stable:
|
|
||||||
ensure: present
|
|
||||||
@@ -200,6 +200,16 @@ profiles::consul::client::node_rules:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
|
|||||||
@@ -6,10 +6,8 @@ hiera_include:
|
|||||||
profiles::dns::resolver::acls:
|
profiles::dns::resolver::acls:
|
||||||
acl-main.unkin.net:
|
acl-main.unkin.net:
|
||||||
addresses:
|
addresses:
|
||||||
- 198.18.1.10/32
|
- 10.10.8.1/32
|
||||||
- 198.18.2.160/27
|
|
||||||
- 198.18.21.160/27
|
- 198.18.21.160/27
|
||||||
- 198.18.2.192/27
|
|
||||||
- 198.18.21.192/27
|
- 198.18.21.192/27
|
||||||
- 198.18.13.0/24
|
- 198.18.13.0/24
|
||||||
- 198.18.14.0/24
|
- 198.18.14.0/24
|
||||||
@@ -84,11 +82,6 @@ profiles::dns::resolver::zones:
|
|||||||
- 10.10.16.32
|
- 10.10.16.32
|
||||||
- 10.10.16.33
|
- 10.10.16.33
|
||||||
forward: 'only'
|
forward: 'only'
|
||||||
k8s.syd1.au.unkin.net-forward:
|
|
||||||
domain: 'k8s.syd1.au.unkin.net'
|
|
||||||
zone_type: 'forward'
|
|
||||||
forwarders: "%{alias('profiles_dns_upstream_forwarder_k8s')}"
|
|
||||||
forward: 'only'
|
|
||||||
unkin.net-forward:
|
unkin.net-forward:
|
||||||
domain: 'unkin.net'
|
domain: 'unkin.net'
|
||||||
zone_type: 'forward'
|
zone_type: 'forward'
|
||||||
@@ -179,11 +172,6 @@ profiles::dns::resolver::zones:
|
|||||||
zone_type: 'forward'
|
zone_type: 'forward'
|
||||||
forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
|
forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
|
||||||
forward: 'only'
|
forward: 'only'
|
||||||
200.18.198.in-addr.arpa-forward:
|
|
||||||
domain: '200.18.198.in-addr.arpa'
|
|
||||||
zone_type: 'forward'
|
|
||||||
forwarders: "%{alias('profiles_dns_upstream_forwarder_k8s')}"
|
|
||||||
forward: 'only'
|
|
||||||
consul-forward:
|
consul-forward:
|
||||||
domain: 'consul'
|
domain: 'consul'
|
||||||
zone_type: 'forward'
|
zone_type: 'forward'
|
||||||
@@ -200,7 +188,6 @@ profiles::dns::resolver::views:
|
|||||||
- network.unkin.net-forward
|
- network.unkin.net-forward
|
||||||
- prod.unkin.net-forward
|
- prod.unkin.net-forward
|
||||||
- consul-forward
|
- consul-forward
|
||||||
- k8s.syd1.au.unkin.net-forward
|
|
||||||
- 13.18.198.in-addr.arpa-forward
|
- 13.18.198.in-addr.arpa-forward
|
||||||
- 14.18.198.in-addr.arpa-forward
|
- 14.18.198.in-addr.arpa-forward
|
||||||
- 15.18.198.in-addr.arpa-forward
|
- 15.18.198.in-addr.arpa-forward
|
||||||
@@ -263,6 +250,16 @@ profiles::consul::client::node_rules:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
|
|||||||
@@ -8,9 +8,9 @@ docker::version: latest
|
|||||||
docker::curl_ensure: false
|
docker::curl_ensure: false
|
||||||
docker::root_dir: /data/docker
|
docker::root_dir: /data/docker
|
||||||
|
|
||||||
profiles::gitea::runner::instance: https://git.unkin.net
|
|
||||||
profiles::gitea::runner::home: /data/runner
|
profiles::gitea::runner::home: /data/runner
|
||||||
profiles::gitea::runner::version: '0.2.12'
|
profiles::gitea::runner::version: '0.2.10'
|
||||||
|
profiles::gitea::runner::source: "https://gitea.com/gitea/act_runner/releases/download/v%{hiera('profiles::gitea::runner::version')}/act_runner-%{hiera('profiles::gitea::runner::version')}-linux-amd64"
|
||||||
profiles::gitea::runner::config:
|
profiles::gitea::runner::config:
|
||||||
log:
|
log:
|
||||||
level: info
|
level: info
|
||||||
|
|||||||
@@ -71,7 +71,7 @@ profiles::nginx::simpleproxy::nginx_aliases:
|
|||||||
|
|
||||||
profiles::nginx::simpleproxy::proxy_port: 3000
|
profiles::nginx::simpleproxy::proxy_port: 3000
|
||||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||||
nginx::client_max_body_size: 5144M
|
nginx::client_max_body_size: 1024M
|
||||||
|
|
||||||
# enable external access via haproxy
|
# enable external access via haproxy
|
||||||
profiles::gitea::haproxy::enable: true
|
profiles::gitea::haproxy::enable: true
|
||||||
@@ -82,14 +82,8 @@ profiles::sql::postgresdb::dbname: gitea
|
|||||||
profiles::sql::postgresdb::dbuser: gitea
|
profiles::sql::postgresdb::dbuser: gitea
|
||||||
|
|
||||||
# deploy gitea
|
# deploy gitea
|
||||||
gitea::base_url: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/gitea'
|
gitea::ensure: '1.22.4'
|
||||||
gitea::install::checksums:
|
gitea::checksum: 'd549104f55067e6fb156e7ba060c9af488f36e12d5e747db7563fcc99eaf8532'
|
||||||
1.26.2:
|
|
||||||
linux:
|
|
||||||
amd64: 5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a
|
|
||||||
|
|
||||||
gitea::ensure: '1.26.2'
|
|
||||||
gitea::checksum: '5b37937b625de69196748f7293eee1a7363f8637ae6e3da3c359bb380bd61a6a'
|
|
||||||
gitea::manage_user: false
|
gitea::manage_user: false
|
||||||
gitea::manage_group: false
|
gitea::manage_group: false
|
||||||
gitea::manage_home: false
|
gitea::manage_home: false
|
||||||
|
|||||||
@@ -35,9 +35,19 @@ frrouting::daemons:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
# haproxy metrics
|
# haproxy metrics
|
||||||
consul::services:
|
consul::services:
|
||||||
@@ -153,50 +163,6 @@ profiles::haproxy::frontends:
|
|||||||
- 'set-header X-Forwarded-Proto https'
|
- 'set-header X-Forwarded-Proto https'
|
||||||
- 'set-header X-Real-IP %[src]'
|
- 'set-header X-Real-IP %[src]'
|
||||||
- 'use-service prometheus-exporter if { path /metrics }'
|
- 'use-service prometheus-exporter if { path /metrics }'
|
||||||
fe_imap:
|
|
||||||
description: 'Frontend for Stalwart IMAP (STARTTLS)'
|
|
||||||
bind:
|
|
||||||
0.0.0.0:143: []
|
|
||||||
mode: 'tcp'
|
|
||||||
options:
|
|
||||||
log: global
|
|
||||||
default_backend: be_stalwart_imap
|
|
||||||
tcp-request:
|
|
||||||
- inspect-delay 5s
|
|
||||||
- content accept if { req_len 0 }
|
|
||||||
fe_imaps:
|
|
||||||
description: 'Frontend for Stalwart IMAPS (implicit TLS)'
|
|
||||||
bind:
|
|
||||||
0.0.0.0:993: []
|
|
||||||
mode: 'tcp'
|
|
||||||
options:
|
|
||||||
log: global
|
|
||||||
default_backend: be_stalwart_imaps
|
|
||||||
tcp-request:
|
|
||||||
- inspect-delay 5s
|
|
||||||
- content accept if { req_len 0 }
|
|
||||||
fe_smtp:
|
|
||||||
description: 'Frontend for Stalwart SMTP'
|
|
||||||
bind:
|
|
||||||
0.0.0.0:25: []
|
|
||||||
mode: 'tcp'
|
|
||||||
options:
|
|
||||||
log: global
|
|
||||||
default_backend: be_stalwart_smtp
|
|
||||||
tcp-request:
|
|
||||||
- inspect-delay 5s
|
|
||||||
- content accept if { req_len 0 }
|
|
||||||
fe_submission:
|
|
||||||
description: 'Frontend for Stalwart SMTP Submission'
|
|
||||||
bind:
|
|
||||||
0.0.0.0:587: []
|
|
||||||
mode: 'tcp'
|
|
||||||
options:
|
|
||||||
log: global
|
|
||||||
default_backend: be_stalwart_submission
|
|
||||||
tcp-request:
|
|
||||||
- inspect-delay 5s
|
|
||||||
- content accept if { req_len 0 }
|
|
||||||
|
|
||||||
profiles::haproxy::backends:
|
profiles::haproxy::backends:
|
||||||
be_letsencrypt:
|
be_letsencrypt:
|
||||||
|
|||||||
@@ -5,17 +5,11 @@ hiera_include:
|
|||||||
- incus
|
- incus
|
||||||
- zfs
|
- zfs
|
||||||
- profiles::ceph::node
|
- profiles::ceph::node
|
||||||
- profiles::ceph::mon
|
|
||||||
- profiles::ceph::mgr
|
|
||||||
- profiles::ceph::mds
|
|
||||||
- profiles::ceph::osd
|
|
||||||
- profiles::ceph::client
|
- profiles::ceph::client
|
||||||
- profiles::ceph::dashboard
|
- profiles::ceph::dashboard
|
||||||
- profiles::storage::cephfsvols
|
- profiles::storage::cephfsvols
|
||||||
- exporters::frr_exporter
|
- exporters::frr_exporter
|
||||||
|
|
||||||
profiles::puppet::migrate::enabled: true
|
|
||||||
|
|
||||||
# FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
|
# FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
|
||||||
python::manage_dev_package: false
|
python::manage_dev_package: false
|
||||||
|
|
||||||
@@ -91,21 +85,46 @@ profiles::consul::client::node_rules:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
ceph:
|
ceph:
|
||||||
ensure: present
|
name: ceph
|
||||||
|
descr: ceph repository
|
||||||
|
target: /etc/yum.repos.d/ceph.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
ceph-noarch:
|
ceph-noarch:
|
||||||
ensure: present
|
name: ceph-noarch
|
||||||
|
descr: ceph-noarch repository
|
||||||
|
target: /etc/yum.repos.d/ceph-noarch.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
zfs-kmod:
|
zfs-kmod:
|
||||||
ensure: present
|
name: zfs-kmod
|
||||||
|
descr: zfs-kmod repository
|
||||||
|
target: /etc/yum.repos.d/zfs-kmod.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-openzfs-2022
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
# dns
|
# dns
|
||||||
profiles::dns::base::primary_interface: loopback0
|
profiles::dns::base::primary_interface: loopback0
|
||||||
|
|
||||||
# dashboard/haproxy
|
# dashboard/haproxy
|
||||||
profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback2_ip')}"
|
profiles::ceph::dashboard::ipaddress: "%{hiera('networking_loopback0_ip')}"
|
||||||
|
|
||||||
# networking
|
# networking
|
||||||
systemd::manage_networkd: true
|
systemd::manage_networkd: true
|
||||||
@@ -205,9 +224,7 @@ profiles::accounts::sysadmin::extra_groups:
|
|||||||
- incus-admin
|
- incus-admin
|
||||||
|
|
||||||
# manage cephfs mounts
|
# manage cephfs mounts
|
||||||
profiles::ceph::client::manage_ceph_conf: true
|
profiles::ceph::client::manage_ceph_conf: false
|
||||||
# mon/mgr/mds host: render the [mds] + [mds.*] sections
|
|
||||||
profiles::ceph::client::render_mds_config: true
|
|
||||||
profiles::ceph::client::manage_ceph_package: false
|
profiles::ceph::client::manage_ceph_package: false
|
||||||
profiles::ceph::client::manage_ceph_paths: false
|
profiles::ceph::client::manage_ceph_paths: false
|
||||||
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
||||||
|
|||||||
@@ -2,75 +2,14 @@
|
|||||||
hiera_include:
|
hiera_include:
|
||||||
- profiles::selinux::setenforce
|
- profiles::selinux::setenforce
|
||||||
- profiles::ceph::node
|
- profiles::ceph::node
|
||||||
- profiles::ceph::osd
|
|
||||||
- profiles::ceph::client
|
- profiles::ceph::client
|
||||||
- exporters::frr_exporter
|
- exporters::frr_exporter
|
||||||
- frrouting
|
- frrouting
|
||||||
- rke2
|
- rke2
|
||||||
|
|
||||||
profiles::puppet::migrate::enabled: true
|
|
||||||
|
|
||||||
# manage rke2
|
# manage rke2
|
||||||
rke2::bootstrap_node: prodnxsr0001.main.unkin.net
|
rke2::bootstrap_node: prodnxsr0001.main.unkin.net
|
||||||
rke2::join_url: https://join-k8s.service.consul:9345
|
rke2::join_url: https://join-k8s.service.consul:9345
|
||||||
# pull the airgap image bundle via artifactapi (host-reachable pre-CNI), not github directly
|
|
||||||
rke2::container_archive_source: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download'
|
|
||||||
rke2::manage_registries: true
|
|
||||||
rke2::registries:
|
|
||||||
docker.io:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "dockerhub/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
ghcr.io:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "ghcr/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
quay.io:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "quay/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
registry.k8s.io:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "k8s-registry/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
registry.gitlab.com:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "gitlab/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
docker.elastic.co:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "elastic/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
gcr.io:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "gcr/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
docker.litellm.ai:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "litellm/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
public.ecr.aws:
|
|
||||||
endpoint:
|
|
||||||
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
||||||
rewrite:
|
|
||||||
"^(.*)$": "ecr-public/$1"
|
|
||||||
disable-default-registry-endpoint: true
|
|
||||||
rke2::config_hash:
|
rke2::config_hash:
|
||||||
bind-address: "%{hiera('networking_loopback0_ip')}"
|
bind-address: "%{hiera('networking_loopback0_ip')}"
|
||||||
node-ip: "%{hiera('networking_loopback0_ip')}"
|
node-ip: "%{hiera('networking_loopback0_ip')}"
|
||||||
@@ -94,7 +33,7 @@ profiles::packages::include:
|
|||||||
|
|
||||||
profiles::selinux::setenforce::mode: disabled
|
profiles::selinux::setenforce::mode: disabled
|
||||||
|
|
||||||
profiles::ceph::client::manage_ceph_conf: true
|
profiles::ceph::client::manage_ceph_conf: false
|
||||||
profiles::ceph::client::manage_ceph_package: false
|
profiles::ceph::client::manage_ceph_package: false
|
||||||
profiles::ceph::client::manage_ceph_paths: false
|
profiles::ceph::client::manage_ceph_paths: false
|
||||||
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
||||||
@@ -108,17 +47,47 @@ profiles::ceph::client::mons:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
ceph:
|
ceph:
|
||||||
ensure: present
|
name: ceph
|
||||||
|
descr: ceph repository
|
||||||
|
target: /etc/yum.repos.d/ceph.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
ceph-noarch:
|
ceph-noarch:
|
||||||
ensure: present
|
name: ceph-noarch
|
||||||
|
descr: ceph-noarch repository
|
||||||
|
target: /etc/yum.repos.d/ceph-noarch.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
rancher-rke2-common-latest:
|
rancher-rke2-common-latest:
|
||||||
ensure: present
|
name: rancher-rke2-common-latest
|
||||||
|
descr: rancher-rke2-common-latest
|
||||||
|
target: /etc/yum.repos.d/rke2-common.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/
|
||||||
|
gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/common-daily/x86_64/os/public.key
|
||||||
|
mirrorlist: absent
|
||||||
rancher-rke2-1-33-latest:
|
rancher-rke2-1-33-latest:
|
||||||
ensure: present
|
name: rancher-rke2-1-33-latest
|
||||||
|
descr: rancher-rke2-1-33-latest
|
||||||
|
target: /etc/yum.repos.d/rke2-1-33.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/
|
||||||
|
gpgkey: https://packagerepo.service.consul/rke2/rhel%{facts.os.release.major}/1.33-daily/x86_64/os/public.key
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
# dns
|
# dns
|
||||||
profiles::dns::base::primary_interface: loopback0
|
profiles::dns::base::primary_interface: loopback0
|
||||||
@@ -186,17 +155,6 @@ frrouting::ospf_exclude_k8s_enable: true
|
|||||||
frrouting::k8s_cluster_cidr: '10.42.0.0/16' # RKE2 cluster-cidr (pods)
|
frrouting::k8s_cluster_cidr: '10.42.0.0/16' # RKE2 cluster-cidr (pods)
|
||||||
frrouting::k8s_service_cidr: '10.43.0.0/16' # RKE2 service-cidr
|
frrouting::k8s_service_cidr: '10.43.0.0/16' # RKE2 service-cidr
|
||||||
|
|
||||||
# sysctl recommendations
|
|
||||||
sysctl::base::values:
|
|
||||||
net.ipv4.conf.default.rp_filter:
|
|
||||||
value: '0'
|
|
||||||
net.ipv4.conf.all.rp_filter:
|
|
||||||
value: '0'
|
|
||||||
fs.inotify.max_user_watches:
|
|
||||||
value: '524288'
|
|
||||||
fs.inotify.max_user_instances:
|
|
||||||
value: '512'
|
|
||||||
|
|
||||||
# add loopback interfaces to ssh list
|
# add loopback interfaces to ssh list
|
||||||
ssh::server::options:
|
ssh::server::options:
|
||||||
ListenAddress:
|
ListenAddress:
|
||||||
|
|||||||
@@ -3,6 +3,9 @@
|
|||||||
rke2::node_type: server
|
rke2::node_type: server
|
||||||
rke2::helm_install: true
|
rke2::helm_install: true
|
||||||
rke2::helm_repos:
|
rke2::helm_repos:
|
||||||
|
rancher-stable: https://releases.rancher.com/server-charts/stable
|
||||||
|
purelb: https://gitlab.com/api/v4/projects/20400619/packages/helm/stable
|
||||||
|
jetstack: https://charts.jetstack.io
|
||||||
harbor: https://helm.goharbor.io
|
harbor: https://helm.goharbor.io
|
||||||
traefik: https://traefik.github.io/charts
|
traefik: https://traefik.github.io/charts
|
||||||
hashicorp: https://helm.releases.hashicorp.com
|
hashicorp: https://helm.releases.hashicorp.com
|
||||||
@@ -30,9 +33,6 @@ rke2::config_hash:
|
|||||||
- '--node-monitor-period=4s'
|
- '--node-monitor-period=4s'
|
||||||
protect-kernel-defaults: true
|
protect-kernel-defaults: true
|
||||||
disable-kube-proxy: false
|
disable-kube-proxy: false
|
||||||
# taint the control-plane/etcd nodes so only tolerating workloads schedule here
|
|
||||||
node-taint:
|
|
||||||
- "node-role.kubernetes.io/control-plane=true:NoSchedule"
|
|
||||||
|
|
||||||
# configure consul service
|
# configure consul service
|
||||||
consul::services:
|
consul::services:
|
||||||
@@ -58,12 +58,6 @@ consul::services:
|
|||||||
tcp: "%{hiera('networking_loopback0_ip')}:9345"
|
tcp: "%{hiera('networking_loopback0_ip')}:9345"
|
||||||
interval: '10s'
|
interval: '10s'
|
||||||
timeout: '1s'
|
timeout: '1s'
|
||||||
- id: 'rke2_server_ping_check'
|
|
||||||
name: 'rke2 Server Ping Check'
|
|
||||||
http: "https://%{hiera('networking_loopback0_ip')}:9345/ping"
|
|
||||||
interval: '10s'
|
|
||||||
timeout: '3s'
|
|
||||||
tls_skip_verify: true
|
|
||||||
profiles::consul::client::node_rules:
|
profiles::consul::client::node_rules:
|
||||||
- resource: service
|
- resource: service
|
||||||
segment: api-k8s
|
segment: api-k8s
|
||||||
|
|||||||
@@ -33,7 +33,7 @@ profiles::packages::include:
|
|||||||
|
|
||||||
profiles::selinux::setenforce::mode: disabled
|
profiles::selinux::setenforce::mode: disabled
|
||||||
|
|
||||||
profiles::ceph::client::manage_ceph_conf: true
|
profiles::ceph::client::manage_ceph_conf: false
|
||||||
profiles::ceph::client::manage_ceph_package: false
|
profiles::ceph::client::manage_ceph_package: false
|
||||||
profiles::ceph::client::manage_ceph_paths: false
|
profiles::ceph::client::manage_ceph_paths: false
|
||||||
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
||||||
@@ -47,17 +47,47 @@ profiles::ceph::client::mons:
|
|||||||
# additional repos
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
ceph:
|
ceph:
|
||||||
ensure: present
|
name: ceph
|
||||||
|
descr: ceph repository
|
||||||
|
target: /etc/yum.repos.d/ceph.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
ceph-noarch:
|
ceph-noarch:
|
||||||
ensure: present
|
name: ceph-noarch
|
||||||
|
descr: ceph-noarch repository
|
||||||
|
target: /etc/yum.repos.d/ceph-noarch.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
|
||||||
|
gpgkey: https://download.ceph.com/keys/release.asc
|
||||||
|
mirrorlist: absent
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
rancher-rke2-common-latest:
|
rancher-rke2-common-latest:
|
||||||
ensure: present
|
name: rancher-rke2-common-latest
|
||||||
|
descr: rancher-rke2-common-latest
|
||||||
|
target: /etc/yum.repos.d/rke2-common.repo
|
||||||
|
baseurl: https://rpm.rancher.io/rke2/latest/common/centos/%{facts.os.release.major}/noarch
|
||||||
|
gpgkey: https://rpm.rancher.io/public.key
|
||||||
|
mirrorlist: absent
|
||||||
rancher-rke2-1-33-latest:
|
rancher-rke2-1-33-latest:
|
||||||
ensure: present
|
name: rancher-rke2-1-33-latest
|
||||||
|
descr: rancher-rke2-1-33-latest
|
||||||
|
target: /etc/yum.repos.d/rke2-1-33.repo
|
||||||
|
baseurl: https://rpm.rancher.io/rke2/latest/1.33/centos/%{facts.os.release.major}/x86_64
|
||||||
|
gpgkey: https://rpm.rancher.io/public.key
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
# dns
|
# dns
|
||||||
profiles::dns::base::primary_interface: loopback0
|
profiles::dns::base::primary_interface: loopback0
|
||||||
|
|||||||
@@ -14,8 +14,6 @@ victorialogs::node::options:
|
|||||||
envflag.enable: 'true'
|
envflag.enable: 'true'
|
||||||
select.disable: 'undef'
|
select.disable: 'undef'
|
||||||
storageNode.tls: 'undef'
|
storageNode.tls: 'undef'
|
||||||
syslog.listenAddr.tcp: ':21514'
|
|
||||||
syslog.timezone: 'Australia/Sydney'
|
|
||||||
storageNode:
|
storageNode:
|
||||||
- ausyd1nxvm2108.main.unkin.net:9428
|
- ausyd1nxvm2108.main.unkin.net:9428
|
||||||
- ausyd1nxvm2109.main.unkin.net:9428
|
- ausyd1nxvm2109.main.unkin.net:9428
|
||||||
@@ -47,20 +45,7 @@ consul::services:
|
|||||||
tls_skip_verify: true
|
tls_skip_verify: true
|
||||||
interval: '10s'
|
interval: '10s'
|
||||||
timeout: '1s'
|
timeout: '1s'
|
||||||
syslog:
|
|
||||||
service_name: 'syslog'
|
|
||||||
address: "%{facts.networking.ip}"
|
|
||||||
port: 21514
|
|
||||||
checks:
|
|
||||||
- id: 'vlinsert_syslog_tcp_check'
|
|
||||||
name: 'VictoriaLogs Syslog TCP Check'
|
|
||||||
tcp: "%{facts.networking.fqdn}:21514"
|
|
||||||
interval: '30s'
|
|
||||||
timeout: '5s'
|
|
||||||
profiles::consul::client::node_rules:
|
profiles::consul::client::node_rules:
|
||||||
- resource: service
|
- resource: service
|
||||||
segment: vlinsert
|
segment: vlinsert
|
||||||
disposition: write
|
disposition: write
|
||||||
- resource: service
|
|
||||||
segment: syslog
|
|
||||||
disposition: write
|
|
||||||
|
|||||||
@@ -0,0 +1,20 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
# Common mail server configuration
|
||||||
|
|
||||||
|
# base postfix configuration (passed to postfix class)
|
||||||
|
postfix::relayhost: 'direct'
|
||||||
|
postfix::myorigin: 'main.unkin.net'
|
||||||
|
postfix::manage_aliases: true
|
||||||
|
|
||||||
|
# Common postfix virtuals for all mail servers
|
||||||
|
postfix::virtuals:
|
||||||
|
'root':
|
||||||
|
ensure: present
|
||||||
|
destination: 'ben@main.unkin.net'
|
||||||
|
'postmaster':
|
||||||
|
ensure: present
|
||||||
|
destination: 'ben@main.unkin.net'
|
||||||
|
'abuse':
|
||||||
|
ensure: present
|
||||||
|
destination: 'ben@main.unkin.net'
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
profiles::sql::postgresdb::dbpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEZkKX2ThGom2PffofEuRBHbyiq68PCsq0+19eSa02fpVPKgZ/5BEjzBhwvrt0BWZWsjYGhccFQ69DR+lTuqS50GcRSAiNQ2LDX2a3J1pu39oIKsNVmcJTza0f5T0VeI3A7sZkn7jL+NVz5ANp8V0EMfAjaduGQ7Jac+8dBsvTrLbJ+1AZVrjaKPxOI1+5tpE7qx35mM0oDVy0NwmlaVf8vbK6jyzyUJRs4Sb+mpioPi5sDxHgClzsQnu93HqqAIqR5UzsUv7MDMljOGYUF5ITyPU836I1LEZ9UfiVO7AikQ3A31LaSUWvwsxRHKxiQXJ7v6W/O+Nt3jdIR0eoqC5xTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC11+SUDLmz6bBrGyfYT9DPgDB3UhuhJ3kUruMTdRCW0Y6hoSBBQYCO+ZRFJToGTkz/BcxVw2Xtwjc7UmKmLodsDAo=]
|
|
||||||
stalwart::s3_access_key: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAm1fkuVcAt4UKFnpljH0o3eb3x1r2ieEU4NUzuSx8DDdOv4rh8rkqghPGn1xs6LGd9zLprc9ZWFowXCP4I2L0gZ4PekI04rV4lL02xYechIah1JAntdwECEks7rmI4BbPabIUIkaHW4i/WtntRNvv38g9JjiWrvOoJSABEsiIVZL0ct6NykLgQk27r4rcP8j7ukNQqPCAA02d4y9CB/5g6RKtYkv6FwZfLA/rFTUIXhKJsNtTa9Gm1yhvb/Y859X4qvsSFymCm/B8+2Bz5H57lE0r6xOBBBS5PfpeQ2YRxmedlkj0HxRFpl2e1W94OazMbbI6dlXa5ceHqHXDZL78EzBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDhiBSQPgE+fwD1Y9Gc1wQ3gCCGeGdA4BKCvIhYaQmzv9wUFuNaO75qHrub0vY8Od1ilQ==]
|
|
||||||
stalwart::s3_secret_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAdFOGR2axfPIksXExnW8vAZBSBm8V/QqPtIMtuzleDLOGsOuyLgJAbHPZJoj/w5bBV9bBKMGfWs94GGbKZ2PafiJeCtqfFJnUAIpVBTZ5cfUhQXERAHcketMvKUi1J8jKLSFc9I3uTjIVcIasjk0oe7WmCPnoikjl1qJZ/lVDH0cXHevjMuohxEyyka5jzC0ixCOkxyqOV2LOqSc6J5d0WSsSWqw0lDmY7vJAtqNtH6y6ghKZo5zdLQOsF2Bseg3oVejRNqYwfUsaDnfiRwJS/Rm/TmtXb4i6Jn8coYplDaJHtxQSXJ+KvOy6LS7M8X5sQ/UZSRqcwM647Yg4pwVWqDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBKBF7hTs0e0FKdRpFYbx4kgDB0xkNe78n6VLbUTHX7vTw6J+K/mxf+XCV95/EIkvBbWBYuU8ZMHNQKMEExmci4C4o=]
|
|
||||||
stalwart::fallback_admin_password: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAMp9wmIhRwj5kxfUcvc+/q/oUs/vBhSqP19ZfErM4vLDK20VOBTnPhSP2lfVh9pqO0c2hpWFeuqBWMynghO+HUBJfAn29Vrc8a9iSBxQ3XuF/uiRq1inOKCQpdsU18TyCrYV9AJFNf9U20JuUoav79m7EKLHS07PHAZ0osqIYy93eXdCFhwXAGHijp4wMMQz/5z1F1mZoSrc1cXe3y8iBeAvvjnRfpw14gOKZBjmEGUbo7AIyc3wax5hbOQYf/v+Hd90JarvAufxGytg9WKO20cChWYbmYDnIkytVt3vHdHf4RT8M635l6qwLr/70O1MdE7bkrVRKP8M3KLyH072pJTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDSJwptBDvPd0WpxiIovZsjgDBBwesNW+UNo4b0idhyqsyWL2rtO7wLStWHgUIvRFJACCrTKKqlu7sta6mhu/ZsnF0=]
|
|
||||||
@@ -1,46 +1,87 @@
|
|||||||
---
|
---
|
||||||
hiera_include:
|
|
||||||
- stalwart
|
|
||||||
- profiles::sql::postgresdb
|
|
||||||
- profiles::stalwart::haproxy
|
|
||||||
|
|
||||||
# additional altnames
|
# additional altnames
|
||||||
profiles::pki::vault::alt_names:
|
profiles::pki::vault::alt_names:
|
||||||
- mail.main.unkin.net
|
- mail.main.unkin.net
|
||||||
- mail-webadmin.main.unkin.net
|
|
||||||
- main-in.main.unkin.net
|
|
||||||
- autoconfig.main.unkin.net
|
|
||||||
- autodiscovery.main.unkin.net
|
|
||||||
|
|
||||||
# manage a pgsql database + user
|
# manage dovecot
|
||||||
profiles::sql::postgresdb::cluster_name: "patroni-shared-%{facts.environment}"
|
dovecot::install::packages:
|
||||||
profiles::sql::postgresdb::dbname: stalwart
|
- dovecot
|
||||||
profiles::sql::postgresdb::dbuser: stalwart
|
- dovecot-pgsql
|
||||||
|
profiles::dovecot::server::maildir_path: "%{hiera('profiles::postfix::gateway::virtual_mailbox_base')}"
|
||||||
|
|
||||||
# export backends to haproxy
|
#dovecot::config:
|
||||||
profiles::stalwart::haproxy::enable: true
|
# auth.conf:
|
||||||
|
# values:
|
||||||
|
# auth_mechanisms: 'plain login'
|
||||||
|
# auth_username_format: '%Lu'
|
||||||
|
# auth_default_realm: 'main.unkin.net'
|
||||||
|
# auth-vmail.conf:
|
||||||
|
# values:
|
||||||
|
# passdb: |
|
||||||
|
# {
|
||||||
|
# driver = pam
|
||||||
|
# }
|
||||||
|
# userdb: |
|
||||||
|
# {
|
||||||
|
# driver = passwd
|
||||||
|
# override_fields = uid=vmail gid=vmail home=/shared/apps/maildata/%u
|
||||||
|
# }
|
||||||
|
# mail.conf:
|
||||||
|
# values:
|
||||||
|
# mail_plugins: '$mail_plugins'
|
||||||
|
# namespace inbox: |
|
||||||
|
# {
|
||||||
|
# inbox = yes
|
||||||
|
# location =
|
||||||
|
# mailbox Drafts {
|
||||||
|
# special_use = \Drafts
|
||||||
|
# }
|
||||||
|
# mailbox Junk {
|
||||||
|
# special_use = \Junk
|
||||||
|
# }
|
||||||
|
# mailbox Sent {
|
||||||
|
# special_use = \Sent
|
||||||
|
# }
|
||||||
|
# mailbox "Sent Messages" {
|
||||||
|
# special_use = \Sent
|
||||||
|
# }
|
||||||
|
# mailbox Trash {
|
||||||
|
# special_use = \Trash
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
# sections:
|
||||||
|
# - name: 'namespace inbox'
|
||||||
|
# values:
|
||||||
|
# 'inbox': 'yes'
|
||||||
|
# 'seperator': '.'
|
||||||
|
# 'prefix': 'INBOX'
|
||||||
|
|
||||||
# Cluster role for node discovery
|
# backend-specific postfix configuration
|
||||||
stalwart::cluster_role: "%{facts.enc_role}"
|
postfix::mydestination: 'localhost'
|
||||||
|
postfix::mynetworks: '127.0.0.0/8 [::1]/128 10.10.12.0/24'
|
||||||
|
postfix::smtp_listen: ['0.0.0.0', '::']
|
||||||
|
postfix::use_dovecot_lda: true # use built-in dovecot LDA support
|
||||||
|
postfix::mail_user: 'vmail:vmail'
|
||||||
|
profiles::postfix::gateway::enable_postscreen: false # disable postscreen (backend doesn't need it)
|
||||||
|
profiles::postfix::gateway::myhostname: 'mail.main.unkin.net'
|
||||||
|
profiles::postfix::gateway::enable_dovecot: true # enable dovecot integration
|
||||||
|
profiles::postfix::gateway::virtual_mailbox_domains:
|
||||||
|
- 'main.unkin.net'
|
||||||
|
profiles::postfix::gateway::virtual_mailbox_base: '/shared/apps/maildata'
|
||||||
|
|
||||||
# PostgreSQL connection
|
profiles::postfix::gateway::virtual_mailbox_maps:
|
||||||
stalwart::postgresql_host: "master.%{hiera('profiles::sql::postgresdb::cluster_name')}.service.%{facts.country}-%{facts.region}.consul"
|
'ben@main.unkin.net': 'main.unkin.net/ben/'
|
||||||
stalwart::postgresql_database: "%{hiera('profiles::sql::postgresdb::dbname')}"
|
'root@main.unkin.net': 'main.unkin.net/ben/'
|
||||||
stalwart::postgresql_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
|
'postmaster@main.unkin.net': 'main.unkin.net/ben/'
|
||||||
stalwart::postgresql_password: "%{hiera('profiles::sql::postgresdb::dbpass')}"
|
'abuse@main.unkin.net': 'main.unkin.net/ben/'
|
||||||
|
|
||||||
# S3/Ceph-RGW connection
|
profiles::postfix::gateway::smtpd_client_restrictions:
|
||||||
stalwart::s3_endpoint: 'https://radosgw.service.consul'
|
- 'permit_mynetworks'
|
||||||
stalwart::s3_bucket: 'stalwart-maildata'
|
- 'reject_unauth_destination'
|
||||||
stalwart::s3_region: "%{facts.region}"
|
profiles::postfix::gateway::smtpd_sender_restrictions:
|
||||||
|
- 'permit_mynetworks'
|
||||||
# Domains and relay
|
- 'reject_non_fqdn_sender'
|
||||||
stalwart::domains:
|
profiles::postfix::gateway::smtpd_recipient_restrictions:
|
||||||
- 'mail.unkin.net'
|
- 'permit_mynetworks'
|
||||||
stalwart::postfix_relay_host: 'out-mta.main.unkin.net'
|
- 'reject_non_fqdn_recipient'
|
||||||
stalwart::service_hostname: 'mail.main.unkin.net'
|
- 'reject_unauth_destination'
|
||||||
stalwart::manage_dns_records: false
|
|
||||||
|
|
||||||
## With load balancer:
|
|
||||||
#stalwart::manage_dns_records: true
|
|
||||||
#stalwart::loadbalancer_host: 'mail-lb.example.com'
|
|
||||||
|
|||||||
@@ -1,90 +1,19 @@
|
|||||||
---
|
---
|
||||||
hiera_include:
|
# additional altnames
|
||||||
- redis
|
profiles::pki::vault::alt_names:
|
||||||
|
- in-mta.main.unkin.net
|
||||||
|
|
||||||
# no consul datacentre at the edge, so nothing to register or scrape via consul
|
# gateway-specific postfix configuration
|
||||||
profiles::consul::client::enable: false
|
|
||||||
exporters::node_exporter::enable: false
|
|
||||||
|
|
||||||
# ssh only from the edge vpcs (syd, mel, bne) and the lab over the vpn route
|
|
||||||
ssh::server::options:
|
|
||||||
AllowUsers: '*@172.18.30.0/24 *@172.18.31.0/24 *@172.18.32.0/24 *@198.18.0.0/16 *@10.10.12.200/32'
|
|
||||||
|
|
||||||
# local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route
|
|
||||||
dnsmasq::no_resolv: true
|
|
||||||
dnsmasq::cache_size: 10000
|
|
||||||
dnsmasq::servers:
|
|
||||||
- 198.18.200.7
|
|
||||||
profiles::dns::base::nameservers:
|
|
||||||
- 127.0.0.1
|
|
||||||
|
|
||||||
profiles::yum::global::repos:
|
|
||||||
rspamd:
|
|
||||||
ensure: present
|
|
||||||
|
|
||||||
# local redis for rspamd bayes and history; bayes tokens carry a ttl so volatile-ttl can evict
|
|
||||||
redis::maxmemory: '128mb'
|
|
||||||
redis::maxmemory_policy: 'volatile-ttl'
|
|
||||||
|
|
||||||
# local rspamd, deterministic checks only; module defaults cover spf/dkim/dmarc/arc/rbl/phishing/mime_types/fuzzy_check
|
|
||||||
profiles::rspamd::edge::rules:
|
|
||||||
edge.cf: 'https://git.unkin.net/unkin/rspamd-rules/raw/branch/main/edge.cf'
|
|
||||||
profiles::rspamd::edge::local_d:
|
|
||||||
worker-proxy.inc: |
|
|
||||||
bind_socket = "127.0.0.1:11332";
|
|
||||||
milter = yes;
|
|
||||||
timeout = 120s;
|
|
||||||
count = 1;
|
|
||||||
upstream "local" {
|
|
||||||
default = yes;
|
|
||||||
self_scan = yes;
|
|
||||||
}
|
|
||||||
worker-normal.inc: |
|
|
||||||
enabled = false;
|
|
||||||
redis.conf: |
|
|
||||||
servers = "127.0.0.1:6379";
|
|
||||||
actions.conf: |
|
|
||||||
reject = 13;
|
|
||||||
add_header = 6;
|
|
||||||
rewrite_subject = null;
|
|
||||||
greylist = null;
|
|
||||||
greylist.conf: |
|
|
||||||
enabled = false;
|
|
||||||
gpt.conf: |
|
|
||||||
enabled = false;
|
|
||||||
classifier-bayes.conf: |
|
|
||||||
backend = "redis";
|
|
||||||
expire = 8640000;
|
|
||||||
autolearn {
|
|
||||||
spam_threshold = 6.0;
|
|
||||||
ham_threshold = -0.5;
|
|
||||||
check_balance = true;
|
|
||||||
}
|
|
||||||
spamassassin.conf: |
|
|
||||||
ruleset = "/etc/rspamd/rules/*.cf";
|
|
||||||
alpha = 0.1;
|
|
||||||
settings.conf: |
|
|
||||||
smarthost_outbound {
|
|
||||||
priority = high;
|
|
||||||
ip = "103.216.191.185";
|
|
||||||
want_spam = yes;
|
|
||||||
}
|
|
||||||
|
|
||||||
# base postfix configuration (passed to postfix class)
|
|
||||||
postfix::relayhost: 'direct'
|
|
||||||
postfix::myorigin: 'unkin.net'
|
|
||||||
postfix::mydestination: 'blank'
|
postfix::mydestination: 'blank'
|
||||||
postfix::mynetworks: '127.0.0.0/8 [::1]/128 103.216.191.185/32'
|
postfix::mynetworks: '127.0.0.0/8 [::1]/128'
|
||||||
|
postfix::smtp_listen: '0.0.0.0'
|
||||||
postfix::mta: true
|
postfix::mta: true
|
||||||
postfix::manage_aliases: true
|
profiles::postfix::gateway::myhostname: 'in-mta.main.unkin.net'
|
||||||
|
|
||||||
# postfix map content (templates)
|
|
||||||
profiles::postfix::gateway::relay_recipients_maps:
|
profiles::postfix::gateway::relay_recipients_maps:
|
||||||
'@unkin.net': 'OK'
|
|
||||||
'@main.unkin.net': 'OK'
|
'@main.unkin.net': 'OK'
|
||||||
|
|
||||||
profiles::postfix::gateway::relay_domains_maps:
|
profiles::postfix::gateway::relay_domains_maps:
|
||||||
'unkin.net': 'OK'
|
|
||||||
'main.unkin.net': 'OK'
|
'main.unkin.net': 'OK'
|
||||||
|
|
||||||
profiles::postfix::gateway::postscreen_access_maps:
|
profiles::postfix::gateway::postscreen_access_maps:
|
||||||
@@ -97,28 +26,9 @@ profiles::postfix::gateway::helo_access_maps:
|
|||||||
'unknown': 'REJECT'
|
'unknown': 'REJECT'
|
||||||
'localhost': 'REJECT You are not localhost'
|
'localhost': 'REJECT You are not localhost'
|
||||||
|
|
||||||
profiles::postfix::gateway::smtp_tls_policy_maps:
|
|
||||||
'[mail-in.main.unkin.net]:25': 'secure match=hostname'
|
|
||||||
|
|
||||||
# postfix transports
|
# postfix transports
|
||||||
postfix::transports:
|
postfix::transports:
|
||||||
'unkin.net':
|
|
||||||
ensure: present
|
|
||||||
destination: 'relay'
|
|
||||||
nexthop: '[mail-in.main.unkin.net]:25'
|
|
||||||
'main.unkin.net':
|
'main.unkin.net':
|
||||||
ensure: present
|
ensure: present
|
||||||
destination: 'relay'
|
destination: 'relay'
|
||||||
nexthop: '[mail-in.main.unkin.net]:25'
|
nexthop: 'ausyd1nxvm2120.main.unkin.net:25'
|
||||||
|
|
||||||
# postfix virtuals
|
|
||||||
postfix::virtuals:
|
|
||||||
'root':
|
|
||||||
ensure: present
|
|
||||||
destination: 'ben@unkin.net'
|
|
||||||
'postmaster':
|
|
||||||
ensure: present
|
|
||||||
destination: 'ben@unkin.net'
|
|
||||||
'abuse':
|
|
||||||
ensure: present
|
|
||||||
destination: 'ben@unkin.net'
|
|
||||||
|
|||||||
@@ -11,7 +11,6 @@ profiles::metrics::grafana::db_name: "%{hiera('profiles::sql::postgresdb::dbname
|
|||||||
profiles::metrics::grafana::db_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
|
profiles::metrics::grafana::db_user: "%{hiera('profiles::sql::postgresdb::dbuser')}"
|
||||||
profiles::metrics::grafana::db_pass: "%{hiera('profiles::sql::postgresdb::dbpass')}"
|
profiles::metrics::grafana::db_pass: "%{hiera('profiles::sql::postgresdb::dbpass')}"
|
||||||
profiles::metrics::grafana::pgsql_backend: true
|
profiles::metrics::grafana::pgsql_backend: true
|
||||||
profiles::metrics::grafana::version: '13.0.2'
|
|
||||||
profiles::metrics::grafana::plugins:
|
profiles::metrics::grafana::plugins:
|
||||||
victoriametrics-logs-datasource:
|
victoriametrics-logs-datasource:
|
||||||
ensure: present
|
ensure: present
|
||||||
|
|||||||
@@ -3,16 +3,6 @@ hiera_include:
|
|||||||
- vmcluster::vmagent
|
- vmcluster::vmagent
|
||||||
|
|
||||||
vmcluster::vmagent::enable: true
|
vmcluster::vmagent::enable: true
|
||||||
vmcluster::vmagent::static_targets:
|
|
||||||
vyos_node:
|
|
||||||
targets:
|
|
||||||
- '198.18.21.160:9100'
|
|
||||||
scrape_interval: '15s'
|
|
||||||
metrics_path: '/metrics'
|
|
||||||
scheme: 'http'
|
|
||||||
labels:
|
|
||||||
instance: 'syrtvm0001.main.unkin.net'
|
|
||||||
job: 'vyos_node'
|
|
||||||
vmcluster::vmagent::options:
|
vmcluster::vmagent::options:
|
||||||
tls: 'true'
|
tls: 'true'
|
||||||
tlsCertFile: '/etc/pki/tls/vault/certificate.crt'
|
tlsCertFile: '/etc/pki/tls/vault/certificate.crt'
|
||||||
|
|||||||
@@ -1,30 +0,0 @@
|
|||||||
---
|
|
||||||
hiera_include:
|
|
||||||
- frrouting
|
|
||||||
- exporters::frr_exporter
|
|
||||||
|
|
||||||
# routing
|
|
||||||
sysctl::base::values:
|
|
||||||
net.ipv4.ip_forward:
|
|
||||||
value: '1'
|
|
||||||
net.ipv4.conf.all.rp_filter:
|
|
||||||
value: '0'
|
|
||||||
net.ipv4.conf.default.rp_filter:
|
|
||||||
value: '0'
|
|
||||||
# overrides 50-redhat.conf's per-interface rp_filter=1 (applied by udev on link add); sysctl -n can't glob, so no enforce
|
|
||||||
net.ipv4.conf.*.rp_filter:
|
|
||||||
value: '0'
|
|
||||||
enforce: false
|
|
||||||
|
|
||||||
# frrouting
|
|
||||||
exporters::frr_exporter::enable: true
|
|
||||||
frrouting::ospfd_redistribute:
|
|
||||||
- connected
|
|
||||||
frrouting::daemons:
|
|
||||||
ospfd: true
|
|
||||||
|
|
||||||
# consul
|
|
||||||
profiles::consul::client::node_rules:
|
|
||||||
- resource: service
|
|
||||||
segment: frr_exporter
|
|
||||||
disposition: write
|
|
||||||
@@ -24,8 +24,13 @@ frrouting::ospfd_interfaces:
|
|||||||
area: 0.0.0.1
|
area: 0.0.0.1
|
||||||
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
ceph:
|
ceph-reef:
|
||||||
ensure: present
|
name: ceph-reef
|
||||||
|
descr: ceph reef repository
|
||||||
|
target: /etc/yum.repos.d/ceph-reef.repo
|
||||||
|
baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
|
||||||
|
gpgcheck: 0,
|
||||||
|
mirrorlist: absent
|
||||||
|
|
||||||
profiles::ceph::client::keyrings:
|
profiles::ceph::client::keyrings:
|
||||||
nomad:
|
nomad:
|
||||||
|
|||||||
@@ -1,18 +1,50 @@
|
|||||||
---
|
---
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
centos_8_advanced_virtualization:
|
centos_8_advanced_virtualization:
|
||||||
ensure: present
|
name: 'virt-advanced-virtualization'
|
||||||
|
descr: 'CentOS Advanced Virtualization'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/advancedvirt-common
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||||
centos_8_ceph_pacific:
|
centos_8_ceph_pacific:
|
||||||
ensure: present
|
name: 'storage-ceph-pacific'
|
||||||
|
descr: 'CentOS Ceph Pacific'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/ceph-pacific
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||||
centos_8_rabbitmq_38:
|
centos_8_rabbitmq_38:
|
||||||
ensure: present
|
name: 'messaging-rabbitmq-38'
|
||||||
|
descr: 'CentOS RabbitMQ 38'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/messaging/x86_64/rabbitmq-38
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
|
||||||
centos_8_nfv_openvswitch:
|
centos_8_nfv_openvswitch:
|
||||||
ensure: present
|
name: 'nfv-openvswitch-2'
|
||||||
|
descr: 'CentOS NFV OpenvSwitch'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/nfv/x86_64/openvswitch-2
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
|
||||||
centos_8_openstack_xena:
|
centos_8_openstack_xena:
|
||||||
ensure: present
|
name: 'cloud-openstack-xena'
|
||||||
|
descr: 'CentOS OpenStack Xena'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/cloud/x86_64/openstack-xena
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
|
||||||
centos_8_opstools:
|
centos_8_opstools:
|
||||||
ensure: present
|
name: 'opstools-collectd-5'
|
||||||
|
descr: 'CentOS OpsTools - collectd'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/opstools/x86_64/collectd-5
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
|
||||||
centos_8_ovirt45:
|
centos_8_ovirt45:
|
||||||
ensure: present
|
name: 'virt-ovirt-45'
|
||||||
|
descr: 'CentOS oVirt 4.5'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/ovirt-45
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||||
centos_8_stream_gluster10:
|
centos_8_stream_gluster10:
|
||||||
ensure: present
|
name: 'storage-gluster-10'
|
||||||
|
descr: 'CentOS oVirt 4.5 - Glusterfs 10'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||||
|
|||||||
@@ -9,18 +9,50 @@ sudo::purge_ignore:
|
|||||||
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
centos_8_advanced_virtualization:
|
centos_8_advanced_virtualization:
|
||||||
ensure: present
|
name: 'virt-advanced-virtualization'
|
||||||
|
descr: 'CentOS Advanced Virtualization'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/advancedvirt-common
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||||
centos_8_ceph_pacific:
|
centos_8_ceph_pacific:
|
||||||
ensure: present
|
name: 'storage-ceph-pacific'
|
||||||
|
descr: 'CentOS Ceph Pacific'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/ceph-pacific
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||||
centos_8_rabbitmq_38:
|
centos_8_rabbitmq_38:
|
||||||
ensure: present
|
name: 'messaging-rabbitmq-38'
|
||||||
|
descr: 'CentOS RabbitMQ 38'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/messaging/x86_64/rabbitmq-38
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
|
||||||
centos_8_nfv_openvswitch:
|
centos_8_nfv_openvswitch:
|
||||||
ensure: present
|
name: 'nfv-openvswitch-2'
|
||||||
|
descr: 'CentOS NFV OpenvSwitch'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/nfv/x86_64/openvswitch-2
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
|
||||||
centos_8_openstack_xena:
|
centos_8_openstack_xena:
|
||||||
ensure: present
|
name: 'cloud-openstack-xena'
|
||||||
|
descr: 'CentOS OpenStack Xena'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/cloud/x86_64/openstack-xena
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
|
||||||
centos_8_opstools:
|
centos_8_opstools:
|
||||||
ensure: present
|
name: 'opstools-collectd-5'
|
||||||
|
descr: 'CentOS OpsTools - collectd'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/opstools/x86_64/collectd-5
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
|
||||||
centos_8_ovirt45:
|
centos_8_ovirt45:
|
||||||
ensure: present
|
name: 'virt-ovirt-45'
|
||||||
|
descr: 'CentOS oVirt 4.5'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/virt/x86_64/ovirt-45
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
|
||||||
centos_8_stream_gluster10:
|
centos_8_stream_gluster10:
|
||||||
ensure: present
|
name: 'storage-gluster-10'
|
||||||
|
descr: 'CentOS oVirt 4.5 - Glusterfs 10'
|
||||||
|
target: /etc/yum.repos.d/ovirt.repo
|
||||||
|
baseurl: https://edgecache.query.consul/centos/8-stream/storage/x86_64/gluster-10
|
||||||
|
gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
|
||||||
|
|||||||
@@ -16,4 +16,3 @@ certbot::domains:
|
|||||||
- git.unkin.net
|
- git.unkin.net
|
||||||
- grafana.unkin.net
|
- grafana.unkin.net
|
||||||
- dashboard.ceph.unkin.net
|
- dashboard.ceph.unkin.net
|
||||||
- auth.unkin.net
|
|
||||||
|
|||||||
@@ -1,6 +1,5 @@
|
|||||||
---
|
---
|
||||||
profiles::puppet::autosign::subnet_ranges:
|
profiles::puppet::autosign::subnet_ranges:
|
||||||
- '198.18.2.0/24'
|
|
||||||
- '198.18.13.0/24'
|
- '198.18.13.0/24'
|
||||||
- '198.18.14.0/24'
|
- '198.18.14.0/24'
|
||||||
- '198.18.15.0/24'
|
- '198.18.15.0/24'
|
||||||
@@ -27,20 +26,7 @@ profiles::puppet::cobbler_enc::packages:
|
|||||||
- 'requests'
|
- 'requests'
|
||||||
- 'PyYAML'
|
- 'PyYAML'
|
||||||
profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
|
profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
|
||||||
|
profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkin/puppet-r10k.git
|
||||||
# Deep-merged with the entries in roles/infra/puppet.yaml.
|
|
||||||
profiles::packages::include:
|
|
||||||
encapic:
|
|
||||||
ensure: '0.2.0'
|
|
||||||
certmanager:
|
|
||||||
ensure: '0.2.0'
|
|
||||||
sshsignhost:
|
|
||||||
ensure: '0.1.0'
|
|
||||||
|
|
||||||
profiles::puppet::encapic::encapi_url: https://encapi.k8s.syd1.au.unkin.net
|
|
||||||
profiles::puppet::server::external_nodes: '/usr/bin/encapic-enc'
|
|
||||||
|
|
||||||
profiles::puppet::r10k::r10k_repo: https://git.unkin.net/unkin/puppet-r10k.git
|
|
||||||
profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
|
profiles::puppet::g10k::bin_path: '/usr/bin/g10k'
|
||||||
profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
|
profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
|
||||||
profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
|
profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
|
||||||
@@ -61,9 +47,10 @@ profiles::helpers::certmanager::vault_config:
|
|||||||
|
|
||||||
profiles::helpers::sshsignhost::vault_config:
|
profiles::helpers::sshsignhost::vault_config:
|
||||||
addr: 'https://vault.service.consul:8200'
|
addr: 'https://vault.service.consul:8200'
|
||||||
mount_point: 'sshca'
|
mount_point: 'ssh-host-signer'
|
||||||
approle_path: 'approle'
|
approle_path: 'approle'
|
||||||
role_name: 'signhost'
|
role_name: 'hostrole'
|
||||||
|
output_path: '/tmp/sshsignhost'
|
||||||
role_id: "%{lookup('sshsignhost::role_id')}"
|
role_id: "%{lookup('sshsignhost::role_id')}"
|
||||||
|
|
||||||
profiles::puppet::server::agent_server: 'puppet.query.consul'
|
profiles::puppet::server::agent_server: 'puppet.query.consul'
|
||||||
|
|||||||
@@ -62,6 +62,14 @@ profiles::consul::client::node_rules:
|
|||||||
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
postgresql-17:
|
postgresql-17:
|
||||||
ensure: present
|
name: postgresql-17
|
||||||
|
descr: postgresql-17 repository
|
||||||
|
target: /etc/yum.repos.d/postgresql.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
|
||||||
postgresql-common:
|
postgresql-common:
|
||||||
ensure: present
|
name: postgresql-common
|
||||||
|
descr: postgresql-common repository
|
||||||
|
target: /etc/yum.repos.d/postgresql.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
|
||||||
|
|||||||
@@ -3,6 +3,90 @@ profiles::packages::include:
|
|||||||
createrepo: {}
|
createrepo: {}
|
||||||
|
|
||||||
profiles::reposync::repos_list:
|
profiles::reposync::repos_list:
|
||||||
|
almalinux_9.6_baseos:
|
||||||
|
repository: 'baseos'
|
||||||
|
description: 'AlmaLinux 9.6 BaseOS'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.6'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/baseos'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9.6_appstream:
|
||||||
|
repository: 'appstream'
|
||||||
|
description: 'AlmaLinux 9.6 AppStream'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.6'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/appstream'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9.6_crb:
|
||||||
|
repository: 'crb'
|
||||||
|
description: 'AlmaLinux 9.6 CRB'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.6'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/crb'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9.6_ha:
|
||||||
|
repository: 'ha'
|
||||||
|
description: 'AlmaLinux 9.6 HighAvailability'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.6'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/highavailability'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9.6_extras:
|
||||||
|
repository: 'extras'
|
||||||
|
description: 'AlmaLinux 9.6 extras'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.6'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.6/extras'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9_5_baseos:
|
||||||
|
repository: 'baseos'
|
||||||
|
description: 'AlmaLinux 9.5 BaseOS'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.5'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/baseos'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9_5_appstream:
|
||||||
|
repository: 'appstream'
|
||||||
|
description: 'AlmaLinux 9.5 AppStream'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.5'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/appstream'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9_5_crb:
|
||||||
|
repository: 'crb'
|
||||||
|
description: 'AlmaLinux 9.5 CRB'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.5'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/crb'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9_5_ha:
|
||||||
|
repository: 'ha'
|
||||||
|
description: 'AlmaLinux 9.5 HighAvailability'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.5'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/highavailability'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
almalinux_9_5_extras:
|
||||||
|
repository: 'extras'
|
||||||
|
description: 'AlmaLinux 9.5 extras'
|
||||||
|
osname: 'almalinux'
|
||||||
|
release: '9.5'
|
||||||
|
mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/extras'
|
||||||
|
gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
|
||||||
|
epel_8:
|
||||||
|
repository: 'everything'
|
||||||
|
description: 'EPEL8'
|
||||||
|
osname: 'epel'
|
||||||
|
release: '8'
|
||||||
|
mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-8&arch=x86_64'
|
||||||
|
gpgkey: 'https://epel.mirror.digitalpacific.com.au/RPM-GPG-KEY-EPEL-8'
|
||||||
|
epel_9:
|
||||||
|
repository: 'everything'
|
||||||
|
description: 'EPEL9'
|
||||||
|
osname: 'epel'
|
||||||
|
release: '9'
|
||||||
|
mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-9&arch=x86_64'
|
||||||
|
gpgkey: 'https://epel.mirror.digitalpacific.com.au/RPM-GPG-KEY-EPEL-9'
|
||||||
docker_stable_el8:
|
docker_stable_el8:
|
||||||
repository: 'stable'
|
repository: 'stable'
|
||||||
description: 'Docker CE Stable EL8'
|
description: 'Docker CE Stable EL8'
|
||||||
@@ -17,6 +101,34 @@ profiles::reposync::repos_list:
|
|||||||
release: 'el9'
|
release: 'el9'
|
||||||
baseurl: 'https://download.docker.com/linux/centos/9/x86_64/stable/'
|
baseurl: 'https://download.docker.com/linux/centos/9/x86_64/stable/'
|
||||||
gpgkey: 'https://download.docker.com/linux/centos/gpg'
|
gpgkey: 'https://download.docker.com/linux/centos/gpg'
|
||||||
|
frr_stable_el8:
|
||||||
|
repository: 'stable'
|
||||||
|
description: 'FRR Stable EL8'
|
||||||
|
osname: 'frr'
|
||||||
|
release: 'el8'
|
||||||
|
baseurl: 'https://rpm.frrouting.org/repo/el8/frr/'
|
||||||
|
gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
|
||||||
|
frr_extras_el8:
|
||||||
|
repository: 'extras'
|
||||||
|
description: 'FRR Extras EL8'
|
||||||
|
osname: 'frr'
|
||||||
|
release: 'el8'
|
||||||
|
baseurl: 'https://rpm.frrouting.org/repo/el8/extras/'
|
||||||
|
gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
|
||||||
|
frr_stable_el9:
|
||||||
|
repository: 'stable'
|
||||||
|
description: 'FRR Stable EL9'
|
||||||
|
osname: 'frr'
|
||||||
|
release: 'el9'
|
||||||
|
baseurl: 'https://rpm.frrouting.org/repo/el9/frr/'
|
||||||
|
gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
|
||||||
|
frr_extras_el9:
|
||||||
|
repository: 'extras'
|
||||||
|
description: 'FRR Extras el9'
|
||||||
|
osname: 'frr'
|
||||||
|
release: 'el9'
|
||||||
|
baseurl: 'https://rpm.frrouting.org/repo/el9/extras/'
|
||||||
|
gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
|
||||||
k8s_1.32:
|
k8s_1.32:
|
||||||
repository: '1.32'
|
repository: '1.32'
|
||||||
description: 'Kubernetes 1.32'
|
description: 'Kubernetes 1.32'
|
||||||
@@ -31,6 +143,62 @@ profiles::reposync::repos_list:
|
|||||||
release: '1.33'
|
release: '1.33'
|
||||||
baseurl: 'https://pkgs.k8s.io/core:/stable:/v1.33/rpm/'
|
baseurl: 'https://pkgs.k8s.io/core:/stable:/v1.33/rpm/'
|
||||||
gpgkey: 'https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key'
|
gpgkey: 'https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key'
|
||||||
|
mariadb_11_8_el8:
|
||||||
|
repository: 'el8'
|
||||||
|
description: 'MariaDB 11.8'
|
||||||
|
osname: 'mariadb'
|
||||||
|
release: '11.8'
|
||||||
|
baseurl: 'http://mariadb.mirror.digitalpacific.com.au/yum/11.8/rhel8-amd64/'
|
||||||
|
gpgkey: 'https://mariadb.mirror.digitalpacific.com.au/yum/RPM-GPG-KEY-MariaDB'
|
||||||
|
mariadb_11_8_el9:
|
||||||
|
repository: 'el9'
|
||||||
|
description: 'MariaDB 11.8'
|
||||||
|
osname: 'mariadb'
|
||||||
|
release: '11.8'
|
||||||
|
baseurl: 'http://mariadb.mirror.digitalpacific.com.au/yum/11.8/rhel9-amd64/'
|
||||||
|
gpgkey: 'https://mariadb.mirror.digitalpacific.com.au/yum/RPM-GPG-KEY-MariaDB'
|
||||||
|
openvox7_el8:
|
||||||
|
repository: '8'
|
||||||
|
description: 'openvox 7 EL8'
|
||||||
|
osname: 'openvox7'
|
||||||
|
release: 'el'
|
||||||
|
baseurl: 'https://yum.voxpupuli.org/openvox7/el/8/x86_64/'
|
||||||
|
gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
|
||||||
|
openvox7_el9:
|
||||||
|
repository: '9'
|
||||||
|
description: 'openvox 7 EL9'
|
||||||
|
osname: 'openvox7'
|
||||||
|
release: 'el'
|
||||||
|
baseurl: 'https://yum.voxpupuli.org/openvox7/el/9/x86_64/'
|
||||||
|
gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
|
||||||
|
openvox7_el10:
|
||||||
|
repository: '10'
|
||||||
|
description: 'openvox 7 EL10'
|
||||||
|
osname: 'openvox7'
|
||||||
|
release: 'el'
|
||||||
|
baseurl: 'https://yum.voxpupuli.org/openvox7/el/10/x86_64/'
|
||||||
|
gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
|
||||||
|
openvox8_el8:
|
||||||
|
repository: '8'
|
||||||
|
description: 'openvox 8 EL8'
|
||||||
|
osname: 'openvox8'
|
||||||
|
release: 'el'
|
||||||
|
baseurl: 'https://yum.voxpupuli.org/openvox8/el/8/x86_64/'
|
||||||
|
gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
|
||||||
|
openvox8_el9:
|
||||||
|
repository: '9'
|
||||||
|
description: 'openvox 8 EL9'
|
||||||
|
osname: 'openvox8'
|
||||||
|
release: 'el'
|
||||||
|
baseurl: 'https://yum.voxpupuli.org/openvox8/el/9/x86_64/'
|
||||||
|
gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
|
||||||
|
openvox8_el10:
|
||||||
|
repository: '10'
|
||||||
|
description: 'openvox 8 EL10'
|
||||||
|
osname: 'openvox8'
|
||||||
|
release: 'el'
|
||||||
|
baseurl: 'https://yum.voxpupuli.org/openvox8/el/10/x86_64/'
|
||||||
|
gpgkey: 'https://yum.voxpupuli.org/GPG-KEY-openvox.pub'
|
||||||
puppet7_el8:
|
puppet7_el8:
|
||||||
repository: '8'
|
repository: '8'
|
||||||
description: 'Puppet 7 EL8'
|
description: 'Puppet 7 EL8'
|
||||||
@@ -59,6 +227,76 @@ profiles::reposync::repos_list:
|
|||||||
release: 'el'
|
release: 'el'
|
||||||
baseurl: 'https://yum.puppet.com/puppet8/el/9/x86_64/'
|
baseurl: 'https://yum.puppet.com/puppet8/el/9/x86_64/'
|
||||||
gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
|
gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
|
||||||
|
postgresql_rhel8_common:
|
||||||
|
repository: 'common'
|
||||||
|
description: 'PostgreSQL Common RHEL 8'
|
||||||
|
osname: 'postgresql'
|
||||||
|
release: 'rhel8'
|
||||||
|
baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-8-x86_64/'
|
||||||
|
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||||
|
postgresql_rhel9_common:
|
||||||
|
repository: 'common'
|
||||||
|
description: 'PostgreSQL Common RHEL 9'
|
||||||
|
osname: 'postgresql'
|
||||||
|
release: 'rhel9'
|
||||||
|
baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-9-x86_64/'
|
||||||
|
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||||
|
postgresql_rhel8_15:
|
||||||
|
repository: '15'
|
||||||
|
description: 'PostgreSQL 15 RHEL 8'
|
||||||
|
osname: 'postgresql'
|
||||||
|
release: 'rhel8'
|
||||||
|
baseurl: 'https://download.postgresql.org/pub/repos/yum/15/redhat/rhel-8-x86_64/'
|
||||||
|
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||||
|
postgresql_rhel9_15:
|
||||||
|
repository: '15'
|
||||||
|
description: 'PostgreSQL 15 RHEL 9'
|
||||||
|
osname: 'postgresql'
|
||||||
|
release: 'rhel9'
|
||||||
|
baseurl: 'https://download.postgresql.org/pub/repos/yum/15/redhat/rhel-9-x86_64/'
|
||||||
|
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||||
|
postgresql_rhel8_16:
|
||||||
|
repository: '16'
|
||||||
|
description: 'PostgreSQL 16 RHEL 8'
|
||||||
|
osname: 'postgresql'
|
||||||
|
release: 'rhel8'
|
||||||
|
baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-x86_64/'
|
||||||
|
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||||
|
postgresql_rhel9_16:
|
||||||
|
repository: '16'
|
||||||
|
description: 'PostgreSQL 16 RHEL 9'
|
||||||
|
osname: 'postgresql'
|
||||||
|
release: 'rhel9'
|
||||||
|
baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-9-x86_64/'
|
||||||
|
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||||
|
postgresql_rhel8_17:
|
||||||
|
repository: '17'
|
||||||
|
description: 'PostgreSQL 17 RHEL 8'
|
||||||
|
osname: 'postgresql'
|
||||||
|
release: 'rhel8'
|
||||||
|
baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-8-x86_64/'
|
||||||
|
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||||
|
postgresql_rhel9_17:
|
||||||
|
repository: '17'
|
||||||
|
description: 'PostgreSQL 17 RHEL 9'
|
||||||
|
osname: 'postgresql'
|
||||||
|
release: 'rhel9'
|
||||||
|
baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-9-x86_64/'
|
||||||
|
gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
|
||||||
|
rke2_common_el9:
|
||||||
|
repository: 'common'
|
||||||
|
description: 'RKE2 common RHEL 9'
|
||||||
|
osname: 'rke2'
|
||||||
|
release: "rhel9"
|
||||||
|
baseurl: "https://rpm.rancher.io/rke2/latest/common/centos/9/noarch"
|
||||||
|
gpgkey: "https://rpm.rancher.io/public.key"
|
||||||
|
rke2_1_33_el9:
|
||||||
|
repository: '1.33'
|
||||||
|
description: 'RKE2 1.33 RHEL 9'
|
||||||
|
osname: 'rke2'
|
||||||
|
release: "rhel9"
|
||||||
|
baseurl: "https://rpm.rancher.io/rke2/latest/1.33/centos/9/x86_64"
|
||||||
|
gpgkey: "https://rpm.rancher.io/public.key"
|
||||||
zfs_dkms_rhel8:
|
zfs_dkms_rhel8:
|
||||||
repository: 'dkms'
|
repository: 'dkms'
|
||||||
description: 'ZFS DKMS RHEL 8'
|
description: 'ZFS DKMS RHEL 8'
|
||||||
|
|||||||
@@ -1,9 +1,17 @@
|
|||||||
---
|
---
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
postgresql-15:
|
postgresql-15:
|
||||||
ensure: present
|
name: postgresql-15
|
||||||
|
descr: postgresql-15 repository
|
||||||
|
target: /etc/yum.repos.d/postgresql.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
|
||||||
postgresql-common:
|
postgresql-common:
|
||||||
ensure: present
|
name: postgresql-common
|
||||||
|
descr: postgresql-common repository
|
||||||
|
target: /etc/yum.repos.d/postgresql.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
|
||||||
|
|
||||||
profiles::sql::patroni::cluster_name: "patroni-%{facts.environment}"
|
profiles::sql::patroni::cluster_name: "patroni-%{facts.environment}"
|
||||||
profiles::sql::patroni::postgres_exporter_enabled: true
|
profiles::sql::patroni::postgres_exporter_enabled: true
|
||||||
|
|||||||
@@ -47,6 +47,14 @@ profiles::consul::client::node_rules:
|
|||||||
|
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
postgresql-17:
|
postgresql-17:
|
||||||
ensure: present
|
name: postgresql-17
|
||||||
|
descr: postgresql-17 repository
|
||||||
|
target: /etc/yum.repos.d/postgresql.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/17-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
|
||||||
postgresql-common:
|
postgresql-common:
|
||||||
ensure: present
|
name: postgresql-common
|
||||||
|
descr: postgresql-common repository
|
||||||
|
target: /etc/yum.repos.d/postgresql.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
|
||||||
|
|||||||
@@ -29,10 +29,7 @@ profiles::consul::server::acl:
|
|||||||
profiles::pki::vault::alt_names:
|
profiles::pki::vault::alt_names:
|
||||||
- consul.main.unkin.net
|
- consul.main.unkin.net
|
||||||
- consul.service.consul
|
- consul.service.consul
|
||||||
- "consul.service.%{facts.country}-%{facts.region}.consul"
|
|
||||||
- consul
|
- consul
|
||||||
- "server.%{facts.country}-%{facts.region}.consul"
|
|
||||||
- "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"
|
|
||||||
|
|
||||||
# manage a simple nginx reverse proxy
|
# manage a simple nginx reverse proxy
|
||||||
profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'
|
profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'
|
||||||
@@ -41,7 +38,6 @@ profiles::nginx::simpleproxy::nginx_aliases:
|
|||||||
- consul.main.unkin.net
|
- consul.main.unkin.net
|
||||||
profiles::nginx::simpleproxy::proxy_port: 8500
|
profiles::nginx::simpleproxy::proxy_port: 8500
|
||||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||||
nginx::client_max_body_size: 512M
|
|
||||||
|
|
||||||
# consul
|
# consul
|
||||||
profiles::consul::client::node_rules:
|
profiles::consul::client::node_rules:
|
||||||
@@ -138,9 +134,19 @@ frrouting::ospfd_interfaces:
|
|||||||
frrouting::daemons:
|
frrouting::daemons:
|
||||||
ospfd: true
|
ospfd: true
|
||||||
|
|
||||||
# additional repos - enable needed repositories
|
# additional repos
|
||||||
profiles::yum::global::repos:
|
profiles::yum::global::repos:
|
||||||
frr-extras:
|
frr-extras:
|
||||||
ensure: present
|
name: frr-extras
|
||||||
|
descr: frr-extras repository
|
||||||
|
target: /etc/yum.repos.d/frr-extras.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
frr-stable:
|
frr-stable:
|
||||||
ensure: present
|
name: frr-stable
|
||||||
|
descr: frr-stable repository
|
||||||
|
target: /etc/yum.repos.d/frr-stable.repo
|
||||||
|
baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
|
||||||
|
gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
|
||||||
|
mirrorlist: absent
|
||||||
|
|||||||
@@ -2,12 +2,10 @@
|
|||||||
profiles::vault::server::members_role: roles::infra::storage::vault
|
profiles::vault::server::members_role: roles::infra::storage::vault
|
||||||
profiles::vault::server::members_lookup: true
|
profiles::vault::server::members_lookup: true
|
||||||
profiles::vault::server::data_dir: /data/vault
|
profiles::vault::server::data_dir: /data/vault
|
||||||
profiles::vault::server::plugin_dir: /opt/openbao-plugins
|
|
||||||
profiles::vault::server::manage_storage_dir: true
|
profiles::vault::server::manage_storage_dir: true
|
||||||
profiles::vault::server::tls_disable: false
|
profiles::vault::server::tls_disable: false
|
||||||
profiles::vault::server::package_name: openbao
|
vault::package_name: openbao
|
||||||
profiles::vault::server::package_ensure: 2.4.4
|
vault::package_ensure: 2.4.1
|
||||||
profiles::vault::server::disable_openbao: false
|
|
||||||
|
|
||||||
# additional altnames
|
# additional altnames
|
||||||
profiles::pki::vault::alt_names:
|
profiles::pki::vault::alt_names:
|
||||||
@@ -25,26 +23,3 @@ profiles::nginx::simpleproxy::proxy_scheme: 'http'
|
|||||||
profiles::nginx::simpleproxy::proxy_host: '127.0.0.1'
|
profiles::nginx::simpleproxy::proxy_host: '127.0.0.1'
|
||||||
profiles::nginx::simpleproxy::proxy_port: 8200
|
profiles::nginx::simpleproxy::proxy_port: 8200
|
||||||
profiles::nginx::simpleproxy::proxy_path: '/'
|
profiles::nginx::simpleproxy::proxy_path: '/'
|
||||||
|
|
||||||
profiles::packages::include:
|
|
||||||
# openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
|
|
||||||
openbao-plugins: {}
|
|
||||||
# Secrets plugins pinned to the exact version whose binary matches the sha256
|
|
||||||
# registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
|
|
||||||
# on upgrade, or OpenBao refuses to launch the plugin after a restart.
|
|
||||||
openbao-plugin-secrets-litellm:
|
|
||||||
ensure: '0.1.1'
|
|
||||||
openbao-plugin-secrets-gpg:
|
|
||||||
ensure: '0.1.0'
|
|
||||||
openbao-plugin-secrets-rancher:
|
|
||||||
ensure: '0.1.1'
|
|
||||||
openbao-plugin-secrets-gitea:
|
|
||||||
ensure: '0.1.0'
|
|
||||||
openbao-plugin-secrets-apptoken:
|
|
||||||
ensure: '0.1.0'
|
|
||||||
openbao-plugin-secrets-netbox:
|
|
||||||
ensure: '0.1.0'
|
|
||||||
openbao-plugin-secrets-ghp:
|
|
||||||
ensure: '0.1.0'
|
|
||||||
openbao-plugin-secrets-arrstack:
|
|
||||||
ensure: '0.2.0'
|
|
||||||
|
|||||||
@@ -1,8 +1,3 @@
|
|||||||
---
|
---
|
||||||
# physical hosts only (facts.virtual == 'physical'); merged 'unique' with the
|
|
||||||
# common hiera_include in profiles::base.
|
|
||||||
hiera_include:
|
|
||||||
- profiles::lldpd
|
|
||||||
|
|
||||||
profiles::packages::include:
|
profiles::packages::include:
|
||||||
"%{hiera('lm-sensors::package')}": {}
|
"%{hiera('lm-sensors::package')}": {}
|
||||||
|
|||||||
@@ -1,51 +0,0 @@
|
|||||||
# manage dnsmasq as a dns forwarder and dhcp relay
|
|
||||||
class dnsmasq (
|
|
||||||
Boolean $manage_package = true,
|
|
||||||
Boolean $manage_service = true,
|
|
||||||
String $package_name = 'dnsmasq',
|
|
||||||
String $service_name = 'dnsmasq',
|
|
||||||
Stdlib::Absolutepath $config_file = '/etc/dnsmasq.conf',
|
|
||||||
Stdlib::Absolutepath $config_dir = '/etc/dnsmasq.d',
|
|
||||||
Boolean $purge_config_dir = false,
|
|
||||||
Array[String] $interfaces = [],
|
|
||||||
Array[Stdlib::IP::Address] $listen_addresses = ['127.0.0.1'],
|
|
||||||
Enum['bind-interfaces', 'bind-dynamic', 'none'] $bind_mode = 'bind-interfaces',
|
|
||||||
Boolean $no_resolv = false,
|
|
||||||
Array[String] $servers = [],
|
|
||||||
Hash[String, Array[String]] $forwards = {},
|
|
||||||
Optional[Integer[0]] $cache_size = undef,
|
|
||||||
Boolean $domain_needed = true,
|
|
||||||
Boolean $bogus_priv = true,
|
|
||||||
Array[String] $dhcp_relays = [],
|
|
||||||
Array[String] $options = [],
|
|
||||||
) {
|
|
||||||
|
|
||||||
if $manage_package {
|
|
||||||
package { $package_name:
|
|
||||||
ensure => installed,
|
|
||||||
before => File[$config_file, $config_dir],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $config_dir:
|
|
||||||
ensure => directory,
|
|
||||||
recurse => $purge_config_dir,
|
|
||||||
purge => $purge_config_dir,
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $config_file:
|
|
||||||
ensure => file,
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0644',
|
|
||||||
content => template('dnsmasq/dnsmasq.conf.erb'),
|
|
||||||
}
|
|
||||||
|
|
||||||
if $manage_service {
|
|
||||||
service { $service_name:
|
|
||||||
ensure => running,
|
|
||||||
enable => true,
|
|
||||||
subscribe => File[$config_file, $config_dir],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
# THIS FILE IS MANAGED BY PUPPET
|
|
||||||
user=dnsmasq
|
|
||||||
group=dnsmasq
|
|
||||||
conf-dir=<%= @config_dir %>,.rpmnew,.rpmsave,.rpmorig
|
|
||||||
|
|
||||||
<% @interfaces.each do |iface| -%>
|
|
||||||
interface=<%= iface %>
|
|
||||||
<% end -%>
|
|
||||||
<% unless @listen_addresses.empty? -%>
|
|
||||||
listen-address=<%= @listen_addresses.join(',') %>
|
|
||||||
<% end -%>
|
|
||||||
<% unless @bind_mode == 'none' -%>
|
|
||||||
<%= @bind_mode %>
|
|
||||||
<% end -%>
|
|
||||||
<% if @no_resolv -%>
|
|
||||||
no-resolv
|
|
||||||
<% end -%>
|
|
||||||
<% if @domain_needed -%>
|
|
||||||
domain-needed
|
|
||||||
<% end -%>
|
|
||||||
<% if @bogus_priv -%>
|
|
||||||
bogus-priv
|
|
||||||
<% end -%>
|
|
||||||
<% if @cache_size -%>
|
|
||||||
cache-size=<%= @cache_size %>
|
|
||||||
<% end -%>
|
|
||||||
<% @servers.each do |server| -%>
|
|
||||||
server=<%= server %>
|
|
||||||
<% end -%>
|
|
||||||
<% @forwards.keys.sort.each do |domain| -%>
|
|
||||||
<% @forwards[domain].each do |server| -%>
|
|
||||||
server=/<%= domain %>/<%= server %>
|
|
||||||
<% end -%>
|
|
||||||
<% end -%>
|
|
||||||
<% @dhcp_relays.each do |relay| -%>
|
|
||||||
dhcp-relay=<%= relay %>
|
|
||||||
<% end -%>
|
|
||||||
<% @options.each do |line| -%>
|
|
||||||
<%= line %>
|
|
||||||
<% end -%>
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# ExternalDNS BIND module - automatically configures master or slave
|
|
||||||
class externaldns (
|
|
||||||
Stdlib::Fqdn $bind_master_hostname,
|
|
||||||
Array[Stdlib::Fqdn] $k8s_zones = [],
|
|
||||||
Array[Stdlib::Fqdn] $slave_servers = [],
|
|
||||||
String $externaldns_key_secret = '',
|
|
||||||
String $externaldns_key_algorithm = 'hmac-sha256',
|
|
||||||
) {
|
|
||||||
|
|
||||||
if $trusted['certname'] == $bind_master_hostname {
|
|
||||||
include externaldns::master
|
|
||||||
} else {
|
|
||||||
include externaldns::slave
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
# ExternalDNS BIND master server class
|
|
||||||
class externaldns::master inherits externaldns {
|
|
||||||
|
|
||||||
include bind
|
|
||||||
|
|
||||||
# Query PuppetDB for slave server IP addresses
|
|
||||||
$slave_ips = $externaldns::slave_servers.map |$fqdn| {
|
|
||||||
puppetdb_query("inventory[facts.networking.ip] { certname = '${fqdn}' }")[0]['facts.networking.ip']
|
|
||||||
}.filter |$ip| { $ip != undef }
|
|
||||||
|
|
||||||
# Create TSIG key for ExternalDNS authentication
|
|
||||||
bind::key { 'externaldns-key':
|
|
||||||
algorithm => $externaldns::externaldns_key_algorithm,
|
|
||||||
secret => $externaldns::externaldns_key_secret,
|
|
||||||
}
|
|
||||||
|
|
||||||
# Create ACL for slave servers
|
|
||||||
if !empty($slave_ips) {
|
|
||||||
bind::acl { 'dns-slaves':
|
|
||||||
addresses => $slave_ips,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# Create master zones for each Kubernetes domain
|
|
||||||
$externaldns::k8s_zones.each |$zone| {
|
|
||||||
bind::zone { $zone:
|
|
||||||
zone_type => 'master',
|
|
||||||
dynamic => true,
|
|
||||||
allow_updates => ['key externaldns-key'],
|
|
||||||
allow_transfers => empty($slave_ips) ? {
|
|
||||||
true => ['key externaldns-key'],
|
|
||||||
false => ['key externaldns-key','dns-slaves'],
|
|
||||||
},
|
|
||||||
ns_notify => !empty($slave_ips),
|
|
||||||
also_notify => $slave_ips,
|
|
||||||
dnssec => false,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# Create default view to include the zones
|
|
||||||
bind::view { 'externaldns':
|
|
||||||
recursion => false,
|
|
||||||
zones => $externaldns::k8s_zones,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
# ExternalDNS BIND slave server class
|
|
||||||
class externaldns::slave inherits externaldns {
|
|
||||||
|
|
||||||
include bind
|
|
||||||
|
|
||||||
# Query PuppetDB for master server IP address
|
|
||||||
$query = "inventory[facts.networking.ip] { certname = '${externaldns::bind_master_hostname}' }"
|
|
||||||
$master_ip = puppetdb_query($query)[0]['facts.networking.ip']
|
|
||||||
|
|
||||||
# Create TSIG key for zone transfers (same as master)
|
|
||||||
bind::key { 'externaldns-key':
|
|
||||||
algorithm => $externaldns::externaldns_key_algorithm,
|
|
||||||
secret => $externaldns::externaldns_key_secret,
|
|
||||||
}
|
|
||||||
|
|
||||||
# Create ACL for master server
|
|
||||||
bind::acl { 'dns-master':
|
|
||||||
addresses => [$master_ip],
|
|
||||||
}
|
|
||||||
|
|
||||||
# Create slave zones for each Kubernetes domain
|
|
||||||
$externaldns::k8s_zones.each |$zone| {
|
|
||||||
bind::zone { $zone:
|
|
||||||
zone_type => 'slave',
|
|
||||||
masters => [$master_ip],
|
|
||||||
allow_notify => ['dns-master'],
|
|
||||||
ns_notify => false,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# Create default view to include the zones
|
|
||||||
bind::view { 'externaldns':
|
|
||||||
recursion => false,
|
|
||||||
zones => $externaldns::k8s_zones,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -22,12 +22,7 @@ class incus::cluster (
|
|||||||
}
|
}
|
||||||
|
|
||||||
# if it is, find hosts, sort them so they dont cause changes every run
|
# if it is, find hosts, sort them so they dont cause changes every run
|
||||||
$servers_array = sort(puppetdb_query(
|
$servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||||
"facts[certname] {
|
|
||||||
name = 'enc_role' and value = '${members_role}' and
|
|
||||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
|
||||||
}"
|
|
||||||
).map |$fact| { $fact['certname'] })
|
|
||||||
|
|
||||||
# else use provided array from params
|
# else use provided array from params
|
||||||
}else{
|
}else{
|
||||||
|
|||||||
@@ -1,23 +0,0 @@
|
|||||||
# frozen_string_literal: true
|
|
||||||
|
|
||||||
require 'facter'
|
|
||||||
|
|
||||||
Facter.add(:ceph_osd_devices) do
|
|
||||||
confine kernel: 'Linux'
|
|
||||||
confine { Facter.value(:is_virtual) == false }
|
|
||||||
confine { Facter::Core::Execution.which('pvs') }
|
|
||||||
setcode do
|
|
||||||
devices = []
|
|
||||||
output = Facter::Core::Execution.execute(
|
|
||||||
'pvs --noheadings -o pv_name,vg_name 2>/dev/null',
|
|
||||||
on_fail: nil
|
|
||||||
)
|
|
||||||
output&.each_line do |line|
|
|
||||||
pv_name, vg_name = line.split
|
|
||||||
next unless pv_name && vg_name
|
|
||||||
|
|
||||||
devices << pv_name if vg_name.start_with?('ceph-')
|
|
||||||
end
|
|
||||||
devices.sort
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
# frozen_string_literal: true
|
|
||||||
|
|
||||||
require 'facter'
|
|
||||||
|
|
||||||
# Detects active ceph service instances via systemctl and exposes facts
|
|
||||||
# for use in ceph service management profiles.
|
|
||||||
# rubocop:disable Style/ClassAndModuleChildren
|
|
||||||
module Unkin
|
|
||||||
module Ceph
|
|
||||||
# Detects active ceph service instances via systemctl and exposes Facter facts.
|
|
||||||
module Utils
|
|
||||||
TYPES = %w[mon mgr mds osd].freeze
|
|
||||||
|
|
||||||
def self.services
|
|
||||||
output = Facter::Core::Execution.execute(
|
|
||||||
'systemctl list-units "ceph*" --no-legend --plain --all 2>/dev/null',
|
|
||||||
on_fail: ''
|
|
||||||
)
|
|
||||||
parse_units(output)
|
|
||||||
end
|
|
||||||
|
|
||||||
def self.parse_units(output)
|
|
||||||
result = TYPES.each_with_object({}) { |type, hash| hash[type] = [] }
|
|
||||||
output.each_line do |line|
|
|
||||||
unit = line.split.first
|
|
||||||
next unless unit
|
|
||||||
|
|
||||||
match_unit(result, unit)
|
|
||||||
end
|
|
||||||
result
|
|
||||||
end
|
|
||||||
|
|
||||||
def self.match_unit(result, unit)
|
|
||||||
TYPES.each do |type|
|
|
||||||
match = unit.match(/\Aceph-#{type}@(.+)\.service\z/)
|
|
||||||
result[type] << "ceph-#{type}@#{match[1]}" if match
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
TYPES.each do |type|
|
|
||||||
define_singleton_method(:"#{type}?") { !services[type].empty? }
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
# rubocop:enable Style/ClassAndModuleChildren
|
|
||||||
|
|
||||||
Facter.add('ceph_services') do
|
|
||||||
setcode { Unkin::Ceph::Utils.services }
|
|
||||||
end
|
|
||||||
|
|
||||||
Unkin::Ceph::Utils::TYPES.each do |type|
|
|
||||||
Facter.add("is_ceph_#{type}") do
|
|
||||||
setcode { Unkin::Ceph::Utils.public_send(:"#{type}?") }
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@@ -1,88 +0,0 @@
|
|||||||
# frozen_string_literal: true
|
|
||||||
|
|
||||||
# lib/facter/dns_records.rb
|
|
||||||
#
|
|
||||||
# Reports this host's expected DNS records (assembled by profiles::dns::updater
|
|
||||||
# into its records file) versus what is currently deployed on the authoritative
|
|
||||||
# server, so puppet can detect drift and re-apply.
|
|
||||||
#
|
|
||||||
# Structured value:
|
|
||||||
# { server, count, expected => [{zone,fqdn,type,ttl,value}], in_sync,
|
|
||||||
# drift => [{...,deployed => [...]}] }
|
|
||||||
|
|
||||||
# Helpers for the dns_records fact.
|
|
||||||
module DnsRecordsFact
|
|
||||||
RECORDS_FILE = '/var/lib/dns-updater/records'
|
|
||||||
SERVER_FILE = '/var/lib/dns-updater/server'
|
|
||||||
|
|
||||||
module_function
|
|
||||||
|
|
||||||
# normalise a value for comparison: strip, drop trailing dot, downcase
|
|
||||||
def norm(value)
|
|
||||||
value.to_s.strip.chomp('.').downcase
|
|
||||||
end
|
|
||||||
|
|
||||||
def server
|
|
||||||
File.exist?(SERVER_FILE) ? File.read(SERVER_FILE).strip : nil
|
|
||||||
end
|
|
||||||
|
|
||||||
# a name relative to a zone (or @) as a fully-qualified name
|
|
||||||
def to_fqdn(name, zone)
|
|
||||||
return "#{zone}." if name.to_s.empty? || name == '@'
|
|
||||||
|
|
||||||
"#{name}.#{zone}."
|
|
||||||
end
|
|
||||||
|
|
||||||
# parse one "zone|name|type|ttl|value" line into a record hash (nil to skip)
|
|
||||||
def parse_line(line)
|
|
||||||
line = line.strip
|
|
||||||
return nil if line.empty? || line.start_with?('#')
|
|
||||||
|
|
||||||
zone, name, type, ttl, value = line.split('|', 5)
|
|
||||||
return nil unless zone && type && value
|
|
||||||
|
|
||||||
{ 'zone' => zone, 'fqdn' => to_fqdn(name, zone), 'type' => type, 'ttl' => ttl, 'value' => value }
|
|
||||||
end
|
|
||||||
|
|
||||||
# parse the records file into record hashes
|
|
||||||
def expected
|
|
||||||
return [] unless File.exist?(RECORDS_FILE)
|
|
||||||
|
|
||||||
File.readlines(RECORDS_FILE).filter_map { |line| parse_line(line) }
|
|
||||||
end
|
|
||||||
|
|
||||||
# the values currently deployed for a record, per the authoritative server
|
|
||||||
def deployed(record, srv)
|
|
||||||
cmd = ['dig', '+short', '+time=2', '+tries=1']
|
|
||||||
cmd << "@#{srv}" if srv && !srv.empty?
|
|
||||||
cmd += [record['fqdn'], record['type']]
|
|
||||||
out = Facter::Core::Execution.execute(cmd.join(' '), on_fail: '')
|
|
||||||
out.to_s.split("\n").map { |line| norm(line) }.reject(&:empty?)
|
|
||||||
end
|
|
||||||
|
|
||||||
def report
|
|
||||||
srv = server
|
|
||||||
exp = expected
|
|
||||||
drift = exp.filter_map do |record|
|
|
||||||
dep = deployed(record, srv)
|
|
||||||
record.merge('deployed' => dep) unless dep.include?(norm(record['value']))
|
|
||||||
end
|
|
||||||
{ 'server' => srv, 'count' => exp.length, 'expected' => exp, 'in_sync' => drift.empty?, 'drift' => drift }
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
Facter.add(:dns_records) do
|
|
||||||
confine kernel: 'Linux'
|
|
||||||
setcode do
|
|
||||||
File.exist?(DnsRecordsFact::RECORDS_FILE) ? DnsRecordsFact.report : nil
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
# Convenience boolean for `if $facts['dns_records_insync']` guards.
|
|
||||||
Facter.add(:dns_records_insync) do
|
|
||||||
confine kernel: 'Linux'
|
|
||||||
setcode do
|
|
||||||
v = Facter.value(:dns_records)
|
|
||||||
v.nil? ? nil : v['in_sync']
|
|
||||||
end
|
|
||||||
end
|
|
||||||
@@ -3,21 +3,13 @@
|
|||||||
require 'facter'
|
require 'facter'
|
||||||
require 'yaml'
|
require 'yaml'
|
||||||
require 'net/http'
|
require 'net/http'
|
||||||
require 'openssl'
|
|
||||||
require 'uri'
|
require 'uri'
|
||||||
require 'fileutils'
|
require 'fileutils'
|
||||||
|
|
||||||
# EncapiENC module: Fetches ENC data from encapi, caches it, and provides structured facts.
|
# CobblerENC module: Fetches ENC data from Cobbler, caches it, and provides structured facts.
|
||||||
module EncapiENC
|
module CobblerENC
|
||||||
CACHE_FILE = '/var/cache/puppet_enc.yaml'
|
CACHE_FILE = '/var/cache/puppet_enc.yaml'
|
||||||
CACHE_TTL = 7 * 24 * 60 * 60 # 7 days in seconds
|
CACHE_TTL = 7 * 24 * 60 * 60 # 7 days in seconds
|
||||||
# Facter runs under Puppet's vendored ruby, whose OpenSSL trusts only
|
|
||||||
# /opt/puppetlabs/puppet/ssl/cert.pem and never the system trust store, so the
|
|
||||||
# estate CA anchor profiles::pki::vaultca installs has to be named explicitly.
|
|
||||||
CA_BUNDLE_PATHS = [
|
|
||||||
'/etc/pki/ca-trust/source/anchors/vaultcaroot.pem',
|
|
||||||
'/usr/local/share/ca-certificates/vaultcaroot.pem'
|
|
||||||
].freeze
|
|
||||||
@enc_data = nil # In-memory cache for the ENC response
|
@enc_data = nil # In-memory cache for the ENC response
|
||||||
|
|
||||||
def self.read_cache
|
def self.read_cache
|
||||||
@@ -37,22 +29,9 @@ module EncapiENC
|
|||||||
File.write(CACHE_FILE, cache_data.to_yaml)
|
File.write(CACHE_FILE, cache_data.to_yaml)
|
||||||
end
|
end
|
||||||
|
|
||||||
def self.ca_bundle
|
def self.fetch_from_cobbler
|
||||||
CA_BUNDLE_PATHS.find { |path| File.exist?(path) }
|
uri = URI("http://cobbler.main.unkin.net/cblr/svc/op/puppet/hostname/#{Facter.value(:fqdn) || Facter.value(:hostname)}")
|
||||||
end
|
response = Net::HTTP.get_response(uri)
|
||||||
|
|
||||||
def self.http_client(uri)
|
|
||||||
client = Net::HTTP.new(uri.host, uri.port)
|
|
||||||
client.use_ssl = true
|
|
||||||
client.verify_mode = OpenSSL::SSL::VERIFY_PEER
|
|
||||||
bundle = ca_bundle
|
|
||||||
client.ca_file = bundle if bundle
|
|
||||||
client
|
|
||||||
end
|
|
||||||
|
|
||||||
def self.fetch_from_encapi
|
|
||||||
uri = URI("https://encapi.k8s.syd1.au.unkin.net/cblr/svc/op/puppet/hostname/#{Facter.value(:fqdn) || Facter.value(:hostname)}")
|
|
||||||
response = http_client(uri).request(Net::HTTP::Get.new(uri))
|
|
||||||
|
|
||||||
raise "Failed to fetch ENC data. HTTP #{response.code}" unless response.is_a?(Net::HTTPSuccess)
|
raise "Failed to fetch ENC data. HTTP #{response.code}" unless response.is_a?(Net::HTTPSuccess)
|
||||||
|
|
||||||
@@ -62,7 +41,7 @@ module EncapiENC
|
|||||||
def self.retrieve_enc_data
|
def self.retrieve_enc_data
|
||||||
return @enc_data if @enc_data
|
return @enc_data if @enc_data
|
||||||
|
|
||||||
@enc_data = fetch_from_encapi
|
@enc_data = fetch_from_cobbler
|
||||||
write_cache(@enc_data)
|
write_cache(@enc_data)
|
||||||
@enc_data
|
@enc_data
|
||||||
end
|
end
|
||||||
@@ -70,26 +49,26 @@ module EncapiENC
|
|||||||
def self.fetch_enc_data
|
def self.fetch_enc_data
|
||||||
retrieve_enc_data
|
retrieve_enc_data
|
||||||
rescue StandardError => e
|
rescue StandardError => e
|
||||||
Facter.warn("Error retrieving encapi ENC data: #{e.message}")
|
Facter.warn("Error retrieving Cobbler ENC data: #{e.message}")
|
||||||
@enc_data = read_cache
|
@enc_data = read_cache
|
||||||
return @enc_data unless @enc_data.empty?
|
return @enc_data unless @enc_data.empty?
|
||||||
|
|
||||||
raise 'No cached ENC data available and encapi is unreachable.'
|
raise 'No cached ENC data available and Cobbler is down.'
|
||||||
end
|
end
|
||||||
|
|
||||||
def self.enc_role
|
def self.enc_role
|
||||||
fetch_enc_data.fetch('classes', {}).keys.first || raise('ENC Role not found in encapi ENC response')
|
fetch_enc_data.fetch('classes', {}).keys.first || raise('ENC Role not found in Cobbler ENC response')
|
||||||
end
|
end
|
||||||
|
|
||||||
def self.enc_env
|
def self.enc_env
|
||||||
fetch_enc_data.fetch('environment', nil) || raise('ENC Environment not found in encapi ENC response')
|
fetch_enc_data.fetch('environment', nil) || raise('ENC Environment not found in Cobbler ENC response')
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
Facter.add('enc_role') do
|
Facter.add('enc_role') do
|
||||||
setcode { EncapiENC.enc_role }
|
setcode { CobblerENC.enc_role }
|
||||||
end
|
end
|
||||||
|
|
||||||
Facter.add('enc_env') do
|
Facter.add('enc_env') do
|
||||||
setcode { EncapiENC.enc_env }
|
setcode { CobblerENC.enc_env }
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -1,104 +0,0 @@
|
|||||||
# frozen_string_literal: true
|
|
||||||
|
|
||||||
require 'facter'
|
|
||||||
require 'json'
|
|
||||||
|
|
||||||
# Exposes LLDP neighbour topology (switch/port each interface is cabled to) as
|
|
||||||
# the structured `lldp` fact, keyed by local interface. This is the only source
|
|
||||||
# of physical switch/port topology in the estate and feeds NetBox. Uses
|
|
||||||
# `lldpctl -f json0`: json0 wraps every node in an array regardless of
|
|
||||||
# cardinality, so one neighbour and many neighbours parse identically (plain
|
|
||||||
# `keyvalue` folds the neighbour's sysname into the key path, and plain `json`
|
|
||||||
# collapses single-element arrays into objects). Never raises: any error or a
|
|
||||||
# down daemon yields an empty hash so a puppet run can never break.
|
|
||||||
module LldpFact
|
|
||||||
SOCKETS = ['/run/lldpd.socket', '/var/run/lldpd.socket'].freeze
|
|
||||||
|
|
||||||
module_function
|
|
||||||
|
|
||||||
# First element of a json0 node (everything is array-wrapped), or the value
|
|
||||||
# itself if it is not an array; nil when absent.
|
|
||||||
def first(node)
|
|
||||||
node.is_a?(Array) ? node[0] : node
|
|
||||||
end
|
|
||||||
|
|
||||||
# Array form of a json0 node whatever its cardinality.
|
|
||||||
def list(node)
|
|
||||||
node.is_a?(Array) ? node : [node].compact
|
|
||||||
end
|
|
||||||
|
|
||||||
# Value string of a json0 leaf like [{ 'value' => 'x' }].
|
|
||||||
def leaf(node)
|
|
||||||
entry = first(node)
|
|
||||||
entry.is_a?(Hash) ? entry['value'] : entry
|
|
||||||
end
|
|
||||||
|
|
||||||
# Chassis MAC from its id list, preferring the entry typed 'mac'.
|
|
||||||
def chassis_mac(chassis)
|
|
||||||
ids = list(chassis['id'])
|
|
||||||
mac = ids.find { |id| id.is_a?(Hash) && id['type'] == 'mac' } || ids.first
|
|
||||||
mac.is_a?(Hash) ? mac['value'] : nil
|
|
||||||
end
|
|
||||||
|
|
||||||
# Topology record for one local interface, or nil when it has no neighbour.
|
|
||||||
def neighbour(iface)
|
|
||||||
chassis = first(iface['chassis'])
|
|
||||||
port = first(iface['port'])
|
|
||||||
return nil unless chassis && port
|
|
||||||
|
|
||||||
chassis_fields(chassis).merge(port_fields(port, first(iface['vlan'])))
|
|
||||||
end
|
|
||||||
|
|
||||||
def chassis_fields(chassis)
|
|
||||||
{
|
|
||||||
'neighbor_chassis_name' => leaf(chassis['name']),
|
|
||||||
'neighbor_chassis_mac' => chassis_mac(chassis),
|
|
||||||
'neighbor_chassis_descr' => leaf(chassis['descr'])
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
def port_fields(port, vlan)
|
|
||||||
port_id = first(port['id'])
|
|
||||||
vlan_h = vlan.is_a?(Hash) ? vlan : {}
|
|
||||||
{
|
|
||||||
'neighbor_port_id' => port_id.is_a?(Hash) ? port_id['value'] : port_id,
|
|
||||||
'neighbor_port_descr' => leaf(port['descr']),
|
|
||||||
'vlan_id' => vlan_h['vlan-id'],
|
|
||||||
'vlan_name' => vlan_h['value']
|
|
||||||
}
|
|
||||||
end
|
|
||||||
|
|
||||||
def interfaces(output)
|
|
||||||
lldp = first(JSON.parse(output)['lldp']) || {}
|
|
||||||
list(lldp['interface'])
|
|
||||||
end
|
|
||||||
|
|
||||||
# Map of local interface => topology record, skipping interfaces with no
|
|
||||||
# neighbour.
|
|
||||||
def collect(ifaces)
|
|
||||||
ifaces.each_with_object({}) do |iface, acc|
|
|
||||||
next unless iface.is_a?(Hash)
|
|
||||||
|
|
||||||
name = iface['name']
|
|
||||||
data = neighbour(iface)
|
|
||||||
acc[name] = data if name && data
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
def resolve
|
|
||||||
output = Facter::Core::Execution.execute('lldpctl -f json0 2>/dev/null', on_fail: nil)
|
|
||||||
return {} if output.to_s.empty?
|
|
||||||
|
|
||||||
collect(interfaces(output))
|
|
||||||
rescue StandardError
|
|
||||||
{}
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
Facter.add(:lldp) do
|
|
||||||
confine kernel: 'Linux'
|
|
||||||
confine { Facter.value(:is_virtual) == false }
|
|
||||||
confine { Facter::Core::Execution.which('lldpctl') }
|
|
||||||
confine { LldpFact::SOCKETS.any? { |path| File.exist?(path) } }
|
|
||||||
setcode { LldpFact.resolve }
|
|
||||||
end
|
|
||||||
@@ -5,7 +5,6 @@ require 'ipaddr'
|
|||||||
# a class that creates facts based on the subnet
|
# a class that creates facts based on the subnet
|
||||||
class SubnetAttributes
|
class SubnetAttributes
|
||||||
SUBNET_TO_ATTRIBUTES = {
|
SUBNET_TO_ATTRIBUTES = {
|
||||||
'198.18.2.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # router loopbacks
|
|
||||||
'198.18.13.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
|
'198.18.13.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
|
||||||
'198.18.14.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
|
'198.18.14.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
|
||||||
'198.18.15.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
|
'198.18.15.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' },
|
||||||
@@ -22,46 +21,27 @@ class SubnetAttributes
|
|||||||
'198.18.26.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # common node0010
|
'198.18.26.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # common node0010
|
||||||
'198.18.27.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # common node0011
|
'198.18.27.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # common node0011
|
||||||
'198.18.28.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # common node0012
|
'198.18.28.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # common node0012
|
||||||
'198.18.29.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' }, # common node0013
|
'198.18.29.0/24' => { environment: 'prod', region: 'syd1', country: 'au', zone: 'common' } # common node0013
|
||||||
'172.18.30.0/24' => { environment: 'prod', region: 'syd2', country: 'au', zone: 'dmz' }, # binarylane syd dmz vpc
|
|
||||||
'172.18.31.0/24' => { environment: 'prod', region: 'mel1', country: 'au', zone: 'dmz' }, # binarylane mel dmz vpc
|
|
||||||
'172.18.32.0/24' => { environment: 'prod', region: 'bne1', country: 'au', zone: 'dmz' } # binarylane bne dmz vpc
|
|
||||||
}.freeze
|
}.freeze
|
||||||
|
|
||||||
# Default attributes if no subnet matches, also defined as a constant
|
# Default attributes if no subnet matches, also defined as a constant
|
||||||
DEFAULT_ATTRIBUTES = { environment: 'unknown', region: 'unknown', country: 'unknown' }.freeze
|
DEFAULT_ATTRIBUTES = { environment: 'unknown', region: 'unknown', country: 'unknown' }.freeze
|
||||||
|
|
||||||
# loopbacks and wg /31s sit in syd1 ranges, so they must not decide where a host lives
|
# provide ip to return attributes
|
||||||
SKIPPED_INTERFACES = /\A(lo\z|dum|wg)/.freeze
|
def self.attributes(ip)
|
||||||
|
|
||||||
# primary ip first, then the remaining interfaces in name order
|
|
||||||
def self.from_networking(networking)
|
|
||||||
match(networking['ip']) || interface_match(networking['interfaces'] || {}) || DEFAULT_ATTRIBUTES
|
|
||||||
end
|
|
||||||
|
|
||||||
def self.interface_match(interfaces)
|
|
||||||
interfaces.sort
|
|
||||||
.reject { |name, _interface| name.match?(SKIPPED_INTERFACES) }
|
|
||||||
.flat_map { |_name, interface| addresses(interface) }
|
|
||||||
.lazy.filter_map { |address| match(address) }.first
|
|
||||||
end
|
|
||||||
|
|
||||||
def self.addresses(interface)
|
|
||||||
(interface['bindings'] || []).map { |binding| binding['address'] }
|
|
||||||
end
|
|
||||||
|
|
||||||
def self.match(ip)
|
|
||||||
return unless ip
|
|
||||||
|
|
||||||
addr = IPAddr.new(ip)
|
|
||||||
SUBNET_TO_ATTRIBUTES.each do |subnet, attrs|
|
SUBNET_TO_ATTRIBUTES.each do |subnet, attrs|
|
||||||
return attrs if IPAddr.new(subnet).include?(addr)
|
return attrs if IPAddr.new(subnet).include?(IPAddr.new(ip))
|
||||||
end
|
end
|
||||||
nil
|
|
||||||
|
DEFAULT_ATTRIBUTES
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
subnet_attributes = SubnetAttributes.from_networking(Facter.value(:networking))
|
# Use the primary IP address from facts
|
||||||
|
ip = Facter.value(:networking)['ip']
|
||||||
|
|
||||||
|
# Call the class method directly without creating an instance
|
||||||
|
subnet_attributes = SubnetAttributes.attributes(ip)
|
||||||
|
|
||||||
# Add separate facts for environment, region, and country
|
# Add separate facts for environment, region, and country
|
||||||
Facter.add('environment') { setcode { subnet_attributes[:environment] } }
|
Facter.add('environment') { setcode { subnet_attributes[:environment] } }
|
||||||
|
|||||||
@@ -1,36 +0,0 @@
|
|||||||
# frozen_string_literal: true
|
|
||||||
|
|
||||||
# ruby modules/libs/test/subnet_facts_check.rb
|
|
||||||
module Facter
|
|
||||||
def self.value(_name)
|
|
||||||
{}
|
|
||||||
end
|
|
||||||
|
|
||||||
def self.add(*); end
|
|
||||||
end
|
|
||||||
load File.expand_path('../lib/facter/subnet_facts.rb', __dir__)
|
|
||||||
|
|
||||||
iface = ->(*addresses) { { 'bindings' => addresses.map { |address| { 'address' => address } } } }
|
|
||||||
|
|
||||||
checks = {
|
|
||||||
'primary ip wins over other interfaces' => [
|
|
||||||
{ 'ip' => '198.18.17.5', 'interfaces' => { 'eth1' => iface.call('198.18.13.5') } }, 'drw1'
|
|
||||||
],
|
|
||||||
'unmatched primary ip falls back to an interface' => [
|
|
||||||
{ 'ip' => '203.0.113.5', 'interfaces' => { 'eth0' => iface.call('203.0.113.5'), 'eth1' => iface.call('198.18.24.11') } }, 'syd1'
|
|
||||||
],
|
|
||||||
'lo, dum and wg interfaces are skipped' => [
|
|
||||||
{ 'ip' => '203.0.113.5',
|
|
||||||
'interfaces' => { 'dum0' => iface.call('198.18.2.161'), 'lo' => iface.call('198.18.19.1'),
|
|
||||||
'wg0' => iface.call('198.18.2.177') } }, 'unknown'
|
|
||||||
],
|
|
||||||
'interfaces are scanned in name order' => [
|
|
||||||
{ 'ip' => '203.0.113.5', 'interfaces' => { 'eth2' => iface.call('198.18.24.1'), 'eth1' => iface.call('198.18.17.1') } }, 'drw1'
|
|
||||||
],
|
|
||||||
'missing ip and interfaces resolve to unknown' => [{}, 'unknown']
|
|
||||||
}
|
|
||||||
|
|
||||||
failures = checks.reject { |_name, (networking, expected)| SubnetAttributes.from_networking(networking)[:region] == expected }
|
|
||||||
failures.each_key { |name| warn "FAIL: #{name}" }
|
|
||||||
abort if failures.any?
|
|
||||||
puts "ok (#{checks.size} checks)"
|
|
||||||
@@ -6,8 +6,8 @@ class nzbget (
|
|||||||
$manage_group = $nzbget::params::manage_group,
|
$manage_group = $nzbget::params::manage_group,
|
||||||
$service_enable = $nzbget::params::service_enable,
|
$service_enable = $nzbget::params::service_enable,
|
||||||
$service_name = $nzbget::params::service_name,
|
$service_name = $nzbget::params::service_name,
|
||||||
$bind_address = $nzbget::params::bind_address,
|
$bind_address = $sonarr::params::bind_address,
|
||||||
$port = $nzbget::params::port,
|
$port = $sonarr::params::port,
|
||||||
) inherits nzbget::params {
|
) inherits nzbget::params {
|
||||||
|
|
||||||
include nzbget::install
|
include nzbget::install
|
||||||
|
|||||||
@@ -20,12 +20,7 @@ class redisha::redis (
|
|||||||
}
|
}
|
||||||
|
|
||||||
# if it is, find hosts, sort them so they dont cause changes every run
|
# if it is, find hosts, sort them so they dont cause changes every run
|
||||||
$servers_array = sort(puppetdb_query(
|
$servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||||
"facts[certname] {
|
|
||||||
name = 'enc_role' and value = '${redisha_members_role}' and
|
|
||||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
|
||||||
}"
|
|
||||||
).map |$fact| { $fact['certname'] })
|
|
||||||
|
|
||||||
# else use provided array from params
|
# else use provided array from params
|
||||||
}else{
|
}else{
|
||||||
|
|||||||
@@ -23,12 +23,7 @@ class redisha::sentinel (
|
|||||||
}
|
}
|
||||||
|
|
||||||
# if it is, find hosts, sort them so they dont cause changes every run
|
# if it is, find hosts, sort them so they dont cause changes every run
|
||||||
$servers_array = sort(puppetdb_query(
|
$servers_array = sort(query_nodes("enc_role='${redisha_members_role}' and region='${facts['region']}'", 'networking.fqdn'))
|
||||||
"facts[certname] {
|
|
||||||
name = 'enc_role' and value = '${redisha_members_role}' and
|
|
||||||
certname in facts[certname] { name = 'region' and value = '${facts['region']}' }
|
|
||||||
}"
|
|
||||||
).map |$fact| { $fact['certname'] })
|
|
||||||
|
|
||||||
# else use provided array from params
|
# else use provided array from params
|
||||||
}else{
|
}else{
|
||||||
|
|||||||
@@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: rancher
|
||||||
|
namespace: cattle-system
|
||||||
|
annotations:
|
||||||
|
kubernetes.io/ingress.class: nginx
|
||||||
|
spec:
|
||||||
|
tls:
|
||||||
|
- hosts: [rancher.main.unkin.net]
|
||||||
|
secretName: tls-rancher
|
||||||
|
rules:
|
||||||
|
- host: rancher.main.unkin.net
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: rancher
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
@@ -0,0 +1,45 @@
|
|||||||
|
apiVersion: purelb.io/v1
|
||||||
|
kind: LBNodeAgent
|
||||||
|
metadata:
|
||||||
|
name: common
|
||||||
|
namespace: purelb
|
||||||
|
spec:
|
||||||
|
local:
|
||||||
|
extlbint: kube-lb0
|
||||||
|
localint: default
|
||||||
|
sendgarp: false
|
||||||
|
---
|
||||||
|
apiVersion: purelb.io/v1
|
||||||
|
kind: LBNodeAgent
|
||||||
|
metadata:
|
||||||
|
name: dmz
|
||||||
|
namespace: purelb
|
||||||
|
spec:
|
||||||
|
local:
|
||||||
|
extlbint: kube-lb0
|
||||||
|
localint: default
|
||||||
|
sendgarp: false
|
||||||
|
---
|
||||||
|
apiVersion: purelb.io/v1
|
||||||
|
kind: ServiceGroup
|
||||||
|
metadata:
|
||||||
|
name: dmz
|
||||||
|
namespace: purelb
|
||||||
|
spec:
|
||||||
|
local:
|
||||||
|
v4pools:
|
||||||
|
- subnet: 198.18.199.0/24
|
||||||
|
pool: 198.18.199.0/24
|
||||||
|
aggregation: /32
|
||||||
|
---
|
||||||
|
apiVersion: purelb.io/v1
|
||||||
|
kind: ServiceGroup
|
||||||
|
metadata:
|
||||||
|
name: common
|
||||||
|
namespace: purelb
|
||||||
|
spec:
|
||||||
|
local:
|
||||||
|
v4pools:
|
||||||
|
- subnet: 198.18.200.0/24
|
||||||
|
pool: 198.18.200.0/24
|
||||||
|
aggregation: /32
|
||||||
@@ -7,8 +7,6 @@ class rke2::config (
|
|||||||
Stdlib::Fqdn $bootstrap_node = $rke2::bootstrap_node,
|
Stdlib::Fqdn $bootstrap_node = $rke2::bootstrap_node,
|
||||||
String $node_token = $rke2::node_token,
|
String $node_token = $rke2::node_token,
|
||||||
Array[String[1]] $extra_config_files = $rke2::extra_config_files,
|
Array[String[1]] $extra_config_files = $rke2::extra_config_files,
|
||||||
Boolean $manage_registries = $rke2::manage_registries,
|
|
||||||
Hash $registries = $rke2::registries,
|
|
||||||
){
|
){
|
||||||
|
|
||||||
# if its not the bootstrap node, add join path to config
|
# if its not the bootstrap node, add join path to config
|
||||||
@@ -30,24 +28,6 @@ class rke2::config (
|
|||||||
$config = $config_hash
|
$config = $config_hash
|
||||||
}
|
}
|
||||||
|
|
||||||
if $manage_registries {
|
|
||||||
file { '/etc/rancher/rke2/registries.yaml':
|
|
||||||
ensure => file,
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0644',
|
|
||||||
content => epp('rke2/registries.yaml.epp', { registries => $registries }),
|
|
||||||
require => Package["rke2-${node_type}"],
|
|
||||||
notify => Service["rke2-${node_type}"],
|
|
||||||
}
|
|
||||||
}else{
|
|
||||||
file { '/etc/rancher/rke2/registries.yaml':
|
|
||||||
ensure => absent,
|
|
||||||
require => Package["rke2-${node_type}"],
|
|
||||||
notify => Service["rke2-${node_type}"],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# create the config file
|
# create the config file
|
||||||
file { $config_file:
|
file { $config_file:
|
||||||
ensure => file,
|
ensure => file,
|
||||||
@@ -88,6 +68,30 @@ class rke2::config (
|
|||||||
# on the controller nodes only
|
# on the controller nodes only
|
||||||
if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
|
if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
|
||||||
|
|
||||||
|
# wait for purelb helm to setup namespace
|
||||||
|
if 'purelb' in $facts['k8s_namespaces'] {
|
||||||
|
file {'/var/lib/rancher/rke2/server/manifests/purelb-config.yaml':
|
||||||
|
ensure => file,
|
||||||
|
owner => 'root',
|
||||||
|
group => 'root',
|
||||||
|
mode => '0644',
|
||||||
|
source => 'puppet:///modules/rke2/purelb-config.yaml',
|
||||||
|
require => Service['rke2-server'],
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# wait for rancher helm to setup namespace
|
||||||
|
if 'cattle-system' in $facts['k8s_namespaces'] {
|
||||||
|
file {'/var/lib/rancher/rke2/server/manifests/ingress-route-rancher.yaml':
|
||||||
|
ensure => file,
|
||||||
|
owner => 'root',
|
||||||
|
group => 'root',
|
||||||
|
mode => '0644',
|
||||||
|
source => 'puppet:///modules/rke2/ingress-route-rancher.yaml',
|
||||||
|
require => Service['rke2-server'],
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
# manage extra config config (these are not dependent on helm)
|
# manage extra config config (these are not dependent on helm)
|
||||||
$extra_config_files.each |$file| {
|
$extra_config_files.each |$file| {
|
||||||
|
|
||||||
|
|||||||
@@ -38,6 +38,44 @@ class rke2::helm (
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# install specific helm charts to bootstrap environment
|
||||||
|
$plb_cmd = 'helm install purelb purelb/purelb \
|
||||||
|
--create-namespace \
|
||||||
|
--namespace=purelb \
|
||||||
|
--repository-config /etc/helm/repositories.yaml'
|
||||||
|
exec { 'install_purelb':
|
||||||
|
command => $plb_cmd,
|
||||||
|
path => ['/usr/bin', '/bin'],
|
||||||
|
environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
|
||||||
|
unless => 'helm list -n purelb | grep -q ^purelb',
|
||||||
|
}
|
||||||
|
|
||||||
|
$cm_cmd = 'helm install cert-manager jetstack/cert-manager \
|
||||||
|
--namespace cert-manager \
|
||||||
|
--create-namespace \
|
||||||
|
--set crds.enabled=true \
|
||||||
|
--repository-config /etc/helm/repositories.yaml'
|
||||||
|
exec { 'install_cert_manager':
|
||||||
|
command => $cm_cmd,
|
||||||
|
path => ['/usr/bin', '/bin'],
|
||||||
|
environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
|
||||||
|
unless => 'helm list -n cert-manager | grep -q ^cert-manager',
|
||||||
|
}
|
||||||
|
|
||||||
|
$r_cmd = 'helm install rancher rancher-stable/rancher \
|
||||||
|
--namespace cattle-system \
|
||||||
|
--create-namespace \
|
||||||
|
--set hostname=rancher.main.unkin.net \
|
||||||
|
--set bootstrapPassword=admin \
|
||||||
|
--set ingress.tls.source=secret \
|
||||||
|
--repository-config /etc/helm/repositories.yaml'
|
||||||
|
exec { 'install_rancher':
|
||||||
|
command => $r_cmd,
|
||||||
|
path => ['/usr/bin', '/bin'],
|
||||||
|
environment => ['KUBECONFIG=/etc/rancher/rke2/rke2.yaml'],
|
||||||
|
unless => 'helm list -n cattle-system | grep -q ^rancher',
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user