feat: manage route-reflectors

- add route-reflector role and hieradata
- enable using dhcp in networkd
- add hieradata/node/* entries for route-reflectors

.reek.yml

@@ -3,3 +3,8 @@
 detectors:
   FeatureEnvy:
     enabled: false
+  TooManyStatements:
+    enabled: false
+  UncommunicativeVariableName:
+    accept:
+      - e

Puppetfile

@@ -2,50 +2,64 @@ forge 'forge.puppetlabs.com'
 moduledir 'external_modules'
 
 # puppetlabs
-mod 'puppetlabs-stdlib', '9.1.0'
-mod 'puppetlabs-inifile', '6.0.0'
-mod 'puppetlabs-concat', '9.0.0'
-mod 'puppetlabs-vcsrepo', '6.1.0'
-mod 'puppetlabs-yumrepo_core', '2.0.0'
-mod 'puppetlabs-apt', '9.4.0'
-mod 'puppetlabs-lvm', '2.1.0'
-mod 'puppetlabs-puppetdb', '7.13.0'
-mod 'puppetlabs-postgresql', '9.1.0'
-mod 'puppetlabs-firewall', '6.0.0'
-mod 'puppetlabs-accounts', '8.1.0'
-mod 'puppetlabs-mysql', '15.0.0'
+mod 'puppetlabs-stdlib', '9.7.0'
+mod 'puppetlabs-inifile', '6.2.0'
+mod 'puppetlabs-concat', '9.1.0'
+mod 'puppetlabs-vcsrepo', '7.0.0'
+mod 'puppetlabs-yumrepo_core', '2.1.0'
+mod 'puppetlabs-apt', '10.0.1'
+mod 'puppetlabs-lvm', '3.0.1'
+mod 'puppetlabs-puppetdb', '7.14.0'
+mod 'puppetlabs-postgresql', '9.2.0'
+mod 'puppetlabs-firewall', '8.1.4'
+mod 'puppetlabs-accounts', '8.2.2'
+mod 'puppetlabs-mysql', '16.2.0'
 mod 'puppetlabs-xinetd', '3.4.1'
-mod 'puppetlabs-haproxy', '8.0.0'
-mod 'puppetlabs-java', '10.1.2'
-mod 'puppetlabs-reboot', '5.0.0'
+mod 'puppetlabs-haproxy', '8.2.0'
+mod 'puppetlabs-java', '11.1.0'
+mod 'puppetlabs-reboot', '5.1.0'
+mod 'puppetlabs-docker', '10.2.0'
 
 # puppet
-mod 'puppet-python', '7.0.0'
-mod 'puppet-systemd', '5.1.0'
-mod 'puppet-yum', '7.0.0'
-mod 'puppet-archive', '7.0.0'
-mod 'puppet-chrony', '2.6.0'
-mod 'puppet-puppetboard', '9.0.0'
-mod 'puppet-nginx', '5.0.0'
-mod 'puppet-selinux', '4.1.0'
-mod 'puppet-prometheus', '13.4.0'
-mod 'puppet-grafana', '13.1.0'
-mod 'puppet-consul', '8.0.0'
-mod 'puppet-vault', '4.1.0'
+mod 'puppet-python', '7.4.0'
+mod 'puppet-systemd', '8.1.0'
+mod 'puppet-yum', '7.2.0'
+mod 'puppet-archive', '7.1.0'
+mod 'puppet-chrony', '3.0.0'
+mod 'puppet-puppetboard', '11.0.0'
+mod 'puppet-nginx', '6.0.1'
+mod 'puppet-selinux', '5.0.0'
+mod 'puppet-prometheus', '16.0.0'
+mod 'puppet-grafana', '14.1.0'
+mod 'puppet-consul', '9.1.0'
+mod 'puppet-vault', '4.1.1'
 mod 'puppet-dhcp', '6.1.0'
-mod 'puppet-keepalived', '3.6.0'
-mod 'puppet-extlib', '7.0.0'
+mod 'puppet-keepalived', '5.1.0'
+mod 'puppet-extlib', '7.5.1'
+mod 'puppet-network', '2.2.1'
+mod 'puppet-kmod', '4.1.0'
+mod 'puppet-filemapper', '4.0.0'
+mod 'puppet-letsencrypt', '11.1.0'
+mod 'puppet-rundeck', '9.2.0'
+mod 'puppet-redis', '11.1.0'
+mod 'puppet-nodejs', '11.0.0'
 
 # other
-mod 'ghoneycutt-puppet', '3.3.0'
-mod 'saz-sudo', '8.0.0'
+mod 'saz-sudo', '9.0.2'
+mod 'saz-ssh', '13.1.0'
+mod 'saz-limits', '5.0.0'
 mod 'ghoneycutt-timezone', '4.0.0'
+mod 'ghoneycutt-puppet', '3.3.0'
 mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
 mod 'broadinstitute-certs', '3.0.1'
 mod 'stm-file_capability', '6.0.0'
 mod 'h0tw1r3-gitea', '3.2.0'
+mod 'rehan-mkdir', '2.0.0'
+mod 'tailoredautomation-patroni', '2.0.0'
+mod 'ssm-crypto_policies', '0.3.3'
+mod 'thias-sysctl', '1.0.8'
 
 mod 'bind',
   :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',

doc/admin/groups.md

@@ -0,0 +1,9 @@
+# Group administration
+
+This page exists to list all the locally managed groups, their gid's and what their general purpose is for.
+
+## List of groups
+| name        | gid         | purpose     |
+|-------------|-------------|-------------|
+| admin | 10000 | admin group designed for system admins |
+| media | 20000 | group permissions to manage media (*arrs) |

doc/ceph/README.md

@@ -0,0 +1,60 @@
+# managing ceph
+
+Always refer back to the official documentation at https://docs.ceph.com/en/latest
+
+## adding new cephfs
+- create a erasure code profile which will allow you to customise the raid level
+    - raid5 with 3 disks? k=2,m=1
+    - raid5 with 6 disks? k=5,m=1
+    - raid6 with 4 disks? k=2,m=2, etc
+- create osd pool using custom profile for data
+- create osd pool using default replicated profile for metadata
+- enable ec_overwrites for the data pool
+- create the ceph fs volume using data/metadata pools
+- set ceph fs settings
+    - specify minimum number of metadata servers (mds)
+    - set fs to be for bulk data
+    - set mds fast failover with standby reply
+
+
+```
+    sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
+    sudo ceph osd pool create media_data 128 erasure ec_4_1
+    sudo ceph osd pool create media_metadata 32 replicated_rule
+    sudo ceph osd pool set media_data allow_ec_overwrites true
+    sudo ceph osd pool set media_data bulk true
+    sudo ceph fs new mediafs media_metadata media_data --force
+    sudo ceph fs set mediafs allow_standby_replay true
+    sudo ceph fs set mediafs max_mds 2
+```
+
+## creating authentication tokens
+
+- this will create a client keyring named media
+- this client will have the following capabilities:
+    - mon: read
+    - mds:
+        - read /
+        - read/write /media
+        - read/write /common
+    - osd: read/write to cephfs_data pool
+
+```
+    sudo ceph auth get-or-create client.media \
+      mon 'allow r' \
+      mds 'allow r path=/, allow rw path=/media, allow rw path=/common' \
+      osd 'allow rw pool=cephfs_data'
+```
+
+## list the authentication tokens and permissions
+
+    ceph auth ls
+
+## change the capabilities of a token
+
+this will overwrite the current capabilities of a given client.user
+
+    sudo ceph auth caps client.media \
+      mon 'allow r' \
+      mds 'allow rw path=/' \
+      osd 'allow rw pool=media_data'

doc/puppet/README.md

@@ -0,0 +1,31 @@
+# add additional master
+
+these steps are required when adding additional puppet masters, as the subject alternative names on the certificate will need to be changed. this requires the old certificate be revoked, cleaned up, and for a new certificate to be generated and signed.
+
+## prepare a new node
+- deploy a new now, or identify a space with the base role
+- change the hosts class to roles::infra::puppet::master
+- apply puppet until there are no more changes
+
+## revoke the current certificate on the puppet master
+
+    sudo puppetserver ca clean --certname ausyd1nxvm1023.main.unkin.net
+
+## stop the new puppetserver and cleanup revoked certificates
+
+    sudo systemctl stop puppetserver
+    sudo rm -f /etc/puppetlabs/puppet/ssl/certs/$(hostname -f).pem
+    sudo rm -f /etc/puppetlabs/puppet/ssl/private_keys/$(hostname -f).pem
+
+## copy the current crl.pem, as puppetserver will overwrite it when starting
+
+    sudo cp /etc/puppetlabs/puppet/ssl/crl.pem /root/current_crl.pem
+
+## request new puppet agent certificate
+
+    sudo puppet ssl bootstrap
+
+## start the puppetserver service and move the crl.pem back in place
+
+    sudo systemctl start puppetserver
+    sudo cp /root/current_crl.pem /etc/puppetlabs/puppet/ssl/crl.pem

doc/vault/README.md

@@ -0,0 +1,123 @@
+# PKI
+## root ca
+    vault secrets enable -path=pki_root pki
+    vault secrets tune -max-lease-ttl=87600h pki_root
+
+    vault write -field=certificate pki_root/root/generate/internal \
+         common_name="unkin.net" \
+         issuer_name="UNKIN_ROOTCA_2024" \
+         ttl=87600h > unkinroot_2024_ca.crt
+
+    vault read pki_root/issuer/$(vault list -format=json pki_root/issuers/ | jq -r '.[]') | tail -n 6
+
+    vault write pki_root/roles/2024-servers allow_any_name=true
+
+    vault write pki_root/config/urls \
+         issuing_certificates="$VAULT_ADDR/v1/pki_root/ca" \
+         crl_distribution_points="$VAULT_ADDR/v1/pki_root/crl"
+
+## intermediate
+    vault secrets enable -path=pki_int pki
+    vault secrets tune -max-lease-ttl=43800h pki_int
+
+    vault write -format=json pki_int/intermediate/generate/internal \
+         common_name="unkin.net Intermediate Authority" \
+         issuer_name="UNKIN_VAULTCA_2024" \
+         | jq -r '.data.csr' > pki_intermediate.csr
+
+    vault write -format=json pki_root/root/sign-intermediate \
+         issuer_ref="UNKIN_ROOTCA_2024" \
+         csr=@pki_intermediate.csr \
+         format=pem_bundle ttl="43800h" \
+         | jq -r '.data.certificate' > intermediate.cert.pem
+
+    vault write pki_int/intermediate/set-signed certificate=@intermediate.cert.pem
+
+## create role
+    vault write pki_int/roles/servers_default \
+        issuer_ref="$(vault read -field=default pki_int/config/issuers)" \
+        allow_ip_sans=true \
+        allowed_domains="unkin.net, *.unkin.net, localhost" \
+        allow_subdomains=true \
+        allow_glob_domains=true \
+        allow_bare_domains=true \
+        enforce_hostnames=true \
+        allow_any_name=true \
+        max_ttl="2160h" \
+        key_bits=4096 \
+        country="Australia"
+
+## test generating a domain cert
+    vault write pki_int/issue/servers_default common_name="test.unkin.net" ttl="24h"
+    vault write pki_int/issue/servers_default common_name="test.main.unkin.net" ttl="24h"
+    vault write pki_int/issue/servers_default common_name="*.test.main.unkin.net" ttl="24h"
+
+## remove expired certificates
+    vault write pki_int/tidy tidy_cert_store=true tidy_revoked_certs=true
+
+# AUTH
+## enable approles
+    vault auth enable approle
+
+# CERTMANAGER
+## create certmanager policy and token, limit to puppetmaster
+    cat <<EOF > certmanager.hcl
+    path "pki_int/issue/*" {
+      capabilities = ["create", "update", "read"]
+    }
+    path "pki_int/renew/*" {
+      capabilities = ["update"]
+    }
+    path "pki_int/cert/*" {
+      capabilities = ["read"]
+    }
+    EOF
+
+    vault policy write certmanager certmanager.hcl
+
+    vault write auth/approle/role/certmanager \
+        bind_secret_id=false \
+        token_policies="certmanager" \
+        token_ttl=30s \
+        token_max_ttl=30s \
+        token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32"
+
+## get the certmanager approle id
+    vault read -field=role_id auth/approle/role/certmanager/role-id
+
+
+# SSH Hostkey Signing
+
+## create ssh engine, key, set ttl
+    vault secrets enable -path=ssh-host-signer ssh
+    vault write ssh-host-signer/config/ca generate_signing_key=true
+    vault secrets tune -max-lease-ttl=87600h ssh-host-signer
+
+## create role
+    vault write ssh-host-signer/roles/hostrole \
+        key_type=ca \
+        algorithm_signer=rsa-sha2-256 \
+        ttl=87600h \
+        allow_host_certificates=true \
+        allowed_domains="unkin.net" \
+        allow_subdomains=true \
+        allow_baredomains=true
+
+## create policy to use hostrole
+    cat <<EOF > sshsign-host.hcl
+    path "ssh-host-signer/sign/hostrole" {
+        capabilities = ["create", "update"]
+    }
+    EOF
+
+    vault policy write sshsign-host-policy sshsign-host.hcl
+
+    vault write auth/approle/role/sshsign-host-role \
+        bind_secret_id=false \
+        token_policies="sshsign-host-policy" \
+        token_ttl=30s \
+        token_max_ttl=30s \
+        token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32"
+
+## get the sshsign-host-role approle id
+    vault read -field=role_id auth/approle/role/sshsign-host-role/role-id

doc/vault/setup.md

@@ -1,48 +0,0 @@
-# root ca
-    vault secrets enable -path=pki_root pki
-
-    vault write -field=certificate pki_root/root/generate/internal \
-         common_name="unkin.net" \
-         issuer_name="unkinroot-2024" \
-         ttl=87600h > unkinroot_2024_ca.crt
-
-    vault read pki_root/issuer/$(vault list -format=json pki_root/issuers/ | jq -r '.[]') | tail -n 6
-
-    vault write pki_root/roles/2024-servers allow_any_name=true
-
-    vault write pki_root/config/urls \
-         issuing_certificates="$VAULT_ADDR/v1/pki_root/ca" \
-         crl_distribution_points="$VAULT_ADDR/v1/pki_root/crl"
-
-# intermediate
-    vault secrets enable -path=pki_int pki
-    vault secrets tune -max-lease-ttl=43800h pki_int
-
-    vault write -format=json pki_int/intermediate/generate/internal \
-         common_name="unkin.net Intermediate Authority" \
-         issuer_name="unkin-dot-net-intermediate" \
-         | jq -r '.data.csr' > pki_intermediate.csr
-
-    vault write -format=json pki_root/root/sign-intermediate \
-         issuer_ref="unkinroot-2024" \
-         csr=@pki_intermediate.csr \
-         format=pem_bundle ttl="43800h" \
-         | jq -r '.data.certificate' > intermediate.cert.pem
-
-    vault write pki_int/intermediate/set-signed certificate=@intermediate.cert.pem
-
-# create role
-    vault write pki_int/roles/unkin-dot-net \
-         issuer_ref="$(vault read -field=default pki_int/config/issuers)" \
-         allowed_domains="unkin.net" \
-         allow_subdomains=true \
-         max_ttl="2160h"
-
-# test generating a domain cert
-    vault write pki_int/issue/unkin-dot-net common_name="test.unkin.net" ttl="24h"
-    vault write pki_int/issue/unkin-dot-net common_name="test.main.unkin.net" ttl="24h"
-    vault write pki_int/issue/unkin-dot-net common_name="*.test.main.unkin.net" ttl="24h"
-
-
-# remove expired certificates
-    vault write pki_int/tidy tidy_cert_store=true tidy_revoked_certs=true

hieradata/common.yaml

@@ -3,16 +3,10 @@ lookup_options:
   hiera_classes:
     merge:
       strategy: deep
-  profiles::packages::install:
+  profiles::packages::include:
     merge:
       strategy: deep
-  profiles::packages::install_exclude:
-    merge:
-      strategy: deep
-  profiles::packages::remove:
-    merge:
-      strategy: deep
-  profiles::packages::remove_exclude:
+  profiles::packages::exclude:
     merge:
       strategy: deep
   profiles::pki::vault::alt_names:
@@ -108,11 +102,63 @@ lookup_options:
   profiles::nginx::simpleproxy::nginx_aliases:
     merge:
       strategy: deep
+  networking::interfaces:
+    merge:
+      strategy: deep
+  networking::interface_defaults:
+    merge:
+      strategy: deep
+  networking::routes:
+    merge:
+      strategy: deep
+  networking::route_defaults:
+    merge:
+      strategy: deep
+  ssh::server::options:
+    merge:
+      strategy: deep
+  mysql::db:
+    merge:
+      strategy: deep
+  profiles::ceph::client::keyrings:
+    merge:
+      strategy: deep
+  profiles::nginx::simpleproxy::locations:
+    merge:
+      strategy: deep
+  certbot::client::domains:
+    merge:
+      strategy: deep
+  keepalived::vrrp_script:
+    merge:
+      strategy: deep
+  keepalived::vrrp_instance:
+    merge:
+      strategy: deep
+  profiles::etcd::node::initial_cluster_token:
+    convert_to: Sensitive
+  sysctl::base::values:
+    merge:
+      strategy: deep
+  limits::entries:
+    merge:
+      strategy: deep
+  zfs::zpools:
+    merge:
+      strategy: deep
+  zfs::datasets:
+    merge:
+      strategy: deep
 
 facts_path: '/opt/puppetlabs/facter/facts.d'
 
-hiera_classes:
+hiera_include:
   - timezone
+  - networking
+  - ssh::server
+  - profiles::accounts::rundeck
+  - limits
+  - sysctl::base
 
 profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
 profiles::ntp::client::use_ntp: 'region'
@@ -125,6 +171,10 @@ profiles::ntp::client::peers:
 profiles::base::puppet_servers:
   - 'prodinf01n01.main.unkin.net'
 
+consul::install_method: 'package'
+consul::manage_repo: false
+consul::bin_dir: /usr/bin
+
 profiles::dns::master::basedir: '/var/named/sources'
 profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
 profiles::dns::base::use_ns: 'region'
@@ -143,57 +193,70 @@ profiles::consul::client::node_rules:
     segment: ''
     disposition: read
 
-profiles::packages::install:
-  - bash-completion
-  - bzip2
-  - ccze
-  - curl
-  - dstat
-  - expect
-  - gzip
-  - git
-  - htop
-  - inotify-tools
-  - iotop
-  - jq
-  - lz4
-  - mtr
-  - ncdu
-  - neovim
-  - p7zip
-  - pbzip2
-  - pigz
-  - pv
-  - python3.11
-  - rsync
-  - screen
-  - socat
-  - strace
-  - sysstat
-  - tmux
-  - traceroute
-  - unzip
-  - vim
-  - vnstat
-  - wget
-  - zsh
-  - zstd
-
-profiles::packages::remove:
-  - iwl100-firmware
-  - iwl1000-firmware
-  - iwl105-firmware
-  - iwl135-firmware
-  - iwl2000-firmware
-  - iwl2030-firmware
-  - iwl3160-firmware
-  - iwl5000-firmware
-  - iwl5150-firmware
-  - iwl6000-firmware
-  - iwl6000g2a-firmware
-  - iwl6050-firmware
-  - iwl7260-firmware
-  - puppet7-release
+profiles::packages::include:
+  bash-completion: {}
+  bzip2: {}
+  ccze: {}
+  curl: {}
+  dstat: {}
+  expect: {}
+  gzip: {}
+  git: {}
+  htop: {}
+  inotify-tools: {}
+  iotop: {}
+  jq: {}
+  lz4: {}
+  mtr: {}
+  ncdu: {}
+  neovim: {}
+  p7zip: {}
+  pbzip2: {}
+  pigz: {}
+  pv: {}
+  python3.11: {}
+  rsync: {}
+  screen: {}
+  socat: {}
+  strace: {}
+  sysstat: {}
+  tar: {}
+  tmux: {}
+  traceroute: {}
+  unzip: {}
+  vim: {}
+  vnstat: {}
+  wget: {}
+  zsh: {}
+  zstd: {}
+  iwl100-firmware:
+    ensure: absent
+  iwl1000-firmware:
+    ensure: absent
+  iwl105-firmware:
+    ensure: absent
+  iwl135-firmware:
+    ensure: absent
+  iwl2000-firmware:
+    ensure: absent
+  iwl2030-firmware:
+    ensure: absent
+  iwl3160-firmware:
+    ensure: absent
+  iwl5000-firmware:
+    ensure: absent
+  iwl5150-firmware:
+    ensure: absent
+  iwl6000-firmware:
+    ensure: absent
+  iwl6000g2a-firmware:
+    ensure: absent
+  iwl6050-firmware:
+    ensure: absent
+  iwl7260-firmware:
+    ensure: absent
+  puppet7-release:
+    ensure: absent
 
 profiles::base::scripts::scripts:
   puppet: puppetwrapper.py
@@ -215,6 +278,38 @@ puppetdbsql: puppetdbsql.service.au-syd1.consul
 prometheus::node_exporter::export_scrape_job: true
 prometheus::systemd_exporter::export_scrape_job: true
 
+ssh::server::storeconfigs_enabled: false
+ssh::server::options:
+  Protocol: '2'
+  ListenAddress:
+    - '127.0.0.1'
+    - '%{facts.networking.ip}'
+  SyslogFacility: 'AUTHPRIV'
+  HostKey:
+    - /etc/ssh/ssh_host_rsa_key
+    - /etc/ssh/ssh_host_ecdsa_key
+    - /etc/ssh/ssh_host_ed25519_key
+  HostCertificate: /etc/ssh/ssh_host_rsa_key-cert.pem
+  AuthorizedKeysFile: .ssh/authorized_keys
+  PermitRootLogin: no
+  PasswordAuthentication: no
+  ChallengeResponseAuthentication: no
+  PubkeyAuthentication: yes
+  GSSAPIAuthentication: yes
+  GSSAPICleanupCredentials: yes
+  UsePAM: yes
+  X11Forwarding: no
+  PrintMotd: no
+  AcceptEnv:
+    - LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+    - LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+    - LC_IDENTIFICATION LC_ALL LANGUAGE
+    - XMODIFIERS
+  Subsystem: sftp /usr/libexec/openssh/sftp-server
+
+profiles::ssh::knownhosts::lines:
+  - '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1HD97vYxLTniE4qNpGuftUlvmkEXIuX8+7nbENv/IzsGUghEDRtyThjQ7ojNKIsQ7f8wXr0gMcI+fAPfrbcOMHCAoYMomikwL0b3h95SZI40q3CyM+0DMnwiVVDX6C1QxkO2Rv9cszSkCa85NotJhXiUuTBI9BFcRPy+mAhbpAru+bfypYofI0wW97XNTl8Jgwmni5MgutBIQAokFIn5ux8iWxndCH3AqDtmkwC5DfQeQ+wZx7rkwqJEpJffQzrjb1gIM6P9hDCVBBVPh/3o80IJ69rFWrJAZUb+JpG4cXJH0NcSW+wqc3JCT/x3q8VlHwOTXSlNNKtOJCRx73mB8e1XTTy2a9FgpKDDg5XQXWHAViJDz1RTRL9gRefMylRgKz4bXoTuY9kJWM8hPTyUejtukbJThlBJc3OmDxBZBF7F0iqB11pHexok43OCEiANodVa36eWu9/5X032Vm48fZ1/akDPY/NSy3wAn7kwut+A0/JAHFHASrq+1mt9YurkJegI+YHXO6eEWpBIpmI7ORHJbGL4MhkHrxYzVamuP8CkU7tXzsv138+wpOcRHNp9yJY4PT40BZkRf/O3O+jt3pj9Dj8rvgywF2W6hFzywh3Y78upOprRkQlQtHfsI8EyrYI8/hUw2u3H+3yPXh3YjWfqvWVG1BRLRHBV7m90uaw=='
+
 profiles::base::groups::local:
   admins:
     ensure: present
@@ -230,39 +325,39 @@ sudo::configs:
 
 profiles::accounts::sysadmin::sshkeys:
   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ8SRLlPiDylBpdWR9LpvPg4fDVD+DZst4yRPFwMMhta4mnB1H9XuvZkptDhXywWQ7QIcqa2WbhCen0OQJCtwn3s7EYtacmF5MxmwBYocPoK2AArGuh6NA9rwTdLrPdzhZ+gwe88PAzRLNzjm0ZBR+mA9saMbPJdqpKp0AWeAM8QofRQAWuCzQg9i0Pn1KDMvVDRHCZof4pVlHSTyHNektq4ifovn0zhKC8jD/cYu95mc5ftBbORexpGiQWwQ3HZw1IBe0ZETB1qPIPwsoJpt3suvMrL6T2//fcIIUE3TcyJKb/yhztja4TZs5jT8370G/vhlT70He0YPxqHub8ZfBv0khlkY93VBWYpNGJwM1fVqlw7XbfBNdOuJivJac8eW317ZdiDnKkBTxapThpPG3et9ib1HoPGKRsd/fICzNz16h2R3tddSdihTFL+bmTCa6Lo+5t5uRuFjQvhSLSgO2/gRAprc3scYOB4pY/lxOFfq3pU2VvSJtRgLNEYMUYKk= ben@unkin.net
+profiles::accounts::rundeck::sshkeys:
+  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD4F7VcorbGpyZzBFexz7c/o1JBscrl7hZU0UkWV7fq6YLizW0r6fOzD99hMwu1kdYCjPxbvuUSDEHfyBIp2EgLWU6wFVoufQqlMyOV85+ivQZUc1VNV+X9T+U4v3u/01hkAmlpXtbkwhMSR4Wi+tdABd04+D3CuMDM37mvnFmBBmi41X4Mr1rJhOQumn1XHQ7EYbsdw2mxfEVVeWpZIHz5BjNKSGzEIAYZbFt6s0Y7X3J5RT+Gjqmu043Tc8nNIUFlR9E10qd3Euf9RiBYxBx3z+yfOzJPBzWNBSHv1+PIbO5Mq+z5JaAfoFZO41L7nw+FjV6JJUCVLr6Vq+bCxyA7LW4Oq9ZahSrt/vrT0kTa0tA5U9bqK6e7pB//dm7PzoROtTq0XksV8RseA/fvIje20uaN1z9dynx+UcbszXu9pQ5GIg1o7b5DEi3OZHJwpgdudiCyEeR4+00G0z4PjpEMnTSMHAJ53WxtjzrPAOBnAmPE7hPu4coU+XrCWEXAvRMloJmca68e+zFX7VvFK82KVDuQ99vQ6w4X73IESKoLzyAVxpelwHaDG4fN+zqYfqubVQU1L5cUeYKxqm5r3Us6VvMaYs1ZMUmDGXHOq4FNhGUJYxSjkLvunM6qyAAJQCd6Pw/2TV3UQVerbouGOZaeBLvRguHWSbDrO99Zu+t87w== rundeck_runner
 
-profiles::base::hosts::additional_hosts:
-  - ip: 198.18.17.3
-    hostname: prodinf01n01.main.unkin.net
-    aliases:
-      - prodinf01n01
-      - puppet
-      - puppetmaster
-      - puppetca
-  - ip: 198.18.17.4
-    hostname: prodinf01n04.main.unkin.net
-    aliases:
-      - prodinf01n04
-  - ip: 198.18.17.5
-    hostname: prodinf01n05.main.unkin.net
-    aliases:
-      - prodinf01n05
-  - ip: 198.18.17.6
-    hostname: prodinf01n06.main.unkin.net
-    aliases:
-      - prodinf01n06
-  - ip: 198.18.17.9
-    hostname: prodinf01n09.main.unkin.net
-    aliases:
-      - prodinf01n09
-      - ntp01.main.unkin.net
-  - ip: 198.18.17.10
-    hostname: prodinf01n10.main.unkin.net
-    aliases:
-      - prodinf01n10
-      - ntp02.main.unkin.net
-  - ip: 198.18.17.22
-    hostname: prodinf01n22.main.unkin.net
-    aliases:
-      - prodinf01n22
-      - repos.main.unkin.net
+networking::interface_defaults:
+  ensure: present
+  family: inet
+  method: static
+  netmask: 255.255.255.0
+  onboot: true
+networking::route_defaults:
+  ensure: present
+  interface: eth0
+  netmask: 0.0.0.0
+  network: default
+
+profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
+profiles::ceph::client::mons:
+  - 10.18.15.1
+  - 10.18.15.2
+  - 10.18.15.3
+#profiles::base::hosts::additional_hosts:
+#  - ip: 198.18.17.9
+#    hostname: prodinf01n09.main.unkin.net
+#    aliases:
+#      - prodinf01n09
+#      - ntp01.main.unkin.net
+#  - ip: 198.18.17.10
+#    hostname: prodinf01n10.main.unkin.net
+#    aliases:
+#      - prodinf01n10
+#      - ntp02.main.unkin.net
+#  - ip: 198.18.17.22
+#    hostname: prodinf01n22.main.unkin.net
+#    aliases:
+#      - prodinf01n22
+#      - repos.main.unkin.net

hieradata/country/au/region/drw1/infra/puppet/master.eyaml

@@ -1,3 +1,4 @@
 ---
 certmanager::vault_token: ENC[PKCS7,MIIBygYJKoZIhvcNAQcDoIIBuzCCAbcCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAWh7bsttz/JCBo/CPoCgA2doo3jO6jT6NsOoE3/06W2IW+Ij6KHKYILMkG3tS4NAegMI48QR9n++4Xa7u+97w1HO4ENpfLrkuKUcWUFCxxb2OdWhxucIlt3Ay/2+tofOSvqiRKeEISBtOK//Q1a4Iu5GwEP+lvDQ5rcoS0dryNie/okXaLratWOsmctJ6LFuUw5siCcFyUzfvr2ROsB14YoF989np+X1dJqBWxcLmbVNKx766GrRhb1WGeF0qxounCmWEKGt0zY4Zk27KNFlFu7XByDWZoSCVCMvkQaRKhvdNA39Y9vscZJGPGFhz+qKPoeqwUidz0IY51CaFSXewmzCBjAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQC+e2iOlFLlr9inVU8nEVWIBgqb0u/ICsLtxZqOpN9OIFWl+4hVrvTo24JzTc1jMSCONeL4Ab7jtTMbsweE9zUf6XlwhHLXfxfg7FL3WBsOWCUBXIAh338cZCXUGX7m0Qvtgg3VTEbTNDJhZle8Sjo6Gl]
 certmanager::role_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJuE+uzgQaBRUXBCigckEo1j+UxxbiUGrzdf/B9K7XPdVxZh6TzYLpBgNnyaT6vLo0boX4uRD/By0gT5R/2qcXD6d/j+fh517Ctk4d2uO64f0vH3PzyyOBalsNtcCdPiV3q/xGqzQSHhPiNkFEjDvMBz5p53UjfKA6gAiPrLklp4rN/NVyiLBw20NeIqbL25VdkQa13ViS0Gm/eUQu7a2xQ1dvQFWWfuLaQxO0dh8L0ynkfmWKIjaiD5412Z8hYURu0otxbqVDdIbEMx5xQsXnFKeN93yHmgs7a7M6fLdp9jh+G8B+IlK1W7/9v2+RT0/yI3ZgWHVTvDRhMHuPGBjfTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC5avtOPp9N65U1ILQENnvAgDBqI8XAjqbWIvXHqOEiKYdu+co0EEtsHR1v5xAeCmj/ZA6MLeKFlAVJbvpyCpzjons=]
+sshsignhost::role_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAT86C/InXrgDtXCc9NFze91YMvjTNDqWgv4uzPFI48clOeQyD6x+vOHWP2yNp1OyNHcYLCiLyrv+rSIQyXlLnbeyZWV+7kXIon057Tp7l0BxWtd0hjQEcyWzqQQE7R264C8/qKRak81LIu6RshWZAchYo/BMPuOqVr0m+1zDwOV9JwZc3bpexzsl57CK5pesOrpfdvnd/xrOoEMR+P+C5PC6QLtQl3zkOD3N9kP6HqwbhWH5ZBPy88Kc+5kYM6QVpQSjFIIHK1SWsN0VZoxpkuFlFXB5KHDgZtg3kxrofzjQghl41zJBCDq9Z5oZ+2b1p/j/9jCASyp/ju68H5WXzbzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCf4Nqp6SAl/XjmhPDnTvVJgDCdDhxWaChhjJ3eRcW4NTFgf3zm7Bu65za0li26FKuKks00duF4zebfNw7ZUVsYtIU=]

hieradata/country/au/region/syd1.yaml

@@ -1,2 +1,3 @@
 ---
 timezone::timezone: 'Australia/Sydney'
+certbot::client::webserver: ausyd1nxvm1021.main.unkin.net

hieradata/country/au/region/syd1/infra/halb/haproxy.yaml

@@ -1,4 +1,31 @@
 ---
+hiera_include:
+  - keepalived
+
+# keepalived
+profiles::haproxy::dns::vrrp_ipaddr: '198.18.13.250'
+profiles::haproxy::dns::vrrp_cnames:
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - nzbget.main.unkin.net
+
+keepalived::vrrp_script:
+  check_haproxy:
+    script: '/usr/bin/killall -0 haproxy'
+
+keepalived::vrrp_instance:
+  VI_250:
+    interface: 'eth0'
+    virtual_router_id: 250
+    auth_type: 'PASS'
+    auth_pass: 'quiiK7oo'
+    virtual_ipaddress: '198.18.13.250/32'
+    track_script:
+      - check_haproxy
+
 # mappings
 profiles::haproxy::mappings:
   fe_http:
@@ -6,11 +33,27 @@ profiles::haproxy::mappings:
     mappings:
       - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
       - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
+      - 'sonarr.main.unkin.net be_sonarr'
+      - 'radarr.main.unkin.net be_radarr'
+      - 'lidarr.main.unkin.net be_lidarr'
+      - 'readarr.main.unkin.net be_readarr'
+      - 'prowlarr.main.unkin.net be_prowlarr'
+      - 'nzbget.main.unkin.net be_nzbget'
+      - 'jellyfin.main.unkin.net be_jellyfin'
+      - 'fafflix.unkin.net be_jellyfin'
   fe_https:
     ensure: present
     mappings:
       - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
       - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
+      - 'sonarr.main.unkin.net be_sonarr'
+      - 'radarr.main.unkin.net be_radarr'
+      - 'lidarr.main.unkin.net be_lidarr'
+      - 'readarr.main.unkin.net be_readarr'
+      - 'prowlarr.main.unkin.net be_prowlarr'
+      - 'nzbget.main.unkin.net be_nzbget'
+      - 'jellyfin.main.unkin.net be_jellyfin'
+      - 'fafflix.unkin.net be_jellyfin'
 
 profiles::haproxy::frontends:
   fe_http:
@@ -20,7 +63,15 @@ profiles::haproxy::frontends:
   fe_https:
     options:
       acl:
-        - 'acl_ausyd1pve req.hdr(host) -i https://au-syd1-pve.main.unkin.net'
+        - 'acl_ausyd1pve req.hdr(host) -i au-syd1-pve.main.unkin.net'
+        - 'acl_sonarr req.hdr(host) -i sonarr.main.unkin.net'
+        - 'acl_radarr req.hdr(host) -i radarr.main.unkin.net'
+        - 'acl_lidarr req.hdr(host) -i lidarr.main.unkin.net'
+        - 'acl_readarr req.hdr(host) -i readarr.main.unkin.net'
+        - 'acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net'
+        - 'acl_nzbget req.hdr(host) -i nzbget.main.unkin.net'
+        - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
+        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
         - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
       use_backend:
         - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -28,6 +79,14 @@ profiles::haproxy::frontends:
         - 'deny if { hdr_dom(host) -i au-syd1-pve.main.unkin.net } !acl_internalsubnets'
       http-response:
         - 'set-header X-Frame-Options DENY if acl_ausyd1pve'
+        - 'set-header X-Frame-Options DENY if acl_sonarr'
+        - 'set-header X-Frame-Options DENY if acl_radarr'
+        - 'set-header X-Frame-Options DENY if acl_lidarr'
+        - 'set-header X-Frame-Options DENY if acl_readarr'
+        - 'set-header X-Frame-Options DENY if acl_prowlarr'
+        - 'set-header X-Frame-Options DENY if acl_nzbget'
+        - 'set-header X-Frame-Options DENY if acl_jellyfin'
+        - 'set-header X-Frame-Options DENY if acl_fafflix'
         - 'set-header X-Content-Type-Options nosniff'
         - 'set-header X-XSS-Protection 1;mode=block'
 
@@ -63,17 +122,152 @@ profiles::haproxy::backends:
         - set-header X-Forwarded-Port %[dst_port]
         - add-header X-Forwarded-Proto https if { dst_port 443 }
       redirect: 'scheme https if !{ ssl_fc }'
+  be_sonarr:
+    description: Backend for au-syd1 sonarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_radarr:
+    description: Backend for au-syd1 radarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_lidarr:
+    description: Backend for au-syd1 lidarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_readarr:
+    description: Backend for au-syd1 readarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_prowlarr:
+    description: Backend for au-syd1 prowlarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_nzbget:
+    description: Backend for au-syd1 nzbget
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_jellyfin:
+    description: Backend for au-syd1 jellyfin
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
 
 profiles::haproxy::certlist::enabled: true
 profiles::haproxy::certlist::certificates:
+  - /etc/pki/tls/letsencrypt/au-syd1-pve.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/au-syd1-pve-api.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/sonarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/radarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/lidarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/readarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/prowlarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/vault/certificate.pem
 
 # additional altnames
 profiles::pki::vault::alt_names:
   - au-syd1-pve.main.unkin.net
   - au-syd1-pve-api.main.unkin.net
+  - jellyfin.main.unkin.net
 
 # additional cnames
 profiles::haproxy::dns::cnames:
   - au-syd1-pve.main.unkin.net
   - au-syd1-pve-api.main.unkin.net
+
+# letsencrypt certificates
+certbot::client::service: haproxy
+certbot::client::domains:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - nzbget.main.unkin.net
+  - fafflix.unkin.net

hieradata/country/au/region/syd1/infra/puppet/master.eyaml

@@ -1,3 +1,4 @@
 ---
 certmanager::vault_token: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJuE+uzgQaBRUXBCigckEo1j+UxxbiUGrzdf/B9K7XPdVxZh6TzYLpBgNnyaT6vLo0boX4uRD/By0gT5R/2qcXD6d/j+fh517Ctk4d2uO64f0vH3PzyyOBalsNtcCdPiV3q/xGqzQSHhPiNkFEjDvMBz5p53UjfKA6gAiPrLklp4rN/NVyiLBw20NeIqbL25VdkQa13ViS0Gm/eUQu7a2xQ1dvQFWWfuLaQxO0dh8L0ynkfmWKIjaiD5412Z8hYURu0otxbqVDdIbEMx5xQsXnFKeN93yHmgs7a7M6fLdp9jh+G8B+IlK1W7/9v2+RT0/yI3ZgWHVTvDRhMHuPGBjfTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC5avtOPp9N65U1ILQENnvAgDBqI8XAjqbWIvXHqOEiKYdu+co0EEtsHR1v5xAeCmj/ZA6MLeKFlAVJbvpyCpzjons=]
 certmanager::role_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJuE+uzgQaBRUXBCigckEo1j+UxxbiUGrzdf/B9K7XPdVxZh6TzYLpBgNnyaT6vLo0boX4uRD/By0gT5R/2qcXD6d/j+fh517Ctk4d2uO64f0vH3PzyyOBalsNtcCdPiV3q/xGqzQSHhPiNkFEjDvMBz5p53UjfKA6gAiPrLklp4rN/NVyiLBw20NeIqbL25VdkQa13ViS0Gm/eUQu7a2xQ1dvQFWWfuLaQxO0dh8L0ynkfmWKIjaiD5412Z8hYURu0otxbqVDdIbEMx5xQsXnFKeN93yHmgs7a7M6fLdp9jh+G8B+IlK1W7/9v2+RT0/yI3ZgWHVTvDRhMHuPGBjfTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC5avtOPp9N65U1ILQENnvAgDBqI8XAjqbWIvXHqOEiKYdu+co0EEtsHR1v5xAeCmj/ZA6MLeKFlAVJbvpyCpzjons=]
+sshsignhost::role_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAT86C/InXrgDtXCc9NFze91YMvjTNDqWgv4uzPFI48clOeQyD6x+vOHWP2yNp1OyNHcYLCiLyrv+rSIQyXlLnbeyZWV+7kXIon057Tp7l0BxWtd0hjQEcyWzqQQE7R264C8/qKRak81LIu6RshWZAchYo/BMPuOqVr0m+1zDwOV9JwZc3bpexzsl57CK5pesOrpfdvnd/xrOoEMR+P+C5PC6QLtQl3zkOD3N9kP6HqwbhWH5ZBPy88Kc+5kYM6QVpQSjFIIHK1SWsN0VZoxpkuFlFXB5KHDgZtg3kxrofzjQghl41zJBCDq9Z5oZ+2b1p/j/9jCASyp/ju68H5WXzbzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCf4Nqp6SAl/XjmhPDnTvVJgDCdDhxWaChhjJ3eRcW4NTFgf3zm7Bu65za0li26FKuKks00duF4zebfNw7ZUVsYtIU=]

hieradata/country/au/region/syd1/infra/sql/galera.eyaml

@@ -0,0 +1,3 @@
+---
+mysql::db::grafana::pass: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAozi1vFf9KfwsGSdxXvhOWRn9Vqbr9AZ+cVJuIOmmLVZMRP4AJkkNgCCly+o1pxtMiU8EISUQuBWCBHUi+u2Y1YAjIABzTa2K+PCU7qqkdrJaxvKqmmKS7C/CWFKp1stYvYIvIofyvl9Q854nMcpvxQKL0PBGh3rIaUHHV3L0PH1UDLqL5j6OPXaNvKL4UzwMDDIVAd7F5yMbtSx2PT23pBLbPYsbG1jRx7pUS/d1ZE9E8h3OA2jxW/CBf68Sb2Xlrh7IAB/6RiLLpIsUyRMv9zrbPrMuKg/q5lzO0i9fejh5z3Z3YkdnhH61doUT/RSjAjz3JrWDGxomOSK0y8TxjjBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCg1kVqFs/mf4r+6EI32b8qgCBm6cL3JhVzj3Btit9D8VYU8mQcrIaXJZ3qF31zJMzCkw==]
+mysql::db::rundeck::pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAcWmZuTro0DNX8X/6DCJdmxm85hawng2cjSm/M26/sAzlr7i3XLIjg5TQc3BpeiKWZvQ2XZWygOEcW7g0bHH7FBS6XTXswDiLCf7ssd0DYL+eQbh4p6VijBKObug33fp4+YJaqGV7YRUNqBjXQv/SSmxFqbNaRahUqwbMidJCyjGNmfCfbSd9WxI4/8j0L38rjXR3/i+/xzgVIhgz/qymmw0rky6jN14YrwRIkdW6loMFzVd12tqdX9kh7UBdE7j58ntQgJSilQn2pLmQs6dgcXSOeIi8Sln4R0MfAtOQ1c6LoKMUdb7k8xEszpGbhX7sw51kpwvnL1LS6PQ+T8T9wDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDm1sAUc6LFtslrIuwk1JlJgDAngDM/0g4dpgyNOZDsvAU8OualEL6HZ2RFGfibteUc11wZzHkdFZlvHz2JZdO7Huo=]

hieradata/country/au/region/syd1/infra/sql/galera.yaml

@@ -2,3 +2,23 @@
 profiles::sql::galera_member::cluster_name: au-syd1
 profiles::sql::galera_member::galera_master: ausyd1nxvm1027.main.unkin.net
 profiles::sql::galera_member::innodb_buffer_pool_size: 256M
+
+mysql::db:
+  grafana:
+    name: grafana
+    user: grafana
+    password: "%{alias('mysql::db::grafana::pass')}"
+    grant:
+      - SELECT
+      - INSERT
+      - UPDATE
+      - DELETE
+  rundeck:
+    name: rundeck
+    user: rundeck
+    password: "%{alias('mysql::db::rundeck::pass')}"
+    grant:
+      - SELECT
+      - INSERT
+      - UPDATE
+      - DELETE

hieradata/nodes/ausyd1nxvm1000.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.10
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1001.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.11
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1002.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.12
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1003.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.13
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1004.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.14
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1005.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.15
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1006.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.16
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1007.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.17
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1008.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.18
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1009.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.19
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1010.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.20
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1011.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.21
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1012.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.22
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1013.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.23
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1014.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.24
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1015.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.25
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+
+profiles::haproxy::dns::vrrp_master: true
+keepalived::vrrp_instance:
+  VI_250:
+    state: 'MASTER'
+    priority: 101

hieradata/nodes/ausyd1nxvm1016.main.unkin.net.yaml

@@ -0,0 +1,12 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.26
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+
+keepalived::vrrp_instance:
+  VI_250:
+    state: 'BACKUP'
+    priority: 100

hieradata/nodes/ausyd1nxvm1017.main.unkin.net.yaml

@@ -1,2 +1,11 @@
 ---
 profiles::cobbler::params::is_cobbler_master: true
+networking::interfaces:
+  ens18:
+    ipaddress: 198.18.13.27
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+    interface: ens18
+
+profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1018.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.28
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1019.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.29
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1020.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.30
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1021.main.unkin.net.yaml

@@ -0,0 +1,10 @@
+---
+networking::interfaces:
+  ens18:
+    ipaddress: 198.18.13.31
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+    interface: ens18
+
+profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1022.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.32
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1023.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.33
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1024.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.34
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1025.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.35
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1026.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.36
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1027.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.37
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1028.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.38
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1029.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.39
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1030.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.40
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1031.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.41
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1032.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.42
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1033.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.43
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1034.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.44
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1035.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.45
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1036.main.unkin.net.yaml

@@ -5,5 +5,17 @@ profiles::puppet::server::dns_alt_names:
   - puppetca.query.consul
   - puppetca
 
+profiles::ssh::sign::principals:
+  - puppetca.main.unkin.net
+  - puppetca.service.consul
+  - puppetca.query.consul
+  - puppetca
+
 profiles::puppet::puppetca::is_puppetca: true
 profiles::puppet::puppetca::allow_subject_alt_names: true
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.46
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1037.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.47
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.47
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1038.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.48
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1039.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.49
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1040.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.50
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.50
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1041.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.51
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.51
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1042.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.52
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.52
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1043.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.53
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.53
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1044.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.54
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1045.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.55
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1046.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.56
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1047.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.57
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.57
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1048.main.unkin.net.yaml

@@ -0,0 +1,14 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.58
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.58
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1049.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.59
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1050.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.60
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1051.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.61
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1052.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.62
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1053.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.63
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1054.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.64
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1055.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.65
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1056.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.66
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1057.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.67
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1058.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.68
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1059.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.69
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1060.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.70
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1061.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.71
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1062.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.72
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1063.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.73
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1064.main.unkin.net.yaml

@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.74
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.74
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.64.254/24'

hieradata/nodes/ausyd1nxvm1065.main.unkin.net.yaml

@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.75
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.75
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.65.254/24'

hieradata/nodes/ausyd1nxvm1066.main.unkin.net.yaml

@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.76
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.76
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.66.254/24'

hieradata/nodes/ausyd1nxvm1067.main.unkin.net.yaml

@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.77
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.77
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.67.254/24'

hieradata/nodes/ausyd1nxvm1068.main.unkin.net.yaml

@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.78
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.78
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.68.254/24'

hieradata/nodes/ausyd1nxvm1069.main.unkin.net.yaml

@@ -0,0 +1,15 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.79
+  ens19:
+    ensure: present
+    family: inet
+    method: static
+    ipaddress: 10.18.15.79
+    netmask: 255.255.255.0
+    onboot: true
+networking::routes:
+  default:
+    gateway: 198.18.13.254
+docker::bip: '198.18.69.254/24'

hieradata/nodes/ausyd1nxvm1070.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.80
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1071.main.unkin.net.yaml

@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.81
+networking::routes:
+  default:
+    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm2000.main.unkin.net.yaml

@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.14  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:69:0f:3b

hieradata/nodes/ausyd1nxvm2001.main.unkin.net.yaml

@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.15  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:55:46:bd

hieradata/nodes/ausyd1nxvm2002.main.unkin.net.yaml

@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.16  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:6a:25:6b

hieradata/nodes/ausyd1nxvm2003.main.unkin.net.yaml

@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.17  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:63:89:f2

hieradata/nodes/ausyd1nxvm2004.main.unkin.net.yaml

@@ -0,0 +1,5 @@
+---
+networking_loopback0_ip: 198.18.19.18  # management loopback
+networking::interfaces:
+  eth0:
+    mac: 00:16:3e:ca:e1:51

hieradata/nodes/prodinf01n01.main.unkin.net.yaml

@@ -7,3 +7,6 @@ profiles::puppet::server::dns_alt_names:
 
 profiles::puppet::puppetca::is_puppetca: false
 profiles::puppet::puppetca::allow_subject_alt_names: true
+
+hiera_exclude:
+  - networking

hieradata/nodes/prodnxsr0009.main.unkin.net.yaml

@@ -0,0 +1,18 @@
+---
+networking_loopback0_ip: 198.18.19.9  # management loopback
+networking_loopback1_ip: 198.18.22.9  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.9  # ceph-public loopback
+networking_br10_ip: 198.18.25.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:38:e9:8d
+    ipaddress: 198.18.15.9
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:5d
+    ipaddress: 198.18.21.9
+
+#zfs::zpools:
+#  fastpool:
+#    ensure: present
+#    disk: /dev/nvme0n1

hieradata/nodes/prodnxsr0010.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking_loopback0_ip: 198.18.19.10  # management loopback
+networking_loopback1_ip: 198.18.22.10  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.10  # ceph-public loopback
+networking_br10_ip: 198.18.26.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:38:e9:37
+    ipaddress: 198.18.15.10
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:de
+    ipaddress: 198.18.21.10

hieradata/nodes/prodnxsr0011.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking_loopback0_ip: 198.18.19.11  # management loopback
+networking_loopback1_ip: 198.18.22.11  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.11  # ceph-public loopback
+networking_br10_ip: 198.18.27.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:38:e9:0f
+    ipaddress: 198.18.15.11
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:55
+    ipaddress: 198.18.21.11

hieradata/nodes/prodnxsr0012.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking_loopback0_ip: 198.18.19.12  # management loopback
+networking_loopback1_ip: 198.18.22.12  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.12  # ceph-public loopback
+networking_br10_ip: 198.18.28.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:4f:05:1e
+    ipaddress: 198.18.15.12
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:e5
+    ipaddress: 198.18.21.12

hieradata/nodes/prodnxsr0013.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking_loopback0_ip: 198.18.19.13  # management loopback
+networking_loopback1_ip: 198.18.22.13  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.13  # ceph-public loopback
+networking_br10_ip: 198.18.29.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:4f:04:b0
+    ipaddress: 198.18.15.13
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:36
+    ipaddress: 198.18.21.13

hieradata/os/AlmaLinux/AlmaLinux8.yaml

@@ -1,2 +1,23 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
+crypto_policies::policy: 'DEFAULT'
+
+profiles::packages::include:
+  network-scripts: {}
+
+profiles::yum::global::repos:
+  powertools:
+    name: powertools
+    descr: powertools repository
+    target: /etc/yum.repos.d/powertools.repo
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el8
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/os/AlmaLinux/AlmaLinux9.yaml

@@ -1,2 +1,36 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
+crypto_policies::policy: 'DEFAULT:SHA1'
+
+profiles::yum::global::repos:
+  baseos:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  extras:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  appstream:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  highavailability:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  crb:
+    name: crb
+    descr: crb repository
+    target: /etc/yum.repos.d/crb.repo
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el9
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/os/AlmaLinux/all_releases.yaml

@@ -3,12 +3,16 @@
 profiles::firewall::firewalld::ensure_package: 'absent'
 profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
-profiles::puppet::agent::puppet_version: '7.26.0'
+profiles::puppet::agent::puppet_version: '7.34.0'
 
-profiles::packages::install:
-  - lzo
-  - xz
-  - policycoreutils
+hiera_include:
+  - profiles::almalinux::base
+
+profiles::packages::include:
+  lzo: {}
+  policycoreutils: {}
+  unar: {}
+  xz: {}
 
 lm-sensors::package: lm_sensors
 
@@ -19,44 +23,47 @@ profiles::yum::global::repos:
     target: /etc/yum.repos.d/baseos.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
   extras:
     name: extras
     descr: extras repository
     target: /etc/yum.repos.d/extras.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
   appstream:
     name: appstream
     descr: appstream repository
     target: /etc/yum.repos.d/appstream.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-  powertools:
-    name: powertools
-    descr: powertools repository
-    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
-    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
   highavailability:
     name: highavailability
     descr: highavailability repository
     target: /etc/yum.repos.d/highavailability.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
   epel:
     name: epel
     descr: epel repository
     target: /etc/yum.repos.d/epel.repo
     baseurl: https://edgecache.query.consul/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
     gpgkey: http://edgecache.query.consul/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
+    mirrorlist: absent
   puppet:
     name: puppet
     descr: puppet repository
     target: /etc/yum.repos.d/puppet.repo
-    baseurl: https://yum.puppet.com/puppet7/el/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406
-  unkin:
-    name: unkin
-    descr: unkin repository
+    baseurl: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-puppet-20250406
+    mirrorlist: absent
+  unkinben:
+    name: unkinben
+    descr: unkinben repository
     target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://repos.main.unkin.net/unkin/%{facts.os.release.major}/%{facts.os.architecture}/os
+    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
+    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent