feat: implement nested groups

- use includegroups feature to nest groups - remove the trailing ',' from includegroups
2024-09-26 17:15:51 +10:00
144 changed files with 516 additions and 4339 deletions
@@ -3,8 +3,3 @@
 detectors:
  FeatureEnvy:
    enabled: false
-  TooManyStatements:
-    enabled: false
-  UncommunicativeVariableName:
-    accept:
-      - e
@@ -2,54 +2,52 @@ forge 'forge.puppetlabs.com'
 moduledir 'external_modules'

 # puppetlabs
-mod 'puppetlabs-stdlib', '9.7.0'
-mod 'puppetlabs-inifile', '6.2.0'
-mod 'puppetlabs-concat', '9.1.0'
-mod 'puppetlabs-vcsrepo', '7.0.0'
-mod 'puppetlabs-yumrepo_core', '2.1.0'
-mod 'puppetlabs-apt', '10.0.1'
-mod 'puppetlabs-lvm', '3.0.1'
-mod 'puppetlabs-puppetdb', '7.14.0'
-mod 'puppetlabs-postgresql', '9.2.0'
-mod 'puppetlabs-firewall', '8.1.4'
-mod 'puppetlabs-accounts', '8.2.2'
-mod 'puppetlabs-mysql', '16.2.0'
+mod 'puppetlabs-stdlib', '9.1.0'
+mod 'puppetlabs-inifile', '6.0.0'
+mod 'puppetlabs-concat', '9.0.0'
+mod 'puppetlabs-vcsrepo', '6.1.0'
+mod 'puppetlabs-yumrepo_core', '2.0.0'
+mod 'puppetlabs-apt', '9.4.0'
+mod 'puppetlabs-lvm', '2.1.0'
+mod 'puppetlabs-puppetdb', '7.13.0'
+mod 'puppetlabs-postgresql', '9.1.0'
+mod 'puppetlabs-firewall', '6.0.0'
+mod 'puppetlabs-accounts', '8.1.0'
+mod 'puppetlabs-mysql', '15.0.0'
 mod 'puppetlabs-xinetd', '3.4.1'
-mod 'puppetlabs-haproxy', '8.2.0'
-mod 'puppetlabs-java', '11.1.0'
-mod 'puppetlabs-reboot', '5.1.0'
-mod 'puppetlabs-docker', '10.2.0'
+mod 'puppetlabs-haproxy', '8.0.0'
+mod 'puppetlabs-java', '10.1.2'
+mod 'puppetlabs-reboot', '5.0.0'
+mod 'puppetlabs-docker', '10.0.1'

 # puppet
-mod 'puppet-python', '7.4.0'
-mod 'puppet-systemd', '8.1.0'
-mod 'puppet-yum', '7.2.0'
-mod 'puppet-archive', '7.1.0'
-mod 'puppet-chrony', '3.0.0'
-mod 'puppet-puppetboard', '11.0.0'
-mod 'puppet-nginx', '6.0.1'
-mod 'puppet-selinux', '5.0.0'
-mod 'puppet-prometheus', '16.0.0'
-mod 'puppet-grafana', '14.1.0'
-mod 'puppet-consul', '9.1.0'
-mod 'puppet-vault', '4.1.1'
+mod 'puppet-python', '7.0.0'
+mod 'puppet-systemd', '5.1.0'
+mod 'puppet-yum', '7.0.0'
+mod 'puppet-archive', '7.0.0'
+mod 'puppet-chrony', '2.6.0'
+mod 'puppet-puppetboard', '9.0.0'
+mod 'puppet-nginx', '5.0.0'
+mod 'puppet-selinux', '4.1.0'
+mod 'puppet-prometheus', '13.4.0'
+mod 'puppet-grafana', '13.1.0'
+mod 'puppet-consul', '8.0.0'
+mod 'puppet-vault', '4.1.0'
 mod 'puppet-dhcp', '6.1.0'
 mod 'puppet-keepalived', '5.1.0'
-mod 'puppet-extlib', '7.5.1'
-mod 'puppet-network', '2.2.1'
-mod 'puppet-kmod', '4.1.0'
+mod 'puppet-extlib', '7.0.0'
+mod 'puppet-network', '2.2.0'
+mod 'puppet-kmod', '4.0.1'
 mod 'puppet-filemapper', '4.0.0'
-mod 'puppet-letsencrypt', '11.1.0'
-mod 'puppet-rundeck', '9.2.0'
-mod 'puppet-redis', '11.1.0'
-mod 'puppet-nodejs', '11.0.0'
+mod 'puppet-letsencrypt', '11.0.0'
+mod 'puppet-rundeck', '9.1.0'
+mod 'puppet-redis', '11.0.0'

 # other
-mod 'saz-sudo', '9.0.2'
-mod 'saz-ssh', '13.1.0'
-mod 'saz-limits', '5.0.0'
-mod 'ghoneycutt-timezone', '4.0.0'
 mod 'ghoneycutt-puppet', '3.3.0'
+mod 'saz-sudo', '8.0.0'
+mod 'saz-ssh', '12.1.0'
+mod 'ghoneycutt-timezone', '4.0.0'
 mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
@@ -58,10 +56,6 @@ mod 'stm-file_capability', '6.0.0'
 mod 'h0tw1r3-gitea', '3.2.0'
 mod 'rehan-mkdir', '2.0.0'
 mod 'tailoredautomation-patroni', '2.0.0'
-mod 'ssm-crypto_policies', '0.3.3'
-mod 'thias-sysctl', '1.0.8'
-mod 'openstack-ceph', '7.0.0'
-

 mod 'bind',
  :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',
@@ -135,20 +135,6 @@ lookup_options:
  keepalived::vrrp_instance:
    merge:
      strategy: deep
-  profiles::etcd::node::initial_cluster_token:
-    convert_to: Sensitive
-  sysctl::base::values:
-    merge:
-      strategy: deep
-  limits::entries:
-    merge:
-      strategy: deep
-  zfs::zpools:
-    merge:
-      strategy: deep
-  zfs::datasets:
-    merge:
-      strategy: deep

 facts_path: '/opt/puppetlabs/facter/facts.d'

@@ -157,8 +143,6 @@ hiera_include:
  - networking
  - ssh::server
  - profiles::accounts::rundeck
-  - limits
-  - sysctl::base

 profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
 profiles::ntp::client::use_ntp: 'region'
@@ -171,22 +155,9 @@ profiles::ntp::client::peers:
 profiles::base::puppet_servers:
  - 'prodinf01n01.main.unkin.net'

-consul::install_method: 'package'
-consul::manage_repo: false
-consul::bin_dir: /usr/bin
-
-vault::install_method: 'repo'
-vault::manage_repo: false
-vault::bin_dir: /usr/bin
-vault::manage_service_file: true
-vault::manage_config_dir: true
-vault::disable_mlock: false
-
-profiles::dns::base::nameservers:
-  - 198.18.19.16
 profiles::dns::master::basedir: '/var/named/sources'
-#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
-#profiles::dns::base::use_ns: 'region'
+profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
+profiles::dns::base::use_ns: 'region'
 profiles::consul::server::members_role: roles::infra::storage::consul
 profiles::consul::token::node_editor::accessor_id: '024e27bd-c5bb-41e7-a578-b766509e11bc'
 profiles::consul::client::members_lookup: true
@@ -1,9 +1,2 @@
 ---
 timezone::timezone: 'Australia/Darwin'
-profiles_dns_upstream_forwarder_unkin:
-  - 198.18.17.23
-  - 198.18.17.24
-profiles_dns_upstream_forwarder_consul:
-  - 198.18.17.34
-  - 198.18.17.35
-  - 198.18.17.36
@@ -1 +1,52 @@
 ---
+profiles::dns::resolver::zones:
+  main.unkin.net-forward:
+    domain: 'main.unkin.net'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  13.18.198.in-addr.arpa-forward:
+    domain: '13.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  14.18.198.in-addr.arpa-forward:
+    domain: '14.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  15.18.198.in-addr.arpa-forward:
+    domain: '15.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  16.18.198.in-addr.arpa-forward:
+    domain: '16.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  17.18.198.in-addr.arpa-forward:
+    domain: '17.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.23
+      - 198.18.17.24
+    forward: 'only'
+  consul-forward:
+    domain: 'consul'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.17.34
+      - 198.18.17.35
+      - 198.18.17.36
+    forward: 'only'
@@ -1,7 +1,3 @@
 ---
 timezone::timezone: 'Australia/Sydney'
 certbot::client::webserver: ausyd1nxvm1021.main.unkin.net
-profiles_dns_upstream_forwarder_unkin:
-  - 198.18.19.15
-profiles_dns_upstream_forwarder_consul:
-  - 198.18.19.14
@@ -1 +1,52 @@
 ---
+profiles::dns::resolver::zones:
+  main.unkin.net-forward:
+    domain: 'main.unkin.net'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  13.18.198.in-addr.arpa-forward:
+    domain: '13.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  14.18.198.in-addr.arpa-forward:
+    domain: '14.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  15.18.198.in-addr.arpa-forward:
+    domain: '15.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  16.18.198.in-addr.arpa-forward:
+    domain: '16.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  17.18.198.in-addr.arpa-forward:
+    domain: '17.18.198.in-addr.arpa'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.14
+      - 198.18.13.15
+    forward: 'only'
+  consul-forward:
+    domain: 'consul'
+    zone_type: 'forward'
+    forwarders:
+      - 198.18.13.19
+      - 198.18.13.20
+      - 198.18.13.21
+    forward: 'only'
@@ -260,7 +260,6 @@ profiles::haproxy::dns::cnames:
  - au-syd1-pve-api.main.unkin.net

 # letsencrypt certificates
-certbot::client::service: haproxy
 certbot::client::domains:
  - au-syd1-pve.main.unkin.net
  - au-syd1-pve-api.main.unkin.net
@@ -1,7 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.70
-networking::routes:
-  default:
-    gateway: 198.18.13.254
@@ -1,7 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.71
-networking::routes:
-  default:
-    gateway: 198.18.13.254
@@ -1,7 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.72
-networking::routes:
-  default:
-    gateway: 198.18.13.254
@@ -1,7 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.73
-networking::routes:
-  default:
-    gateway: 198.18.13.254
@@ -1,15 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.74
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.74
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.64.254/24'
@@ -1,15 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.75
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.75
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.65.254/24'
@@ -1,15 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.76
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.76
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.66.254/24'
@@ -1,15 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.77
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.77
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.67.254/24'
@@ -1,15 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.78
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.78
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.68.254/24'
@@ -1,15 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.79
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.79
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.69.254/24'
@@ -1,7 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.80
-networking::routes:
-  default:
-    gateway: 198.18.13.254
@@ -1,7 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.81
-networking::routes:
-  default:
-    gateway: 198.18.13.254
@@ -1,7 +0,0 @@
---
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.82
-networking::routes:
-  default:
-    gateway: 198.18.13.254
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-profiles::consul::server::anycast_ip: 198.18.19.14
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-profiles::consul::server::anycast_ip: 198.18.19.14
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-profiles::consul::server::anycast_ip: 198.18.19.14
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-profiles::consul::server::anycast_ip: 198.18.19.14
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-profiles::consul::server::anycast_ip: 198.18.19.14
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-dns_master_anycast_ip: 198.18.19.15
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('dns_master_anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-dns_master_anycast_ip: 198.18.19.15
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('dns_master_anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-dns_master_anycast_ip: 198.18.19.15
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('dns_master_anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-dns_resolver_anycast_ip: 198.18.19.16
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('dns_resolver_anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-dns_resolver_anycast_ip: 198.18.19.16
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('dns_resolver_anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,47 +0,0 @@
---
-hiera_include:
-  - frrouting
-
-# networking
-dns_resolver_anycast_ip: 198.18.19.16
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    type: physical
-    forwarding: true
-    dhcp: true
-  anycast0:
-    type: dummy
-    ipaddress: "%{hiera('dns_resolver_anycast_ip')}"
-    netmask: 255.255.255.255
-    mtu: 1500
-
-# frrouting
-frrouting::ospfd_router_id: "%{facts.networking.ip}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  anycast0:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
@@ -1,18 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.9  # management loopback
-networking_loopback1_ip: 198.18.22.9  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.9  # ceph-public loopback
-networking_br10_ip: 198.18.25.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:8d
-    ipaddress: 198.18.15.9
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:5d
-    ipaddress: 198.18.21.9
-
-#zfs::zpools:
-#  fastpool:
-#    ensure: present
-#    disk: /dev/nvme0n1
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.10  # management loopback
-networking_loopback1_ip: 198.18.22.10  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.10  # ceph-public loopback
-networking_br10_ip: 198.18.26.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:37
-    ipaddress: 198.18.15.10
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:de
-    ipaddress: 198.18.21.10
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.11  # management loopback
-networking_loopback1_ip: 198.18.22.11  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.11  # ceph-public loopback
-networking_br10_ip: 198.18.27.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:0f
-    ipaddress: 198.18.15.11
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:55
-    ipaddress: 198.18.21.11
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.12  # management loopback
-networking_loopback1_ip: 198.18.22.12  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.12  # ceph-public loopback
-networking_br10_ip: 198.18.28.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:4f:05:1e
-    ipaddress: 198.18.15.12
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:e5
-    ipaddress: 198.18.21.12
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.13  # management loopback
-networking_loopback1_ip: 198.18.22.13  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.13  # ceph-public loopback
-networking_br10_ip: 198.18.29.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:4f:04:b0
-    ipaddress: 198.18.15.13
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:36
-    ipaddress: 198.18.21.13
@@ -1,23 +1,2 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
-crypto_policies::policy: 'DEFAULT'
-
-profiles::packages::include:
-  network-scripts: {}
-
-profiles::yum::global::repos:
-  powertools:
-    name: powertools
-    descr: powertools repository
-    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
-    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el8
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent
@@ -1,36 +1,2 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
-crypto_policies::policy: 'DEFAULT:SHA1'
-
-profiles::yum::global::repos:
-  baseos:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  extras:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  appstream:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  highavailability:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  crb:
-    name: crb
-    descr: crb repository
-    target: /etc/yum.repos.d/crb.repo
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el9
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent
@@ -3,14 +3,14 @@
 profiles::firewall::firewalld::ensure_package: 'absent'
 profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
-profiles::puppet::agent::puppet_version: '7.34.0'
+profiles::puppet::agent::puppet_version: '7.26.0'

 hiera_include:
  - profiles::almalinux::base

 profiles::packages::include:
-  crypto-policies-scripts: {}
  lzo: {}
+  network-scripts: {}
  policycoreutils: {}
  unar: {}
  xz: {}
@@ -39,6 +39,13 @@ profiles::yum::global::repos:
    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
    mirrorlist: absent
+  powertools:
+    name: powertools
+    descr: powertools repository
+    target: /etc/yum.repos.d/powertools.repo
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
  highavailability:
    name: highavailability
    descr: highavailability repository
@@ -57,12 +64,12 @@ profiles::yum::global::repos:
    name: puppet
    descr: puppet repository
    target: /etc/yum.repos.d/puppet.repo
-    baseurl: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-puppet-20250406
+    baseurl: https://yum.puppet.com/puppet7/el/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406
    mirrorlist: absent
-  unkinben:
-    name: unkinben
-    descr: unkinben repository
+  unkin:
+    name: unkin
+    descr: unkin repository
    target: /etc/yum.repos.d/unkin.repo
    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
@@ -13,7 +13,3 @@ profiles::packages::include:

 lm-sensors::package: lm-sensors
 networking::nwmgr_dns_none: false
-
-consul::install_method: 'url'
-consul::manage_repo: false
-consul::bin_dir: /usr/local/bin
@@ -1 +0,0 @@
-profiles::jupyter::jupyterhub::ldap_bind_pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJspN3e2WzA0uZaLgFZ0Ewqii9dY0tTgbirsW70M2VZtLY+s+C6HE8ZZUtpfnRsFwUUhOj7s25X9xVOZNTpZIGPyfx9MWlSyFw2RFuXSEwaydf1DcBbg8261YrTTysA4Jsa1L4DLsX55q+XJUyeUbimVQkIacVIvzTdnZCBKnVNUh3U2PNAmV7SOL2KH8Jpbfs/EQfBt8XuGMCg3I/4RDyoNERqthW6W2KiMX2Gmd8iQ5+W9udH0lEAMx415oyImmN+dEuThcx9FGMi8BWYtnxH96yWafpT5qltwW6EVzIGWuLhiD1LcWYc5RB8jc3DhbeouChpKsN6c4EHoKt3aWsTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC8jcnqilJgY1/AnHWHfX4bgDCi2a3Rj43Z0dgfB5HaHdpfked3Cx+u94r2S5+Cg3QogU1AIF04rjzOL+bD2HdaMfo=]
@@ -1,74 +0,0 @@
---
-profiles::packages::include:
-  python3.12: {}
-  python3.12-pip: {}
-
-hiera_include:
-  - docker
-  - profiles::nginx::simpleproxy
-
-# manage docker
-docker::version: latest
-docker::curl_ensure: false
-docker::root_dir: /data/docker
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'jupyterhub.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - jupyterhub.service.consul
-  - jupyterhub.query.consul
-  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_port: 8000
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-profiles::nginx::simpleproxy::locations:
-  # authorised access from external
-  default:
-    ensure: 'present'
-    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
-    ssl_only: true
-    location: '/'
-    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
-    proxy_set_header:
-      - 'Host $host'
-      - 'X-Real-IP $remote_addr'
-      - 'X-Forwarded-For $proxy_add_x_forwarded_for'
-      - 'X-Forwarded-Host $host'
-      - 'X-Forwarded-Proto $scheme'
-      - 'Upgrade $http_upgrade'
-      - 'Connection $http_connection'
-      - 'X-Scheme $scheme'
-    proxy_redirect: 'off'
-    proxy_http_version: '1.1'
-    proxy_buffering: 'off'
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - jupyterhub.service.consul
-  - jupyterhub.query.consul
-  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  jupyterhub:
-    service_name: 'jupyterhub'
-    tags:
-      - 'jupyterhub'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'jupyterhub_http_check'
-        name: 'jupyterhub HTTP Check'
-        http: "https://%{facts.networking.fqdn}"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: jupyterhub
-    disposition: write
@@ -52,19 +52,10 @@ glauth::users:
    uidnumber: 20000
    primarygroup: 20000
    othergroups:
-      - 20010
-      - 20011
-      - 20012
-      - 20013
-      - 20014
-      - 20015
-      - 20016
-      - 20017
-      - 20018
-      - 20023
-      - 20024
-      - 20025   # jupyterhub_admin
-      - 20026   # jupyterhub_user
+      - 20025 # media_admin
+      - 20017 # rundeck_access
+      - 20018 # rundeck_globaladmin
+      - 20023 # vault_access
    loginshell: '/bin/bash'
    homedir: '/home/benvin'
    passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
@@ -78,13 +69,7 @@ glauth::users:
    uidnumber: 20001
    primarygroup: 20000
    othergroups:
-      - 20010
-      - 20011
-      - 20012
-      - 20013
-      - 20014
-      - 20015
-      - 20016
+      - 20025 # media_admin
    loginshell: '/bin/bash'
    homedir: '/home/matsol'
    passsha256: '369263e2455a57c8c21388860c417b640fcf045a303cfc88def18c5197493600'
@@ -96,12 +81,7 @@ glauth::users:
    uidnumber: 20002
    primarygroup: 20000
    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
+      - 20024 # media_access
    loginshell: '/bin/bash'
    homedir: '/home/seablo'
    passsha256: '2db12484b2b5fdae7f3a1f9f870143c363af14bf2c31a415a9a7afcb02520df2'
@@ -113,12 +93,7 @@ glauth::users:
    uidnumber: 20003
    primarygroup: 20000
    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
+      - 20024 # media_access
    loginshell: '/bin/bash'
    homedir: '/home/marbal'
    passsha256: 'cc20cee6269b9970a76549c66b51d0c543352796180d4122260a47f0f7a442a9'
@@ -130,67 +105,22 @@ glauth::users:
    uidnumber: 20004
    primarygroup: 20000
    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
+      - 20024 # media_access
    loginshell: '/bin/bash'
    homedir: '/home/kelren'
    passsha256: '5b01659bca1ecb27847d2f746fab03eb169879ebcc86547024753dac7cb184c4'
  ryadun:
    user_name: 'ryadun'
-    givenname: 'Ryan'
-    sn: 'Dunbar'
+    givenname: 'Dunbar'
+    sn: 'Ryan'
    mail: 'ryadun@users.main.unkin.net'
    uidnumber: 20005
    primarygroup: 20000
    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
+      - 20024 # media_access
    loginshell: '/bin/bash'
    homedir: '/home/ryadun'
    passsha256: 'ee17174d49545f6f7257ae79eb173de4acf2b2edf55e181de90decd0e4b4e617'
-  margol:
-    user_name: 'margol'
-    givenname: 'Maree'
-    sn: 'Goldsworthy'
-    mail: 'margol@users.main.unkin.net'
-    uidnumber: 20006
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/margol'
-    passsha256: '31a66085fb7eaeb059e51d1376233db72b54f96a6c45947aafbb350c83e618ef'
-  sudobo:
-    user_name: 'sudobo'
-    givenname: 'Sudaporn'
-    sn: 'Obom'
-    mail: 'sudobo@users.main.unkin.net'
-    uidnumber: 20007
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-      - 20026 # jupyterhub_user
-    loginshell: '/bin/bash'
-    homedir: '/home/sudobo'
-    passsha256: 'a326e049c2a615226877946220a978a0a8247c569be1adcd73539b09b14136d0'

 glauth::services:
  svc_jellyfin:
@@ -261,12 +191,6 @@ glauth::services:
    uidnumber: 30009
    primarygroup: 20001
    passsha256: 'd63b04884d5c7d630b0c06896046065a0926ac5c3d6177ef85320e5fa1be00b9'
-  svc_jupyterhub:
-    service_name: 'svc_jupyterhub'
-    mail: 'jupyterhub@service.main.unkin.net'
-    uidnumber: 30010
-    primarygroup: 20001
-    passsha256: '09db1e0c2498214da35f3f2ed46a90a7b90635c207f8725e7abf76b48345a39b'

 glauth::groups:
  users:
@@ -317,12 +241,11 @@ glauth::groups:
  vault_access:
    group_name: 'vault_access'
    gidnumber: 20023
-  vault_admin:
-    group_name: 'vault_admin'
+  media_access:
+    group_name: 'media_access'
    gidnumber: 20024
-  jupyterhub_admin:
-    group_name: 'jupyterhub_admin'
+    includegroups: [20010, 20011, 20012, 20013, 20014, 20016]
+  media_admin:
+    group_name: 'media_admin'
    gidnumber: 20025
-  jupyterhub_user:
-    group_name: 'jupyterhub_user'
-    gidnumber: 20026
+    includegroups: [20024, 20015]
@@ -15,7 +15,9 @@ profiles::dhcp::server::pools:
    range:
      - '198.18.15.200 198.18.15.220'
    gateway: 198.18.15.254
-    nameservers: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
+    nameservers:
+      - 198.18.13.12
+      - 198.18.13.13
    domain_name: main.unkin.net
    pxeserver: 198.18.13.27
  syd1-test:
@@ -24,7 +26,9 @@ profiles::dhcp::server::pools:
    range:
      - '198.18.16.200 198.18.16.220'
    gateway: 198.18.16.254
-    nameservers: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
+    nameservers:
+      - 198.18.13.12
+      - 198.18.13.13
    domain_name: main.unkin.net
    pxeserver: 198.18.13.27
  syd1-prod1:
@@ -33,7 +37,9 @@ profiles::dhcp::server::pools:
    range:
      - '198.18.13.200 198.18.13.220'
    gateway: 198.18.13.254
-    nameservers: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
+    nameservers:
+      - 198.18.13.12
+      - 198.18.13.13
    domain_name: main.unkin.net
    pxeserver: 198.18.13.27
  syd1-prod2:
@@ -42,7 +48,9 @@ profiles::dhcp::server::pools:
    range:
      - '198.18.14.200 198.18.14.220'
    gateway: 198.18.14.254
-    nameservers: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
+    nameservers:
+      - 198.18.13.12
+      - 198.18.13.13
    domain_name: main.unkin.net
    pxeserver: 198.18.13.27
  drw1-prod:
@@ -51,7 +59,9 @@ profiles::dhcp::server::pools:
    range:
      - '198.18.17.200 198.18.17.220'
    gateway: 198.18.17.1
-    nameservers: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
+    nameservers:
+      - 198.18.17.7
+      - 198.18.17.8
    domain_name: main.unkin.net
    pxeserver: 198.18.13.27

@@ -9,14 +9,6 @@ profiles::dns::master::acls:
      - 198.18.15.0/24
      - 198.18.16.0/24
      - 198.18.17.0/24
-      - 198.18.19.0/24
-      - 198.18.20.0/24
-      - 198.18.24.0/24
-      - 198.18.25.0/24
-      - 198.18.26.0/24
-      - 198.18.27.0/24
-      - 198.18.28.0/24
-      - 198.18.29.0/24

 profiles::dns::master::zones:
  main.unkin.net:
@@ -55,72 +47,6 @@ profiles::dns::master::zones:
    dynamic: false
    ns_notify: true
    source: '/var/named/sources/17.18.198.in-addr.arpa.conf'
-  19.18.198.in-addr.arpa:
-    domain: '19.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/19.18.198.in-addr.arpa.conf'
-  20.18.198.in-addr.arpa:
-    domain: '20.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/20.18.198.in-addr.arpa.conf'
-  21.18.198.in-addr.arpa:
-    domain: '21.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/21.18.198.in-addr.arpa.conf'
-  22.18.198.in-addr.arpa:
-    domain: '22.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/22.18.198.in-addr.arpa.conf'
-  23.18.198.in-addr.arpa:
-    domain: '23.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/23.18.198.in-addr.arpa.conf'
-  24.18.198.in-addr.arpa:
-    domain: '24.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/24.18.198.in-addr.arpa.conf'
-  25.18.198.in-addr.arpa:
-    domain: '25.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/25.18.198.in-addr.arpa.conf'
-  26.18.198.in-addr.arpa:
-    domain: '26.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/26.18.198.in-addr.arpa.conf'
-  27.18.198.in-addr.arpa:
-    domain: '27.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/27.18.198.in-addr.arpa.conf'
-  28.18.198.in-addr.arpa:
-    domain: '28.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/28.18.198.in-addr.arpa.conf'
-  29.18.198.in-addr.arpa:
-    domain: '29.18.198.in-addr.arpa'
-    zone_type: 'master'
-    dynamic: false
-    ns_notify: true
-    source: '/var/named/sources/29.18.198.in-addr.arpa.conf'

 profiles::dns::master::views:
  master-zones:
@@ -132,17 +58,6 @@ profiles::dns::master::views:
      - 15.18.198.in-addr.arpa
      - 16.18.198.in-addr.arpa
      - 17.18.198.in-addr.arpa
-      - 19.18.198.in-addr.arpa
-      - 20.18.198.in-addr.arpa
-      - 21.18.198.in-addr.arpa
-      - 22.18.198.in-addr.arpa
-      - 23.18.198.in-addr.arpa
-      - 24.18.198.in-addr.arpa
-      - 25.18.198.in-addr.arpa
-      - 26.18.198.in-addr.arpa
-      - 27.18.198.in-addr.arpa
-      - 28.18.198.in-addr.arpa
-      - 29.18.198.in-addr.arpa
    match_clients:
      - acl-main.unkin.net

@@ -10,30 +10,6 @@ profiles::dns::resolver::acls:
      - 198.18.15.0/24
      - 198.18.16.0/24
      - 198.18.17.0/24
-      - 198.18.18.0/24
-      - 198.18.19.0/24
-      - 198.18.20.0/24
-      - 198.18.21.0/24
-      - 198.18.22.0/24
-      - 198.18.23.0/24
-  acl-dmz:
-    addresses:
-      - 198.18.24.0/24
-  acl-common:
-    addresses:
-      - 198.18.25.0/24
-      - 198.18.26.0/24
-      - 198.18.27.0/24
-      - 198.18.28.0/24
-      - 198.18.29.0/24
-  acl-nomad-jobs:
-    addresses:
-      - 198.18.64.0/24
-      - 198.18.65.0/24
-      - 198.18.66.0/24
-      - 198.18.67.0/24
-      - 198.18.68.0/24
-      - 198.18.69.0/24

 profiles::dns::resolver::zones:
  8.10.10.in-addr.arpa-forward:
@@ -78,96 +54,6 @@ profiles::dns::resolver::zones:
      - 10.10.16.32
      - 10.10.16.33
    forward: 'only'
-  main.unkin.net-forward:
-    domain: 'main.unkin.net'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  13.18.198.in-addr.arpa-forward:
-    domain: '13.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  14.18.198.in-addr.arpa-forward:
-    domain: '14.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  15.18.198.in-addr.arpa-forward:
-    domain: '15.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  16.18.198.in-addr.arpa-forward:
-    domain: '16.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  17.18.198.in-addr.arpa-forward:
-    domain: '17.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  19.18.198.in-addr.arpa-forward:
-    domain: '19.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  20.18.198.in-addr.arpa-forward:
-    domain: '20.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  21.18.198.in-addr.arpa-forward:
-    domain: '21.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  22.18.198.in-addr.arpa-forward:
-    domain: '22.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  23.18.198.in-addr.arpa-forward:
-    domain: '23.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  24.18.198.in-addr.arpa-forward:
-    domain: '24.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  25.18.198.in-addr.arpa-forward:
-    domain: '25.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  26.18.198.in-addr.arpa-forward:
-    domain: '26.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  27.18.198.in-addr.arpa-forward:
-    domain: '27.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  28.18.198.in-addr.arpa-forward:
-    domain: '28.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  29.18.198.in-addr.arpa-forward:
-    domain: '29.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_unkin')}"
-    forward: 'only'
-  consul-forward:
-    domain: 'consul'
-    zone_type: 'forward'
-    forwarders: "%{alias('profiles_dns_upstream_forwarder_consul')}"
-    forward: 'only'

 profiles::dns::resolver::views:
  openforwarder:
@@ -183,22 +69,8 @@ profiles::dns::resolver::views:
      - 15.18.198.in-addr.arpa-forward
      - 16.18.198.in-addr.arpa-forward
      - 17.18.198.in-addr.arpa-forward
-      - 19.18.198.in-addr.arpa-forward
-      - 20.18.198.in-addr.arpa-forward
-      - 21.18.198.in-addr.arpa-forward
-      - 22.18.198.in-addr.arpa-forward
-      - 23.18.198.in-addr.arpa-forward
-      - 24.18.198.in-addr.arpa-forward
-      - 25.18.198.in-addr.arpa-forward
-      - 26.18.198.in-addr.arpa-forward
-      - 27.18.198.in-addr.arpa-forward
-      - 28.18.198.in-addr.arpa-forward
-      - 29.18.198.in-addr.arpa-forward
      - 8.10.10.in-addr.arpa-forward
      - 16.10.10.in-addr.arpa-forward
      - 20.10.10.in-addr.arpa-forward
    match_clients:
      - acl-main.unkin.net
-      - acl-nomad-jobs
-      - acl-common
-      - acl-dmz
@@ -1,2 +0,0 @@
---
-profiles::etcd::node::initial_cluster_token: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAhLyXszXUU6Dkiw9bEJTH0RXGaV2751NzvLH94i7QHfNukvOslF/kaDOA+FwqG06xSKSKo24Qyj4ewYA3BzhN8XLf2E9uW2LuDrUoA6aXUP2tYPqiTw8zmmgsVV5t7Y5PeNcleV3KmfcJZJKp33yGCKtGF7ggvNvnied5slO6E1BDkcVnqO7sdyI0MqSvsvH4IvEmeiSWAcBRBnwVLIwfn10frIvUg0fH4uZR7DASfO/HstYWKAEacz4xYBv74TtVVtYHlPvnVwC20YIYDMrgBsm3XngyWIQvruQCgyIkRzHjUKCpp76HpyEqzdJdEdaywkODYNOT6ab1B5uUu9WaMjBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBADXLPOqFHdnVgJW5+iXJYcgCDK1Eyr+RwvMA+3VszYALU5B6OCH5maplwC5aUgiQZ7ew==]
@@ -1,62 +0,0 @@
---
-hiera_include:
-  - profiles::etcd::node
-
-profiles::etcd::node::members_lookup: true
-profiles::etcd::node::members_role: roles::infra::etcd::node
-
-profiles::etcd::node::config:
-  data-dir: /data/etcd
-  client-cert-auth: false
-  client-transport-security:
-    cert-file: /etc/pki/tls/vault/certificate.crt
-    key-file: /etc/pki/tls/vault/private.key
-    client-cert-auth: false
-    auto-tls: false
-  peer-transport-security:
-    cert-file: /etc/pki/tls/vault/certificate.crt
-    key-file: /etc/pki/tls/vault/private.key
-    client-cert-auth: false
-    auto-tls: false
-  allowed-cn:
-  max-wals: 5
-  max-snapshots: 5
-  snapshot-count: 10000
-  heartbeat-interval: 100
-  election-timeout: 1000
-  cipher-suites: [
-    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-  ]
-  tls-min-version: 'TLS1.2'
-  tls-max-version: 'TLS1.3'
-
-profiles::pki::vault::alt_names:
-  - etcd.service.consul
-  - etcd.query.consul
-  - "etcd.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - etcd.query.consul
-  - etcd.service.consul
-  - etcd.service.%{facts.country}-%{facts.region}.consul
-
-consul::services:
-  etcd:
-    service_name: 'etcd'
-    tags:
-      - 'etcd'
-    address: "%{facts.networking.ip}"
-    port: 2379
-    checks:
-      - id: 'etcd_http_health_check'
-        name: 'ETCD HTTP Health Check'
-        http: "https://%{facts.networking.ip}:2379/health"
-        method: 'GET'
-        interval: '10s'
-        timeout: '1s'
-        tls_skip_verify: true
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: etcd
-    disposition: write
@@ -5,7 +5,6 @@ hiera_include:

 docker::version: latest
 docker::curl_ensure: false
-docker::root_dir: /data/docker

 profiles::gitea::runner::home: /data/runner
 profiles::gitea::runner::version: '0.2.10'
@@ -45,10 +44,3 @@ profiles::gitea::runner::config:
    force_rebuild: false
  host:
    workdir_parent: "%{hiera('profiles::gitea::runner::home')}/.cache/act"
-
-# enable ip forwarding for docker containers
-sysctl::base::values:
-  net.ipv4.conf.all.forwarding:
-    value: '1'
-  net.ipv6.conf.all.forwarding:
-    value: '1'
@@ -1,125 +0,0 @@
---
-hiera_include:
-  - incus
-  - zfs
-
-profiles::packages::include:
-  bridge-utils: {}
-  dnsmasq: {}
-
-profiles::pki::vault::alt_names:
-  - incus-images.service.consul
-  - incus-images.query.consul
-  - "incus-images.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - incus-images.service.consul
-  - incus-images.query.consul
-  - "incus-images.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  incus-images:
-    service_name: 'incus-images'
-    tags:
-      - 'incus'
-      - 'images'
-      - 'container'
-      - 'lxd'
-    address: "%{facts.networking.ip}"
-    port: 8443
-    checks:
-      - id: 'incus_https_check'
-        name: 'incus HTTPS Check'
-        http: "https://%{facts.networking.fqdn}:8443"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: incus-images
-    disposition: write
-
-# additional repos
-profiles::yum::global::repos:
-  zfs-kmod:
-    name: zfs-kmod
-    descr: zfs-kmod repository
-    target: /etc/yum.repos.d/zfs-kmod.repo
-    baseurl: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-openzfs-2022
-    mirrorlist: absent
-
-# zfs settings
-zfs::manage_repo: false
-zfs::zfs_arc_min: ~
-zfs::zfs_arc_max: 429496729 # 400MB
-zfs::zpools:
-  fastpool:
-    ensure: present
-    disk: /dev/vdb
-    ashift: 12
-zfs::datasets:
-  fastpool:
-    canmount: 'off'
-    acltype: posix
-    atime: 'off'
-    relatime: 'off'
-    compression: 'zstd'
-    xattr: 'sa'
-  fastpool/data:
-    canmount: 'on'
-    mountpoint: '/data'
-  fastpool/data/incus:
-    canmount: 'on'
-    mountpoint: '/data/incus'
-
-# manage incus
-incus::init: true
-incus::server_port: 8443
-incus::storage_images_volume: fastpool/imagestore
-
-# add sysadmin to incus-admin group
-profiles::accounts::sysadmin::extra_groups:
-  - incus-admin
-
-# sysctl recommendations
-sysctl::base::values:
-  fs.aio-max-nr:
-    value: '524288'
-  fs.inotify.max_queued_events:
-    value: '1048576'
-  fs.inotify.max_user_instances:
-    value: '1048576'
-  fs.inotify.max_user_watches:
-    value: '1048576'
-  kernel.dmesg_restrict:
-    value: '1'
-  kernel.keys.maxbytes:
-    value: '2000000'
-  kernel.keys.maxkeys:
-    value: '2000'
-  net.core.bpf_jit_limit:
-    value: '1000000000'
-  net.ipv4.neigh.default.gc_thresh3:
-    value: '8192'
-  net.ipv6.neigh.default.gc_thresh3:
-    value: '8192'
-  vm.max_map_count:
-    value: '262144'
-  net.ipv4.conf.all.forwarding:
-    value: '1'
-  net.ipv6.conf.all.forwarding:
-    value: '1'
-
-# limits.d recommendations
-limits::entries:
-  '*/nofile':
-    both: 1048576
-  'root/nofile':
-    both: 1048576
-  '*/memlock':
-    both: unlimited
-  'root/memlock':
-    both: unlimited
@@ -1,230 +0,0 @@
---
-hiera_include:
-  - profiles::selinux::frr
-  - frrouting
-  - incus
-  - zfs
-  - profiles::ceph::mon
-
-profiles::packages::include:
-  bridge-utils: {}
-
-profiles::pki::vault::alt_names:
-  - incus.service.consul
-  - incus.query.consul
-  - "incus.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::pki::vault::ip_sans:
-  - "%{hiera('networking_loopback0_ip')}"
-  - "%{hiera('networking_loopback1_ip')}"
-  - "%{hiera('networking_loopback2_ip')}"
-
-profiles::ssh::sign::principals:
-  - incus.service.consul
-  - incus.query.consul
-  - "incus.service.%{facts.country}-%{facts.region}.consul"
-  - "%{hiera('networking_loopback0_ip')}"
-  - "%{hiera('networking_loopback1_ip')}"
-  - "%{hiera('networking_loopback2_ip')}"
-
-# configure consul service
-consul::services:
-  incus:
-    service_name: 'incus'
-    tags:
-      - 'incus'
-      - 'container'
-      - 'lxd'
-    address: "%{hiera('networking_loopback0_ip')}"
-    port: 8443
-    checks:
-      - id: 'incus_https_check'
-        name: 'incus HTTPS Check'
-        http: "https://%{hiera('networking_loopback0_ip')}:8443"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: incus
-    disposition: write
-
-# additional repos
-profiles::yum::global::repos:
-  ceph:
-    name: ceph
-    descr: ceph repository
-    target: /etc/yum.repos.d/ceph.repo
-    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://download.ceph.com/keys/release.asc
-    mirrorlist: absent
-  ceph-noarch:
-    name: ceph-noarch
-    descr: ceph-noarch repository
-    target: /etc/yum.repos.d/ceph-noarch.repo
-    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
-    gpgkey: https://download.ceph.com/keys/release.asc
-    mirrorlist: absent
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  zfs-kmod:
-    name: zfs-kmod
-    descr: zfs-kmod repository
-    target: /etc/yum.repos.d/zfs-kmod.repo
-    baseurl: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-openzfs-2022
-    mirrorlist: absent
-
-# dns
-profiles::dns::base::primary_interface: loopback0
-
-# networking
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  enp2s0:
-    type: physical
-    txqueuelen: 10000
-    forwarding: true
-  enp3s0:
-    type: physical
-    mtu: 9000
-    txqueuelen: 10000
-    forwarding: true
-  loopback0:
-    type: dummy
-    ipaddress: "%{hiera('networking_loopback0_ip')}"
-    netmask: 255.255.255.255
-    mtu: 9000
-  loopback1:
-    type: dummy
-    ipaddress: "%{hiera('networking_loopback1_ip')}"
-    netmask: 255.255.255.255
-    mtu: 9000
-  loopback2:
-    type: dummy
-    ipaddress: "%{hiera('networking_loopback2_ip')}"
-    netmask: 255.255.255.255
-    mtu: 9000
-
-# frrouting
-frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  enp2s0:
-    area: 0.0.0.0
-  enp3s0:
-    area: 0.0.0.0
-  loopback0:
-    area: 0.0.0.0
-  loopback1:
-    area: 0.0.0.0
-  loopback2:
-    area: 0.0.0.0
-  brcom1:
-    area: 0.0.0.0
-  brdmz1:
-    area: 0.0.0.0
-  brwan1:
-    area: 0.0.0.0
-frrouting::daemons:
-  ospfd: true
-
-# add loopback interfaces to ssh list
-ssh::server::options:
-  ListenAddress:
-    - "%{hiera('networking_loopback0_ip')}"
-
-# zfs settings
-zfs::manage_repo: false
-zfs::zfs_arc_min: ~
-zfs::zfs_arc_max: 4294967296 # 4GB
-zfs::zpools:
-  fastpool:
-    ensure: present
-    disk: /dev/nvme1n1
-    ashift: 12
-zfs::datasets:
-  fastpool:
-    canmount: 'off'
-    acltype: posix
-    atime: 'off'
-    relatime: 'off'
-    compression: 'zstd'
-    xattr: 'sa'
-  fastpool/data:
-    canmount: 'on'
-    mountpoint: '/data'
-  fastpool/data/incus:
-    canmount: 'on'
-    mountpoint: '/data/incus'
-
-# manage incus
-incus::init: true
-incus::bridge: br10
-incus::server_port: 8443
-incus::server_addr: "%{hiera('networking_loopback0_ip')}"
-
-# add sysadmin to incus-admin group
-profiles::accounts::sysadmin::extra_groups:
-  - incus-admin
-
-# sysctl recommendations
-sysctl::base::values:
-  fs.aio-max-nr:
-    value: '524288'
-  fs.inotify.max_queued_events:
-    value: '1048576'
-  fs.inotify.max_user_instances:
-    value: '1048576'
-  fs.inotify.max_user_watches:
-    value: '1048576'
-  kernel.dmesg_restrict:
-    value: '1'
-  kernel.keys.maxbytes:
-    value: '2000000'
-  kernel.keys.maxkeys:
-    value: '2000'
-  net.core.bpf_jit_limit:
-    value: '1000000000'
-  net.ipv4.neigh.default.gc_thresh3:
-    value: '8192'
-  net.ipv6.neigh.default.gc_thresh3:
-    value: '8192'
-  vm.max_map_count:
-    value: '262144'
-  net.ipv4.conf.all.forwarding:
-    value: '1'
-  net.ipv6.conf.all.forwarding:
-    value: '1'
-  net.ipv4.tcp_l3mdev_accept:
-    value: '0'
-  net.ipv4.conf.default.rp_filter:
-    value: '0'
-  net.ipv4.conf.all.rp_filter:
-    value: '0'
-
-# limits.d recommendations
-limits::entries:
-  '*/nofile':
-    both: 1048576
-  'root/nofile':
-    both: 1048576
-  '*/memlock':
-    both: unlimited
-  'root/memlock':
-    both: unlimited
@@ -1,2 +0,0 @@
---
-ceph::key::media: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzl2zX8ok6iURymPLbvkFE/dZhunzwisNCsLE5Tx6Pmil0PNx7iFULHXxWU6HMVOxzJmgcnTY+NsRnoTMSpXHGeC3wmD525T4xO4wvG/l9apzmPs1NTI4hcyYCj4NkAKyo249xXEodU4uM2AZp3ZgLBLf2cZpOe0/SPngWSq0kC4pJMnxWH+YsQ/O/1EMxpjSgMMna4YcMtcW2M0+wRhASNSTV7icsiAp6F/cInZuP44ASviHmM6+aMEhygBariOT80kaHZZI+aP6vqSd9lChXCV5qjRzeoEBIKOzT2ZBj41RTsF75J8UYFPwY7dp584tDpiIedUSR9IRCJe4d0uTjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCau9oXJiYiCGgvxZl62EsagDDgX2cU3+3QCkImEGS1oBahkPl3fYHKynbRi0ZQW1CoW0UFRzY8FmWmGkowns9OsIM=]
@@ -1,72 +0,0 @@
---
-
-hiera_include:
-  - docker
-  - docker::networks
-  - frrouting
-  - profiles::nomad::node
-
-docker::version: latest
-docker::curl_ensure: false
-docker::root_dir: /data/docker
-docker::ip_forward: true
-docker::ip_masq: false
-docker::iptables: false
-
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  ens19:
-    passive: true
-  docker0:
-    area: 0.0.0.1
-
-profiles::yum::global::repos:
-  ceph-reef:
-    name: ceph-reef
-    descr: ceph reef repository
-    target: /etc/yum.repos.d/ceph-reef.repo
-    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
-    gpgcheck: 0,
-    mirrorlist: absent
-
-profiles::ceph::client::keyrings:
-  nomad:
-    key: "%{hiera('ceph::key::media')}"
-
-profiles::packages::include:
-  nomad: {}
-  cni-plugins: {}
-
-profiles::nomad::node::client: true
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - client.global.nomad
-  - client.au-syd1.nomad
-  - nomad-client.service.consul
-  - nomad-client.query.consul
-  - "nomad-client.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: nomad-client
-    disposition: write
-  - resource: agent_prefix
-    segment: ''
-    disposition: read
-  - resource: node_prefix
-    segment: ''
-    disposition: write
-  - resource: service_prefix
-    segment: ''
-    disposition: write
-  - resource: key_prefix
-    segment: "nomad"
-    disposition: write
-  - resource: session_prefix
-    segment: ""
-    disposition: write
@@ -1,34 +0,0 @@
---
-
-hiera_include:
-  - profiles::nomad::node
-
-profiles::packages::include:
-  nomad: {}
-
-profiles::nomad::node::server: true
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - client.global.nomad
-  - client.au-syd1.nomad
-  - server.global.nomad
-  - server.au-syd1.nomad
-  - nomad.service.consul
-  - nomad.query.consul
-  - "nomad.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: nomad
-    disposition: write
-  - resource: agent_prefix
-    segment: ''
-    disposition: read
-  - resource: node_prefix
-    segment: ''
-    disposition: write
-  - resource: service_prefix
-    segment: ''
-    disposition: write
@@ -1,29 +0,0 @@
-profiles::pki::vault::alt_names:
-  - jumphost.service.consul
-  - jumphost.query.consul
-  - "jumphost.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - jumphost.query.consul
-  - jumphost.service.consul
-  - jumphost.service.%{facts.country}-%{facts.region}.consul
-
-consul::services:
-  jumphost:
-    service_name: 'jumphost'
-    tags:
-      - 'jumphost'
-      - 'proxy'
-      - 'ssh'
-    address: "%{facts.networking.ip}"
-    port: 22
-    checks:
-      - id: 'ssh_tcp_check'
-        name: 'SSH TCP Check'
-        tcp: "%{facts.networking.ip}:22"
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: jumphost
-    disposition: write
@@ -5,13 +5,6 @@ profiles::puppet::autosign::subnet_ranges:
  - '198.18.15.0/24'
  - '198.18.16.0/24'
  - '198.18.17.0/24'
-  - '198.18.20.0/24'
-  - '198.18.24.0/24'
-  - '198.18.25.0/24'
-  - '198.18.26.0/24'
-  - '198.18.27.0/24'
-  - '198.18.28.0/24'
-  - '198.18.29.0/24'

 profiles::puppet::autosign::domains:
  - '*.main.unkin.net'
@@ -26,7 +19,7 @@ profiles::puppet::cobbler_enc::packages:
  - 'requests'
  - 'PyYAML'
 profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
-profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkin/puppet-r10k.git
+profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkinben/puppet-r10k.git
 profiles::puppet::g10k::bin_path: '/opt/puppetlabs/bin/g10k'
 profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
 profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'
@@ -1 +0,0 @@
-profiles::puppet::puppetboard::secret_key: ENC[PKCS7,MIIB+wYJKoZIhvcNAQcDoIIB7DCCAegCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAoCr9JTtrnMaVjJlEpA0NYNt/QAgTGiEmS3kPn2oJ80Ay7fUl79pop95uLQIfw6C3e8WGUhxYt31wmzent4Bfbced7uF/tjhP2cniKPmZGuf/tmVrGIHIh4T4g0Wz2K0DIU/dGWUlgE03ICRxXlAy0atjUuAp02ehj7bzLuMf+vZbghm8vnOoDCTKjeZNAJEkDvBkIzwUu9JiM9Gn6BzoLLGdEERqs/LR832vjjNmF7KUEH/Ntt47wbLdfCzawsZsBNLggEb1HNGu0aSb0qBXYBPRq6w1L/RU8gX2dCqGRbhDZymihebaOcwU1AtbLEBdHTYQpga+c4bcTz9rJplLtjCBvQYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQAdSjLEaZPK47TY7LDCB7b4CBkOTvHbi4nb+pB/Kng+Z3N9ocZPZdGbV6WzMNGxsxmhWXoi+XKEzEvfB10UhQwDcvZXd2W9hhiRkakq7+S0uLWzCX1jNMH2LXZAzoiyGM4FFvGpx7Z64OhmVrOJuKnxD+3zK6PZqvMb3g7CjZeAr5vyhcT/zO75krhJuYp11ZFpLCRcuASf0ru+Jq5OKD4+ZI/g==]
@@ -1,2 +0,0 @@
-profiles::puppet::puppetdb_api::public_cert: ENC[PKCS7,MIIJrQYJKoZIhvcNAQcDoIIJnjCCCZoCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEATUl7Aa6W6Q0gWWPet6fufBUtFUO7wCkED8w3NojkDYNR0Cine5+yWupy1FZ0d75mtdjI16DgZ9d2BhNlnbvPrZHuFSfBFj0s6lc0cYs1dpEUwPwPssmfNNfLe+73Fn0e43fguXisBYiE0Xn4x9UqGEIXXnwBqucIo4lkR0QAvhrmgEsNJKrxKV2isBZOnV40hrilnK3fLszGlfEfEuK1ZLrdtQV54Cl/Fpga8OOEk3Ji+WO/qC3WSQ+RWmc+si5L7w6raFLcHb3ZN96BHNVN2h2rBe85RRTg08LT+9Eyge3Fc0/+eoRmzTvnHMc4RptRfvopv5RGGyOma0mExmD6CzCCCG4GCSqGSIb3DQEHATAdBglghkgBZQMEASoEEB2t8I7YdvzPGIuGG1fUIViAgghAKhUoHO1UphPXu/KwYgo3xPSmWWF76B/ZKPd3SdzobYBsfK7CEhRiONU29W/wEzDdn7An2E16bIuecxT114z0i6OqQc3W92jBETWlpV1IRWs4DTb2QWjA4l74KdwRtltpeAKeFjSjuW2+L5UUOgGsaW4lxR0wP/uIqUT76/wQCoCAIw/i+YcIvIJDpeVPKSyaA6GFJbiT8CuG1SzD/1tb+XOxEf3WpeUwVNrPIO1ADjdi3cha6bJDa6Dvrtz8ornYwsfZ9cIlhDb6kmz938+EWpH5swCppfHcMncSd+R1zST6DzhN54+kvWGjvrN79m5+f0al/t3a85iZ6boLXSE8VkPLWZnlAt0ISdCtt0m7luxWWUN3AvmBmLZ5hhjnHUQC4RNCmu3BrjB7bN/nvInZQNcBlArhthiy/DpbdjLpF5kkUq+J+S7I898rG/B8lWrWjYsQvOUM/yiVbpCtsLJS9Pv1UjlkHcere6YgOq4gZKaESF19npV6SLU2MfC+Raefj1biE+haOOjpDdR+xQLAHmZqgOBUFMkYh1RH77zg2QPtz5aDLGypO/yVuJDcuSGV6qpoxc0uu7EmihfOg2cHF6FtSlStwFQYw3mG3oyuByv527lVRUjNHOx85bXeFccb96lyTzStAopLADo9nuOHjDxs6qzXj4h0y5w0ODh3Wyy/h4EXYaTrXuSB/FJJb1rvToC+XJ7ABxzt0rB8ySNtt+DFRssZQ5ZXWF6T88YKLcigKYGNTGmf92Iwpq6+hw0NEF1OWy7aHDzog6xORilgy6zcPTWkz2TUxzOuwN6Y0UeLlj+C4r+hl17/9aYhls6UJ+5xF+ZNcJmqEXqZ5HHykcYRwaWI0FF4tkbsto8Is2/aZVfeQc/2JZ+9IbLXlh1Km6hJxWJmw/S9RwTXVK7kGO/IlIoQiYTFYoeSU4RDPVUXZTBmGxuBmz37JPVMLXkL6tGUPwTz6pa+AMppT/qMLC8y2LhLm+eRsfz4w2ySc/kBR0FKsD0Z1h9h4zM+VtNnxaSYmxkFG77pX+bi/ToQqaydWblf0NPdw2t+uoULzkxxhX3wjZi8V9gGOhZ7s7YUKJFljZZYcl0MnDab+xGjD8DGiq/vHqTLXm8DYpVOxsryGIJ3zXf5KPvo8y6/wQAkKq6Vb4lraqkg9m5wGLxQDemE4h2OWgjcnWOXx/N9bcVO0xMyqrFo337wPoZ+hYQhwxzrfiQZ87nLe28OstaWS8OK6KoAx95LvMypaFURf+EoZkYO8wFiLmFBNAMMOkf/TJjmXoeDw46Qv1sZi57239pgzxz6RXEjd5TBURli7tSaniqKNarRY7ZoYymzYBv9Kyj6zQGgXxozhQsMsju9fTo2l+bXQ2siBljHnNkI+I3aO5Q6FLpM57h5xhA86ayJzfaKSbniMARGY2inG3qUfKafgQUvrYBxaIxSBAg7LfE2GRJx8gEioATFZpclrm+0fP3xaXW3I/wiyl/EPKIP2aPP8lqJam/KWXZ46nYdgrKIrg51tXp/YUcgR6geZYHIBWkAgofJeThKPz9ervLzu3dYS0FgMiRcyCOXfI4nttW/QCNl5a19UXXYpSgj0MOAKuSZYkHYgaSt7DNt3sZtWLtCZ1M/QFLSiqsfUAULVwUJpOCS4Ul0Bn9gu038xCBCkaQ8VnSHtvl6NsCUHDhk/JGq5pmZjrE5zTEnlMBUBoQ1sun/HwLAnoX24KV+3pzwul0eCLm2pBndWvgnHsEY7COiookx7mwvg93xuejN7zQk/NAJp4L3haT5ueVTcUcEsTPmsIDMn2xg2HSGLum6yG02XPMBYJlG/GHtu2kuvOV2UFqxkzje4FB3cNishelQ1VRDOBJodt8xmfKkgPciFChEOVe5OY7AbBvKIBab+kjbG78guGReqkmePFkEtsnL7KouiERojAVsGXtvqOT2dQvO7xLrozLk+kY/Xk6HkGedmc2PUEc/CSKPy73k2a154ByzwfOaAaTM1XCvo4Ff7hTA7VHUu3rWpHmd2LZbKN1nlGbrrX0Wk0jt72OsRWRzgKp+81jEkNh/hbD9xCjmIbzdloOmcJJbcyikmThVpFaUMaHowZmrBtQxE7pR2ARbhVvNXH3fZQnIpxMcHEPoKh12pOTlp+GIO8H1EsGZ6tOjXniBiy/szoa8Oi/eJp/Co8uRoDSyBc5t6ZD6ciLHOVG4c0nCdMHaouA/EXNe/EOzLg4fYk7cLBNGoaBUo8LbXv0Z2tkhtE1ctl8NBvZS3X80VchtmQg7lVlqZUEkcXEtoadrjRpiWL9EW68mzjTsejePMNBb6CCL4zGqQwCfA1zUVtlNJslguClQ2u0IlqPjBYsj3Xy+leg24YrHKB1zEu1/aGuVxCBlJMozQj//5OCTp+1iO0EExnGBYjZuk8UTYrUj9FZeu5GiRlBvky1HBE/fq4LPD7l/Gr0npAwKJofIglA2DZe9Sr4VmA8oi4vsmbpmtyPLVa/pfVXrl/w2dLH/Y2TI8MbPFMvjtAgdlK6endrxpb9EC2YeWrFibDXL9EsOAXo5droa6WyIDoVr7GBZ0Faa19uW2IZf0fw02tz0L1Bg/4RopeIZpbH0CKCwpqg5GNb7gKvKkXt9ugI84ZGnF5CgrqXH+lXXtMgHsEkUQ6vAJeKioLSMVla6Pu/BdztDKBVuKTEzV/lH/nbR2qhjlIEm+AntndtRNU3J6Aakje0keGjDV66paCnh/v7fha3SOPkgCV8OxrqMDAUl9/RxB907OF/Ethg4F/gsWfwDJLcAoS206rV6r+VZyurb3xx6HSLFzh+MMBgNlJhf]
-profiles::puppet::puppetdb_api::private_cert: ENC[PKCS7,MIIOHQYJKoZIhvcNAQcDoIIODjCCDgoCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAR7TO46Sg7DTeJmy+YMKpcKgcbbyDed4zHib7Jii2ltlFBMzFAJ49u986i13pSE0qaPIgydc94ILKc0oTwTWvstbiBJB2NYikswKHIJwKKSTzzbfCz1/eyfVKwKyp3DakdImdPClmjZIp/eQyWsLkZjxmJ5T9MVHSo3l8sNVY3WyGbKwEi0TwZabE9Op8cvFTifcBL5zDwKMrhwghAPEoVz8DALoMOko8Lp2K7yCo+LvyvY/Ib9CtIfbgpXQTo2NDbww29/KWHqw6PjzRdyuswUDdnCuLOaThUQkDopTZyhhJ9Y5z5/7Doo/zGYQLBkyThjtKkKwsPlq1eGkjFzY/ITCCDN4GCSqGSIb3DQEHATAdBglghkgBZQMEASoEEAvibroua3O2ot73run7uWKAggywIm7gZ/o/vc47kaCICTS2LtsHDmTe9HHqujdAdQLlBGvEhasKGDMr8s54aIbNUbLhD82Vuvwjl2GShqSg/IATfwzDPoqm982KrVZd/9kO61o3vBdtqZO1+InbY7iDbTqf45A7Ar3545aF+/y30WDamFyECwCePrQu1Y9bw6VhLTEVYO+A8zr8y0CYRKAtWNYcPpTP/3VO8/RKtMV+nWrUzS00zAp56lA7xeOzdeKdHzCkpKeaHrpSEN6YGrZmAhTdKBxHYiez9h3eZprEtqoAz0I5DL9Y54t74+pZxicFjQKYPxUGccqg0dIkFZUgE1dxuOkASspydJ890xC/SYJZxREeuF9SPCUkT4Szc814/JHzfqrHt5ZfdzQcBX0xjtEfwoud+Hc4MVerT4cmhyaJLP1/jEe8l3B3Cj4uVilbfAyxOAmAHZl4lcKawdzqUm1os6bsBzCwQU0usKYlW1vczvjvxHvq5z/+IQvCvvlPlUrVIlB7XaiIihkW4LbgZBKNaCWW8rihewX5FUTtvjveHzkGqXnzBBF8WfQmNvVtjKFGdkz3teOHShZOZO7fYo4rHGAV+KVz3kzSCZ8pgqAUsYYW5z/aViNnFuNdDz8xiq05DfUtD3GwbydH2mr5IN8bAFwufAidKEfuQeAusCuS5k6PRJyXK81ErqYMW/H+mSLVw9jCNOqqGGfiYdfcx8oNw+U1Vz/fDmQIQ+eT/JKDSOCbBYjrydC9WBzvgRngDoLQ/UXGCnIENqLJekvVJ0x9KTUhrzQyZVky+INyzp3i5UDyu2uLH55vJEI7qSmcM0Y8Eyj3Buc+0k739OQCC56IiQm/Aw6Uh+6Vi+/MfevcI5K0etMgTZ+dIhRAJAT5Jd4vRu4ge8M1HqEOQQj5lQfO+WtHcgwFyg1dGeQF6I6iy0JfMqXZVDsEkyCsDN6ZDaLcgMQN0FYWSsqy7tCzU9ZbvQ/pAHT/Ed1mNDWs+w0YzgcVv8+XCBGVzunpqcjbi08aKDYIKOIL5EBVOfDwGIeYjBuJhINQa49tNryXEkjZs+OxXDM4YvvksvwfNq4P4OLNJHoQ4DCEyqVbdqGGksRjNtU28Lu8y2M5eX6ehG8ismBMSgUy0SIbR5vTDVNjguo4HD7slVNYqERfMjlwHbnOLajoPl8nWIrhW3glWKBvJ1bQKWU81TRawlCAQ3k5DFnebFgoBagtqo0+Zoygt29Bz38wwqfF90jvfzVEM0sy4X+7FxZFYX2WTWKyZV3+16a7hWBjMbJeulU1chzs1V0/lPMXVEa+c3xcO8W2DyrX4wR27fUEfjPmug49tMhMSFOZXEOwzUMsXjz3K4XhEcC0mtYHDMT0EYtRX8pHe62RkMILuJGRHvw3Wwg2GzZRMpZfPQy8jLhkOhUSGc7z4XEWC/PdLmfGjBTZsZ6G2FfKlGLbSxOlgQlew2sZ+oNTHRrN+aMrkgyG11TheXDbE0y+Sxls+13DEYbMaflq5wjE2FlvD3b5X7/Pu4BizQI7Ski7jjb5qcqik8xoin2qGfhnY6H6PNSPz67J1RTxVZjHgUtZQKG56e+aKIv5FFyjFTgEPRqj3Yyrzh7+E6gt+LETh3vuJDUxKPLZskLD03xP6E/yiLbIu5DIYzK9+uuS/JGF3OibE93hgwp9uzDFirDzRbcuDVDxZyToSfH8P7m58lhp/FiKO3rpUqRqaC/GXz5xbekQ+yGuMKk6qEmiPj7B3pHm2Ic2tJIGTpTNCDNfsqefplUJXbKskiKRxOP04yCIn3XuHu8jUDhWZW848RWHgXfySdqEAFKrvsyamJKXz/1IGIdDzOgnAcd/wiudhZ41gDaCyA1DQYxU9T04106eD9aTZwj+mS9uZmfwHfROiBinC1ZAHsXfjLtwVZj3gpdUsieIqAiuAuMKle9yOMn3np4NEu5vjj/SOZeVWCvBfcPg8VB+uj6s7FtXRH5jdxkaB72PykYa8aTAbNKqcw/qlowv0k/vWnWa++fFFVfbg+VZ3a6oEW2YKvcVefQg/R4nEeTusmH/tnOl7SHLlJ4WLQ+U+v0GLeCY6zJKS6WweN+6SXIbkB9BLES2VpvxlYAmjqLlQuJBpcIuxL1SwCIkKUXdWjQqp6WzfS4XSxuxizZNL8xlEjXSJzFXvo+rPZXF37gHvmLHnjJkQdhctZUjyzDUfgLdR4FcMsp/U8qugWtbbemARFtrXHT9D3M/hVp0z/0ho80LB2chI1nOfY0u8GXgHtJfwZtoeyctud6JLo4zUxZy0zQMqIqgpytVNhjMPOIK5sWpKCKscPlg8+vANhPQHze7Wc8PXwC7jbSMH4QqqnGz+fPB/KKl+wz4jICe/vu7fNJRq0pehibPifXJtBDBH+i+s/U3ZX2WECKPYsF0DXq8Askisa3b97WPO7oWk8ghzE8ZXZs5CypkLpq+oPRg/WrsRJea+EWmkzKmBXtS23AQzhItNB0KFP18elLVmb6atYNs4lzv22ptifD+5wbYmk+/mAVgInqqixLPAy2uofCXvlXhIPd4vgkwpjar/lxcZWGtX7c7EUzDND1AyirMjcZyTaMsHEzYybT3S/8n8OgxVvyemLvgHnmZxmWnUBFUhItQ2Pt6iF2Dn68huo+0PE5K5qlKzoRPbfNLrNYImn4KxmLW5+bT2STe1j8aowyY3ROY1r+4BxHIbDknCb5aj6N4WR14SeUWSSPu23oK1VDLBlQUMiHHqfJwu0NiGhsI8Vl0Mp5Slp6FK0UvZz2O7C+x0HGaWVK9mMuP40BKHjEo7T97ZoXMN0uX4GmBQ3jEwXzsPpuPbZI5JnwwEyp5YX+IyYWJyCww2fntSQ/fS509b6mvG5isUMK3lpiogucROtJTA1KrODrocpTgUGvIwDUP/tosGT57lmXjTmHbTf6WjCHIUZsrbT5ycjYNJI0sn+dfx3Tba289CEeBEaX2FefnHX+o8HMLlRI4JmiD6faswCjC2IFMjDVfkJoie45Y+8Q9LSVZ8TkZey1QucNRrMIKpNLo4cPDCdUJIOPUDbfX4I1g0Qhk7T5WYX/JUtiaUgKiR5Gc/PHmV8oL8G9P+OSgg2Lc5XaN7/PevHCiBOLwAXsKbSCwL7oGmxyw90+sHIZr+ZyClNnfuXE3UrW7NXQI6mCxvQWKtJKn1trO17I6Cd00RMfC3uPy5/LIicubunfvDjp3BlaatxIrzDg3rVnFPX0dKzt/s4iuSyK3IT0le/x9OBLIp4EhdQdvd2HOFYxOtjxzbvWRzWrqGpBsLQLg7EG5adrqg69VOQMCT2pq0sCJp6hk4yGHbuz4hoX2PIeiI3l/Z0TwDGopGWW3uWRWxH/6bq1a6idgxHYhruUmR8aFpUKSsVyodiDV1PtK1zj5mKcZdeXx0THBYTEUWyo3RI9iLUnMcDYyPRTjCKoCm6pPS7yjIT7tq+MUi3iWo2XijY8AaV/K+WrnkcqoQH2cXsrBoH0sZMksdWwYBYz97+RKkx3FSxgdXJb1xxr0X21oPW1PhJq/zHSxe3OmxwYMPeZsGPaG8UngxTdfTQ3KPn+mN9NRXvlXkqudGJa/d/QMinCf/tp9eU1WX5xktqDgqBbPD391+6gcDsFgdidFdpLKf6yGLEovTwE9GrLX7srAC2dPOxviWekqng8H0N9RjHT06NVD9kAnnR/01ZkmmPzdP7vLX9imy0j/huTpN8i9XpFS6za4jdGt46Y5SfRKg/4qpwtE6meElgiOnTkP2uBI5cF4czaK1rYr1ZlwoneFzNHnBVFctAP7CD+w98hYexQ5RrdUYgFrMB5+88Y1IrI8Gd02RCEycPCoxdEFXqBVWmu2N/fuovgihTn9qf/mUxpQPsiUHjCgmV5w+ALs02oiRf08b8mTBAjy8utziFA6efpAppv98bQUfTs8lyNn7sH6OCoa4ZKeB51wqPXZBsKZ8Ja9VDZXjpCV+MB0b9XuSgOx2Y3UD/GJ/+eW7J6MiYFTHrhB1kRert5vRdF4M2KMoyYnVRFMBRqimnNBq6xrOvz4D6dSiquhFRtxlnb6dPCyRgHImsFbR/qdDukLB6DB+vfjzZQArLbkaMVF86hX1+9xP+BdZPsnVapY9u+DSZP7ZkEP/VftTl7uJZnqAWUis+jOncUizmzSIpV6cZO7SVdiQicHiRm6VSOmpBhniRKYN13Ct8B0g+JJeyMlx6OGALMLvcXKDXxJNvyYL9FuXyRvOygButRRjvLsEku+fl9ESD27r56ZNExf7w411cGbKQ+obhSnMsBM2qGBDR97VJyLGhbFX7SKl7CGOAWZF3TbOe4PU4Ty75qb8+U5R8amQ1FFQD4r65M=]
@@ -29,11 +29,11 @@ profiles::yum::global::repos:
    name: postgresql-15
    descr: postgresql-15 repository
    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
+    baseurl: https://edgecache.query.consul/postgres/yum/15/redhat/rhel-%{facts.os.release.full}-%{facts.os.architecture}
+    gpgkey: https://edgecache.query.consul/postgres/yum/keys/PGDG-RPM-GPG-KEY-RHEL
  postgresql-common:
    name: postgresql-common
    descr: postgresql-common repository
    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
+    baseurl: https://edgecache.query.consul/postgres/yum/common/redhat/rhel-%{facts.os.release.full}-%{facts.os.architecture}
+    gpgkey: https://edgecache.query.consul/postgres/yum/keys/PGDG-RPM-GPG-KEY-RHEL
@@ -2,161 +2,110 @@
 profiles::packages::include:
  createrepo: {}

-profiles::ssh::sign::principals:
-  - packagerepo.service.consul
-  - packagerepo.query.consul
-  - "packagerepo.service.%{facts.country}-%{facts.region}.consul"
-
-# additional altnames
 profiles::pki::vault::alt_names:
-  - packagerepo.main.unkin.net
-  - packagerepo.service.consul
-  - packagerepo.query.consul
-  - "packagerepo.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  jupyterhub:
-    service_name: 'packagerepo'
-    tags:
-      - 'packagerepo'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'packagerepo_http_check'
-        name: 'packagerepo HTTP Check'
-        http: "https://%{facts.networking.fqdn}"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: packagerepo
-    disposition: write
+  - repos.main.unkin.net

 profiles::reposync::webserver::nginx_listen_mode: both
 profiles::reposync::webserver::nginx_cert_type: vault
 profiles::reposync::repos_list:
-  almalinux_9_5_baseos:
-    repository: 'baseos'
-    description: 'AlmaLinux 9.5 BaseOS'
+  almalinux_8_9_baseos:
+    repository: 'BaseOS'
+    description: 'AlmaLinux 8.9 - BaseOS'
    osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/baseos'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_5_appstream:
-    repository: 'appstream'
-    description: 'AlmaLinux 9.5 AppStream'
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/baseos
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  almalinux_8_9_appstream:
+    repository: 'AppStream'
+    description: 'AlmaLinux 8.9 - AppStream'
    osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/appstream'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_5_crb:
-    repository: 'crb'
-    description: 'AlmaLinux 9.5 CRB'
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/appstream
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  almalinux_8_9_highavailability:
+    repository: 'HighAvailability'
+    description: 'AlmaLinux 8.9 - HighAvailability'
    osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/crb'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_5_ha:
-    repository: 'ha'
-    description: 'AlmaLinux 9.5 HighAvailability'
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/ha
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  almalinux_8_9_powertools:
+    repository: 'PowerTools'
+    description: 'AlmaLinux 8.9 - PowerTools'
    osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/highavailability'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_5_extras:
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/powertools
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  almalinux_8_9_extras:
    repository: 'extras'
-    description: 'AlmaLinux 9.5 extras'
+    description: 'AlmaLinux 8.9 - extras'
    osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/extras'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_baseos:
-    repository: 'baseos'
-    description: 'AlmaLinux 9.4 BaseOS'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/BaseOS/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/BaseOS/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_appstream:
-    repository: 'appstream'
-    description: 'AlmaLinux 9.4 AppStream'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/AppStream/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/AppStream/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_crb:
-    repository: 'crb'
-    description: 'AlmaLinux 9.4 CRB'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/CRB/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/CRB/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_ha:
-    repository: 'ha'
-    description: 'AlmaLinux 9.4 HighAvailability'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/HighAvailability/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/HighAvailability/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_extras:
-    repository: 'extras'
-    description: 'AlmaLinux 9.4 extras'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/extras/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/extras/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  docker_stable_el8:
-    repository: 'stable'
-    description: 'Docker CE Stable EL8'
-    osname: 'docker'
-    release: 'el8'
-    baseurl: 'https://download.docker.com/linux/centos/8/x86_64/stable/'
-    gpgkey: 'https://download.docker.com/linux/centos/gpg'
-  docker_stable_el9:
-    repository: 'stable'
-    description: 'Docker CE Stable EL9'
-    osname: 'docker'
-    release: 'el9'
-    baseurl: 'https://download.docker.com/linux/centos/9/x86_64/stable/'
-    gpgkey: 'https://download.docker.com/linux/centos/gpg'
-  frr_stable_el8:
-    repository: 'stable'
-    description: 'FRR Stable EL8'
-    osname: 'frr'
-    release: 'el8'
-    baseurl: 'https://rpm.frrouting.org/repo/el8/frr/'
-    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
-  frr_extras_el8:
-    repository: 'extras'
-    description: 'FRR Extras EL8'
-    osname: 'frr'
-    release: 'el8'
-    baseurl: 'https://rpm.frrouting.org/repo/el8/extras/'
-    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
-  frr_stable_el9:
-    repository: 'stable'
-    description: 'FRR Stable EL9'
-    osname: 'frr'
-    release: 'el9'
-    baseurl: 'https://rpm.frrouting.org/repo/el9/frr/'
-    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
-  frr_extras_el9:
-    repository: 'extras'
-    description: 'FRR Extras el9'
-    osname: 'frr'
-    release: 'el9'
-    baseurl: 'https://rpm.frrouting.org/repo/el9/extras/'
-    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
-  k8s_1.32:
-    repository: '1.32'
-    description: 'Kubernetes 1.32'
-    osname: 'k8s'
-    release: '1.32'
-    baseurl: 'https://pkgs.k8s.io/core:/stable:/v1.32/rpm/'
-    gpgkey: 'https://pkgs.k8s.io/core:/stable:/v1.32/rpm/repodata/repomd.xml.key'
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/extras
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  centos_8_advanced_virtualization:
+    repository: 'virt-advanced-virtualization'
+    description: 'CentOS Advanced Virtualization'
+    osname: 'centos'
+    release: '8' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8&arch=x86_64&repo=virt-advanced-virtualization' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
+  centos_8_ceph_pacific:
+    repository: 'storage-ceph-pacific'
+    description: 'CentOS Ceph Pacific'
+    osname: 'centos'
+    release: '8' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8&arch=x86_64&repo=storage-ceph-pacific' # Assuming '8' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
+  centos_8_rabbitmq_38:
+    repository: 'messaging-rabbitmq-38'
+    description: 'CentOS RabbitMQ 38'
+    osname: 'centos'
+    release: '8-stream' # Specified based on the repository name
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=messaging-rabbitmq-38' # Assuming '8' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
+  centos_8_nfv_openvswitch:
+    repository: 'nfv-openvswitch-2'
+    description: 'CentOS NFV OpenvSwitch'
+    osname: 'centos'
+    release: '8-stream' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=nfv-openvswitch-2' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
+  centos_8_openstack_xena:
+    repository: 'cloud-openstack-xena'
+    description: 'CentOS OpenStack Xena'
+    osname: 'centos'
+    release: '8-stream' # Directly taken from the provided mirrorlist
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=cloud-openstack-xena' # Assuming 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
+  centos_8_opstools:
+    repository: 'opstools-collectd-5'
+    description: 'CentOS OpsTools - collectd'
+    osname: 'centos'
+    release: '8-stream' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?arch=x86_64&release=8-stream&repo=opstools-collectd-5' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
+  centos_8_ovirt45:
+    repository: 'virt-ovirt-45'
+    description: 'CentOS oVirt 4.5'
+    osname: 'centos'
+    release: '8-stream' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=virt-ovirt-45' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
+  centos_8_stream_gluster10:
+    repository: 'storage-gluster-10'
+    description: 'CentOS oVirt 4.5 - Glusterfs 10'
+    osname: 'centos'
+    release: '8-stream' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=storage-gluster-10' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
+  epel_8_everything:
+    repository: 'Everything'
+    description: 'EPEL 8 Everything'
+    osname: 'epel'
+    release: '8'
+    mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-8&arch=x86_64'
+    gpgkey: 'https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8'
  mariadb_11_2_el8:
    repository: 'el8'
    description: 'MariaDB 11.2'
@@ -171,27 +120,6 @@ profiles::reposync::repos_list:
    release: 'el'
    baseurl: 'https://yum.puppet.com/puppet7/el/8/x86_64/'
    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
-  puppet7_el9:
-    repository: '9'
-    description: 'Puppet 7 EL9'
-    osname: 'puppet7'
-    release: 'el'
-    baseurl: 'https://yum.puppet.com/puppet7/el/9/x86_64/'
-    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
-  puppet8_el8:
-    repository: '8'
-    description: 'Puppet 8 EL8'
-    osname: 'puppet8'
-    release: 'el'
-    baseurl: 'https://yum.puppet.com/puppet8/el/8/x86_64/'
-    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
-  puppet8_el9:
-    repository: '9'
-    description: 'Puppet 8 EL9'
-    osname: 'puppet8'
-    release: 'el'
-    baseurl: 'https://yum.puppet.com/puppet8/el/9/x86_64/'
-    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
  postgresql_rhel8_common:
    repository: 'common'
    description: 'PostgreSQL Common RHEL 8'
@@ -199,27 +127,6 @@ profiles::reposync::repos_list:
    release: 'rhel8'
    baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-8-x86_64/'
    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  postgresql_rhel9_common:
-    repository: 'common'
-    description: 'PostgreSQL Common RHEL 9'
-    osname: 'postgresql'
-    release: 'rhel9'
-    baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-9-x86_64/'
-    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  postgresql_rhel8_15:
-    repository: '15'
-    description: 'PostgreSQL 15 RHEL 8'
-    osname: 'postgresql'
-    release: 'rhel8'
-    baseurl: 'https://download.postgresql.org/pub/repos/yum/15/redhat/rhel-8-x86_64/'
-    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  postgresql_rhel9_15:
-    repository: '15'
-    description: 'PostgreSQL 15 RHEL 9'
-    osname: 'postgresql'
-    release: 'rhel9'
-    baseurl: 'https://download.postgresql.org/pub/repos/yum/15/redhat/rhel-9-x86_64/'
-    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
  postgresql_rhel8_16:
    repository: '16'
    description: 'PostgreSQL 16 RHEL 8'
@@ -227,52 +134,3 @@ profiles::reposync::repos_list:
    release: 'rhel8'
    baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-x86_64/'
    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  postgresql_rhel9_16:
-    repository: '16'
-    description: 'PostgreSQL 16 RHEL 9'
-    osname: 'postgresql'
-    release: 'rhel9'
-    baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-9-x86_64/'
-    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  postgresql_rhel8_17:
-    repository: '17'
-    description: 'PostgreSQL 17 RHEL 8'
-    osname: 'postgresql'
-    release: 'rhel8'
-    baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-8-x86_64/'
-    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  postgresql_rhel9_17:
-    repository: '17'
-    description: 'PostgreSQL 17 RHEL 9'
-    osname: 'postgresql'
-    release: 'rhel9'
-    baseurl: 'https://download.postgresql.org/pub/repos/yum/17/redhat/rhel-9-x86_64/'
-    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  zfs_dkms_rhel8:
-    repository: 'dkms'
-    description: 'ZFS DKMS RHEL 8'
-    osname: 'zfs'
-    release: 'rhel8'
-    baseurl: 'http://download.zfsonlinux.org/epel/8/x86_64/'
-    gpgkey: 'https://packagerepo.service.consul/zfs/gpg/RPM-GPG-KEY-openzfs-2013'
-  zfs_kmod_rhel8:
-    repository: 'kmod'
-    description: 'ZFS KMOD RHEL 8'
-    osname: 'zfs'
-    release: 'rhel8'
-    baseurl: 'http://download.zfsonlinux.org/epel/8/kmod/x86_64/'
-    gpgkey: 'https://packagerepo.service.consul/zfs/gpg/RPM-GPG-KEY-openzfs-2013'
-  zfs_dkms_rhel9:
-    repository: 'dkms'
-    description: 'ZFS DKMS RHEL 9'
-    osname: 'zfs'
-    release: 'rhel9'
-    baseurl: 'http://download.zfsonlinux.org/epel/9/x86_64/'
-    gpgkey: 'https://packagerepo.service.consul/zfs/gpg/RPM-GPG-KEY-openzfs-2022'
-  zfs_kmod_rhel9:
-    repository: 'kmod'
-    description: 'ZFS KMOD RHEL 9'
-    osname: 'zfs'
-    release: 'rhel9'
-    baseurl: 'http://download.zfsonlinux.org/epel/9/kmod/x86_64/'
-    gpgkey: 'https://packagerepo.service.consul/zfs/gpg/RPM-GPG-KEY-openzfs-2022'
@@ -4,14 +4,14 @@ profiles::yum::global::repos:
    name: postgresql-15
    descr: postgresql-15 repository
    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/15-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
+    baseurl: https://edgecache.query.consul/postgres/yum/15/redhat/rhel-%{facts.os.release.full}-%{facts.os.architecture}
+    gpgkey: https://edgecache.query.consul/postgres/yum/keys/PGDG-RPM-GPG-KEY-RHEL
  postgresql-common:
    name: postgresql-common
    descr: postgresql-common repository
    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/postgresql/rhel%{facts.os.release.major}/common-daily/%{facts.os.architecture}/os/PGDG-RPM-GPG-KEY-RHEL
+    baseurl: https://edgecache.query.consul/postgres/yum/common/redhat/rhel-%{facts.os.release.full}-%{facts.os.architecture}
+    gpgkey: https://edgecache.query.consul/postgres/yum/keys/PGDG-RPM-GPG-KEY-RHEL

 profiles::sql::patroni::cluster_name: "patroni-%{facts.environment}"
 profiles::sql::patroni::postgres_exporter_enabled: true
@@ -1,7 +0,0 @@
---
-profiles::packages::include:
-  chrony:
-    ensure: absent
-
-# disable mlock for vault nodes on lxd/incus
-vault::disable_mlock: true
@@ -1,14 +1,7 @@
-# used by certbot clients to request letsencrypt certificates
-# - domains: list of certificates to generate
-# - webserver: where the client downloads certificates from
-# - data_dir: where to store the certificates on the client
-# - services: the services to notify when certificates change
-#
 class certbot::client (
  Array[Stdlib::Fqdn]   $domains,
  Stdlib::Fqdn          $webserver,
  Stdlib::Absolutepath  $data_dir = '/etc/pki/tls/letsencrypt/',
-  Optional[String]      $service = undef,
 ) {

  mkdir::p {$data_dir:}
@@ -21,11 +14,10 @@ class certbot::client (

  $domains.each |$domain| {
    certbot::client::cert {"${facts['networking']['fqdn']}_download_${domain}":
-      domain         => $domain,
-      destination    => "${data_dir}/${domain}",
-      webserver      => $webserver,
-      require        => File[$data_dir],
-      notify_service => $service,
+      domain      => $domain,
+      destination => "${data_dir}/${domain}",
+      webserver   => $webserver,
+      require     => File[$data_dir],
    }
  }
 }
@@ -1,13 +1,7 @@
-# a define for creating a single certificate
-# - domain: the domain to generate a certificate for
-# - webserver: where to download the certificate from
-# - destination: the data directory on the client
-# - notify_service: what service to notify when the concat exec completes
 define certbot::client::cert (
  Stdlib::Fqdn          $domain,
  Stdlib::Fqdn          $webserver,
  Stdlib::Absolutepath  $destination = "/etc/pki/tls/letsencrypt/${domain}",
-  Optional[String]      $notify_service = undef,
 ) {

  file { $destination:
@@ -40,16 +34,8 @@ define certbot::client::cert (
      }
    }

-    # create file resources
    create_resources(file, $files_to_create)

-    # if notify_service is specified
-    if $notify_service != undef {
-      $service = Service[$notify_service]
-    }else{
-      $service = undef
-    }
-
    exec { "concat_${domain}_certs":
      command     => "cat ${destination}/fullchain.pem ${destination}/privkey.pem > ${destination}/fullchain_combined.pem",
      path        => ['/bin', '/usr/bin'],
@@ -58,7 +44,6 @@ define certbot::client::cert (
        File["${destination}/fullchain.pem"],
        File["${destination}/privkey.pem"],
      ],
-      notify      => $service,
    }
  } else {
    notify { 'Certificates are not yet ready on the generator server.': }
@@ -1,110 +0,0 @@
-# manage etcd
-class etcd (
-  Boolean $manage_user = true,
-  Boolean $manage_group = true,
-  Boolean $manage_package = true,
-  Boolean $manage_service = true,
-  String[1] $package_name = 'etcd',
-  String[1] $user = 'etcd',
-  String[1] $group = 'etcd',
-  Stdlib::Absolutepath $config_path = '/etc/etcd',
-  Stdlib::Absolutepath $config_file = "${config_path}/etcd.yaml",
-  Hash $config = { 'data-dir' => '/var/lib/etcd' },
-  Integer $max_open_files = 40000,
-) {
-  if downcase($facts['kernel']) != 'linux' {
-    fail("Module etcd only supports Linux, not ${facts['kernel']}")
-  }
-  if $facts['service_provider'] != 'systemd' {
-    fail('Module etcd only supported on systems using systemd')
-  }
-  if ! $config['data-dir'] {
-    fail('Module etcd requires data-dir be specified in config Hash')
-  }
-
-  if $manage_package {
-    package { $package_name:
-      ensure => installed,
-    }
-  }
-
-  if $manage_user {
-    user { 'etcd':
-      ensure     => 'present',
-      name       => $user,
-      forcelocal => true,
-      shell      => '/bin/false',
-      gid        => $group,
-      home       => $config['data-dir'],
-      managehome => false,
-      system     => true,
-      before     => Systemd::Unit_file['etcd.service'],
-    }
-  }
-  if $manage_group {
-    group { 'etcd':
-      ensure     => 'present',
-      name       => $group,
-      forcelocal => true,
-      system     => true,
-      before     => Systemd::Unit_file['etcd.service'],
-    }
-  }
-
-  mkdir::p { $config_path: }
-  mkdir::p { $config['data-dir']: }
-
-  file { $config_file:
-    ensure  => 'file',
-    owner   => $user,
-    group   => $group,
-    mode    => '0600',
-    content => to_yaml($config),
-    notify  => Systemd::Unit_file['etcd.service'],
-    require => Mkdir::P[$config_path],
-  }
-
-  file { 'etcd-data-dir':
-    ensure  => 'directory',
-    path    => $config['data-dir'],
-    owner   => $user,
-    group   => $group,
-    mode    => '0700',
-    notify  => Systemd::Unit_file['etcd.service'],
-    require => Mkdir::P[$config['data-dir']],
-  }
-
-  file { 'etcd-data-dir-wal.tmp':
-    ensure  => 'directory',
-    path    => "${config['data-dir']}/wal.tmp",
-    owner   => $user,
-    group   => $group,
-    mode    => '0700',
-    notify  => Systemd::Unit_file['etcd.service'],
-    require => File['etcd-data-dir'],
-  }
-
-  if $config['wal-dir'] {
-    mkdir::p { $config['wal-dir']: }
-    file { 'etcd-wal-dir':
-      ensure  => 'directory',
-      path    => $config['wal-dir'],
-      owner   => $user,
-      group   => $group,
-      mode    => '0700',
-      notify  => Systemd::Unit_file['etcd.service'],
-      require => Mkdir::P[$config['wal-dir']],
-    }
-  }
-
-  if $manage_service {
-    include ::systemd
-
-    systemd::unit_file { 'etcd.service':
-      content => template('etcd/etcd.service.erb'),
-      enable  => true,
-      active  => true,
-      require => Package[$package_name],
-    }
-  }
-}
@@ -1,17 +0,0 @@
-# DO NOT EDIT: This file is being managed by Puppet.
-[Unit]
-Description=etcd key-value store
-Documentation=https://github.com/etcd-io/etcd
-After=network.target
-
-[Service]
-User=<%= @user %>
-Group=<%= @group %>
-Type=notify
-ExecStart=/usr/bin/etcd --config-file <%= @config_file %>
-Restart=always
-RestartSec=10s
-LimitNOFILE=<%= @max_open_files %>
-
-[Install]
-WantedBy=multi-user.target
@@ -1,89 +0,0 @@
-class frrouting (
-  Boolean $manage_package           = true,
-  Boolean $manage_config            = true,
-  Boolean $manage_service           = true,
-  String  $package_name             = 'frr',
-  String  $service_name             = 'frr',
-  Hash    $daemons                  = {},
-  Hash    $ospfd_interfaces         = {},
-  String  $ospfd_router_id          = $facts['networking']['ip'],
-  Array[String] $ospfd_redistribute = [],
-  Array[String] $ospfd_networks     = [],
-  Boolean $ospfd_default_originate_always = false,
-  Boolean $mpls_te_enabled                   = false,
-  Optional[String] $mpls_ldp_router_id       = undef,
-  Optional[String] $mpls_ldp_transport_addr  = undef,
-  Array[String] $mpls_ldp_interfaces         = [],
-) {
-
-  $daemons_defaults = {
-    'bgpd'    => false,
-    'ospfd'   => true,
-    'ospf6d'  => false,
-    'ldpd'    => false,
-    'ripd'    => false,
-    'ripngd'  => false,
-    'isisd'   => false,
-    'pimd'    => false,
-    'pim6d'   => false,
-    'nhrpd'   => false,
-    'eigrpd'  => false,
-    'sharpd'  => false,
-    'pbrd'    => false,
-    'bfdd'    => false,
-    'fabricd' => false,
-    'vrrpd'   => false,
-    'pathd'   => false,
-    'staticd' => false,
-  }
-
-  $daemons_merged = merge($daemons_defaults, $daemons)
-
-  if $manage_package {
-    package { $package_name:
-      ensure => installed,
-    }
-  }
-
-  if $manage_config {
-    file { '/etc/frr/frr.conf':
-      ensure  => file,
-      content => template('frrouting/frr.conf.erb'),
-      notify  => Service[$service_name],
-    }
-
-    file { '/etc/frr/daemons':
-      ensure  => file,
-      content => template('frrouting/daemons.erb'),
-      notify  => Service[$service_name],
-    }
-  }
-
-  if $manage_service {
-    service { $service_name:
-      ensure     => running,
-      enable     => true,
-      hasstatus  => true,
-      hasrestart => true,
-    }
-  }
-
-  if $mpls_ldp_router_id and $mpls_ldp_transport_addr and !empty($mpls_ldp_interfaces) {
-    file { '/etc/modules-load.d/mpls_ldp_modules.conf':
-      ensure  => file,
-      content => @(EOT/L),
-        # Load MPLS Kernel Modules
-        mpls_router
-        mpls_iptunnel
-        | EOT
-    }
-
-    ['mpls_router', 'mpls_iptunnel'].each |$mod| {
-      exec { "load_${mod}":
-        command => "/sbin/modprobe ${mod}",
-        unless  => "/sbin/lsmod | /bin/grep -q ^${mod}",
-        path    => ['/sbin', '/bin', '/usr/sbin', '/usr/bin'],
-      }
-    }
-  }
-}
@@ -1,29 +0,0 @@
-# THIS FILE IS MANAGED BY PUPPET
-<% @daemons_merged.each do |daemon, status| -%>
-<% if status -%>
-<%= daemon %>=yes
-<% else -%>
-<%= daemon %>=no
-<% end -%>
-<% end -%>
-
-vtysh_enable=yes
-zebra_options="  -A 127.0.0.1 -s 90000000"
-bgpd_options="   -A 127.0.0.1"
-ospfd_options="  -A 127.0.0.1"
-ospf6d_options=" -A ::1"
-ldpd_options="   -A 127.0.0.1"
-ripd_options="   -A 127.0.0.1"
-ripngd_options=" -A ::1"
-isisd_options="  -A 127.0.0.1"
-pimd_options="   -A 127.0.0.1"
-pim6d_options="  -A ::1"
-nhrpd_options="  -A 127.0.0.1"
-eigrpd_options=" -A 127.0.0.1"
-sharpd_options=" -A 127.0.0.1"
-pbrd_options="   -A 127.0.0.1"
-staticd_options="-A 127.0.0.1"
-bfdd_options="   -A 127.0.0.1"
-fabricd_options="-A 127.0.0.1"
-vrrpd_options="  -A 127.0.0.1"
-pathd_options="  -A 127.0.0.1"
@@ -1,45 +0,0 @@
-# THIS FILE IS MANAGED BY PUPPET
-frr defaults traditional
-hostname <%= @hostname %>
-no ipv6 forwarding
-<% @ospfd_interfaces.each do |iface, params| -%>
-interface <%= iface %>
-<% if params['area'] -%>
- ip ospf area <%= params['area'] %>
-<% end -%>
-<% if params['passive'] == true -%>
- ip ospf passive
-<% end -%>
-exit
-<% end -%>
-router ospf
- ospf router-id <%= @ospfd_router_id %>
- log-adjacency-changes detail
-<% @ospfd_redistribute.each do |type| -%>
- redistribute <%= type %>
-<% end -%>
-<% @ospfd_networks.each do |network| -%>
- network <%= network %>
-<% end -%>
-<% if @ospfd_default_originate_always -%>
- default-information originate always
-<% end -%>
-<% if @mpls_te_enabled -%>
- capability opaque
- mpls-te on
- mpls-te router-address <%= @ospfd_router_id %>
- mpls-te inter-as area 0.0.0.0
-<% end -%>
-exit
-<% if @mpls_ldp_router_id and @mpls_ldp_transport_addr and @mpls_ldp_interfaces.any? -%>
-mpls ldp
- router-id <%= @mpls_ldp_router_id %>
- address-family ipv4
-  discovery transport-address <%= @mpls_ldp_transport_addr %>
-<% @mpls_ldp_interfaces.each do |iface| -%>
-  interface <%= iface %>
-  exit
-<% end -%>
- exit-address-family
-exit
-<% end -%>
@@ -1,5 +1,5 @@
 [[groups]]
  name = "<%= $name %>"
  gidnumber = <%= $gidnumber %>
-  <% if $includegroups.length > 0 { %>includegroups = [<% $includegroups.each |Integer $group| { %><%= $group %>, <% } %>]<% } %>
+  <% if $includegroups.length > 0 { %>includegroups = [<%= $includegroups.join(', ') %>]<% } %>

@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-require 'yaml'
-
-Facter.add(:incus) do
-  setcode do
-    # Check if the 'incus' executable exists
-    incus_path = Facter::Util::Resolution.which('incus')
-    next {} unless incus_path # Return an empty fact if incus isn't found
-
-    # Run the `incus info` command using the found path
-    incus_output = Facter::Core::Execution.execute("#{incus_path} info")
-    next {} if incus_output.empty? # Return an empty fact if there's no output
-
-    # Parse the output as YAML and return it
-    YAML.safe_load(incus_output, permitted_classes: [Symbol, Time, Date])
-  end
-end
@@ -1,57 +0,0 @@
-# manage incus clusters
-class incus::cluster (
-  Boolean $members_lookup   = false,
-  String  $members_role     = undef,
-  String  $master           = undef,
-  Array   $servers          = [],
-  Stdlib::Fqdn $server_fqdn = $facts['networking']['fqdn'],
-  Stdlib::Port $server_port = 8443,
-){
-
-  # check that the master is named
-  unless !($master == undef) {
-    fail("master must be provided for ${title}")
-  }
-
-  # if lookup is enabled
-  if $members_lookup {
-
-    # check that the role is also set
-    unless !($members_role == undef) {
-      fail("members_role must be provided for ${title} when members_lookup is True")
-    }
-
-    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.fqdn'))
-
-  # else use provided array from params
-  }else{
-    $servers_array = $servers
-  }
-
-  # if its not an empty array. Give puppetdb a chance to be populated with data.
-  if length($servers_array) >= 3 {
-
-    # check if this is the master_node
-    if $master == $trusted['certname'] {
-      $master_bool = true
-    }else{
-      $master_bool = false
-    }
-
-    # find bootstrap status for servers
-    $bootstrap_array = puppetdb_query("inventory[certname, facts] { facts.enc_role = '${members_role}' }").map |$node| {
-      {
-        'fqdn'        => $node['certname'],
-        'ip'          => $node['facts']['networking']['ip'],
-        'clustered'   => $node['facts']['incus']['environment']['server_clustered'],
-        'certificate' => $node['facts']['incus']['environment']['certificate'],
-      }
-    }
-
-    # determine if the cluster is bootstrapped
-    $cluster_bootstrapped = $bootstrap_array.any |$server| {
-      $server['fqdn'] == $master and $server['clustered'] == true
-    }
-  }
-}
@@ -1,77 +0,0 @@
-class incus (
-  Array[String] $packages     = [
-    'incus',
-    'incus-tools',
-    'incus-client'
-  ],
-  Boolean       $cluster      = false,
-  Boolean       $init         = true,
-  String        $bridge       = 'incusbr0',
-  Stdlib::Port        $server_port = 8443,
-  Stdlib::IP::Address $server_addr = $facts['networking']['ip'],
-  Optional[String] $storage_images_volume = undef,
-) {
-
-  package { $packages:
-    ensure => installed,
-  }
-
-  service { 'incus':
-    ensure     => running,
-    enable     => true,
-    hasstatus  => true,
-    hasrestart => true,
-  }
-
-  file_line { 'subuid_root':
-    ensure => present,
-    path   => '/etc/subuid',
-    line   => 'root:1000000:1000000000',
-    match  => '^root:',
-    notify => Service['incus'],
-  }
-
-  file_line { 'subgid_root':
-    ensure => present,
-    path   => '/etc/subgid',
-    line   => 'root:1000000:1000000000',
-    match  => '^root:',
-    notify => Service['incus'],
-  }
-
-  if $init {
-    file {'/root/incus.preseed.yaml':
-      ensure  => file,
-      owner   => root,
-      group   => root,
-      content => template('incus/join_preseed.yaml.erb')
-    }
-
-    exec { 'initiate_incus':
-      path        => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
-      command     => 'cat /root/incus.preseed.yaml | incus admin init --preseed && touch /root/.incus_initialized',
-      refreshonly => true,
-      creates     => '/root/.incus_initialized',
-      subscribe   => File['/root/incus.preseed.yaml'],
-    }
-  }
-
-  if $facts['incus'] and $facts['incus']['config'] {
-    # set core.https_address
-    if $facts['incus']['config']['core.https_address'] != "${server_addr}:${server_port}" {
-      exec { 'incus_config_set_core_https_address':
-        path    => ['/bin', '/usr/bin'],
-        command => "incus config set core.https_address ${server_addr}:${server_port}",
-      }
-    }
-    # set storage.images_volume # path to store images
-    if $storage_images_volume {
-      if $facts['incus']['config']['storage.images_volume'] != $storage_images_volume {
-        exec { 'incus_config_set_storage_images_volume':
-          path    => ['/bin', '/usr/bin'],
-          command => "incus config set storage.images_volume ${storage_images_volume}",
-        }
-      }
-    }
-  }
-}
@@ -1,18 +0,0 @@
-config:
-  core.https_address: <%= @server_fqdn %>:<%= @server_port %>
-networks: []
-storage_pools: []
-storage_volumes: []
-profiles:
- config: {}
-  description: ""
-  devices:
-    eth0:
-      name: eth0
-      nictype: bridged
-      parent: <%= @bridge %>
-      type: nic
-  name: default
-  project: default
-projects: []
-cluster: null
@@ -1,74 +0,0 @@
-# frozen_string_literal: true
-
-require 'facter'
-require 'yaml'
-require 'net/http'
-require 'uri'
-require 'fileutils'
-
-# CobblerENC module: Fetches ENC data from Cobbler, caches it, and provides structured facts.
-module CobblerENC
-  CACHE_FILE = '/var/cache/puppet_enc.yaml'
-  CACHE_TTL = 7 * 24 * 60 * 60 # 7 days in seconds
-  @enc_data = nil # In-memory cache for the ENC response
-
-  def self.read_cache
-    return {} unless File.exist?(CACHE_FILE)
-
-    cache_data = YAML.safe_load(File.read(CACHE_FILE)) || {}
-    timestamp = cache_data.fetch('timestamp', 0)
-
-    return cache_data if Time.now.to_i - timestamp < CACHE_TTL
-
-    {}
-  end
-
-  def self.write_cache(enc_data)
-    FileUtils.mkdir_p(File.dirname(CACHE_FILE))
-    cache_data = enc_data.merge({ 'timestamp' => Time.now.to_i })
-    File.write(CACHE_FILE, cache_data.to_yaml)
-  end
-
-  def self.fetch_from_cobbler
-    uri = URI("http://cobbler.main.unkin.net/cblr/svc/op/puppet/hostname/#{Facter.value(:fqdn) || Facter.value(:hostname)}")
-    response = Net::HTTP.get_response(uri)
-
-    raise "Failed to fetch ENC data. HTTP #{response.code}" unless response.is_a?(Net::HTTPSuccess)
-
-    YAML.safe_load(response.body) || {}
-  end
-
-  def self.retrieve_enc_data
-    return @enc_data if @enc_data
-
-    @enc_data = fetch_from_cobbler
-    write_cache(@enc_data)
-    @enc_data
-  end
-
-  def self.fetch_enc_data
-    retrieve_enc_data
-  rescue StandardError => e
-    Facter.warn("Error retrieving Cobbler ENC data: #{e.message}")
-    @enc_data = read_cache
-    return @enc_data unless @enc_data.empty?
-
-    raise 'No cached ENC data available and Cobbler is down.'
-  end
-
-  def self.enc_role
-    fetch_enc_data.fetch('classes', {}).keys.first || raise('ENC Role not found in Cobbler ENC response')
-  end
-
-  def self.enc_env
-    fetch_enc_data.fetch('environment', nil) || raise('ENC Environment not found in Cobbler ENC response')
-  end
-end
-
-Facter.add('enc_role') do
-  setcode { CobblerENC.enc_role }
-end
-
-Facter.add('enc_env') do
-  setcode { CobblerENC.enc_env }
-end
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+Facter.add('enc_env') do
+  setcode do
+    require 'yaml'
+    # Check if the YAML file exists
+    if File.exist?('/root/.cache/custom_facts.yaml')
+      data = YAML.load_file('/root/.cache/custom_facts.yaml')
+      # Use safe navigation to return 'enc_env' or nil
+      data&.dig('enc_env')
+    end
+  end
+end
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+Facter.add('enc_role') do
+  setcode do
+    require 'yaml'
+    # Check if the YAML file exists
+    if File.exist?('/root/.cache/custom_facts.yaml')
+      data = YAML.load_file('/root/.cache/custom_facts.yaml')
+      # Use safe navigation to return 'enc_role' or nil
+      data&.dig('enc_role')
+    end
+  end
+end
@@ -10,18 +10,7 @@ class SubnetAttributes
    '198.18.15.0/24' => { environment: 'prod', region: 'syd1', country: 'au' },
    '198.18.16.0/24' => { environment: 'test', region: 'syd1', country: 'au' },
    '198.18.17.0/24' => { environment: 'prod', region: 'drw1', country: 'au' },
-    '198.18.18.0/24' => { environment: 'test', region: 'drw1', country: 'au' },
-    '198.18.19.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # loopbacks
-    '198.18.20.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # transit blocks
-    '198.18.21.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # physical network 2.5gbe
-    '198.18.22.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # ceph cluster
-    '198.18.23.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # ceph public
-    '198.18.24.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # dmz 1
-    '198.18.25.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # common node0009
-    '198.18.26.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # common node0010
-    '198.18.27.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # common node0011
-    '198.18.28.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }, # common node0012
-    '198.18.29.0/24' => { environment: 'prod', region: 'syd1', country: 'au' }  # common node0013
+    '198.18.18.0/24' => { environment: 'test', region: 'drw1', country: 'au' }
  }.freeze

  # Default attributes if no subnet matches, also defined as a constant
@@ -1,22 +0,0 @@
-# manage bridges and bridge slaves
-define networking::bridge (
-  String                $type,
-  Optional[Stdlib::IP::Address] $ipaddress,
-  Optional[Stdlib::IP::Address] $netmask   = undef,
-  Optional[Stdlib::IP::Address] $gateway   = undef,
-  Optional[Boolean]             $nocarrier = undef,
-  Boolean               $bridge = true,
-  Integer[100-9200]     $mtu    = 1500,
-  Optional[Boolean]     $forwarding = false,
-) {
-  include systemd
-
-  systemd::network { "${title}.netdev":
-    content => template('networking/bridge.netdev.erb'),
-  }
-
-  # Use shared template, it will detect bridge=true and skip Address/DNS/etc
-  systemd::network { "${title}.network":
-    content => template('networking/networkd-network.erb'),
-  }
-}
@@ -1,18 +0,0 @@
-# manage dummy/loopback interfaces
-define networking::dummy (
-  String                $type,
-  Stdlib::IP::Address   $ipaddress,
-  Stdlib::IP::Address   $netmask,
-  Integer[100-9200]     $mtu = 1500,
-  Optional[Boolean]     $forwarding = false,
-) {
-  include systemd
-
-  systemd::network { "${title}.netdev":
-    content => template('networking/dummy.netdev.erb'),
-  }
-
-  systemd::network { "${title}.network":
-    content => template('networking/networkd-network.erb'),
-  }
-}
@@ -4,67 +4,34 @@ class networking (
  Hash $interface_defaults = {},
  Hash $routes = {},
  Hash $route_defaults = {},
-  Boolean $use_networkd = lookup('systemd::manage_networkd', undef, undef, false),
 ){

  include network
  include networking::params

-  if $use_networkd {
-
-    include systemd
-
-    service { 'NetworkManager':
-      ensure => 'stopped',
-      enable => false,
+  # manage interfaces
+  $interfaces.each | $interface, $data | {
+    $merged_data = merge($interface_defaults, $data)
+    network_config { $interface:
+      *      => $merged_data,
+      notify => Exec['networking_reload_network'],
    }
+  }

-    $interfaces.each |String $iface, Hash $data| {
-      $type   = $data['type']
-      #$params = $data.filter |$key, $value| { $key != 'type' }
-
-      case $type {
-        'bridge': { networking::bridge { $iface: * => $data } }
-        'dummy': { networking::dummy { $iface: * => $data } }
-        'static': { networking::static { $iface: * => $data } }
-        'physical': { networking::static { $iface: * => $data } }
-        default: {
-          fail("Unsupported interface type '${type}' for interface '${iface}'")
-        }
-      }
-    }
-  }else{
-    # manage interfaces
-    $interfaces.each | $interface, $data | {
-      $merged_data = merge($interface_defaults, $data)
-      network_config { $interface:
-        *      => $merged_data,
-        notify => Exec['networking_reload_network'],
-      }
-    }
-
-    # manage routes
-    $routes.each | $route, $data | {
-      $merged_data = merge($route_defaults, $data)
-      network_route { $route:
-        *      => $merged_data,
-        notify => Exec['networking_reload_network'],
-      }
+  # manage routes
+  $routes.each | $route, $data | {
+    $merged_data = merge($route_defaults, $data)
+    network_route { $route:
+      *      => $merged_data,
+      notify => Exec['networking_reload_network'],
    }
  }

  # determine which networking service to restart
-  $restart_command = $use_networkd ? {
-    true    => '/usr/bin/systemctl restart systemd-networkd',
-    default => $facts['os']['family'] ? {
-      'RedHat' => $facts['os']['release']['major'] ? {
-        '8' => '/usr/bin/systemctl restart network',
-        '9' => '/usr/bin/systemctl restart NetworkManager',
-        default => fail('Unsupported RedHat OS release for networking restart'),
-      },
-      'Debian' => '/usr/bin/systemctl restart networking',
-      default  => fail('Unsupported OS in networking-restart-command'),
-    }
+  $restart_command = $facts['os']['family'] ? {
+    'RedHat' => '/usr/bin/systemctl restart network',
+    'Debian' => '/usr/bin/systemctl restart networking',
+    default  => fail('Unsupported OS in networking-restart-command'),
  }

  # restart network/networking only if $restart_networking boolean is true
@@ -1,27 +0,0 @@
-# manage static interfaces
-define networking::static (
-  String                $type,
-  Stdlib::IP::Address   $netmask  = '255.255.255.0',
-  Integer[100-9200]     $mtu      = 1500,
-  Boolean               $dhcp     = false,
-  Optional[Boolean]     $forwarding = false,
-  Optional[Stdlib::IP::Address]         $ipaddress = undef,
-  Optional[Stdlib::IP::Address]         $gateway = undef,
-  Optional[Array[Stdlib::IP::Address]]  $dns = undef,
-  Optional[Array[Stdlib::Fqdn]]         $domains = undef,
-  Optional[Integer[0-4096]]             $vlan = undef,
-  Optional[Variant[Boolean,String]]     $bridge = undef,
-  Optional[Integer[0-4294967294]]       $txqueuelen = undef,
-  Optional[Stdlib::MAC]                 $mac = undef,
-) {
-  include systemd
-
-  systemd::network { "${title}.network":
-    content => template('networking/networkd-network.erb'),
-  }
-  #if $type == 'physical' and $mac {
-  #  systemd::network { "${title}.link":
-  #    content => template('networking/networkd-link.erb'),
-  #  }
-  #}
-}
@@ -1,3 +0,0 @@
-[NetDev]
-Name=<%= @title %>
-Kind=bridge
@@ -1,3 +0,0 @@
-[NetDev]
-Name=<%= @title %>
-Kind=dummy
@@ -1,8 +0,0 @@
-[Match]
-MACAddress=<%= @mac %>
-
-[Link]
-MTUBytes=<%= @mtu %>
-<% if @txqueuelen and @txqueuelen >= 1 -%>
-TransmitQueueLength=<%= @txqueuelen %>
-<% end -%>
@@ -1,41 +0,0 @@
-[Match]
-Name=<%= @title %>
-
-[Network]
-<% if @dhcp == true -%>
-DHCP=yes
-<% else -%>
-<% if @ipaddress && @netmask -%>
-Address=<%= @ipaddress %>/<%= IPAddr.new(@netmask).to_i.to_s(2).count('1') %>
-<% end -%>
-<% if @gateway -%>
-Gateway=<%= @gateway %>
-<% end -%>
-<% if @dns -%>
-DNS=<%= Array(@dns).join(' ') %>
-<% end -%>
-<% if @domains -%>
-Domains=<%= Array(@domains).join(' ') %>
-<% end -%>
-<% end -%>
-<% if @bridge and @bridge != true -%>
-Bridge=<%= @bridge %>
-<% end -%>
-<% if @vlan -%>
-VLAN=<%= @vlan %>
-<% end -%>
-<% if @nocarrier and @nocarrier == true -%>
-ConfigureWithoutCarrier=true
-DuplicateAddressDetection=none
-RequiredForOnline=no-carrier
-<% end -%>
-<% if @type == 'dummy' -%>
-LinkLocalAddressing=no
-ActivationPolicy=always-up
-<% end -%>
-<% if @forwarding and @forwarding == true -%>
-IPForward=true
-<% end -%>
-
-[Link]
-MTUBytes=<%= @mtu %>
@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-Facter.add('zfs_zpool_cache_present') do
-  confine kernel: 'Linux'
-  setcode do
-    File.exist?('/etc/zfs/zpool.cache')
-  end
-end
-
-Facter.add('zfs_zpool_cache_present') do
-  setcode do
-    false
-  end
-end
@@ -1,10 +0,0 @@
-# manage zfs config
-class zfs::config {
-
-  file { $zfs::conf_dir:
-    ensure => directory,
-    owner  => 0,
-    group  => 0,
-    mode   => '0644',
-  }
-}
@@ -1,52 +0,0 @@
-# Installs basic ZFS kernel and userland support.
-#
-# @example Declaring the class
-#   include zfs
-#
-# @example Tuning the ZFS ARC
-#   class { 'zfs':
-#     zfs_arc_max => to_bytes('256 M'),
-#     zfs_arc_min => to_bytes('128 M'),
-#   }
-#
-# @param conf_dir Top-level configuration directory, usually `/etc/zfs`.
-# @param kmod_type Whether to use DKMS kernel packages or ones built to match
-#   the running kernel (only applies to RHEL platforms).
-# @param manage_repo Whether to setup and manage external package repositories.
-# @param package_name The name of the top-level metapackage that installs ZFS
-#   support.
-# @param service_manage Whether to manage the various ZFS services.
-# @param zfs_arc_max Maximum size of the ARC in bytes.
-# @param zfs_arc_min Minimum size of the ARC in bytes.
-class zfs (
-  Optional[Integer[0]]              $zfs_arc_max,
-  Optional[Integer[0]]              $zfs_arc_min,
-  Optional[Hash]                    $zpools,
-  Optional[Hash]                    $datasets,
-  Stdlib::Absolutepath              $conf_dir = '/etc/zfs',
-  Enum['dkms', 'kabi']              $kmod_type = 'kabi',
-  Boolean                           $manage_repo = true,
-  Variant[String, Array[String, 1]] $package_name = 'zfs',
-  Boolean                           $service_manage = true,
-) {
-
-  contain zfs::install
-  contain zfs::config
-  contain zfs::service
-
-  Class['zfs::install'] ~> Class['zfs::config'] ~> Class['zfs::service']
-
-  # create zpools
-  $zpools.each | $zpool, $data | {
-    zpool { $zpool:
-      * => $data
-    }
-  }
-
-  # create datasets
-  $datasets.each | $dataset, $data | {
-    zfs { $dataset:
-      * => $data
-    }
-  }
-}
@@ -1,151 +0,0 @@
-# manage zfs install/repos
-class zfs::install {
-
-  if $zfs::manage_repo {
-    case $facts['os']['family'] {
-      'RedHat': {
-        $baseurl = 'http://download.zfsonlinux.org'
-        $release = $facts['os']['release']['major'] ? {
-          '6'     => '6',
-          '7'     => $facts['os']['release']['full'] ? {
-            /^7\.[012]/ => '7',
-            default     => regsubst($facts['os']['release']['full'], '^7\.(\d+).*$', '7.\1'),
-          },
-          '8'     => $facts['os']['release']['full'] ? {
-            /^8\.4/ => '8.3',
-            default => regsubst($facts['os']['release']['full'], '^8\.(\d+).*$', '8.\1'),
-          },
-          default => regsubst($facts['os']['release']['full'], '^(\d\.\d+).*$', '\1'),
-        }
-
-        yumrepo { 'zfs':
-          baseurl => "${baseurl}/epel/${release}/\$basearch/",
-          descr   => "ZFS on Linux for EL${facts['os']['release']['major']} - dkms",
-          enabled => Integer($zfs::kmod_type == 'dkms'),
-          before  => Package[$zfs::package_name],
-        }
-
-        yumrepo { 'zfs-kmod':
-          baseurl => "${baseurl}/epel/${release}/kmod/\$basearch/",
-          descr   => "ZFS on Linux for EL${facts['os']['release']['major']} - kmod",
-          enabled => Integer($zfs::kmod_type == 'kabi'),
-        }
-
-        yumrepo { 'zfs-source':
-          baseurl => "${baseurl}/epel/${release}/SRPMS/",
-          descr   => "ZFS on Linux for EL${facts['os']['release']['major']} - Source",
-          enabled => 0,
-        }
-
-        yumrepo { 'zfs-testing':
-          baseurl => "${baseurl}/epel-testing/${release}/\$basearch/",
-          descr   => "ZFS on Linux for EL${facts['os']['release']['major']} - dkms - Testing",
-          enabled => 0,
-        }
-
-        yumrepo { 'zfs-testing-kmod':
-          baseurl => "${baseurl}/epel-testing/${release}/kmod/\$basearch/",
-          descr   => "ZFS on Linux for EL${facts['os']['release']['major']} - kmod - Testing",
-          enabled => 0,
-        }
-
-        yumrepo { 'zfs-testing-source':
-          baseurl => "${baseurl}/epel-testing/${release}/SRPMS/",
-          descr   => "ZFS on Linux for EL${facts['os']['release']['major']} - Testing Source",
-          enabled => 0,
-        }
-      }
-      default: {
-        # noop
-      }
-    }
-  }
-
-  # Handle these dependencies separately as they shouldn't be guarded by
-  # `$zfs::manage_repo`
-  case $facts['os']['family'] {
-    'RedHat': {
-      case $zfs::kmod_type {
-        'dkms': {
-          # Puppet doesn't like managing multiple versions of the same package.
-          # By using the version in the name Yum will do the right thing
-          ensure_packages(["kernel-devel-${facts['kernelrelease']}"], {
-            ensure => present,
-            before => Package[$zfs::package_name],
-          })
-        }
-        default: {
-          # noop
-        }
-      }
-    }
-    'Debian': {
-      case $facts['os']['name'] {
-        'Ubuntu': {
-          # noop
-        }
-        default: {
-          ensure_packages(["linux-headers-${facts['kernelrelease']}", "linux-headers-${facts['os']['architecture']}"], {
-            before => Package[$zfs::package_name],
-          })
-        }
-      }
-    }
-    default: {
-      # noop
-    }
-  }
-
-  # This is to work around the broken Debian 9 packages. Upon install the
-  # zfs-mount.service is started first which is the only unit that doesn't
-  # have an "ExecStartPre=-/sbin/modprobe zfs" line so the package can never
-  # be installed!
-  if $facts['os']['name'] == 'Debian' and $facts['os']['release']['major'] == '9' {
-    exec { 'zfs systemctl daemon-reload':
-      command     => 'systemctl daemon-reload',
-      refreshonly => true,
-      path        => $facts['path'],
-    }
-
-    Exec['zfs systemctl daemon-reload'] -> Package[$zfs::package_name]
-
-    file { '/etc/systemd/system/zfs-mount.service.d':
-      ensure => directory,
-      owner  => 0,
-      group  => 0,
-      mode   => '0644',
-    }
-
-    file { '/etc/systemd/system/zfs-mount.service.d/override.conf':
-      ensure  => file,
-      owner   => 0,
-      group   => 0,
-      mode    => '0644',
-      content => @(EOS/L),
-        [Service]
-        ExecStartPre=-/sbin/modprobe zfs
-        | EOS
-      notify  => Exec['zfs systemctl daemon-reload'],
-    }
-  }
-
-  # These need to be done here so the kernel settings are present before the
-  # package is installed and potentially loading the kernel module
-  $config = delete_undef_values({
-    'zfs_arc_max' => $zfs::zfs_arc_max,
-    'zfs_arc_min' => $zfs::zfs_arc_min,
-  })
-
-  $config.each |$option,$value| {
-    kmod::option { "zfs ${option}":
-      module => 'zfs',
-      option => $option,
-      value  => $value,
-      before => Package[$zfs::package_name],
-    }
-  }
-
-  package { $zfs::package_name:
-    ensure => present,
-  }
-}
@@ -1,90 +0,0 @@
-# manage zfs services
-class zfs::service {
-
-  if $zfs::service_manage {
-
-    exec { 'modprobe zfs':
-      path   => $facts['path'],
-      unless => 'grep -q "^zfs " /proc/modules',
-    }
-
-    case $facts['service_provider'] {
-      'systemd': {
-        $cache_ensure = str2bool($facts['zfs_zpool_cache_present']) ? {
-          true    => 'running',
-          default => 'stopped',
-        }
-
-        $scan_ensure = str2bool($facts['zfs_zpool_cache_present']) ? {
-          true    => 'stopped',
-          default => 'running',
-        }
-
-        service { 'zfs-import-cache':
-          ensure     => $cache_ensure,
-          enable     => true,
-          hasstatus  => true,
-          hasrestart => true,
-          require    => Exec['modprobe zfs'],
-          before     => Service['zfs-mount'],
-        }
-
-        service { 'zfs-import-scan':
-          ensure     => $scan_ensure,
-          enable     => true,
-          hasstatus  => true,
-          hasrestart => true,
-          require    => Exec['modprobe zfs'],
-          before     => Service['zfs-mount'],
-        }
-      }
-      default: {
-
-        case $facts['os']['family'] {
-          'RedHat': {
-            service { 'zfs-import':
-              ensure     => running,
-              enable     => true,
-              hasstatus  => true,
-              hasrestart => true,
-              require    => Exec['modprobe zfs'],
-              before     => Service['zfs-mount'],
-            }
-          }
-          'Debian': {
-            $import_ensure = str2bool($facts['zfs_zpool_cache_present']) ? {
-              true    => 'running',
-              default => 'stopped',
-            }
-
-            service { 'zpool-import':
-              ensure     => $import_ensure,
-              enable     => true,
-              hasstatus  => true,
-              hasrestart => true,
-              require    => Exec['modprobe zfs'],
-            }
-          }
-          default: {
-            # noop
-          }
-        }
-      }
-    }
-
-    service { 'zfs-mount':
-      ensure     => running,
-      enable     => true,
-      hasstatus  => true,
-      hasrestart => true,
-      before     => Service['zfs-share'],
-    }
-
-    service { 'zfs-share':
-      ensure     => running,
-      enable     => true,
-      hasstatus  => true,
-      hasrestart => true,
-    }
-  }
-}
@@ -2,20 +2,12 @@
 class profiles::accounts::sysadmin(
  String $password,
  Array[String] $sshkeys = [],
-  Array[String] $extra_groups = [],
 ){
-
-  $default_groups = [
-    'adm',
-    'admins',
-    'systemd-journal'
-  ]
-
-  $groups = $extra_groups + $default_groups
-
  profiles::base::account {'sysadmin':
    username   => 'sysadmin',
-    groups     => $groups,
+    uid        => 1000,
+    gid        => 1000,
+    groups     => ['adm', 'admins', 'systemd-journal'],
    sshkeys    => $sshkeys,
    sudo_rules => ['sysadmin ALL=(ALL) NOPASSWD:ALL'],
    password   => $password,
@@ -8,21 +8,14 @@ class profiles::almalinux::base (
      ensure => absent,
    }
  }
-  if $facts['os']['release'] == '8' {
-    service {'NetworkManager':
-      ensure  => false,
-      enable  => false,
-      require => Package['network-scripts'],
-    }
-    -> service {'network':
-      ensure  => true,
-      enable  => true,
-      require => Package['network-scripts'],
-    }
-  } elsif $facts['os']['release'] == '8' {
-    service {'NetworkManager':
-      ensure => true,
-      enable => true,
-    }
+  service {'NetworkManager':
+    ensure  => false,
+    enable  => false,
+    require => Package['network-scripts'],
+  }
+  -> service {'network':
+    ensure  => true,
+    enable  => true,
+    require => Package['network-scripts'],
  }
 }
@@ -22,20 +22,18 @@ class profiles::base (
    # include the base profiles
    include profiles::base::repos
    include profiles::packages
+    include profiles::base::facts
    include profiles::base::motd
    include profiles::base::scripts
    include profiles::base::hosts
    include profiles::base::groups
    include profiles::base::root
    include profiles::accounts::sysadmin
-    if $facts['virtual'] != 'lxc' {
-      include profiles::ntp::client
-    }
+    include profiles::ntp::client
    include profiles::dns::base
    include profiles::pki::vault
    include profiles::ssh::sign
    include profiles::ssh::knownhosts
-    include profiles::ssh::service
    include profiles::cloudinit::init
    include profiles::metrics::default
    include profiles::helpers::node_lookup
@@ -59,10 +57,6 @@ class profiles::base (
      include profiles::qemu::agent
    }

-    class { 'limits':
-      purge_limits_d_dir => false,
-    }
-
    # include classes from hiera
    $hiera_include = lookup('hiera_include', Array[String], 'unique', [])
    $hiera_exclude = lookup('hiera_exclude', Array[String], 'unique', [])
@@ -1,8 +1,8 @@
 # a wrapper for puppetlabs-account and saz-sudo
 define profiles::base::account (
  String $username,
-  Optional[Integer] $uid = undef,
-  Optional[Integer] $gid = undef,
+  Integer $uid,
+  Integer $gid = undef,
  Boolean $manage_home = true,
  Boolean $create_group = true,
  Boolean $purge_sshkeys = true,
@@ -2,9 +2,6 @@
 #
 # This class manages the creation of a logical volume using the `lvm::volume` definition.
 #
-# For LXC hosts, this is replaced with a mount added from the host os. This class will simply check the
-# mountpoint exists.
-#
 # Parameters:
 #   $ensure   - Ensure whether the logical volume is present or not. Defaults to 'present'.
 #   $vg       - Volume group name. No default.
@@ -28,48 +25,33 @@ class profiles::base::datavol (
  ]] $mount_options = ['noatime', 'nodiratime'],
 ) {

-  if $facts['virtual'] != 'lxc' {
+  # Ensure the physical volume exists
+  physical_volume { $pv:
+    ensure => $ensure,
+    before => Volume_group[$vg],
+  }

-    # Ensure the physical volume exists
-    physical_volume { $pv:
-      ensure => $ensure,
-      before => Volume_group[$vg],
-    }
+  # Ensure the volume group exists
+  volume_group { $vg:
+    ensure           => $ensure,
+    physical_volumes => [$pv],
+    before           => Logical_volume[$lv],
+  }

-    # Ensure the volume group exists
-    volume_group { $vg:
-      ensure           => $ensure,
-      physical_volumes => [$pv],
-      before           => Logical_volume[$lv],
-    }
+  # Ensure the logical volume exists
+  logical_volume { $lv:
+    ensure       => $ensure,
+    volume_group => $vg,
+    size         => $size,
+    before       => Filesystem["/dev/${vg}/${lv}"],
+  }

-    # Ensure the logical volume exists
-    logical_volume { $lv:
-      ensure       => $ensure,
-      volume_group => $vg,
-      size         => $size,
-      before       => Filesystem["/dev/${vg}/${lv}"],
-    }
-
-    # Ensure the filesystem is created on the logical volume
-    filesystem { "/dev/${vg}/${lv}":
-      ensure  => $ensure,
-      fs_type => $fstype,
-      require => Logical_volume[$lv],
-      before  => Mount[$mount],
-    }
-
-    # Ensure the logical volume is mounted at the desired location
-    mount { $mount:
-      ensure  => $mountstate,
-      device  => "/dev/${vg}/${lv}",
-      fstype  => $fstype,
-      options => $mount_options.join(','),
-      require => [
-        Filesystem["/dev/${vg}/${lv}"],
-        File[$mount]
-      ],
-    }
+  # Ensure the filesystem is created on the logical volume
+  filesystem { "/dev/${vg}/${lv}":
+    ensure  => $ensure,
+    fs_type => $fstype,
+    require => Logical_volume[$lv],
+    before  => Mount[$mount],
  }

  # Ensure the mountpath exists
@@ -80,4 +62,12 @@ class profiles::base::datavol (
    mode   => '0755',
  }

+  # Ensure the logical volume is mounted at the desired location
+  mount { $mount:
+    ensure  => $mountstate,
+    device  => "/dev/${vg}/${lv}",
+    fstype  => $fstype,
+    options => $mount_options.join(','),
+    require => Filesystem["/dev/${vg}/${lv}"],
+  }
 }
@@ -0,0 +1,39 @@
+# a class to define some global facts
+class profiles::base::facts {
+
+  # The path where external facts are stored
+  $facts_d_path = '/opt/puppetlabs/facter/facts.d'
+
+  # Ensure the directory exists
+  file { $facts_d_path:
+    ensure => directory,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+  }
+
+  # cleanup old facts files
+  $fact_list = [ 'enc_role', 'enc_env' ]
+  $fact_list.each | String $item | {
+    file { "${facts_d_path}/${item}.txt":
+      ensure  => absent,
+    }
+  }
+
+  # ensure the path to the custom store exists
+  file { '/root/.cache':
+    ensure => directory,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0750',
+  }
+
+  # create the file that will be read
+  file { '/root/.cache/custom_facts.yaml':
+    ensure  => file,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('profiles/base/facts/custom_facts.yaml.erb'),
+  }
+}
@@ -3,7 +3,6 @@ class profiles::base::repos {
  # manage package repositories
  case $facts['os']['family'] {
    'RedHat': {
-      include crypto_policies
      include profiles::yum::global
      include profiles::firewall::firewalld
    }
@@ -1,62 +0,0 @@
-class profiles::ceph::mon (
-  Boolean $members_lookup    = true,
-  String  $members_role      = 'roles::infra::incus::node',
-  String  $master            = 'prodnxsr0009.main.unkin.net',
-){
-
-  $admin_key = 'AQAN/iRooIyMCRAAynGdDgfEZX79YycRZcp6tw=='
-  $mon_key = 'AQAa/iRo37CdIhAAERhnXqDVs1BaMcVVIBc3Ew=='
-  $bootstrap_osd_key = 'AQAo/iRoZx0wFxAAhVVQ0BkfBpIeL6l1kdLBIw=='
-  $fsid = 'FBDBD9F1-9606-42D2-9C93-0E9A73BBF2C2'
-
-  # if lookup is enabled
-  if $members_lookup {
-
-    # check that the role is also set
-    unless !($members_role == undef) {
-      fail("members_role must be provided for ${title} when members_lookup is True")
-    }
-
-    # if it is, find hosts, sort them so they dont cause changes every run
-    $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.hostname'))
-    $servers_ip = sort(query_nodes("enc_role='${members_role}' and region='${facts['region']}'", 'networking.interfaces.loopback2.ip'))
-  }
-
-  if length($servers_array) >= 3 {
-
-    $servers_hostname_string = join($servers_array, ',')
-    $servers_ip_string = join($servers_ip, ',')
-
-    class { 'ceph':
-      fsid                => $fsid,
-      mon_initial_members => $servers_hostname_string,
-      mon_host            => $servers_ip_string,
-      cluster_network     => '198.18.22.0/24',
-      public_network      => '198.18.23.0/24',
-      public_addr         => "%{hiera('networking_loopback2_ip')}",
-    }
-
-    ceph::mon { $facts['networking']['hostname']:
-      key         => $mon_key,
-      public_addr => $facts['networking']['interfaces']['loopback2']['ip'],
-    }
-
-    Ceph::Key {
-      inject         => true,
-      inject_as_id   => 'mon.',
-      inject_keyring => "/var/lib/ceph/mon/ceph-${facts['networking']['hostname']}/keyring",
-    }
-
-    ceph::key { 'client.admin':
-      secret  => $admin_key,
-      cap_mon => 'allow *',
-      cap_osd => 'allow *',
-      cap_mds => 'allow',
-    }
-
-    ceph::key { 'client.bootstrap-osd':
-      secret  => $bootstrap_osd_key,
-      cap_mon => 'allow profile bootstrap-osd',
-    }
-  }
-}
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				profiles::jupyter::jupyterhub::ldap_bind_pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJspN3e2WzA0uZaLgFZ0Ewqii9dY0tTgbirsW70M2VZtLY+s+C6HE8ZZUtpfnRsFwUUhOj7s25X9xVOZNTpZIGPyfx9MWlSyFw2RFuXSEwaydf1DcBbg8261YrTTysA4Jsa1L4DLsX55q+XJUyeUbimVQkIacVIvzTdnZCBKnVNUh3U2PNAmV7SOL2KH8Jpbfs/EQfBt8XuGMCg3I/4RDyoNERqthW6W2KiMX2Gmd8iQ5+W9udH0lEAMx415oyImmN+dEuThcx9FGMi8BWYtnxH96yWafpT5qltwW6EVzIGWuLhiD1LcWYc5RB8jc3DhbeouChpKsN6c4EHoKt3aWsTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC8jcnqilJgY1/AnHWHfX4bgDCi2a3Rj43Z0dgfB5HaHdpfked3Cx+u94r2S5+Cg3QogU1AIF04rjzOL+bD2HdaMfo=]
				`@@ -1 +0,0 @@`
				profiles::puppet::puppetboard::secret_key: ENC[PKCS7,MIIB+wYJKoZIhvcNAQcDoIIB7DCCAegCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAoCr9JTtrnMaVjJlEpA0NYNt/QAgTGiEmS3kPn2oJ80Ay7fUl79pop95uLQIfw6C3e8WGUhxYt31wmzent4Bfbced7uF/tjhP2cniKPmZGuf/tmVrGIHIh4T4g0Wz2K0DIU/dGWUlgE03ICRxXlAy0atjUuAp02ehj7bzLuMf+vZbghm8vnOoDCTKjeZNAJEkDvBkIzwUu9JiM9Gn6BzoLLGdEERqs/LR832vjjNmF7KUEH/Ntt47wbLdfCzawsZsBNLggEb1HNGu0aSb0qBXYBPRq6w1L/RU8gX2dCqGRbhDZymihebaOcwU1AtbLEBdHTYQpga+c4bcTz9rJplLtjCBvQYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQAdSjLEaZPK47TY7LDCB7b4CBkOTvHbi4nb+pB/Kng+Z3N9ocZPZdGbV6WzMNGxsxmhWXoi+XKEzEvfB10UhQwDcvZXd2W9hhiRkakq7+S0uLWzCX1jNMH2LXZAzoiyGM4FFvGpx7Z64OhmVrOJuKnxD+3zK6PZqvMb3g7CjZeAr5vyhcT/zO75krhJuYp11ZFpLCRcuASf0ru+Jq5OKD4+ZI/g==]