feat: moved puppetdb profiles

- move puppetdb profiles to profiles::puppetdb namespace
- add profile to manage puppetdb api ssl certificates

Puppetfile

@@ -11,13 +11,13 @@ mod 'puppetlabs-apt', '9.4.0'
 mod 'puppetlabs-lvm', '2.1.0'
 mod 'puppetlabs-puppetdb', '7.13.0'
 mod 'puppetlabs-postgresql', '9.1.0'
+mod 'puppetlabs-firewall', '6.0.0'
 mod 'puppetlabs-accounts', '8.1.0'
 mod 'puppetlabs-mysql', '15.0.0'
 mod 'puppetlabs-xinetd', '3.4.1'
 mod 'puppetlabs-haproxy', '8.0.0'
 mod 'puppetlabs-java', '10.1.2'
 mod 'puppetlabs-reboot', '5.0.0'
-mod 'puppetlabs-docker', '10.0.1'
 
 # puppet
 mod 'puppet-python', '7.0.0'
@@ -33,21 +33,12 @@ mod 'puppet-grafana', '13.1.0'
 mod 'puppet-consul', '8.0.0'
 mod 'puppet-vault', '4.1.0'
 mod 'puppet-dhcp', '6.1.0'
-mod 'puppet-keepalived', '5.1.0'
+mod 'puppet-keepalived', '3.6.0'
 mod 'puppet-extlib', '7.0.0'
-mod 'puppet-network', '2.2.0'
-mod 'puppet-kmod', '4.0.1'
-mod 'puppet-filemapper', '4.0.0'
-mod 'puppet-letsencrypt', '11.0.0'
-mod 'puppet-rundeck', '9.1.0'
-mod 'puppet-redis', '11.0.0'
-mod 'puppet-ipset', '4.3.0'
-mod 'puppet-nftables', '4.0.0'
 
 # other
 mod 'ghoneycutt-puppet', '3.3.0'
 mod 'saz-sudo', '8.0.0'
-mod 'saz-ssh', '12.1.0'
 mod 'ghoneycutt-timezone', '4.0.0'
 mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
@@ -55,8 +46,6 @@ mod 'kogitoapp-minio', '1.1.4'
 mod 'broadinstitute-certs', '3.0.1'
 mod 'stm-file_capability', '6.0.0'
 mod 'h0tw1r3-gitea', '3.2.0'
-mod 'rehan-mkdir', '2.0.0'
-mod 'tailoredautomation-patroni', '2.0.0'
 
 mod 'bind',
   :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',

doc/admin/groups.md

@@ -1,9 +0,0 @@
-# Group administration
-
-This page exists to list all the locally managed groups, their gid's and what their general purpose is for.
-
-## List of groups
-| name        | gid         | purpose     |
-|-------------|-------------|-------------|
-| admin | 10000 | admin group designed for system admins |
-| media | 20000 | group permissions to manage media (*arrs) |

doc/ceph/README.md

@@ -1,60 +0,0 @@
-# managing ceph
-
-Always refer back to the official documentation at https://docs.ceph.com/en/latest
-
-## adding new cephfs
-- create a erasure code profile which will allow you to customise the raid level
-    - raid5 with 3 disks? k=2,m=1
-    - raid5 with 6 disks? k=5,m=1
-    - raid6 with 4 disks? k=2,m=2, etc
-- create osd pool using custom profile for data
-- create osd pool using default replicated profile for metadata
-- enable ec_overwrites for the data pool
-- create the ceph fs volume using data/metadata pools
-- set ceph fs settings
-    - specify minimum number of metadata servers (mds)
-    - set fs to be for bulk data
-    - set mds fast failover with standby reply
-
-
-```
-    sudo ceph osd erasure-code-profile set ec_4_1 k=4 m=1
-    sudo ceph osd pool create media_data 128 erasure ec_4_1
-    sudo ceph osd pool create media_metadata 32 replicated_rule
-    sudo ceph osd pool set media_data allow_ec_overwrites true
-    sudo ceph osd pool set media_data bulk true
-    sudo ceph fs new mediafs media_metadata media_data --force
-    sudo ceph fs set mediafs allow_standby_replay true
-    sudo ceph fs set mediafs max_mds 2
-```
-
-## creating authentication tokens
-
-- this will create a client keyring named media
-- this client will have the following capabilities:
-    - mon: read
-    - mds:
-        - read /
-        - read/write /media
-        - read/write /common
-    - osd: read/write to cephfs_data pool
-
-```
-    sudo ceph auth get-or-create client.media \
-      mon 'allow r' \
-      mds 'allow r path=/, allow rw path=/media, allow rw path=/common' \
-      osd 'allow rw pool=cephfs_data'
-```
-
-## list the authentication tokens and permissions
-
-    ceph auth ls
-
-## change the capabilities of a token
-
-this will overwrite the current capabilities of a given client.user
-
-    sudo ceph auth caps client.media \
-      mon 'allow r' \
-      mds 'allow rw path=/' \
-      osd 'allow rw pool=media_data'

doc/puppet/README.md

@@ -1,31 +0,0 @@
-# add additional master
-
-these steps are required when adding additional puppet masters, as the subject alternative names on the certificate will need to be changed. this requires the old certificate be revoked, cleaned up, and for a new certificate to be generated and signed.
-
-## prepare a new node
-- deploy a new now, or identify a space with the base role
-- change the hosts class to roles::infra::puppet::master
-- apply puppet until there are no more changes
-
-## revoke the current certificate on the puppet master
-
-    sudo puppetserver ca clean --certname ausyd1nxvm1023.main.unkin.net
-
-## stop the new puppetserver and cleanup revoked certificates
-
-    sudo systemctl stop puppetserver
-    sudo rm -f /etc/puppetlabs/puppet/ssl/certs/$(hostname -f).pem
-    sudo rm -f /etc/puppetlabs/puppet/ssl/private_keys/$(hostname -f).pem
-
-## copy the current crl.pem, as puppetserver will overwrite it when starting
-
-    sudo cp /etc/puppetlabs/puppet/ssl/crl.pem /root/current_crl.pem
-
-## request new puppet agent certificate
-
-    sudo puppet ssl bootstrap
-
-## start the puppetserver service and move the crl.pem back in place
-
-    sudo systemctl start puppetserver
-    sudo cp /root/current_crl.pem /etc/puppetlabs/puppet/ssl/crl.pem

doc/vault/README.md

@@ -1,123 +0,0 @@
-# PKI
-## root ca
-    vault secrets enable -path=pki_root pki
-    vault secrets tune -max-lease-ttl=87600h pki_root
-
-    vault write -field=certificate pki_root/root/generate/internal \
-         common_name="unkin.net" \
-         issuer_name="UNKIN_ROOTCA_2024" \
-         ttl=87600h > unkinroot_2024_ca.crt
-
-    vault read pki_root/issuer/$(vault list -format=json pki_root/issuers/ | jq -r '.[]') | tail -n 6
-
-    vault write pki_root/roles/2024-servers allow_any_name=true
-
-    vault write pki_root/config/urls \
-         issuing_certificates="$VAULT_ADDR/v1/pki_root/ca" \
-         crl_distribution_points="$VAULT_ADDR/v1/pki_root/crl"
-
-## intermediate
-    vault secrets enable -path=pki_int pki
-    vault secrets tune -max-lease-ttl=43800h pki_int
-
-    vault write -format=json pki_int/intermediate/generate/internal \
-         common_name="unkin.net Intermediate Authority" \
-         issuer_name="UNKIN_VAULTCA_2024" \
-         | jq -r '.data.csr' > pki_intermediate.csr
-
-    vault write -format=json pki_root/root/sign-intermediate \
-         issuer_ref="UNKIN_ROOTCA_2024" \
-         csr=@pki_intermediate.csr \
-         format=pem_bundle ttl="43800h" \
-         | jq -r '.data.certificate' > intermediate.cert.pem
-
-    vault write pki_int/intermediate/set-signed certificate=@intermediate.cert.pem
-
-## create role
-    vault write pki_int/roles/servers_default \
-        issuer_ref="$(vault read -field=default pki_int/config/issuers)" \
-        allow_ip_sans=true \
-        allowed_domains="unkin.net, *.unkin.net, localhost" \
-        allow_subdomains=true \
-        allow_glob_domains=true \
-        allow_bare_domains=true \
-        enforce_hostnames=true \
-        allow_any_name=true \
-        max_ttl="2160h" \
-        key_bits=4096 \
-        country="Australia"
-
-## test generating a domain cert
-    vault write pki_int/issue/servers_default common_name="test.unkin.net" ttl="24h"
-    vault write pki_int/issue/servers_default common_name="test.main.unkin.net" ttl="24h"
-    vault write pki_int/issue/servers_default common_name="*.test.main.unkin.net" ttl="24h"
-
-## remove expired certificates
-    vault write pki_int/tidy tidy_cert_store=true tidy_revoked_certs=true
-
-# AUTH
-## enable approles
-    vault auth enable approle
-
-# CERTMANAGER
-## create certmanager policy and token, limit to puppetmaster
-    cat <<EOF > certmanager.hcl
-    path "pki_int/issue/*" {
-      capabilities = ["create", "update", "read"]
-    }
-    path "pki_int/renew/*" {
-      capabilities = ["update"]
-    }
-    path "pki_int/cert/*" {
-      capabilities = ["read"]
-    }
-    EOF
-
-    vault policy write certmanager certmanager.hcl
-
-    vault write auth/approle/role/certmanager \
-        bind_secret_id=false \
-        token_policies="certmanager" \
-        token_ttl=30s \
-        token_max_ttl=30s \
-        token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32"
-
-## get the certmanager approle id
-    vault read -field=role_id auth/approle/role/certmanager/role-id
-
-
-# SSH Hostkey Signing
-
-## create ssh engine, key, set ttl
-    vault secrets enable -path=ssh-host-signer ssh
-    vault write ssh-host-signer/config/ca generate_signing_key=true
-    vault secrets tune -max-lease-ttl=87600h ssh-host-signer
-
-## create role
-    vault write ssh-host-signer/roles/hostrole \
-        key_type=ca \
-        algorithm_signer=rsa-sha2-256 \
-        ttl=87600h \
-        allow_host_certificates=true \
-        allowed_domains="unkin.net" \
-        allow_subdomains=true \
-        allow_baredomains=true
-
-## create policy to use hostrole
-    cat <<EOF > sshsign-host.hcl
-    path "ssh-host-signer/sign/hostrole" {
-        capabilities = ["create", "update"]
-    }
-    EOF
-
-    vault policy write sshsign-host-policy sshsign-host.hcl
-
-    vault write auth/approle/role/sshsign-host-role \
-        bind_secret_id=false \
-        token_policies="sshsign-host-policy" \
-        token_ttl=30s \
-        token_max_ttl=30s \
-        token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32"
-
-## get the sshsign-host-role approle id
-    vault read -field=role_id auth/approle/role/sshsign-host-role/role-id

doc/vault/setup.md

@@ -0,0 +1,48 @@
+# root ca
+    vault secrets enable -path=pki_root pki
+
+    vault write -field=certificate pki_root/root/generate/internal \
+         common_name="unkin.net" \
+         issuer_name="unkinroot-2024" \
+         ttl=87600h > unkinroot_2024_ca.crt
+
+    vault read pki_root/issuer/$(vault list -format=json pki_root/issuers/ | jq -r '.[]') | tail -n 6
+
+    vault write pki_root/roles/2024-servers allow_any_name=true
+
+    vault write pki_root/config/urls \
+         issuing_certificates="$VAULT_ADDR/v1/pki_root/ca" \
+         crl_distribution_points="$VAULT_ADDR/v1/pki_root/crl"
+
+# intermediate
+    vault secrets enable -path=pki_int pki
+    vault secrets tune -max-lease-ttl=43800h pki_int
+
+    vault write -format=json pki_int/intermediate/generate/internal \
+         common_name="unkin.net Intermediate Authority" \
+         issuer_name="unkin-dot-net-intermediate" \
+         | jq -r '.data.csr' > pki_intermediate.csr
+
+    vault write -format=json pki_root/root/sign-intermediate \
+         issuer_ref="unkinroot-2024" \
+         csr=@pki_intermediate.csr \
+         format=pem_bundle ttl="43800h" \
+         | jq -r '.data.certificate' > intermediate.cert.pem
+
+    vault write pki_int/intermediate/set-signed certificate=@intermediate.cert.pem
+
+# create role
+    vault write pki_int/roles/unkin-dot-net \
+         issuer_ref="$(vault read -field=default pki_int/config/issuers)" \
+         allowed_domains="unkin.net" \
+         allow_subdomains=true \
+         max_ttl="2160h"
+
+# test generating a domain cert
+    vault write pki_int/issue/unkin-dot-net common_name="test.unkin.net" ttl="24h"
+    vault write pki_int/issue/unkin-dot-net common_name="test.main.unkin.net" ttl="24h"
+    vault write pki_int/issue/unkin-dot-net common_name="*.test.main.unkin.net" ttl="24h"
+
+
+# remove expired certificates
+    vault write pki_int/tidy tidy_cert_store=true tidy_revoked_certs=true

hieradata/common.yaml

@@ -3,10 +3,16 @@ lookup_options:
   hiera_classes:
     merge:
       strategy: deep
-  profiles::packages::include:
+  profiles::packages::install:
     merge:
       strategy: deep
-  profiles::packages::exclude:
+  profiles::packages::install_exclude:
+    merge:
+      strategy: deep
+  profiles::packages::remove:
+    merge:
+      strategy: deep
+  profiles::packages::remove_exclude:
     merge:
       strategy: deep
   profiles::pki::vault::alt_names:
@@ -102,56 +108,11 @@ lookup_options:
   profiles::nginx::simpleproxy::nginx_aliases:
     merge:
       strategy: deep
-  networking::interfaces:
-    merge:
-      strategy: deep
-  networking::interface_defaults:
-    merge:
-      strategy: deep
-  networking::routes:
-    merge:
-      strategy: deep
-  networking::route_defaults:
-    merge:
-      strategy: deep
-  ssh::server::options:
-    merge:
-      strategy: deep
-  mysql::db:
-    merge:
-      strategy: deep
-  profiles::ceph::client::keyrings:
-    merge:
-      strategy: deep
-  profiles::nginx::simpleproxy::locations:
-    merge:
-      strategy: deep
-  certbot::client::domains:
-    merge:
-      strategy: deep
-  keepalived::vrrp_script:
-    merge:
-      strategy: deep
-  keepalived::vrrp_instance:
-    merge:
-      strategy: deep
 
 facts_path: '/opt/puppetlabs/facter/facts.d'
 
-hiera_include:
+hiera_classes:
   - timezone
-  - networking
-  - ssh::server
-  - profiles::accounts::rundeck
-  - firewall::rules::in::exporters
-  - firewall::rules::in::consul
-  - firewall::rules::out::consul
-  - firewall::rules::out::dns
-  - firewall::rules::out::http
-  - firewall::rules::out::https
-  - firewall::rules::out::ntp
-  - firewall::rules::out::puppet
-  - firewall::rules::out::vault
 
 profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
 profiles::ntp::client::use_ntp: 'region'
@@ -182,70 +143,57 @@ profiles::consul::client::node_rules:
     segment: ''
     disposition: read
 
-profiles::packages::include:
+profiles::packages::install:
-  bash-completion: {}
+  - bash-completion
-  bzip2: {}
+  - bzip2
-  ccze: {}
+  - ccze
-  curl: {}
+  - curl
-  dstat: {}
+  - dstat
-  expect: {}
+  - expect
-  gzip: {}
+  - gzip
-  git: {}
+  - git
-  htop: {}
+  - htop
-  inotify-tools: {}
+  - inotify-tools
-  iotop: {}
+  - iotop
-  jq: {}
+  - jq
-  lz4: {}
+  - lz4
-  mtr: {}
+  - mtr
-  ncdu: {}
+  - ncdu
-  neovim: {}
+  - neovim
-  p7zip: {}
+  - p7zip
-  pbzip2: {}
+  - pbzip2
-  pigz: {}
+  - pigz
-  pv: {}
+  - pv
-  python3.11: {}
+  - python3.11
-  rsync: {}
+  - rsync
-  screen: {}
+  - screen
-  socat: {}
+  - socat
-  strace: {}
+  - strace
-  sysstat: {}
+  - sysstat
-  tar: {}
+  - tmux
-  tmux: {}
+  - traceroute
-  traceroute: {}
+  - unzip
-  unzip: {}
+  - vim
-  vim: {}
+  - vnstat
-  vnstat: {}
+  - wget
-  wget: {}
+  - zsh
-  zsh: {}
+  - zstd
-  zstd: {}
+
-  iwl100-firmware:
+profiles::packages::remove:
-    ensure: absent
+  - iwl100-firmware
-  iwl1000-firmware:
+  - iwl1000-firmware
-    ensure: absent
+  - iwl105-firmware
-  iwl105-firmware:
+  - iwl135-firmware
-    ensure: absent
+  - iwl2000-firmware
-  iwl135-firmware:
+  - iwl2030-firmware
-    ensure: absent
+  - iwl3160-firmware
-  iwl2000-firmware:
+  - iwl5000-firmware
-    ensure: absent
+  - iwl5150-firmware
-  iwl2030-firmware:
+  - iwl6000-firmware
-    ensure: absent
+  - iwl6000g2a-firmware
-  iwl3160-firmware:
+  - iwl6050-firmware
-    ensure: absent
+  - iwl7260-firmware
-  iwl5000-firmware:
+  - puppet7-release
-    ensure: absent
-  iwl5150-firmware:
-    ensure: absent
-  iwl6000-firmware:
-    ensure: absent
-  iwl6000g2a-firmware:
-    ensure: absent
-  iwl6050-firmware:
-    ensure: absent
-  iwl7260-firmware:
-    ensure: absent
-  puppet7-release:
-    ensure: absent
 
 profiles::base::scripts::scripts:
   puppet: puppetwrapper.py
@@ -267,38 +215,6 @@ puppetdbsql: puppetdbsql.service.au-syd1.consul
 prometheus::node_exporter::export_scrape_job: true
 prometheus::systemd_exporter::export_scrape_job: true
 
-ssh::server::storeconfigs_enabled: false
-ssh::server::options:
-  Protocol: '2'
-  ListenAddress:
-    - '127.0.0.1'
-    - '%{facts.networking.ip}'
-  SyslogFacility: 'AUTHPRIV'
-  HostKey:
-    - /etc/ssh/ssh_host_rsa_key
-    - /etc/ssh/ssh_host_ecdsa_key
-    - /etc/ssh/ssh_host_ed25519_key
-  HostCertificate: /etc/ssh/ssh_host_rsa_key-cert.pem
-  AuthorizedKeysFile: .ssh/authorized_keys
-  PermitRootLogin: no
-  PasswordAuthentication: no
-  ChallengeResponseAuthentication: no
-  PubkeyAuthentication: yes
-  GSSAPIAuthentication: yes
-  GSSAPICleanupCredentials: yes
-  UsePAM: yes
-  X11Forwarding: no
-  PrintMotd: no
-  AcceptEnv:
-    - LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
-    - LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
-    - LC_IDENTIFICATION LC_ALL LANGUAGE
-    - XMODIFIERS
-  Subsystem: sftp /usr/libexec/openssh/sftp-server
-
-profiles::ssh::knownhosts::lines:
-  - '@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1HD97vYxLTniE4qNpGuftUlvmkEXIuX8+7nbENv/IzsGUghEDRtyThjQ7ojNKIsQ7f8wXr0gMcI+fAPfrbcOMHCAoYMomikwL0b3h95SZI40q3CyM+0DMnwiVVDX6C1QxkO2Rv9cszSkCa85NotJhXiUuTBI9BFcRPy+mAhbpAru+bfypYofI0wW97XNTl8Jgwmni5MgutBIQAokFIn5ux8iWxndCH3AqDtmkwC5DfQeQ+wZx7rkwqJEpJffQzrjb1gIM6P9hDCVBBVPh/3o80IJ69rFWrJAZUb+JpG4cXJH0NcSW+wqc3JCT/x3q8VlHwOTXSlNNKtOJCRx73mB8e1XTTy2a9FgpKDDg5XQXWHAViJDz1RTRL9gRefMylRgKz4bXoTuY9kJWM8hPTyUejtukbJThlBJc3OmDxBZBF7F0iqB11pHexok43OCEiANodVa36eWu9/5X032Vm48fZ1/akDPY/NSy3wAn7kwut+A0/JAHFHASrq+1mt9YurkJegI+YHXO6eEWpBIpmI7ORHJbGL4MhkHrxYzVamuP8CkU7tXzsv138+wpOcRHNp9yJY4PT40BZkRf/O3O+jt3pj9Dj8rvgywF2W6hFzywh3Y78upOprRkQlQtHfsI8EyrYI8/hUw2u3H+3yPXh3YjWfqvWVG1BRLRHBV7m90uaw=='
-
 profiles::base::groups::local:
   admins:
     ensure: present
@@ -314,67 +230,39 @@ sudo::configs:
 
 profiles::accounts::sysadmin::sshkeys:
   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ8SRLlPiDylBpdWR9LpvPg4fDVD+DZst4yRPFwMMhta4mnB1H9XuvZkptDhXywWQ7QIcqa2WbhCen0OQJCtwn3s7EYtacmF5MxmwBYocPoK2AArGuh6NA9rwTdLrPdzhZ+gwe88PAzRLNzjm0ZBR+mA9saMbPJdqpKp0AWeAM8QofRQAWuCzQg9i0Pn1KDMvVDRHCZof4pVlHSTyHNektq4ifovn0zhKC8jD/cYu95mc5ftBbORexpGiQWwQ3HZw1IBe0ZETB1qPIPwsoJpt3suvMrL6T2//fcIIUE3TcyJKb/yhztja4TZs5jT8370G/vhlT70He0YPxqHub8ZfBv0khlkY93VBWYpNGJwM1fVqlw7XbfBNdOuJivJac8eW317ZdiDnKkBTxapThpPG3et9ib1HoPGKRsd/fICzNz16h2R3tddSdihTFL+bmTCa6Lo+5t5uRuFjQvhSLSgO2/gRAprc3scYOB4pY/lxOFfq3pU2VvSJtRgLNEYMUYKk= ben@unkin.net
-profiles::accounts::rundeck::sshkeys:
-  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD4F7VcorbGpyZzBFexz7c/o1JBscrl7hZU0UkWV7fq6YLizW0r6fOzD99hMwu1kdYCjPxbvuUSDEHfyBIp2EgLWU6wFVoufQqlMyOV85+ivQZUc1VNV+X9T+U4v3u/01hkAmlpXtbkwhMSR4Wi+tdABd04+D3CuMDM37mvnFmBBmi41X4Mr1rJhOQumn1XHQ7EYbsdw2mxfEVVeWpZIHz5BjNKSGzEIAYZbFt6s0Y7X3J5RT+Gjqmu043Tc8nNIUFlR9E10qd3Euf9RiBYxBx3z+yfOzJPBzWNBSHv1+PIbO5Mq+z5JaAfoFZO41L7nw+FjV6JJUCVLr6Vq+bCxyA7LW4Oq9ZahSrt/vrT0kTa0tA5U9bqK6e7pB//dm7PzoROtTq0XksV8RseA/fvIje20uaN1z9dynx+UcbszXu9pQ5GIg1o7b5DEi3OZHJwpgdudiCyEeR4+00G0z4PjpEMnTSMHAJ53WxtjzrPAOBnAmPE7hPu4coU+XrCWEXAvRMloJmca68e+zFX7VvFK82KVDuQ99vQ6w4X73IESKoLzyAVxpelwHaDG4fN+zqYfqubVQU1L5cUeYKxqm5r3Us6VvMaYs1ZMUmDGXHOq4FNhGUJYxSjkLvunM6qyAAJQCd6Pw/2TV3UQVerbouGOZaeBLvRguHWSbDrO99Zu+t87w== rundeck_runner
 
-networking::interface_defaults:
+profiles::base::hosts::additional_hosts:
-  ensure: present
+  - ip: 198.18.17.3
-  family: inet
+    hostname: prodinf01n01.main.unkin.net
-  method: static
+    aliases:
-  netmask: 255.255.255.0
+      - prodinf01n01
-  onboot: true
+      - puppet
-networking::route_defaults:
+      - puppetmaster
-  ensure: present
+      - puppetca
-  interface: eth0
+  - ip: 198.18.17.4
-  netmask: 0.0.0.0
+    hostname: prodinf01n04.main.unkin.net
-  network: default
+    aliases:
-
+      - prodinf01n04
-profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
+  - ip: 198.18.17.5
-profiles::ceph::client::mons:
+    hostname: prodinf01n05.main.unkin.net
-  - 10.18.15.1
+    aliases:
-  - 10.18.15.2
+      - prodinf01n05
-  - 10.18.15.3
+  - ip: 198.18.17.6
-#profiles::base::hosts::additional_hosts:
+    hostname: prodinf01n06.main.unkin.net
-#  - ip: 198.18.17.9
+    aliases:
-#    hostname: prodinf01n09.main.unkin.net
+      - prodinf01n06
-#    aliases:
+  - ip: 198.18.17.9
-#      - prodinf01n09
+    hostname: prodinf01n09.main.unkin.net
-#      - ntp01.main.unkin.net
+    aliases:
-#  - ip: 198.18.17.10
+      - prodinf01n09
-#    hostname: prodinf01n10.main.unkin.net
+      - ntp01.main.unkin.net
-#    aliases:
+  - ip: 198.18.17.10
-#      - prodinf01n10
+    hostname: prodinf01n10.main.unkin.net
-#      - ntp02.main.unkin.net
+    aliases:
-#  - ip: 198.18.17.22
+      - prodinf01n10
-#    hostname: prodinf01n22.main.unkin.net
+      - ntp02.main.unkin.net
-#    aliases:
+  - ip: 198.18.17.22
-#      - prodinf01n22
+    hostname: prodinf01n22.main.unkin.net
-#      - repos.main.unkin.net
+    aliases:
-
+      - prodinf01n22
-firewall::enable: true
+      - repos.main.unkin.net
-firewall::ipset_queries:
-  certbot: "enc_role=roles::infra::pki::certbot"
-  cobbler: "enc_role=roles::infra::cobbler::server"
-  consul: "enc_role=roles::infra::storage::consul"
-  dhcp: "enc_role=roles::infra::dhcp::server"
-  dns_master: "enc_role=roles::infra::dns::master"
-  dns_resolver: "enc_role=roles::infra::dns::resolver"
-  edgecache: "enc_role=roles::infra::storage::edgecache"
-  gitea_runner: "enc_role=roles::infra::git::runner"
-  gitea_server: "enc_role=roles::infra::git::gitea"
-  glauth: "enc_role=roles::infra::auth::glauth"
-  gonic: "enc_role=roles::apps::music::gonic"
-  grafana: "enc_role=roles::infra::metrics::grafana"
-  haproxy: "enc_role=roles::infra::halb::haproxy"
-  jumphost: "enc_role=roles::infra::proxy::jumphost"
-  ntp: "enc_role=roles::infra::ntp::server"
-  prometheus: "enc_role=roles::infra::metrics::prometheus"
-  puppetboard: "enc_role=roles::infra::puppetboard::server"
-  puppetmaster: "enc_role=roles::infra::puppet::master"
-  puppetdb_sql: "enc_role=roles::infra::puppetdb::sql"
-  puppetdb_api: "enc_role=roles::infra::puppetdb::api"
-  redis: "enc_role=roles::infra::db::redis"
-  rundeck: "enc_role=roles::infra::automation::rundeck"
-  sql_galera: "enc_role=roles::infra::sql::galera"
-  sql_patroni: "enc_role=roles::infra::sql::patroni"
-  vault: "enc_role=roles::infra::storage::vault"

hieradata/country/au/region/drw1/infra/puppet/master.eyaml

@@ -1,4 +1,3 @@
 ---
 certmanager::vault_token: ENC[PKCS7,MIIBygYJKoZIhvcNAQcDoIIBuzCCAbcCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAWh7bsttz/JCBo/CPoCgA2doo3jO6jT6NsOoE3/06W2IW+Ij6KHKYILMkG3tS4NAegMI48QR9n++4Xa7u+97w1HO4ENpfLrkuKUcWUFCxxb2OdWhxucIlt3Ay/2+tofOSvqiRKeEISBtOK//Q1a4Iu5GwEP+lvDQ5rcoS0dryNie/okXaLratWOsmctJ6LFuUw5siCcFyUzfvr2ROsB14YoF989np+X1dJqBWxcLmbVNKx766GrRhb1WGeF0qxounCmWEKGt0zY4Zk27KNFlFu7XByDWZoSCVCMvkQaRKhvdNA39Y9vscZJGPGFhz+qKPoeqwUidz0IY51CaFSXewmzCBjAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQC+e2iOlFLlr9inVU8nEVWIBgqb0u/ICsLtxZqOpN9OIFWl+4hVrvTo24JzTc1jMSCONeL4Ab7jtTMbsweE9zUf6XlwhHLXfxfg7FL3WBsOWCUBXIAh338cZCXUGX7m0Qvtgg3VTEbTNDJhZle8Sjo6Gl]
 certmanager::role_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJuE+uzgQaBRUXBCigckEo1j+UxxbiUGrzdf/B9K7XPdVxZh6TzYLpBgNnyaT6vLo0boX4uRD/By0gT5R/2qcXD6d/j+fh517Ctk4d2uO64f0vH3PzyyOBalsNtcCdPiV3q/xGqzQSHhPiNkFEjDvMBz5p53UjfKA6gAiPrLklp4rN/NVyiLBw20NeIqbL25VdkQa13ViS0Gm/eUQu7a2xQ1dvQFWWfuLaQxO0dh8L0ynkfmWKIjaiD5412Z8hYURu0otxbqVDdIbEMx5xQsXnFKeN93yHmgs7a7M6fLdp9jh+G8B+IlK1W7/9v2+RT0/yI3ZgWHVTvDRhMHuPGBjfTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC5avtOPp9N65U1ILQENnvAgDBqI8XAjqbWIvXHqOEiKYdu+co0EEtsHR1v5xAeCmj/ZA6MLeKFlAVJbvpyCpzjons=]
-sshsignhost::role_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAT86C/InXrgDtXCc9NFze91YMvjTNDqWgv4uzPFI48clOeQyD6x+vOHWP2yNp1OyNHcYLCiLyrv+rSIQyXlLnbeyZWV+7kXIon057Tp7l0BxWtd0hjQEcyWzqQQE7R264C8/qKRak81LIu6RshWZAchYo/BMPuOqVr0m+1zDwOV9JwZc3bpexzsl57CK5pesOrpfdvnd/xrOoEMR+P+C5PC6QLtQl3zkOD3N9kP6HqwbhWH5ZBPy88Kc+5kYM6QVpQSjFIIHK1SWsN0VZoxpkuFlFXB5KHDgZtg3kxrofzjQghl41zJBCDq9Z5oZ+2b1p/j/9jCASyp/ju68H5WXzbzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCf4Nqp6SAl/XjmhPDnTvVJgDCdDhxWaChhjJ3eRcW4NTFgf3zm7Bu65za0li26FKuKks00duF4zebfNw7ZUVsYtIU=]

hieradata/country/au/region/syd1.yaml

@@ -1,3 +1,2 @@
 ---
 timezone::timezone: 'Australia/Sydney'
-certbot::client::webserver: ausyd1nxvm1021.main.unkin.net

hieradata/country/au/region/syd1/infra/halb/haproxy.yaml

@@ -1,31 +1,4 @@
 ---
-hiera_include:
-  - keepalived
-
-# keepalived
-profiles::haproxy::dns::vrrp_ipaddr: '198.18.13.250'
-profiles::haproxy::dns::vrrp_cnames:
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-
-keepalived::vrrp_script:
-  check_haproxy:
-    script: '/usr/bin/killall -0 haproxy'
-
-keepalived::vrrp_instance:
-  VI_250:
-    interface: 'eth0'
-    virtual_router_id: 250
-    auth_type: 'PASS'
-    auth_pass: 'quiiK7oo'
-    virtual_ipaddress: '198.18.13.250/32'
-    track_script:
-      - check_haproxy
-
 # mappings
 profiles::haproxy::mappings:
   fe_http:
@@ -33,27 +6,11 @@ profiles::haproxy::mappings:
     mappings:
       - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
       - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
-      - 'sonarr.main.unkin.net be_sonarr'
-      - 'radarr.main.unkin.net be_radarr'
-      - 'lidarr.main.unkin.net be_lidarr'
-      - 'readarr.main.unkin.net be_readarr'
-      - 'prowlarr.main.unkin.net be_prowlarr'
-      - 'nzbget.main.unkin.net be_nzbget'
-      - 'jellyfin.main.unkin.net be_jellyfin'
-      - 'fafflix.unkin.net be_jellyfin'
   fe_https:
     ensure: present
     mappings:
       - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
       - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
-      - 'sonarr.main.unkin.net be_sonarr'
-      - 'radarr.main.unkin.net be_radarr'
-      - 'lidarr.main.unkin.net be_lidarr'
-      - 'readarr.main.unkin.net be_readarr'
-      - 'prowlarr.main.unkin.net be_prowlarr'
-      - 'nzbget.main.unkin.net be_nzbget'
-      - 'jellyfin.main.unkin.net be_jellyfin'
-      - 'fafflix.unkin.net be_jellyfin'
 
 profiles::haproxy::frontends:
   fe_http:
@@ -63,15 +20,7 @@ profiles::haproxy::frontends:
   fe_https:
     options:
       acl:
-        - 'acl_ausyd1pve req.hdr(host) -i au-syd1-pve.main.unkin.net'
+        - 'acl_ausyd1pve req.hdr(host) -i https://au-syd1-pve.main.unkin.net'
-        - 'acl_sonarr req.hdr(host) -i sonarr.main.unkin.net'
-        - 'acl_radarr req.hdr(host) -i radarr.main.unkin.net'
-        - 'acl_lidarr req.hdr(host) -i lidarr.main.unkin.net'
-        - 'acl_readarr req.hdr(host) -i readarr.main.unkin.net'
-        - 'acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net'
-        - 'acl_nzbget req.hdr(host) -i nzbget.main.unkin.net'
-        - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
-        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
         - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
       use_backend:
         - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -79,14 +28,6 @@ profiles::haproxy::frontends:
         - 'deny if { hdr_dom(host) -i au-syd1-pve.main.unkin.net } !acl_internalsubnets'
       http-response:
         - 'set-header X-Frame-Options DENY if acl_ausyd1pve'
-        - 'set-header X-Frame-Options DENY if acl_sonarr'
-        - 'set-header X-Frame-Options DENY if acl_radarr'
-        - 'set-header X-Frame-Options DENY if acl_lidarr'
-        - 'set-header X-Frame-Options DENY if acl_readarr'
-        - 'set-header X-Frame-Options DENY if acl_prowlarr'
-        - 'set-header X-Frame-Options DENY if acl_nzbget'
-        - 'set-header X-Frame-Options DENY if acl_jellyfin'
-        - 'set-header X-Frame-Options DENY if acl_fafflix'
         - 'set-header X-Content-Type-Options nosniff'
         - 'set-header X-XSS-Protection 1;mode=block'
 
@@ -122,152 +63,17 @@ profiles::haproxy::backends:
         - set-header X-Forwarded-Port %[dst_port]
         - add-header X-Forwarded-Proto https if { dst_port 443 }
       redirect: 'scheme https if !{ ssl_fc }'
-  be_sonarr:
-    description: Backend for au-syd1 sonarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_radarr:
-    description: Backend for au-syd1 radarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_lidarr:
-    description: Backend for au-syd1 lidarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_readarr:
-    description: Backend for au-syd1 readarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_prowlarr:
-    description: Backend for au-syd1 prowlarr
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_nzbget:
-    description: Backend for au-syd1 nzbget
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /consul/health
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
-  be_jellyfin:
-    description: Backend for au-syd1 jellyfin
-    collect_exported: false # handled in custom function
-    options:
-      balance: roundrobin
-      option:
-        - httpchk GET /
-        - forwardfor
-        - http-keep-alive
-        - prefer-last-server
-      cookie: SRVNAME insert indirect nocache
-      http-reuse: always
-      http-request:
-        - set-header X-Forwarded-Port %[dst_port]
-        - add-header X-Forwarded-Proto https if { dst_port 443 }
-      redirect: 'scheme https if !{ ssl_fc }'
 
 profiles::haproxy::certlist::enabled: true
 profiles::haproxy::certlist::certificates:
-  - /etc/pki/tls/letsencrypt/au-syd1-pve.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/au-syd1-pve-api.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/sonarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/radarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/lidarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/readarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/prowlarr.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/vault/certificate.pem
 
 # additional altnames
 profiles::pki::vault::alt_names:
   - au-syd1-pve.main.unkin.net
   - au-syd1-pve-api.main.unkin.net
-  - jellyfin.main.unkin.net
 
 # additional cnames
 profiles::haproxy::dns::cnames:
   - au-syd1-pve.main.unkin.net
   - au-syd1-pve-api.main.unkin.net
-
-# letsencrypt certificates
-certbot::client::service: haproxy
-certbot::client::domains:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-  - fafflix.unkin.net

hieradata/country/au/region/syd1/infra/puppet/master.eyaml

@@ -1,4 +1,3 @@
 ---
 certmanager::vault_token: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJuE+uzgQaBRUXBCigckEo1j+UxxbiUGrzdf/B9K7XPdVxZh6TzYLpBgNnyaT6vLo0boX4uRD/By0gT5R/2qcXD6d/j+fh517Ctk4d2uO64f0vH3PzyyOBalsNtcCdPiV3q/xGqzQSHhPiNkFEjDvMBz5p53UjfKA6gAiPrLklp4rN/NVyiLBw20NeIqbL25VdkQa13ViS0Gm/eUQu7a2xQ1dvQFWWfuLaQxO0dh8L0ynkfmWKIjaiD5412Z8hYURu0otxbqVDdIbEMx5xQsXnFKeN93yHmgs7a7M6fLdp9jh+G8B+IlK1W7/9v2+RT0/yI3ZgWHVTvDRhMHuPGBjfTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC5avtOPp9N65U1ILQENnvAgDBqI8XAjqbWIvXHqOEiKYdu+co0EEtsHR1v5xAeCmj/ZA6MLeKFlAVJbvpyCpzjons=]
 certmanager::role_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJuE+uzgQaBRUXBCigckEo1j+UxxbiUGrzdf/B9K7XPdVxZh6TzYLpBgNnyaT6vLo0boX4uRD/By0gT5R/2qcXD6d/j+fh517Ctk4d2uO64f0vH3PzyyOBalsNtcCdPiV3q/xGqzQSHhPiNkFEjDvMBz5p53UjfKA6gAiPrLklp4rN/NVyiLBw20NeIqbL25VdkQa13ViS0Gm/eUQu7a2xQ1dvQFWWfuLaQxO0dh8L0ynkfmWKIjaiD5412Z8hYURu0otxbqVDdIbEMx5xQsXnFKeN93yHmgs7a7M6fLdp9jh+G8B+IlK1W7/9v2+RT0/yI3ZgWHVTvDRhMHuPGBjfTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC5avtOPp9N65U1ILQENnvAgDBqI8XAjqbWIvXHqOEiKYdu+co0EEtsHR1v5xAeCmj/ZA6MLeKFlAVJbvpyCpzjons=]
-sshsignhost::role_id: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAT86C/InXrgDtXCc9NFze91YMvjTNDqWgv4uzPFI48clOeQyD6x+vOHWP2yNp1OyNHcYLCiLyrv+rSIQyXlLnbeyZWV+7kXIon057Tp7l0BxWtd0hjQEcyWzqQQE7R264C8/qKRak81LIu6RshWZAchYo/BMPuOqVr0m+1zDwOV9JwZc3bpexzsl57CK5pesOrpfdvnd/xrOoEMR+P+C5PC6QLtQl3zkOD3N9kP6HqwbhWH5ZBPy88Kc+5kYM6QVpQSjFIIHK1SWsN0VZoxpkuFlFXB5KHDgZtg3kxrofzjQghl41zJBCDq9Z5oZ+2b1p/j/9jCASyp/ju68H5WXzbzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCf4Nqp6SAl/XjmhPDnTvVJgDCdDhxWaChhjJ3eRcW4NTFgf3zm7Bu65za0li26FKuKks00duF4zebfNw7ZUVsYtIU=]

hieradata/country/au/region/syd1/infra/sql/galera.eyaml

@@ -1,3 +0,0 @@
----
-mysql::db::grafana::pass: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAozi1vFf9KfwsGSdxXvhOWRn9Vqbr9AZ+cVJuIOmmLVZMRP4AJkkNgCCly+o1pxtMiU8EISUQuBWCBHUi+u2Y1YAjIABzTa2K+PCU7qqkdrJaxvKqmmKS7C/CWFKp1stYvYIvIofyvl9Q854nMcpvxQKL0PBGh3rIaUHHV3L0PH1UDLqL5j6OPXaNvKL4UzwMDDIVAd7F5yMbtSx2PT23pBLbPYsbG1jRx7pUS/d1ZE9E8h3OA2jxW/CBf68Sb2Xlrh7IAB/6RiLLpIsUyRMv9zrbPrMuKg/q5lzO0i9fejh5z3Z3YkdnhH61doUT/RSjAjz3JrWDGxomOSK0y8TxjjBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCg1kVqFs/mf4r+6EI32b8qgCBm6cL3JhVzj3Btit9D8VYU8mQcrIaXJZ3qF31zJMzCkw==]
-mysql::db::rundeck::pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAcWmZuTro0DNX8X/6DCJdmxm85hawng2cjSm/M26/sAzlr7i3XLIjg5TQc3BpeiKWZvQ2XZWygOEcW7g0bHH7FBS6XTXswDiLCf7ssd0DYL+eQbh4p6VijBKObug33fp4+YJaqGV7YRUNqBjXQv/SSmxFqbNaRahUqwbMidJCyjGNmfCfbSd9WxI4/8j0L38rjXR3/i+/xzgVIhgz/qymmw0rky6jN14YrwRIkdW6loMFzVd12tqdX9kh7UBdE7j58ntQgJSilQn2pLmQs6dgcXSOeIi8Sln4R0MfAtOQ1c6LoKMUdb7k8xEszpGbhX7sw51kpwvnL1LS6PQ+T8T9wDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDm1sAUc6LFtslrIuwk1JlJgDAngDM/0g4dpgyNOZDsvAU8OualEL6HZ2RFGfibteUc11wZzHkdFZlvHz2JZdO7Huo=]

hieradata/country/au/region/syd1/infra/sql/galera.yaml

@@ -2,23 +2,3 @@
 profiles::sql::galera_member::cluster_name: au-syd1
 profiles::sql::galera_member::galera_master: ausyd1nxvm1027.main.unkin.net
 profiles::sql::galera_member::innodb_buffer_pool_size: 256M
-
-mysql::db:
-  grafana:
-    name: grafana
-    user: grafana
-    password: "%{alias('mysql::db::grafana::pass')}"
-    grant:
-      - SELECT
-      - INSERT
-      - UPDATE
-      - DELETE
-  rundeck:
-    name: rundeck
-    user: rundeck
-    password: "%{alias('mysql::db::rundeck::pass')}"
-    grant:
-      - SELECT
-      - INSERT
-      - UPDATE
-      - DELETE

hieradata/nodes/ausyd1nxvm1000.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.10
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1001.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.11
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1002.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.12
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1003.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.13
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1004.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.14
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1005.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.15
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1006.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.16
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1007.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.17
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1008.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.18
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1009.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.19
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1010.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.20
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1011.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.21
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1012.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.22
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1013.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.23
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1014.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.24
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1015.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.25
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-
-profiles::haproxy::dns::vrrp_master: true
-keepalived::vrrp_instance:
-  VI_250:
-    state: 'MASTER'
-    priority: 101

hieradata/nodes/ausyd1nxvm1016.main.unkin.net.yaml

@@ -1,12 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.26
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-
-keepalived::vrrp_instance:
-  VI_250:
-    state: 'BACKUP'
-    priority: 100

hieradata/nodes/ausyd1nxvm1017.main.unkin.net.yaml

@@ -1,11 +1,2 @@
 ---
 profiles::cobbler::params::is_cobbler_master: true
-networking::interfaces:
-  ens18:
-    ipaddress: 198.18.13.27
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-    interface: ens18
-
-profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1018.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.28
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1019.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.29
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1020.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.30
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1021.main.unkin.net.yaml

@@ -1,10 +0,0 @@
----
-networking::interfaces:
-  ens18:
-    ipaddress: 198.18.13.31
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-    interface: ens18
-
-profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1022.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.32
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1023.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.33
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1024.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.34
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1025.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.35
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1026.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.36
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1027.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.37
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1028.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.38
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1029.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.39
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1030.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.40
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1031.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.41
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1032.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.42
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1033.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.43
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1034.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.44
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1035.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.45
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1036.main.unkin.net.yaml

@@ -5,17 +5,5 @@ profiles::puppet::server::dns_alt_names:
   - puppetca.query.consul
   - puppetca
 
-profiles::ssh::sign::principals:
-  - puppetca.main.unkin.net
-  - puppetca.service.consul
-  - puppetca.query.consul
-  - puppetca
-
 profiles::puppet::puppetca::is_puppetca: true
 profiles::puppet::puppetca::allow_subject_alt_names: true
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.46
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1037.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.47
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.47
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1038.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.48
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1039.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.49
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1040.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.50
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.50
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1041.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.51
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.51
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1042.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.52
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.52
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1043.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.53
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.53
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1044.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.54
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1045.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.55
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1046.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.56
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1047.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.57
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.57
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1048.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.58
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.58
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1049.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.59
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1050.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.60
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1051.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.61
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1052.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.62
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1053.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.63
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1054.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.64
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1055.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.65
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1056.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.66
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1057.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.67
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1058.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.68
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1059.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.69
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/prodinf01n01.main.unkin.net.yaml

@@ -7,6 +7,3 @@ profiles::puppet::server::dns_alt_names:
 
 profiles::puppet::puppetca::is_puppetca: false
 profiles::puppet::puppetca::allow_subject_alt_names: true
-
-hiera_exclude:
-  - networking

hieradata/os/AlmaLinux/all_releases.yaml

@@ -5,17 +5,10 @@ profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
 profiles::puppet::agent::puppet_version: '7.26.0'
 
-hiera_include:
+profiles::packages::install:
-  - profiles::almalinux::base
+  - lzo
-
+  - xz
-profiles::packages::include:
+  - policycoreutils
-  lzo: {}
-  firewalld:
-    ensure: absent
-  network-scripts: {}
-  policycoreutils: {}
-  unar: {}
-  xz: {}
 
 lm-sensors::package: lm_sensors
 
@@ -26,54 +19,44 @@ profiles::yum::global::repos:
     target: /etc/yum.repos.d/baseos.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/BaseOS/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
   extras:
     name: extras
     descr: extras repository
     target: /etc/yum.repos.d/extras.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/extras/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
   appstream:
     name: appstream
     descr: appstream repository
     target: /etc/yum.repos.d/appstream.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
   powertools:
     name: powertools
     descr: powertools repository
     target: /etc/yum.repos.d/powertools.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
   highavailability:
     name: highavailability
     descr: highavailability repository
     target: /etc/yum.repos.d/highavailability.repo
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/HighAvailability/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
   epel:
     name: epel
     descr: epel repository
     target: /etc/yum.repos.d/epel.repo
     baseurl: https://edgecache.query.consul/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
     gpgkey: http://edgecache.query.consul/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
-    mirrorlist: absent
   puppet:
     name: puppet
     descr: puppet repository
     target: /etc/yum.repos.d/puppet.repo
     baseurl: https://yum.puppet.com/puppet7/el/%{facts.os.release.major}/%{facts.os.architecture}
     gpgkey: https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406
-    mirrorlist: absent
   unkin:
     name: unkin
     descr: unkin repository
     target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
+    baseurl: https://repos.main.unkin.net/unkin/%{facts.os.release.major}/%{facts.os.architecture}/os
-    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent

hieradata/os/Debian/all_releases.yaml

@@ -1,15 +1,14 @@
 # hieradata/os/debian/all_releases.yaml
 ---
-profiles::apt::base::mirrorurl: http://edgecache.query.consul/debian/
+profiles::apt::base::mirrorurl: http://repos.main.unkin.net/debian
 profiles::apt::base::secureurl: http://security.debian.org/debian-security
 profiles::apt::puppet7::mirror: http://apt.puppetlabs.com
 profiles::apt::puppet7::repo: puppet7
 profiles::pki::vaultca::ca_cert-path: /usr/local/share/ca-certificates/
 
-profiles::packages::include:
+profiles::packages::install:
-  lzop: {}
+  - lzop
-  python3.11-venv: {}
+  - python3.11-venv
-  xz-utils: {}
+  - xz-utils
 
 lm-sensors::package: lm-sensors
-networking::nwmgr_dns_none: false

hieradata/roles/apps/media.eyaml

@@ -1,2 +0,0 @@
----
-ceph::key::media: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEBANgP2ifU7NbuMs+kWpeg1tchR5IMD7Z7kMpRBejgCMHludTYGf/BzxTe36YjpwLsuUd658QK5vE4EYpM1MuzqfuNiWJa5ec1IR/AgWQUMZcpjEDEqpHTb2qygmpc+jb3vW1EMBleZL2Z4GrgJ00gWO/EvukBSPgyxBsFe4Bb/L3aK6xiucG3JA9A7qA6cS4Oz5pf8dfC0FBjsc+XN7++bJN5pWUgMcEDgiyCy3bkL2gWfPKOWfabTRwuC3qd6SihZMg/tY8uoDfYoI8jHkjU07/mhC6AD930wgcFG+xJwNAX7FxLvLyJ8iN/648LVoZFuszYiTwPib1CszksdYBjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBSGXrbrl4FisZN5FT1hfmrgDBnV2SVfCJIYYyZ9+Vo1ykNmzUypJdJ+4llyXA7FOuH90xVZvLZMjNMhVCxP48CiYI=]

hieradata/roles/apps/media.yaml

@@ -1,101 +0,0 @@
----
-hiera_include:
-  - profiles::nginx::simpleproxy
-
-profiles::yum::global::repos:
-  ceph-reef:
-    name: ceph-reef
-    descr: ceph reef repository
-    target: /etc/yum.repos.d/ceph-reef.repo
-    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
-    gpgcheck: 0,
-    mirrorlist: absent
-
-profiles::ceph::client::keyrings:
-  media:
-    key: "%{hiera('ceph::key::media')}"
-
-profiles::base::groups::local:
-  media:
-    ensure: present
-    gid: 20000
-    allowdupe: false
-    forcelocal: true
-
-ldap_host: 'ldap.service.consul'
-ldap_basedn: 'dc=main,dc=unkin,dc=net'
-
-profiles::nginx::simpleproxy::locations:
-  # authentication proxy
-  authproxy:
-    ensure: 'present'
-    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
-    ssl_only: true
-    internal: true
-    location: '= /auth-proxy'
-    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:8888"
-    proxy_set_header:
-      - 'Content-Length ""'
-      - "X-Ldap-URL ldap://%{lookup('ldap_host')}"
-      - 'X-Ldap-Starttls "false"'
-      - "X-Ldap-BaseDN %{lookup('ldap_basedn')}"
-      - "X-Ldap-BindDN %{lookup('ldap_binddn')}"
-      - "X-Ldap-BindPass %{lookup('ldap_bindpass')}"
-      - 'X-CookieName "nginxauth"'
-      - 'Cookie nginxauth=$cookie_nginxauth'
-      - "X-Ldap-Template %{lookup('ldap_template')}"
-      - 'X-Ldap-Realm "Restricted"'
-    proxy_cache: 'cache'
-    proxy_cache_valid: '200 10m'
-    proxy_cache_key: '"$http_authorization$cookie_nginxauth"'
-    location_cfg_append:
-      proxy_pass_request_body: 'off'
-  # health checks by consul/haproxy
-  arrstack_web_healthcheck:
-    ensure: 'present'
-    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
-    ssl_only: true
-    location: '/consul/health'
-    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
-    proxy_set_header:
-      - 'Host $host'
-      - 'X-Forwarded-For $proxy_add_x_forwarded_for'
-      - 'X-Forwarded-Host $host'
-      - 'X-Forwarded-Proto $scheme'
-      - 'Upgrade $http_upgrade'
-      - 'Connection $http_connection'
-    proxy_redirect: 'off'
-    proxy_http_version: '1.1'
-    location_allow:
-      - 127.0.0.1
-      - "%{facts.networking.ip}"
-      - 198.18.13.25
-      - 198.18.13.26
-    location_deny:
-      - all
-  # authorised access from external
-  arrstack_web_external:
-    ensure: 'present'
-    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
-    ssl_only: true
-    location: '/'
-    auth_request: '/auth-proxy'
-    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
-    proxy_set_header:
-      - 'Host $host'
-      - 'X-Forwarded-For $proxy_add_x_forwarded_for'
-      - 'X-Forwarded-Host $host'
-      - 'X-Forwarded-Proto $scheme'
-      - 'Upgrade $http_upgrade'
-      - 'Connection $http_connection'
-    proxy_redirect: 'off'
-    proxy_http_version: '1.1'
-  # location for api, which should be accessible without authentication
-  arrstack_api:
-    ensure: 'present'
-    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
-    ssl_only: true
-    location: '~ /api'
-    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
-    location_cfg_append:
-      client_max_body_size: '20m'

hieradata/roles/apps/media/jellyfin.yaml

@@ -1,63 +0,0 @@
----
-hiera_include:
-  - jellyfin
-
-# manage jellyfin
-jellyfin::params::service_enable: true
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - jellyfin.main.unkin.net
-  - jellyfin.service.consul
-  - jellyfin.query.consul
-  - "jellyfin.service.%{facts.country}-%{facts.region}.consul"
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'jellyfin.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - jellyfin.main.unkin.net
-  - jellyfin.service.consul
-  - jellyfin.query.consul
-  - "jellyfin.service.%{facts.country}-%{facts.region}.consul"
-profiles::nginx::simpleproxy::proxy_port: 8096
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_path: '/'
-
-# configure consul service
-nginx::client_max_body_size: 10M
-consul::services:
-  jellyfin:
-    service_name: 'jellyfin'
-    tags:
-      - 'media'
-      - 'jellyfin'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'jellyfin_http_check'
-        name: 'jellyfin HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: jellyfin
-    disposition: write
-
-profiles::yum::global::repos:
-  rpmfusion-free:
-    name: rpmfusion-free
-    descr: rpmfusion-free repository
-    target: /etc/yum.repos.d/rpmfusion.repo
-    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
-    mirrorlist: absent
-  rpmfusion-nonfree:
-    name: rpmfusion-nonfree
-    descr: rpmfusion-nonfree repository
-    target: /etc/yum.repos.d/rpmfusion.repo
-    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
-    mirrorlist: absent

hieradata/roles/apps/media/lidarr.eyaml

@@ -1,3 +0,0 @@
----
-lidarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAeIT5i5yJ/KCmEBEgF8r36dl2RK/0/LQWPl6bgth7KOdtfNynhH4bCxembrJwzXasT1KBrPWYmTc2IObBz2tqu7BIHoioI2y+GVs2ulhx63lrfeDI/I4QFs5EOh9fIoyOxlIkvKm+p0WVfaegKOKM63XHHvG2TmBwTypEHB1IXaCMVl87tY+3xmMEaiqVPik3llqLCog1rmRLbIQx+whAFPtlhHur0ozfdYLKiM57YHAsQpGgASYkAAjvZuKabOrRZsIhhsHCb4JQ/evvIrhkviK7nP4xHdeqRSJgdEDmIldr2FW3uHCzuq033K3T7HNc3HbUM/5lC0ygP8sZnnM8rDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAyfQkaBPJJWVsc2FGiyCyMgDAYuYDAwBBAJzfVZ4RFrQyi48VZeS8MTjf2HNAXBYoYgTtdZAk9i+pIV22p9ee+KsU=]
-ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEDEyk6fBBnrjZvfK8MnUVOTWxhFGtgY34/2CuIq55MoVLsk2ZgVrL7Kt+94bqFhwEB67kuNpMGXqTgW5ose2yWs5iVSJLECsf9C+tvGBGwaV35LNwP5S3aQmFagyTpZZz9QlGKC7818jlXz7vZWDtiUhy5TGMHeyS0fdjCveavtZR28A+ZrvWjJeLdN47mmvYwYfFnQBs3kSgkl5KyMVhFWSFOSLeHsuEzCVXHoQ1jQG+2TV5m18wV0RR/sOju2E+vsulqlDgCyifgoiry4GzJeKNrNDI2bifzHCAi6yZqHL/klyqbGTnKLlA4xKoXsHF+xEwcoq4S9JDLAdWeH1SDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCdvh4yn8knozcYhinybRq3gDAwTKv8VakQG7XK/mcEplwtoiKqLnj9IIGdIUh1zPi2Sg48ET5rfZyl0p7ddIYoHjU=]

hieradata/roles/apps/media/lidarr.yaml

@@ -1,56 +0,0 @@
----
-hiera_include:
-  - lidarr
-  - profiles::nginx::ldapauth
-
-# manage lidarr
-lidarr::params::user: lidarr
-lidarr::params::group: media
-lidarr::params::manage_group: false
-lidarr::params::archive_version: 2.3.3
-lidarr::params::port: 8000
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - lidarr.main.unkin.net
-  - lidarr.service.consul
-  - lidarr.query.consul
-  - "lidarr.service.%{facts.country}-%{facts.region}.consul"
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'lidarr.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - lidarr.main.unkin.net
-  - lidarr.service.consul
-  - lidarr.query.consul
-  - "lidarr.service.%{facts.country}-%{facts.region}.consul"
-profiles::nginx::simpleproxy::proxy_port: 8000
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-ldap_binddn: 'cn=svc_lidarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
-ldap_template: '(&(uid=%(username)s)(memberOf=ou=lidarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
-
-# configure consul service
-consul::services:
-  lidarr:
-    service_name: 'lidarr'
-    tags:
-      - 'media'
-      - 'lidarr'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'lidarr_http_check'
-        name: 'Lidarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443/consul/health"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: lidarr
-    disposition: write

hieradata/roles/apps/media/nzbget.eyaml

@@ -1,2 +0,0 @@
----
-ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAPomn4iZbT0JEysvDo7OgblpoQLFp9DzryY558UfVWQq6HDAkgoSC42cbgZGBPFclCgLaO/LfBrFpRXkafEVV33Vg2AmP/FiS9SmmwREc3t/ZTvENlDIgasY3pDIph0/i5u0S45mjyzzciBK0KY6cMZvPDVRvU+d0SyVnbSBlef6VmyZOhUk6ILpaYTGu+suVR/BAL/DTKsmmY7iTotTWN+IW/1cY3vprvBMJQVftaO1WSqKftmX29/PAsxbQo6AMpuQFx/dMcMe3d5JTB0mgzIhAFaKmSC8vJFqe21Nrr8F+PxJMSEl1saBJTwJc5RyPVm9ejVKfcPhDfWK5stNNvjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAo205Hvo/Z+rhnSGgkTS2YgDB7pTHdgnQz1UOK323DRljWcqx+SnCA7izyF1SNMlzlCck79Fr4zKh0qnbYsMZDWZU=]

hieradata/roles/apps/media/nzbget.yaml

@@ -1,77 +0,0 @@
----
-
-hiera_include:
-  - nzbget
-  - profiles::media::nzbget
-  - profiles::nginx::ldapauth
-
-# manage nzbget
-nzbget::params::user: nzbget
-nzbget::params::group: media
-nzbget::params::manage_group: false
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - nzbget.main.unkin.net
-  - nzbget.service.consul
-  - nzbget.query.consul
-  - "nzbget.service.%{facts.country}-%{facts.region}.consul"
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'nzbget.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - nzbget.main.unkin.net
-  - nzbget.service.consul
-  - nzbget.query.consul
-  - "nzbget.service.%{facts.country}-%{facts.region}.consul"
-profiles::nginx::simpleproxy::proxy_port: 6789
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-ldap_binddn: 'cn=svc_nzbget,ou=services,ou=users,dc=main,dc=unkin,dc=net'
-ldap_template: '(&(uid=%(username)s)(memberOf=ou=nzbget_access,ou=groups,dc=main,dc=unkin,dc=net))'
-
-profiles::nginx::simpleproxy::locations:
-  arrstack_web_healthcheck:
-    location_cfg_append:
-      rewrite: '/consul/health / break'
-
-# configure consul service
-consul::services:
-  nzbget:
-    service_name: 'nzbget'
-    tags:
-      - 'media'
-      - 'nzbget'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'nzbget_http_check'
-        name: 'nzbget HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443/consul/health"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: nzbget
-    disposition: write
-
-profiles::yum::global::repos:
-  rpmfusion-free:
-    name: rpmfusion-free
-    descr: rpmfusion-free repository
-    target: /etc/yum.repos.d/rpmfusion.repo
-    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
-    mirrorlist: absent
-  rpmfusion-nonfree:
-    name: rpmfusion-nonfree
-    descr: rpmfusion-nonfree repository
-    target: /etc/yum.repos.d/rpmfusion.repo
-    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
-    mirrorlist: absent

hieradata/roles/apps/media/prowlarr.eyaml

@@ -1,3 +0,0 @@
----
-prowlarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAdAzvi5Z2cX7KWdMlMfR5N+Jz9Pmh3k9yvPgM1JnTM8ZODs5VyQf/d3goWJ5Fn+jcjVqQ+aBga2CHfbdjgg5dGC19Jr8CmxVkYpMVb+e6Md4LEglUD6g70LK8JHB1FAM0fqW82/zqBL73KFKcu71Hpbf9YylJD4LXCr/k4D7hPX3tgEOzFn1iGl/DqxJFWnorj0btk3/2AmA3AMjvFy4r39PwbMfr2jNFSmAdJa7j7W+ESyE08Cc795VORIa/lbrT0ZfBMGXqzNTIpcdJ7uabcrH0qHNM8FPh4eHBzGMqLvIba487bs2TUb8eIivwT2EAwmGDWX1QkG2o6lGyO8PyqzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBO8BQpHvHYOA2tjyxpjGw4gDATwt1wP0aPFPnbRoqPdwClfOzbWmtbT/rCBmCQH0HkyA8sqr2I2qlOsuJukCjBDHo=]
-ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAhduPAqoZuq/xeRs4f/KX4r88evPMogQX79yofLAB5Qqdr48s2X0BAa1iiw0vMdL6Tf0uc794WJN5MP2Yp365Vk1yhwgqH92rt5hKPI+wBN5uak2iLgLzLWsp0HOx7d1ukDWBbj0lI6G5LiofsL3KJbbTnkovn06L4PRJXgn44+ynfywiCl2tPy2294DhfooeM6/Cy+t9lA6blzHLCOHtt/rBKmk1GT2y3YBCPhRfOumWXQWnv4Q+f6KkQkvpfPyAFYNiQxQYBv5bGwLnwiDk3xQnPM4FfcutVuAOKjsoeMa+K1KShDFyEfBxIER8JSpigj2/khstyihcVW0Xrod3uDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCRqqRwMThwn1F/6byFhTWxgDAfucfkFhmqxBv/u5H+wWnjvK5EH7eU/fECrajYPBW/cmsYjLgXlwrAzFGqWze3AZc=]

hieradata/roles/apps/media/prowlarr.yaml

@@ -1,65 +0,0 @@
----
-hiera_include:
-  - prowlarr
-  - profiles::nginx::ldapauth
-
-# manage prowlarr
-prowlarr::params::user: prowlarr
-prowlarr::params::group: media
-prowlarr::params::manage_group: false
-prowlarr::params::archive_version: 1.19.0
-prowlarr::params::port: 8000
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - prowlarr.main.unkin.net
-  - prowlarr.service.consul
-  - prowlarr.query.consul
-  - "prowlarr.service.%{facts.country}-%{facts.region}.consul"
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'prowlarr.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - prowlarr.main.unkin.net
-  - prowlarr.service.consul
-  - prowlarr.query.consul
-  - "prowlarr.service.%{facts.country}-%{facts.region}.consul"
-profiles::nginx::simpleproxy::proxy_port: 8000
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-ldap_binddn: 'cn=svc_prowlarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
-ldap_template: '(&(uid=%(username)s)(memberOf=ou=prowlarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
-
-# configure consul service
-consul::services:
-  prowlarr:
-    service_name: 'prowlarr'
-    tags:
-      - 'media'
-      - 'prowlarr'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'prowlarr_http_check'
-        name: 'Prowlarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443/consul/health"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: prowlarr
-    disposition: write
-
-profiles::nginx::simpleproxy::locations:
-  arrstack_web_external:
-    location_satisfy: any
-    location_allow:
-      - 198.18.13.47
-      - 198.18.13.50
-      - 198.18.13.51
-      - 198.18.13.52

hieradata/roles/apps/media/radarr.eyaml

@@ -1,3 +0,0 @@
----
-radarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEALtNnNr2N7DpP9zx5anmQavFmsTLIyPkpJGCkJpUTHMYFSScS/3FOUuufajk4Cmu4FbPswp/N/U1nHO8oLF6xNQ+H77+xXuKPalW/3R1IRqGoczwsAfstJ6nYF+PLjjeK2TDP+KMs3Eg2+nrXB7NOVOP88RvDLyZq93Wn9qR+1VG6Y2gLqGSJArZpNilV5ygUYRgbMeckjqfLynYBXtgDQQLYNhxDO6WGRRv+0X773nmOdrWFAUjqF6/K+Ejjk5ZbaqnGyjljMstSrhg7NWxtMRbCjeMpjUjUS4Hn/Vayg2M2Ag2s87gsE1e4QFa6KP7GVRu3swvyZ3D54Ba/xrebxzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDD6gIEfNGPXA8zv/vysgxJgDADMi7Fx5q+aqTMeqcKLg1AukTlCnJ62zykm6RNGdS0KlpJsvTSmWF4So3v/9BsKdk=]
-ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAf6LbAXy3EsJqkf4KO8xikpXfSVIVOD2obnwZLPEiCfbC0iJyZ2Uc/RbHM9NnIpg8dgEnYGgaBM9HC+kFKYFP4skLsPQ0mpqOv13WbOAHOphhyBxWc/n4Eg4HqMAiHsC4qA9Sj5j4F29tNiMmpNM0eqDXD6YIrajV5IF+SKQQzZrNSrcDrzjqENaMnJWVc2gj7Zb9kPB1LdM5ZfljpPtfQHXHhh9ShTDKuWMx46nc+UYaRcJqHEns7OExwpsEAtA1SSunD81PTijJ6Bn1Y6cAsZoBot5YgFGaWtgQ4jvEqj7EbG8gDJuHMSwa9RzA9SMsVwEh2g1pko7wYbBR/arV7jBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAhZlVaEdaLNh60gAY0KwEKgDAHPoXfFRq0I2K2J+NFgNFm/A00jYGVRfuPsX6VZfPaJ499dtMiJifrK3Kfk1oXpvk=]

hieradata/roles/apps/media/radarr.yaml

@@ -1,57 +0,0 @@
----
-hiera_include:
-  - radarr
-  - profiles::nginx::ldapauth
-
-# manage radarr
-radarr::params::user: radarr
-radarr::params::group: media
-radarr::params::manage_group: false
-radarr::params::archive_version: 5.7.0
-radarr::params::port: 8000
-
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - radarr.main.unkin.net
-  - radarr.service.consul
-  - radarr.query.consul
-  - "radarr.service.%{facts.country}-%{facts.region}.consul"
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'radarr.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - radarr.main.unkin.net
-  - radarr.service.consul
-  - radarr.query.consul
-  - "radarr.service.%{facts.country}-%{facts.region}.consul"
-profiles::nginx::simpleproxy::proxy_port: 8000
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-ldap_binddn: 'cn=svc_radarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
-ldap_template: '(&(uid=%(username)s)(memberOf=ou=radarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
-
-# configure consul service
-consul::services:
-  radarr:
-    service_name: 'radarr'
-    tags:
-      - 'media'
-      - 'radarr'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'radarr_http_check'
-        name: 'radarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443/consul/health"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: radarr
-    disposition: write

hieradata/roles/apps/media/readarr.eyaml

@@ -1,3 +0,0 @@
----
-readarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAlJ5RLp6pVTGQgtbzO5cQSrHBMg80S1ImFprHDeWC3GPN2KbheM80b1FKxvN+oVUJ8/kfiV6zstLOoYPUJQfmJNa/Xe95W/5+9hH2IS/oQ0yVdfLOjRq//qp+mVvSJ7JrtOyYSIrU3HjxaD+eXTPYp4UEJKfdSmGyDr7XuCOVIZe0Lu7OHczs8VKrowN99RJZ589HoMqrqCZWPlx14l/uNFjYdK/w6VcUWoo9y/5z1jtsNIObV8kSAYQQLwSr3tmjJdEE3au4sjeMOOJDpGcd5aJRWpKp12+8oHdVR5BV5326aCb13tkp6Td0jq/W9J2Jyv05vUdpP3PnVH9mHPDh6TBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDA+2mMNGwfYM+mRoVTQiZMgDBanhVFmpYe42vZgMBKpNcNRjTnoCl27RpxD3KnjYwkE1zw/NeEOLoSZ1Try3GrlaA=]
-ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAcOegaqGEsivQAlhSYvaiVUij4QJ/kterSg+wX/7P/oWjSN1oSNAFfco6lg5fYUsR7HDKZ4IwYuO1Q/q8hOxYkqzYrH/MIAhZatfQxyxriKuekxqOMuXgwrWCzAexQL0Fb4s5gcHQ4fwy5OxsM1CxFXnSSm1eYNXl5IERd//c0dFoIcshiGlOCFsj8Ne9mookFTJQDZrxM4VMXaVb+Fl9mOyy1ppDBKHTP/1ise/6LIUi+9YngamAWLIrsur5KvR45kvRoxDNLfJZasAqhD/5QLceDdSxqKBDur57QzmoPo2lFdT4WlzphKOdyHZtYOYr7BPdbtCqkXTWdkXvqFlRxjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCXhYe6zoRW7/OxVrZnAEoTgDDPFTz5S4nZWiwzjdT7Yd88Ii6I/v6ckaKTx0gd0pZKsVZkFYQBBhIfqFS2ho0UG3Y=]

hieradata/roles/apps/media/readarr.yaml

@@ -1,56 +0,0 @@
----
-hiera_include:
-  - readarr
-  - profiles::nginx::ldapauth
-
-# manage readarr
-readarr::params::user: readarr
-readarr::params::group: media
-readarr::params::manage_group: false
-readarr::params::archive_version: 0.3.28
-readarr::params::port: 8000
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - readarr.main.unkin.net
-  - readarr.service.consul
-  - readarr.query.consul
-  - "readarr.service.%{facts.country}-%{facts.region}.consul"
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'readarr.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - readarr.main.unkin.net
-  - readarr.service.consul
-  - readarr.query.consul
-  - "readarr.service.%{facts.country}-%{facts.region}.consul"
-profiles::nginx::simpleproxy::proxy_port: 8000
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-ldap_binddn: 'cn=svc_readarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
-ldap_template: '(&(uid=%(username)s)(memberOf=ou=readarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
-
-# configure consul service
-consul::services:
-  readarr:
-    service_name: 'readarr'
-    tags:
-      - 'media'
-      - 'readarr'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'readarr_http_check'
-        name: 'Readarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443/consul/health"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: readarr
-    disposition: write

hieradata/roles/apps/media/sonarr.eyaml

@@ -1,2 +0,0 @@
-sonarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEANhwc0Vk0htkacwqGA/ZEVR7hpC1V2+nyP3lxyqkVNWERdcIsoMjlfwp2QNoLVirALY10Kon1wKXiRLT+QOqF9aTapS2Vb2YH3ZujR5yT6T1z4e0o4EA3IlNJZemVIziIqrK8+8zZzVafYdOYwMwpbc5EzoJPBtdqNHbDaQu4bRTCp2yMISTOzFjZpOoEJlRyC8YrffNU2xzA5mh5Cw+00MdIfPd8enrCnA4b1ddqP/IsfEYRt91ANQBULwKC5wenKdJAN5qKSKW6KU9TUM5YvGvUPgTvcYgXNf3/INL6G3/HwISTE5A7S6lqwYLyRTT1fMHtgDIqS936DPqCdAZtzjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBZ4e3jAM0zvV43IrCzQOGIgDBwOWgm+wJG+jAU8r1awWDvzQXgF3h65nAKfoOuGEztsjeBEruU4EmZy6llLbfSSb8=]
-ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAF5/sP43SJX/FB6cAS0GPqxC78JS7jSNKoUqWB/IXkv8uXYiClqk+Xw4nFx8EtknNn628DHBY3vCLQ59Xk89p0fyimP70m3BM6or5iRGdCqEAOzL399GbYX8WFHjyQRBmGdaLR5h2r5UnmjuPpDtV+fgsqxo4gNpXnuQ+46ZZPQce/dzHzux+4aEK4Q6UbD/ZZSQklD6zEUV+Agj6E9cQlJPBiHtTyUdXOYHYlJN1HhFPXu3C6KIz63YioVCah1n6T/rJtPQ07pVUfizIaJiPpzcUN91+ZWyyjUPo0bRGZtYKVs/uCAYXht4F5ttKQDaGa3wd4a5IdtacmEWQWFqk3TBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDtB/68xkjxK3nrNh0MilACgDDt85aBvSp/Oj9EY67eNPr+JcnQ7WfyuqAYAnmYqfbQI8MDtYAx7br0+inJXvQ1BvI=]

hieradata/roles/apps/media/sonarr.yaml

@@ -1,56 +0,0 @@
----
-hiera_include:
-  - sonarr
-  - profiles::nginx::ldapauth
-
-# manage sonarr
-sonarr::params::user: sonarr
-sonarr::params::group: media
-sonarr::params::manage_group: false
-sonarr::params::archive_version: 4.0.5
-sonarr::params::port: 8000
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - sonarr.main.unkin.net
-  - sonarr.service.consul
-  - sonarr.query.consul
-  - "sonarr.service.%{facts.country}-%{facts.region}.consul"
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'sonarr.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - sonarr.main.unkin.net
-  - sonarr.service.consul
-  - sonarr.query.consul
-  - "sonarr.service.%{facts.country}-%{facts.region}.consul"
-profiles::nginx::simpleproxy::proxy_port: 8000
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-ldap_binddn: 'cn=svc_sonarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
-ldap_template: '(&(uid=%(username)s)(memberOf=ou=sonarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
-
-# configure consul service
-consul::services:
-  sonarr:
-    service_name: 'sonarr'
-    tags:
-      - 'media'
-      - 'sonarr'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'sonarr_http_check'
-        name: 'Sonarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443/consul/health"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: sonarr
-    disposition: write

hieradata/roles/infra.yaml

@@ -1,6 +1,5 @@
 ---
-profiles::packages::include:
+profiles::packages::install:
-  policycoreutils: {}
+  - policycoreutils
 
 puppetdb::master::config::create_puppet_service_resource: false
-#puppetdb::master::config::puppetdb_host: "%{lookup('profiles::puppet::puppetdb::puppetdb_host')}"

hieradata/roles/infra/auth/glauth.yaml

@@ -1,296 +0,0 @@
----
-hiera_include:
-  - glauth
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - ldap.main.unkin.net
-  - ldap.service.consul
-  - ldap.query.consul
-  - "ldap.service.%{facts.country}-%{facts.region}.consul"
-
-glauth::params::download_version: 2.3.2
-glauth::params::ldap_enabled: true
-glauth::params::ldaps_enabled: true
-glauth::params::basedn: 'dc=main,dc=unkin,dc=net'
-glauth::params::behaviors_ignorecapabilities: true
-glauth::params::ldap_tlscertpath: /etc/pki/tls/vault/certificate.crt
-glauth::params::ldap_tlskeypath: /etc/pki/tls/vault/private.key
-glauth::params::ldaps_cert: /etc/pki/tls/vault/certificate.crt
-glauth::params::ldaps_key: /etc/pki/tls/vault/private.key
-glauth::params::api_cert: /etc/pki/tls/vault/certificate.crt
-glauth::params::api_key: /etc/pki/tls/vault/private.key
-
-# configure consul service
-consul::services:
-  ldap:
-    service_name: 'ldap'
-    tags:
-      - 'media'
-      - 'ldap'
-    address: "%{facts.networking.ip}"
-    port: 636
-    checks:
-      - id: 'glauth_http_check'
-        name: 'glauth HTTP Check'
-        http: "https://%{facts.networking.fqdn}:5555"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: ldap
-    disposition: write
-
-glauth::users:
-  benvin:
-    user_name: 'benvin'
-    givenname: 'Ben'
-    sn: 'Vincent'
-    mail: 'benvin@users.main.unkin.net'
-    uidnumber: 20000
-    primarygroup: 20000
-    othergroups:
-      - 20010
-      - 20011
-      - 20012
-      - 20013
-      - 20014
-      - 20015
-      - 20016
-      - 20017
-      - 20018
-      - 20023
-      - 20024
-    loginshell: '/bin/bash'
-    homedir: '/home/benvin'
-    passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
-    sshkeys:
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ8SRLlPiDylBpdWR9LpvPg4fDVD+DZst4yRPFwMMhta4mnB1H9XuvZkptDhXywWQ7QIcqa2WbhCen0OQJCtwn3s7EYtacmF5MxmwBYocPoK2AArGuh6NA9rwTdLrPdzhZ+gwe88PAzRLNzjm0ZBR+mA9saMbPJdqpKp0AWeAM8QofRQAWuCzQg9i0Pn1KDMvVDRHCZof4pVlHSTyHNektq4ifovn0zhKC8jD/cYu95mc5ftBbORexpGiQWwQ3HZw1IBe0ZETB1qPIPwsoJpt3suvMrL6T2//fcIIUE3TcyJKb/yhztja4TZs5jT8370G/vhlT70He0YPxqHub8ZfBv0khlkY93VBWYpNGJwM1fVqlw7XbfBNdOuJivJac8eW317ZdiDnKkBTxapThpPG3et9ib1HoPGKRsd/fICzNz16h2R3tddSdihTFL+bmTCa6Lo+5t5uRuFjQvhSLSgO2/gRAprc3scYOB4pY/lxOFfq3pU2VvSJtRgLNEYMUYKk= ben@unkin.net'
-  matsol:
-    user_name: 'matsol'
-    givenname: 'Matt'
-    sn: 'Solomon'
-    mail: 'matsol@users.main.unkin.net'
-    uidnumber: 20001
-    primarygroup: 20000
-    othergroups:
-      - 20010
-      - 20011
-      - 20012
-      - 20013
-      - 20014
-      - 20015
-      - 20016
-    loginshell: '/bin/bash'
-    homedir: '/home/matsol'
-    passsha256: '369263e2455a57c8c21388860c417b640fcf045a303cfc88def18c5197493600'
-  seablo:
-    user_name: 'seablo'
-    givenname: 'Sean'
-    sn: 'Bloomfield'
-    mail: 'seablo@users.main.unkin.net'
-    uidnumber: 20002
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/seablo'
-    passsha256: '2db12484b2b5fdae7f3a1f9f870143c363af14bf2c31a415a9a7afcb02520df2'
-  marbal:
-    user_name: 'marbal'
-    givenname: 'Mark'
-    sn: 'Balch'
-    mail: 'marbal@users.main.unkin.net'
-    uidnumber: 20003
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/marbal'
-    passsha256: 'cc20cee6269b9970a76549c66b51d0c543352796180d4122260a47f0f7a442a9'
-  kelren:
-    user_name: 'kelren'
-    givenname: 'Kelly'
-    sn: 'Rennie'
-    mail: 'kelren@users.main.unkin.net'
-    uidnumber: 20004
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/kelren'
-    passsha256: '5b01659bca1ecb27847d2f746fab03eb169879ebcc86547024753dac7cb184c4'
-  ryadun:
-    user_name: 'ryadun'
-    givenname: 'Ryan'
-    sn: 'Dunbar'
-    mail: 'ryadun@users.main.unkin.net'
-    uidnumber: 20005
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/ryadun'
-    passsha256: 'ee17174d49545f6f7257ae79eb173de4acf2b2edf55e181de90decd0e4b4e617'
-  margol:
-    user_name: 'margol'
-    givenname: 'Maree'
-    sn: 'Goldsworthy'
-    mail: 'margol@users.main.unkin.net'
-    uidnumber: 20006
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/margol'
-    passsha256: '31a66085fb7eaeb059e51d1376233db72b54f96a6c45947aafbb350c83e618ef'
-
-glauth::services:
-  svc_jellyfin:
-    service_name: 'svc_jellyfin'
-    mail: 'jellyfin@service.main.unkin.net'
-    uidnumber: 30000
-    primarygroup: 20001
-    passsha256: '97f7b1eb24deb0a86e812d79c56f4901d39a24128dc9f6fde033e7195f7d0739'
-  svc_sonarr:
-    service_name: 'svc_sonarr'
-    mail: 'sonarr@service.main.unkin.net'
-    uidnumber: 30001
-    primarygroup: 20001
-    passsha256: '2c32d4cb831183cfbef15835cc76f99b401d0159621bc580e852253d4d8f8722'
-  svc_radarr:
-    service_name: 'svc_radarr'
-    mail: 'radarr@service.main.unkin.net'
-    uidnumber: 30002
-    primarygroup: 20001
-    passsha256: '805b0182d90c2b5b3ba43e50988447a0bff0115eb5fedd8eeae8eac00ba53025'
-  svc_lidarr:
-    service_name: 'svc_lidarr'
-    mail: 'lidarr@service.main.unkin.net'
-    uidnumber: 30003
-    primarygroup: 20001
-    passsha256: '6d04cd2a45784bacbd50e6714710b55805c7e9886665a6d7790e6d8712b67aff'
-  svc_readarr:
-    service_name: 'svc_readarr'
-    mail: 'readarr@service.main.unkin.net'
-    uidnumber: 30004
-    primarygroup: 20001
-    passsha256: '751f22fbd9c052b2cd0c1cb4be514d8710f1a51f84ce44f607ab3a5591162f8c'
-  svc_prowlarr:
-    service_name: 'svc_prowlarr'
-    mail: 'prowlarr@service.main.unkin.net'
-    uidnumber: 30005
-    primarygroup: 20001
-    passsha256: 'd1e6bcc4a9f2d15b6e3c349155a88e433902dfe765e57bf3c10e6830f151a043'
-  svc_nzbget:
-    service_name: 'svc_nzbget'
-    mail: 'nzbget@service.main.unkin.net'
-    uidnumber: 30006
-    primarygroup: 20001
-    passsha256: 'c9d38f687fcbea754a9f78675d89276d2347f9d15190fff267c3ae1a75f61be6'
-  svc_nzbsubmit:
-    service_name: 'svc_nzbsubmit'
-    mail: 'nzbsubmit@service.main.unkin.net'
-    uidnumber: 30007
-    primarygroup: 20001
-    othergroups:
-      - 20016
-    passsha256: '7af7e12fdc56e9050d16c167f4e34091ad3cf938283e13451b35f9b3d212bfa2'
-  svc_rundeck:
-    service_name: 'svc_rundeck'
-    mail: 'rundeck@service.main.unkin.net'
-    uidnumber: 30007
-    primarygroup: 20001
-    passsha256: 'b27786b22c5938d24ffc9be049de366b055c9f054bf38fb73bbd6fba9e1bd525'
-  svc_terraform:
-    service_name: 'svc_terraform'
-    mail: 'terraform@service.main.unkin.net'
-    uidnumber: 30008
-    primarygroup: 20001
-    passsha256: 'b27786b22c5938d24ffc9be049de366b055c9f054bf38fb73bbd6fba9e1bd525'
-  svc_vault:
-    service_name: 'svc_vault'
-    mail: 'vault@service.main.unkin.net'
-    uidnumber: 30009
-    primarygroup: 20001
-    passsha256: 'd63b04884d5c7d630b0c06896046065a0926ac5c3d6177ef85320e5fa1be00b9'
-
-glauth::groups:
-  users:
-    group_name: 'people'
-    gidnumber: 20000
-  services:
-    group_name: 'services'
-    gidnumber: 20001
-  jellyfin_access:
-    group_name: 'jellyfin_access'
-    gidnumber: 20010
-  sonarr_access:
-    group_name: 'sonarr_access'
-    gidnumber: 20011
-  radarr_access:
-    group_name: 'radarr_access'
-    gidnumber: 20012
-  lidarr_access:
-    group_name: 'lidarr_access'
-    gidnumber: 20013
-  readarr_access:
-    group_name: 'readarr_access'
-    gidnumber: 20014
-  prowlarr_access:
-    group_name: 'prowlarr_access'
-    gidnumber: 20015
-  nzbget_access:
-    group_name: 'nzbget_access'
-    gidnumber: 20016
-  rundeck_access:
-    group_name: 'rundeck_access'
-    gidnumber: 20017
-  rundeck_globaladmin:
-    group_name: 'rundeck_globaladmin'
-    gidnumber: 20018
-  rundeck_selfservice_admin:
-    group_name: 'rundeck_selfservice_admin'
-    gidnumber: 20019
-  rundeck_selfservice_user:
-    group_name: 'rundeck_selfservice_user'
-    gidnumber: 20020
-  rundeck_infrastructure_admin:
-    group_name: 'rundeck_infrastructure_admin'
-    gidnumber: 20021
-  rundeck_infrastructure_user:
-    group_name: 'rundeck_infrastructure_user'
-    gidnumber: 20022
-  vault_access:
-    group_name: 'vault_access'
-    gidnumber: 20023
-  vault_admin:
-    group_name: 'vault_admin'
-    gidnumber: 20024

hieradata/roles/infra/automation/rundeck.yaml

@@ -1,205 +0,0 @@
----
-hiera_include:
-  - profiles::rundeck::server
-  - profiles::nginx::simpleproxy
-
-hiera_exclude:
-  - profiles::accounts::rundeck
-
-profiles::packages::exclude:
-  - jq
-
-profiles::ssh::sign::principals:
-  - rundeck.main.unkin.net
-  - rundeck.service.consul
-  - rundeck.query.consul
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'rundeck.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - rundeck.main.unkin.net
-  - rundeck.service.consul
-  - rundeck.query.consul
-  - "rundeck.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::nginx::simpleproxy::proxy_port: 4440
-profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 20M
-# additional altnames
-profiles::pki::vault::alt_names:
-  - rundeck.main.unkin.net
-  - rundeck.service.consul
-  - rundeck.query.consul
-  - "rundeck.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  rundeck:
-    service_name: 'rundeck'
-    tags:
-      - 'automation'
-      - 'rundeck'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'glauth_http_check'
-        name: 'glauth HTTP Check'
-        http: "http://%{facts.networking.fqdn}:4440"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: rundeck
-    disposition: write
-
-profiles::rundeck::server::mysql_backend: true
-profiles::rundeck::server::mysql_host: mariadb-prod.service.au-syd1.consul
-profiles::rundeck::server::grails_server_url: https://rundeck.service.consul
-profiles::rundeck::server::auth_config:
-  file:
-    auth_flag: 'sufficient'
-    jaas_config:
-      file: '/etc/rundeck/realm.properties'
-    realm_config:
-      admin_user: 'admin'
-      admin_password: "%{hiera('rundeck_admin_pass')}"
-  ldap:
-    jaas_config:
-      debug: 'true'
-      providerUrl: 'ldap://ldap.service.consul:389'
-      bindDn: 'cn=svc_rundeck,ou=services,ou=users,dc=main,dc=unkin,dc=net'
-      bindPassword: "%{hiera('ldap_bindpass')}"
-      authenticationMethod: 'simple'
-      forceBindingLogin: 'true'
-      userBaseDn: 'ou=people,ou=users,dc=main,dc=unkin,dc=net'
-      userRdnAttribute: 'uid'
-      userIdAttribute: 'uid'
-      userPasswordAttribute: 'userPassword'
-      userObjectClass: 'posixAccount'
-      roleBaseDn: 'ou=groups,dc=main,dc=unkin,dc=net'
-      roleNameAttribute: 'uid'
-      roleMemberAttribute: 'uniqueMember'
-      roleObjectClass: 'groupOfUniqueNames'
-      nestedGroups: 'true'
-
-profiles::rundeck::server::key_storage_config:
-  - type: 'db'
-    path: 'keys'
-  - type: 'vault-storage'
-    path: 'vault'
-    config:
-      prefix: 'rundeck'
-      address: https://vault.query.consul:8200
-      storageBehaviour: 'vault'
-      secretBackend: rundeck
-      engineVersion: '2'
-      authBackend: approle
-      approleAuthMount: approle
-      approleId: "%{hiera('vault::roleid')}"
-
-profiles::rundeck::server::cli_projects:
-  Self-Service:
-    update_method: 'set'
-    config:
-      project.description: 'self-service tasks'
-      project.disable.executions: 'false'
-  Infrastructure:
-    config:
-      project.description: 'infrastructure management'
-      project.disable.schedule: 'false'
-
-profiles::rundeck::server::acl_policies:
-  global_admin_policy:
-    acl_policies:
-      - description: 'Global Admin, all access'
-        context:
-          application: "rundeck"
-        for:
-          project:
-            - allow: '*'
-          resource:
-            - allow: '*'
-          storage:
-            - allow: '*'
-        by:
-          - group: ['rundeck_globaladmin']
-      - description: 'Global Admin, all access'
-        context:
-          project: '.*'
-        for:
-          resource:
-            - allow: '*'
-          adhoc:
-            - allow: '*'
-          job:
-            - allow: '*'
-          node:
-            - allow: '*'
-        by:
-          - group: ['rundeck_globaladmin']
-  selfservice_admin_policy:
-    acl_policies:
-      - description: 'Admin, all access for Self-Service project'
-        context:
-          project: 'Self-Service'
-        for:
-          resource:
-            - allow: '*'
-          adhoc:
-            - allow: '*'
-          job:
-            - allow: '*'
-          node:
-            - allow: '*'
-        by:
-          - group: ['rundeck_selfserice_admin']
-  selfservice_user_policy:
-    acl_policies:
-      - description: 'Users can execute tasks but not edit for Self-Service project'
-        context:
-          project: 'Self-Service'
-        for:
-          resource:
-            - allow: ['read']
-          adhoc:
-            - allow: ['run']
-          job:
-            - allow: ['read', 'run']
-          node:
-            - allow: ['read', 'run']
-        by:
-          - group: ['rundeck_selfserice_user']
-  infrastructure_admin_policy:
-    acl_policies:
-      - description: 'Admin, all access for Infrastructure project'
-        context:
-          project: 'Infrastructure'
-        for:
-          resource:
-            - allow: '*'
-          adhoc:
-            - allow: '*'
-          job:
-            - allow: '*'
-          node:
-            - allow: '*'
-        by:
-          - group: ['rundeck_infrastructure_admin']
-  infrastructure_user_policy:
-    acl_policies:
-      - description: 'Users can execute tasks but not edit for Infrastructure project'
-        context:
-          project: 'Infrastructure'
-        for:
-          resource:
-            - allow: ['read']
-          adhoc:
-            - allow: ['run']
-          job:
-            - allow: ['read', 'run']
-          node:
-            - allow: ['read', 'run']
-        by:
-          - group: ['rundeck_infrastructure_user']

hieradata/roles/infra/cobbler/server.yaml

@@ -1,15 +1,15 @@
 ---
-profiles::packages::include:
+profiles::packages::install:
-  cobbler: {}
+  - cobbler
-  cobbler3.2-web: {}
+  - cobbler3.2-web
-  httpd: {}
+  - httpd
-  syslinux: {}
+  - syslinux
-  dnf-plugins-core: {}
+  - dnf-plugins-core
-  debmirror: {}
+  - debmirror
-  pykickstart: {}
+  - pykickstart
-  fence-agents: {}
+  - fence-agents
-  selinux-policy-devel: {}
+  - selinux-policy-devel
-  ipxe-bootimgs: {}
+  - ipxe-bootimgs
 
 profiles::pki::vault::alt_names:
   - cobbler.main.unkin.net
@@ -17,10 +17,5 @@ profiles::pki::vault::alt_names:
 profiles::cobbler::params::service_cname: 'cobbler.main.unkin.net'
 profiles::selinux::setenforce::mode: permissive
 
-hiera_include:
+hiera_classes:
   - profiles::selinux::setenforce
-  - firewall::rules::in::cobbler
-  - firewall::rules::in::http
-  - firewall::rules::in::https
-  - firewall::rules::in::tftp
-  - firewall::rules::in::sshd

hieradata/roles/infra/db/redis.eyaml

@@ -1,2 +0,0 @@
----
-redisha::masterauth: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAV8znsSGAbPpPUhAcyOIWFltVyAcx3yVcIvC+JFndkkuVBT1813GSURrXIreXSilvJEHlwRC03A9NhjWJSsHBIS12uUb+7ap95oh2JJ7OHmeWSVD1GDDRpTQAgDEOikAnioRNJfQ83jUa11nJrsavt46hSq8vDq+rZ2P8ugiNk59mNX5vgYthCPXcEJd7UmpLZhgxZ8+42l4TKo7QpqKRcIMteJXk1NvyYfYGnGTZhknuyHM3xPGauGjKzamMlTzD9dGnn2K0/Q7I4PUyT24ZEG3kNVyDlVHTYcKnIT5q8qvmJdDQfZwOETF3SrzcqhQ2nqFvmI19sCTsQVmveb/2ITBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC9KML3vzwF4vGZdtiu++jmgDAWPZspCckgoXPkgNRMePov3pXSlKUAGxwmdsuIM75rJMxlSTiil2lzMMBWXmUofys=]

hieradata/roles/infra/db/redis.yaml

@@ -1,67 +0,0 @@
----
-# additional altnames
-profiles::pki::vault::alt_names:
-  - redis.main.unkin.net
-  - redis.service.consul
-  - redis.query.consul
-  - "redis.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - redis.main.unkin.net
-  - redis.service.consul
-  - redis.query.consul
-
-
-hiera_include:
-  - redisha
-
-redisha::manage_repo: false
-redisha::redisha_members_lookup: true
-redisha::redisha_members_role: roles::infra::db::redis
-#redisha::redis::requirepass: "%{hiera('redisha::masterauth')}"
-#redisha::redis::masterauth: "%{hiera('redisha::masterauth')}"
-redisha::sentinel::master_name: "%{facts.country}-%{facts.region}"
-redisha::sentinel::requirepass: "%{hiera('redisha::masterauth')}"
-redisha::sentinel::auth_pass: "%{hiera('redisha::masterauth')}"
-redisha::tools::requirepass: "%{hiera('redisha::masterauth')}"
-
-sudo::configs:
-  consul:
-    priority: 20
-    content: |
-      consul ALL=(ALL) NOPASSWD: /usr/local/sbin/sentineladm info
-consul::services:
-  redis-replica:
-    service_name: "redis-replica-%{facts.environment}"
-    tags:
-      - 'redis'
-      - 'redis-replica'
-    address: "%{facts.networking.ip}"
-    port: 6379
-    checks:
-      - id: 'redis-replica_tcp_check'
-        name: 'Redis Replica TCP Check'
-        tcp: "%{facts.networking.ip}:6379"
-        interval: '10s'
-        timeout: '1s'
-  redis-master:
-    service_name: "redis-master-%{facts.environment}"
-    tags:
-      - 'redis'
-      - 'redis-master'
-    address: "%{facts.networking.ip}"
-    port: 6379
-    checks:
-      - id: 'redis-master_tcp_check'
-        name: "Redis Master Check"
-        args:
-          - '/usr/local/bin/check_redis_master'
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: "redis-replica-%{facts.environment}"
-    disposition: write
-  - resource: service
-    segment: "redis-master-%{facts.environment}"
-    disposition: write

hieradata/roles/infra/dhcp/server.yaml

@@ -1,8 +1,4 @@
 ---
-hiera_include:
-  - firewall::rules::in::dhcp
-  - firewall::rules::in::sshd
-
 profiles::dhcp::server::ntpservers:
   - ntp01.main.unkin.net
   - ntp02.main.unkin.net

hieradata/roles/infra/dns/resolver.yaml

@@ -33,6 +33,13 @@ profiles::dns::resolver::zones:
       - 10.10.16.32
       - 10.10.16.33
     forward: 'only'
+  unkin.net-forward:
+    domain: 'unkin.net'
+    zone_type: 'forward'
+    forwarders:
+      - 10.10.16.32
+      - 10.10.16.33
+    forward: 'only'
   dmz.unkin.net-forward:
     domain: 'dmz.unkin.net'
     zone_type: 'forward'
@@ -60,6 +67,7 @@ profiles::dns::resolver::views:
     recursion: true
     zones:
       - main.unkin.net-forward
+      - unkin.net-forward
       - dmz.unkin.net-forward
       - network.unkin.net-forward
       - prod.unkin.net-forward