feat: adding rke2

- manage rke2 repos
- add rke2 module (init, params, install, config, service)
- split roles::infra::k8s::node -> control/compute roles
- moved common k8s config into k8s.yaml
- add bootstrap_node, manage server and token fields in rke2 config
- manage install of helm
- manage node attributes (from puppet facts)
- manage frr exclusions for service/cluster network

.gitea/workflows/build.yaml

@@ -0,0 +1,24 @@
+name: Build
+
+on:
+  pull_request:
+
+jobs:
+  precommit:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Install requirements
+        run: |
+          dnf groupinstall -y "Development Tools" -y
+          dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
+
+      - name: Pre-Commit All Files
+        run: |
+          uvx pre-commit run --all-files

.rubocop.yml

@@ -8,3 +8,6 @@ Style/Documentation:
 
 Layout/LineLength:
   Max: 140
+
+Metrics/BlockNesting:
+  Max: 4

hieradata/common.yaml

@@ -36,6 +36,12 @@ lookup_options:
   profiles::haproxy::server::listeners:
     merge:
       strategy: deep
+  profiles::accounts::root::sshkeys:
+    merge:
+      strategy: deep
+  profiles::accounts::sysadmin::sshkeys:
+    merge:
+      strategy: deep
   haproxy::backend:
     merge:
       strategy: deep
@@ -149,6 +155,9 @@ lookup_options:
   zfs::datasets:
     merge:
       strategy: deep
+  rke2::config_hash:
+    merge:
+      strategy: deep
 
 facts_path: '/opt/puppetlabs/facter/facts.d'
 
@@ -159,14 +168,13 @@ hiera_include:
   - profiles::accounts::rundeck
   - limits
   - sysctl::base
+  - exporters::node_exporter
 
-profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
-profiles::ntp::client::use_ntp: 'region'
 profiles::ntp::client::peers:
-  - 0.pool.ntp.org
+  - 0.au.pool.ntp.org
-  - 1.pool.ntp.org
+  - 1.au.pool.ntp.org
-  - 2.pool.ntp.org
+  - 2.au.pool.ntp.org
-  - 3.pool.ntp.org
+  - 3.au.pool.ntp.org
 
 profiles::base::puppet_servers:
   - 'prodinf01n01.main.unkin.net'
@@ -175,9 +183,18 @@ consul::install_method: 'package'
 consul::manage_repo: false
 consul::bin_dir: /usr/bin
 
+vault::install_method: 'repo'
+vault::manage_repo: false
+vault::bin_dir: /usr/bin
+vault::manage_service_file: true
+vault::manage_config_dir: true
+vault::disable_mlock: false
+
+profiles::dns::base::nameservers:
+  - 198.18.19.16
 profiles::dns::master::basedir: '/var/named/sources'
-profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
+#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
-profiles::dns::base::use_ns: 'region'
+#profiles::dns::base::use_ns: 'region'
 profiles::consul::server::members_role: roles::infra::storage::consul
 profiles::consul::token::node_editor::accessor_id: '024e27bd-c5bb-41e7-a578-b766509e11bc'
 profiles::consul::client::members_lookup: true
@@ -192,6 +209,9 @@ profiles::consul::client::node_rules:
   - resource: node
     segment: ''
     disposition: read
+  - resource: service
+    segment: node_exporter
+    disposition: write
 
 profiles::packages::include:
   bash-completion: {}
@@ -275,7 +295,8 @@ profiles::puppet::client::dns_alt_names:
 puppetdbapi: puppetdbapi.query.consul
 puppetdbsql: puppetdbsql.service.au-syd1.consul
 
-prometheus::node_exporter::export_scrape_job: true
+exporters::node_exporter::enable: true
+exporters::node_exporter::cleanup_old_node_exporter: true
 prometheus::systemd_exporter::export_scrape_job: true
 
 ssh::server::storeconfigs_enabled: false
@@ -340,11 +361,38 @@ networking::route_defaults:
   netmask: 0.0.0.0
   network: default
 
+# logging:
+victorialogs::client::journald::enable: true
+victorialogs::client::journald::inserturl: https://vlinsert.service.consul:9428/insert/journald
+
+# FIXME these are for the proxmox ceph cluster
 profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
 profiles::ceph::client::mons:
   - 10.18.15.1
   - 10.18.15.2
   - 10.18.15.3
+
+profiles::ceph::conf::config:
+  global:
+    auth_client_required: 'cephx'
+    auth_cluster_required: 'cephx'
+    auth_service_required: 'cephx'
+    fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
+    mon_allow_pool_delete: true
+    mon_initial_members: 'prodnxsr0009,prodnxsr0010,prodnxsr0011,prodnxsr0012,prodnxsr0013'
+    mon_host: '198.18.23.9,198.18.23.10,198.18.23.11,198.18.23.12,198.18.23.13'
+    ms_bind_ipv4: true
+    ms_bind_ipv6: false
+    osd_crush_chooseleaf_type: 1
+    osd_pool_default_min_size: 2
+    osd_pool_default_size: 3
+    osd_pool_default_pg_num: 128
+    public_network: >
+      198.18.23.1/32,198.18.23.2/32,198.18.23.3/32,198.18.23.4/32,
+      198.18.23.5/32,198.18.23.6/32,198.18.23.7/32,198.18.23.8/32,
+      198.18.23.9/32,198.18.23.10/32,198.18.23.11/32,198.18.23.12/32,
+      198.18.23.13/32
+
 #profiles::base::hosts::additional_hosts:
 #  - ip: 198.18.17.9
 #    hostname: prodinf01n09.main.unkin.net

hieradata/country/au/region/drw1.yaml

@@ -1,2 +1,9 @@
 ---
 timezone::timezone: 'Australia/Darwin'
+profiles_dns_upstream_forwarder_unkin:
+  - 198.18.17.23
+  - 198.18.17.24
+profiles_dns_upstream_forwarder_consul:
+  - 198.18.17.34
+  - 198.18.17.35
+  - 198.18.17.36

hieradata/country/au/region/drw1/infra/dns/resolver.yaml

@@ -1,52 +1 @@
 ---
-profiles::dns::resolver::zones:
-  main.unkin.net-forward:
-    domain: 'main.unkin.net'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  13.18.198.in-addr.arpa-forward:
-    domain: '13.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  14.18.198.in-addr.arpa-forward:
-    domain: '14.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  15.18.198.in-addr.arpa-forward:
-    domain: '15.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  16.18.198.in-addr.arpa-forward:
-    domain: '16.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  17.18.198.in-addr.arpa-forward:
-    domain: '17.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  consul-forward:
-    domain: 'consul'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.34
-      - 198.18.17.35
-      - 198.18.17.36
-    forward: 'only'

hieradata/country/au/region/syd1.yaml

@@ -1,3 +1,7 @@
 ---
 timezone::timezone: 'Australia/Sydney'
-certbot::client::webserver: ausyd1nxvm1021.main.unkin.net
+certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
+profiles_dns_upstream_forwarder_unkin:
+  - 198.18.19.15
+profiles_dns_upstream_forwarder_consul:
+  - 198.18.19.14

hieradata/country/au/region/syd1/infra/dns/resolver.yaml

@@ -1,52 +1 @@
 ---
-profiles::dns::resolver::zones:
-  main.unkin.net-forward:
-    domain: 'main.unkin.net'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  13.18.198.in-addr.arpa-forward:
-    domain: '13.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  14.18.198.in-addr.arpa-forward:
-    domain: '14.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  15.18.198.in-addr.arpa-forward:
-    domain: '15.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  16.18.198.in-addr.arpa-forward:
-    domain: '16.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  17.18.198.in-addr.arpa-forward:
-    domain: '17.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  consul-forward:
-    domain: 'consul'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.19
-      - 198.18.13.20
-      - 198.18.13.21
-    forward: 'only'

hieradata/country/au/region/syd1/infra/halb/haproxy.yaml

@@ -3,7 +3,7 @@ hiera_include:
   - keepalived
 
 # keepalived
-profiles::haproxy::dns::vrrp_ipaddr: '198.18.13.250'
+profiles::haproxy::dns::ipaddr: '198.18.13.250'
 profiles::haproxy::dns::vrrp_cnames:
   - sonarr.main.unkin.net
   - radarr.main.unkin.net

hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

@@ -0,0 +1,332 @@
+---
+profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
+profiles::haproxy::dns::vrrp_cnames:
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - nzbget.main.unkin.net
+  - git.unkin.net
+  - fafflix.unkin.net
+  - grafana.unkin.net
+  - dashboard.ceph.unkin.net
+
+profiles::haproxy::mappings:
+  fe_http:
+    ensure: present
+    mappings:
+      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
+      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
+      - 'sonarr.main.unkin.net be_sonarr'
+      - 'radarr.main.unkin.net be_radarr'
+      - 'lidarr.main.unkin.net be_lidarr'
+      - 'readarr.main.unkin.net be_readarr'
+      - 'prowlarr.main.unkin.net be_prowlarr'
+      - 'nzbget.main.unkin.net be_nzbget'
+      - 'jellyfin.main.unkin.net be_jellyfin'
+      - 'fafflix.unkin.net be_jellyfin'
+      - 'git.unkin.net be_gitea'
+      - 'grafana.unkin.net be_grafana'
+      - 'dashboard.ceph.unkin.net be_ceph_dashboard'
+  fe_https:
+    ensure: present
+    mappings:
+      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
+      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
+      - 'sonarr.main.unkin.net be_sonarr'
+      - 'radarr.main.unkin.net be_radarr'
+      - 'lidarr.main.unkin.net be_lidarr'
+      - 'readarr.main.unkin.net be_readarr'
+      - 'prowlarr.main.unkin.net be_prowlarr'
+      - 'nzbget.main.unkin.net be_nzbget'
+      - 'jellyfin.main.unkin.net be_jellyfin'
+      - 'fafflix.unkin.net be_jellyfin'
+      - 'git.unkin.net be_gitea'
+      - 'grafana.unkin.net be_grafana'
+      - 'dashboard.ceph.unkin.net be_ceph_dashboard'
+
+profiles::haproxy::frontends:
+  fe_http:
+    options:
+      use_backend:
+        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_http.map,be_default)]"
+  fe_https:
+    options:
+      acl:
+        - 'acl_ausyd1pve req.hdr(host) -i au-syd1-pve.main.unkin.net'
+        - 'acl_sonarr req.hdr(host) -i sonarr.main.unkin.net'
+        - 'acl_radarr req.hdr(host) -i radarr.main.unkin.net'
+        - 'acl_lidarr req.hdr(host) -i lidarr.main.unkin.net'
+        - 'acl_readarr req.hdr(host) -i readarr.main.unkin.net'
+        - 'acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net'
+        - 'acl_nzbget req.hdr(host) -i nzbget.main.unkin.net'
+        - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
+        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
+        - 'acl_gitea req.hdr(host) -i git.unkin.net'
+        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
+        - 'acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net'
+        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
+      use_backend:
+        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
+      http-request:
+        - 'deny if { hdr_dom(host) -i au-syd1-pve.main.unkin.net } !acl_internalsubnets'
+      http-response:
+        - 'set-header X-Frame-Options DENY if acl_ausyd1pve'
+        - 'set-header X-Frame-Options DENY if acl_sonarr'
+        - 'set-header X-Frame-Options DENY if acl_radarr'
+        - 'set-header X-Frame-Options DENY if acl_lidarr'
+        - 'set-header X-Frame-Options DENY if acl_readarr'
+        - 'set-header X-Frame-Options DENY if acl_prowlarr'
+        - 'set-header X-Frame-Options DENY if acl_nzbget'
+        - 'set-header X-Frame-Options DENY if acl_jellyfin'
+        - 'set-header X-Frame-Options DENY if acl_fafflix'
+        - 'set-header X-Frame-Options DENY if acl_gitea'
+        - 'set-header X-Frame-Options DENY if acl_grafana'
+        - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
+        - 'set-header X-Content-Type-Options nosniff'
+        - 'set-header X-XSS-Protection 1;mode=block'
+
+profiles::haproxy::backends:
+  be_ausyd1pve_web:
+    description: Backend for au-syd1 pve cluster (Web)
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_ausyd1pve_api:
+    description: Backend for au-syd1 pve cluster (API only)
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_sonarr:
+    description: Backend for au-syd1 sonarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_radarr:
+    description: Backend for au-syd1 radarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_lidarr:
+    description: Backend for au-syd1 lidarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_readarr:
+    description: Backend for au-syd1 readarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_prowlarr:
+    description: Backend for au-syd1 prowlarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_nzbget:
+    description: Backend for au-syd1 nzbget
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_jellyfin:
+    description: Backend for au-syd1 jellyfin
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_gitea:
+    description: Backend for gitea cluster
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      stick-table: 'type ip size 200k expire 30m'
+      stick: 'on src'
+  be_grafana:
+    description: Backend for grafana nodes
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      stick-table: 'type ip size 200k expire 30m'
+      stick: 'on src'
+  be_ceph_dashboard:
+    description: Backend for Ceph Dashboard from Mgr instances
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-check:
+        - expect status 200
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 9443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      stick-table: 'type ip size 200k expire 30m'
+      stick: 'on src'
+
+profiles::haproxy::certlist::enabled: true
+profiles::haproxy::certlist::certificates:
+  - /etc/pki/tls/letsencrypt/au-syd1-pve.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/au-syd1-pve-api.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/sonarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/radarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/lidarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/readarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/prowlarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/vault/certificate.pem
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+  - jellyfin.main.unkin.net
+
+# additional cnames
+profiles::haproxy::dns::cnames:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+
+# letsencrypt certificates
+certbot::client::service: haproxy
+certbot::client::domains:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - nzbget.main.unkin.net
+  - fafflix.unkin.net
+  - git.unkin.net
+  - grafana.unkin.net
+  - dashboard.ceph.unkin.net

hieradata/nodes/ausyd1nxvm1000.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.10
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1001.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.11
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1002.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.12
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1003.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.13
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1004.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.14
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1005.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.15
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1006.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.16
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1007.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.17
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1008.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.18
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1009.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.19
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1010.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.20
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1011.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.21
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1012.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.22
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1013.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.23
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1014.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.24
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1015.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.25
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-
-profiles::haproxy::dns::vrrp_master: true
-keepalived::vrrp_instance:
-  VI_250:
-    state: 'MASTER'
-    priority: 101

hieradata/nodes/ausyd1nxvm1016.main.unkin.net.yaml

@@ -1,12 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.26
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-
-keepalived::vrrp_instance:
-  VI_250:
-    state: 'BACKUP'
-    priority: 100

hieradata/nodes/ausyd1nxvm1017.main.unkin.net.yaml

@@ -1,11 +0,0 @@
----
-profiles::cobbler::params::is_cobbler_master: true
-networking::interfaces:
-  ens18:
-    ipaddress: 198.18.13.27
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-    interface: ens18
-
-profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1018.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.28
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1019.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.29
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1020.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.30
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1021.main.unkin.net.yaml

@@ -1,10 +0,0 @@
----
-networking::interfaces:
-  ens18:
-    ipaddress: 198.18.13.31
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-    interface: ens18
-
-profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1022.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.32
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1023.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.33
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1024.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.34
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1025.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.35
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1026.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.36
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1027.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.37
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1028.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.38
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1029.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.39
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1030.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.40
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1031.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.41
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1032.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.42
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1033.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.43
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1034.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.44
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1035.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.45
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1037.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.47
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.47
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1038.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.48
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1039.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.49
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1040.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.50
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.50
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1041.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.51
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.51
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1042.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.52
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.52
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1043.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.53
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.53
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1044.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.54
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1045.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.55
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1046.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.56
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1047.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.57
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.57
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1048.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.58
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.58
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1049.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.59
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1050.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.60
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1051.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.61
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1052.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.62
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1053.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.63
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1054.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.64
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1055.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.65
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1056.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.66
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1057.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.67
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1058.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.68
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1059.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.69
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1060.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.70
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1061.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.71
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1062.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.72
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1063.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.73
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1064.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.74
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.74
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.64.254/24'

hieradata/nodes/ausyd1nxvm1065.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.75
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.75
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.65.254/24'

hieradata/nodes/ausyd1nxvm1066.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.76
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.76
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.66.254/24'

hieradata/nodes/ausyd1nxvm1067.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.77
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.77
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.67.254/24'

hieradata/nodes/ausyd1nxvm1068.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.78
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.78
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.68.254/24'

hieradata/nodes/ausyd1nxvm1069.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.79
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.79
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.69.254/24'

hieradata/nodes/ausyd1nxvm1070.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.80
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1071.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.81
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm2097.main.unkin.net.yaml

@@ -13,9 +13,3 @@ profiles::ssh::sign::principals:
 
 profiles::puppet::puppetca::is_puppetca: true
 profiles::puppet::puppetca::allow_subject_alt_names: true
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.46
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm2098.main.unkin.net.yaml

@@ -0,0 +1,2 @@
+---
+profiles::cobbler::params::is_cobbler_master: true

hieradata/nodes/prodinf01n01.main.unkin.net.yaml

@@ -1,12 +0,0 @@
----
-profiles::puppet::server::dns_alt_names:
-  - puppetca.main.unkin.net
-  - puppetca.service.consul
-  - puppetca.query.consul
-  - puppetca
-
-profiles::puppet::puppetca::is_puppetca: false
-profiles::puppet::puppetca::allow_subject_alt_names: true
-
-hiera_exclude:
-  - networking

hieradata/nodes/prodnxsr0001.main.unkin.net.yaml

@@ -1,5 +1,13 @@
 ---
-profiles::proxmox::params::pve_clusterinit_master: true
+networking_loopback0_ip: 198.18.19.1  # management loopback
-profiles::proxmox::params::pve_ceph_mon: true
+networking_loopback1_ip: 198.18.22.1  # ceph-cluster loopback
-profiles::proxmox::params::pve_ceph_mgr: true
+networking_loopback2_ip: 198.18.23.1  # ceph-public loopback
-profiles::proxmox::params::pve_ceph_osd: true
+networking_1000_ip: 198.18.15.1       # 1gbe network
+networking_2500_ip: 198.18.21.1       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:75:c3:60
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:ac:d0:00:00:50

hieradata/nodes/prodnxsr0002.main.unkin.net.yaml

@@ -1,4 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_mon: true
+networking_loopback0_ip: 198.18.19.2  # management loopback
-profiles::proxmox::params::pve_ceph_mgr: true
+networking_loopback1_ip: 198.18.22.2  # ceph-cluster loopback
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback2_ip: 198.18.23.2  # ceph-public loopback
+networking_1000_ip: 198.18.15.2       # 1gbe network
+networking_2500_ip: 198.18.21.2       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:74:b6:08
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:e0:4c:68:08:43

hieradata/nodes/prodnxsr0003.main.unkin.net.yaml

@@ -1,4 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_mon: true
+networking_loopback0_ip: 198.18.19.3  # management loopback
-profiles::proxmox::params::pve_ceph_mgr: true
+networking_loopback1_ip: 198.18.22.3  # ceph-cluster loopback
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback2_ip: 198.18.23.3  # ceph-public loopback
+networking_1000_ip: 198.18.15.3       # 1gbe network
+networking_2500_ip: 198.18.21.3       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: b8:85:84:a3:25:c5
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:e0:4c:68:07:82

hieradata/nodes/prodnxsr0004.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.4  # management loopback
+networking_loopback1_ip: 198.18.22.4  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.4  # ceph-public loopback
+networking_1000_ip: 198.18.15.4       # 1gbe network
+networking_2500_ip: 198.18.21.4       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:75:d5:00
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:ac:d0:00:00:43

hieradata/nodes/prodnxsr0005.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.5  # management loopback
+networking_loopback1_ip: 198.18.22.5  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.5  # ceph-public loopback
+networking_1000_ip: 198.18.15.5       # 1gbe network
+networking_2500_ip: 198.18.21.5       # 2.5gbe network
+networking_1000_iface: enp1s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: 54:bf:64:a0:08:64
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:e0:4c:68:07:79

hieradata/nodes/prodnxsr0006.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.6  # management loopback
+networking_loopback1_ip: 198.18.22.6  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.6  # ceph-public loopback
+networking_1000_ip: 198.18.15.6       # 1gbe network
+networking_2500_ip: 198.18.21.6       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:75:10:8d
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:ac:d0:00:00:53

hieradata/nodes/prodnxsr0007.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.7  # management loopback
+networking_loopback1_ip: 198.18.22.7  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.7  # ceph-public loopback
+networking_1000_ip: 198.18.15.7       # 1gbe network
+networking_2500_ip: 198.18.21.7       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:74:b4:27
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:ac:d0:00:00:5b

hieradata/nodes/prodnxsr0008.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.8  # management loopback
+networking_loopback1_ip: 198.18.22.8  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.8  # ceph-public loopback
+networking_1000_ip: 198.18.15.8       # 1gbe network
+networking_2500_ip: 198.18.21.8       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:75:06:18
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:e0:4c:68:08:4b

hieradata/os/AlmaLinux/all_releases.yaml

@@ -9,6 +9,7 @@ hiera_include:
   - profiles::almalinux::base
 
 profiles::packages::include:
+  crypto-policies-scripts: {}
   lzo: {}
   policycoreutils: {}
   unar: {}
@@ -49,8 +50,8 @@ profiles::yum::global::repos:
     name: epel
     descr: epel repository
     target: /etc/yum.repos.d/epel.repo
-    baseurl: https://edgecache.query.consul/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
+    baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
-    gpgkey: http://edgecache.query.consul/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
+    gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
     mirrorlist: absent
   puppet:
     name: puppet

hieradata/roles/apps/media.yaml

@@ -69,8 +69,7 @@ profiles::nginx::simpleproxy::locations:
     location_allow:
       - 127.0.0.1
       - "%{facts.networking.ip}"
-      - 198.18.13.25
+      - 198.18.24.0/24
-      - 198.18.13.26
     location_deny:
       - all
   # authorised access from external

hieradata/roles/apps/media/jellyfin.yaml

@@ -2,6 +2,12 @@
 hiera_include:
   - jellyfin
 
+profiles::packages::include:
+  intel-media-driver: {}
+  libva-intel-driver: {}
+  libva-intel-hybrid-driver: {}
+  intel-mediasdk: {}
+
 # manage jellyfin
 jellyfin::params::service_enable: true
 
@@ -61,3 +67,11 @@ profiles::yum::global::repos:
     baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
     gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
     mirrorlist: absent
+  unkinben:
+    name: unkinben
+    descr: unkinben repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el8
+    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/roles/apps/media/lidarr.yaml

@@ -2,6 +2,7 @@
 hiera_include:
   - lidarr
   - profiles::nginx::ldapauth
+  - profiles::media::lidarr
 
 # manage lidarr
 lidarr::params::user: lidarr

hieradata/roles/apps/media/nzbget.yaml

@@ -4,12 +4,19 @@ hiera_include:
   - nzbget
   - profiles::media::nzbget
   - profiles::nginx::ldapauth
+  - exporters::nzbget_exporter
+
+profiles::packages::include:
+  unrar: {}
 
 # manage nzbget
 nzbget::params::user: nzbget
 nzbget::params::group: media
 nzbget::params::manage_group: false
 
+# nzbget_exporter
+exporters::nzbget_exporter::enable: true
+
 # additional altnames
 profiles::pki::vault::alt_names:
   - nzbget.main.unkin.net
@@ -59,6 +66,9 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: nzbget
     disposition: write
+  - resource: service
+    segment: nzbget_exporter
+    disposition: write
 
 profiles::yum::global::repos:
   rpmfusion-free:

hieradata/roles/apps/media/prowlarr.yaml

@@ -2,6 +2,8 @@
 hiera_include:
   - prowlarr
   - profiles::nginx::ldapauth
+  - profiles::media::prowlarr
+  - exporters::exportarr
 
 # manage prowlarr
 prowlarr::params::user: prowlarr
@@ -10,6 +12,12 @@ prowlarr::params::manage_group: false
 prowlarr::params::archive_version: 1.19.0
 prowlarr::params::port: 8000
 
+# exportarr
+exporters::exportarr::enable: true
+exporters::exportarr::app: prowlarr
+exporters::exportarr::api_key: "%{hiera('prowlarr::api_key')}"
+exporters::exportarr::backfill: true
+
 # additional altnames
 profiles::pki::vault::alt_names:
   - prowlarr.main.unkin.net
@@ -54,12 +62,15 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: prowlarr
     disposition: write
+  - resource: service
+    segment: exportarr
+    disposition: write
 
 profiles::nginx::simpleproxy::locations:
   arrstack_web_external:
     location_satisfy: any
     location_allow:
-      - 198.18.13.47
+      - 198.18.26.161
-      - 198.18.13.50
+      - 198.18.27.131
-      - 198.18.13.51
+      - 198.18.28.165
-      - 198.18.13.52
+      - 198.18.29.32

hieradata/roles/apps/media/radarr.yaml

@@ -2,6 +2,8 @@
 hiera_include:
   - radarr
   - profiles::nginx::ldapauth
+  - profiles::media::radarr
+  - exporters::exportarr
 
 # manage radarr
 radarr::params::user: radarr
@@ -10,6 +12,10 @@ radarr::params::manage_group: false
 radarr::params::archive_version: 5.7.0
 radarr::params::port: 8000
 
+# exportarr
+exporters::exportarr::enable: true
+exporters::exportarr::app: radarr
+exporters::exportarr::api_key: "%{hiera('radarr::api_key')}"
 
 # additional altnames
 profiles::pki::vault::alt_names:
@@ -55,3 +61,6 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: radarr
     disposition: write
+  - resource: service
+    segment: exportarr
+    disposition: write

hieradata/roles/apps/media/readarr.yaml

@@ -2,6 +2,7 @@
 hiera_include:
   - readarr
   - profiles::nginx::ldapauth
+  - profiles::media::readarr
 
 # manage readarr
 readarr::params::user: readarr

hieradata/roles/apps/media/sonarr.yaml

@@ -2,6 +2,8 @@
 hiera_include:
   - sonarr
   - profiles::nginx::ldapauth
+  - profiles::media::sonarr
+  - exporters::exportarr
 
 # manage sonarr
 sonarr::params::user: sonarr
@@ -10,6 +12,11 @@ sonarr::params::manage_group: false
 sonarr::params::archive_version: 4.0.5
 sonarr::params::port: 8000
 
+# exportarr
+exporters::exportarr::enable: true
+exporters::exportarr::app: sonarr
+exporters::exportarr::api_key: "%{hiera('sonarr::api_key')}"
+
 # additional altnames
 profiles::pki::vault::alt_names:
   - sonarr.main.unkin.net
@@ -54,3 +61,6 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: sonarr
     disposition: write
+  - resource: service
+    segment: exportarr
+    disposition: write