feat: add exportarr metrics

- add class to manage the exportarr service
- add exportarr to each *arr application

.reek.yml

@@ -3,8 +3,3 @@
 detectors:
   FeatureEnvy:
     enabled: false
-  TooManyStatements:
-    enabled: false
-  UncommunicativeVariableName:
-    accept:
-      - e

Puppetfile

@@ -2,54 +2,49 @@ forge 'forge.puppetlabs.com'
 moduledir 'external_modules'
 
 # puppetlabs
-mod 'puppetlabs-stdlib', '9.7.0'
-mod 'puppetlabs-inifile', '6.2.0'
-mod 'puppetlabs-concat', '9.1.0'
-mod 'puppetlabs-vcsrepo', '7.0.0'
-mod 'puppetlabs-yumrepo_core', '2.1.0'
-mod 'puppetlabs-apt', '10.0.1'
-mod 'puppetlabs-lvm', '3.0.1'
-mod 'puppetlabs-puppetdb', '7.14.0'
-mod 'puppetlabs-postgresql', '9.2.0'
-mod 'puppetlabs-firewall', '8.1.4'
-mod 'puppetlabs-accounts', '8.2.2'
-mod 'puppetlabs-mysql', '16.2.0'
+mod 'puppetlabs-stdlib', '9.1.0'
+mod 'puppetlabs-inifile', '6.0.0'
+mod 'puppetlabs-concat', '9.0.0'
+mod 'puppetlabs-vcsrepo', '6.1.0'
+mod 'puppetlabs-yumrepo_core', '2.0.0'
+mod 'puppetlabs-apt', '9.4.0'
+mod 'puppetlabs-lvm', '2.1.0'
+mod 'puppetlabs-puppetdb', '7.13.0'
+mod 'puppetlabs-postgresql', '9.1.0'
+mod 'puppetlabs-firewall', '6.0.0'
+mod 'puppetlabs-accounts', '8.1.0'
+mod 'puppetlabs-mysql', '15.0.0'
 mod 'puppetlabs-xinetd', '3.4.1'
-mod 'puppetlabs-haproxy', '8.2.0'
-mod 'puppetlabs-java', '11.1.0'
-mod 'puppetlabs-reboot', '5.1.0'
-mod 'puppetlabs-docker', '10.2.0'
+mod 'puppetlabs-haproxy', '8.0.0'
+mod 'puppetlabs-java', '10.1.2'
+mod 'puppetlabs-reboot', '5.0.0'
 
 # puppet
-mod 'puppet-python', '7.4.0'
-mod 'puppet-systemd', '8.1.0'
-mod 'puppet-yum', '7.2.0'
-mod 'puppet-archive', '7.1.0'
-mod 'puppet-chrony', '3.0.0'
-mod 'puppet-puppetboard', '11.0.0'
-mod 'puppet-nginx', '6.0.1'
-mod 'puppet-selinux', '5.0.0'
-mod 'puppet-prometheus', '16.0.0'
-mod 'puppet-grafana', '14.1.0'
-mod 'puppet-consul', '9.1.0'
-mod 'puppet-vault', '4.1.1'
+mod 'puppet-python', '7.0.0'
+mod 'puppet-systemd', '5.1.0'
+mod 'puppet-yum', '7.0.0'
+mod 'puppet-archive', '7.0.0'
+mod 'puppet-chrony', '2.6.0'
+mod 'puppet-puppetboard', '9.0.0'
+mod 'puppet-nginx', '5.0.0'
+mod 'puppet-selinux', '4.1.0'
+mod 'puppet-prometheus', '13.4.0'
+mod 'puppet-grafana', '13.1.0'
+mod 'puppet-consul', '8.0.0'
+mod 'puppet-vault', '4.1.0'
 mod 'puppet-dhcp', '6.1.0'
-mod 'puppet-keepalived', '5.1.0'
-mod 'puppet-extlib', '7.5.1'
-mod 'puppet-network', '2.2.1'
-mod 'puppet-kmod', '4.1.0'
+mod 'puppet-keepalived', '3.6.0'
+mod 'puppet-extlib', '7.0.0'
+mod 'puppet-network', '2.2.0'
+mod 'puppet-kmod', '4.0.1'
 mod 'puppet-filemapper', '4.0.0'
-mod 'puppet-letsencrypt', '11.1.0'
-mod 'puppet-rundeck', '9.2.0'
-mod 'puppet-redis', '11.1.0'
-mod 'puppet-nodejs', '11.0.0'
+mod 'puppet-letsencrypt', '11.0.0'
 
 # other
-mod 'saz-sudo', '9.0.2'
-mod 'saz-ssh', '13.1.0'
-mod 'saz-limits', '5.0.0'
-mod 'ghoneycutt-timezone', '4.0.0'
 mod 'ghoneycutt-puppet', '3.3.0'
+mod 'saz-sudo', '8.0.0'
+mod 'saz-ssh', '12.1.0'
+mod 'ghoneycutt-timezone', '4.0.0'
 mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
@@ -57,9 +52,6 @@ mod 'broadinstitute-certs', '3.0.1'
 mod 'stm-file_capability', '6.0.0'
 mod 'h0tw1r3-gitea', '3.2.0'
 mod 'rehan-mkdir', '2.0.0'
-mod 'tailoredautomation-patroni', '2.0.0'
-mod 'ssm-crypto_policies', '0.3.3'
-mod 'thias-sysctl', '1.0.8'
 
 mod 'bind',
   :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',

hieradata/common.yaml

@@ -3,10 +3,16 @@ lookup_options:
   hiera_classes:
     merge:
       strategy: deep
-  profiles::packages::include:
+  profiles::packages::install:
     merge:
       strategy: deep
-  profiles::packages::exclude:
+  profiles::packages::install_exclude:
+    merge:
+      strategy: deep
+  profiles::packages::remove:
+    merge:
+      strategy: deep
+  profiles::packages::remove_exclude:
     merge:
       strategy: deep
   profiles::pki::vault::alt_names:
@@ -129,24 +135,7 @@ lookup_options:
   certbot::client::domains:
     merge:
       strategy: deep
-  keepalived::vrrp_script:
-    merge:
-      strategy: deep
-  keepalived::vrrp_instance:
-    merge:
-      strategy: deep
-  profiles::etcd::node::initial_cluster_token:
-    convert_to: Sensitive
-  sysctl::base::values:
-    merge:
-      strategy: deep
-  limits::entries:
-    merge:
-      strategy: deep
-  zfs::zpools:
-    merge:
-      strategy: deep
-  zfs::datasets:
+  profiles::metrics::exportarr:
     merge:
       strategy: deep
 
@@ -156,9 +145,6 @@ hiera_include:
   - timezone
   - networking
   - ssh::server
-  - profiles::accounts::rundeck
-  - limits
-  - sysctl::base
 
 profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
 profiles::ntp::client::use_ntp: 'region'
@@ -171,10 +157,6 @@ profiles::ntp::client::peers:
 profiles::base::puppet_servers:
   - 'prodinf01n01.main.unkin.net'
 
-consul::install_method: 'package'
-consul::manage_repo: false
-consul::bin_dir: /usr/bin
-
 profiles::dns::master::basedir: '/var/named/sources'
 profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
 profiles::dns::base::use_ns: 'region'
@@ -193,70 +175,59 @@ profiles::consul::client::node_rules:
     segment: ''
     disposition: read
 
-profiles::packages::include:
-  bash-completion: {}
-  bzip2: {}
-  ccze: {}
-  curl: {}
-  dstat: {}
-  expect: {}
-  gzip: {}
-  git: {}
-  htop: {}
-  inotify-tools: {}
-  iotop: {}
-  jq: {}
-  lz4: {}
-  mtr: {}
-  ncdu: {}
-  neovim: {}
-  p7zip: {}
-  pbzip2: {}
-  pigz: {}
-  pv: {}
-  python3.11: {}
-  rsync: {}
-  screen: {}
-  socat: {}
-  strace: {}
-  sysstat: {}
-  tar: {}
-  tmux: {}
-  traceroute: {}
-  unzip: {}
-  vim: {}
-  vnstat: {}
-  wget: {}
-  zsh: {}
-  zstd: {}
-  iwl100-firmware:
-    ensure: absent
-  iwl1000-firmware:
-    ensure: absent
-  iwl105-firmware:
-    ensure: absent
-  iwl135-firmware:
-    ensure: absent
-  iwl2000-firmware:
-    ensure: absent
-  iwl2030-firmware:
-    ensure: absent
-  iwl3160-firmware:
-    ensure: absent
-  iwl5000-firmware:
-    ensure: absent
-  iwl5150-firmware:
-    ensure: absent
-  iwl6000-firmware:
-    ensure: absent
-  iwl6000g2a-firmware:
-    ensure: absent
-  iwl6050-firmware:
-    ensure: absent
-  iwl7260-firmware:
-    ensure: absent
-  puppet7-release:
-    ensure: absent
+profiles::packages::install:
+  - bash-completion
+  - bzip2
+  - ccze
+  - curl
+  - dstat
+  - expect
+  - gcc
+  - gzip
+  - git
+  - htop
+  - inotify-tools
+  - iotop
+  - jq
+  - lz4
+  - mtr
+  - ncdu
+  - neovim
+  - p7zip
+  - pbzip2
+  - pigz
+  - pv
+  - python3.11
+  - rsync
+  - screen
+  - socat
+  - strace
+  - sysstat
+  - tar
+  - tmux
+  - traceroute
+  - unzip
+  - vim
+  - vnstat
+  - wget
+  - zsh
+  - zstd
+
+profiles::packages::remove:
+  - iwl100-firmware
+  - iwl1000-firmware
+  - iwl105-firmware
+  - iwl135-firmware
+  - iwl2000-firmware
+  - iwl2030-firmware
+  - iwl3160-firmware
+  - iwl5000-firmware
+  - iwl5150-firmware
+  - iwl6000-firmware
+  - iwl6000g2a-firmware
+  - iwl6050-firmware
+  - iwl7260-firmware
+  - puppet7-release
 
 profiles::base::scripts::scripts:
   puppet: puppetwrapper.py
@@ -325,8 +296,6 @@ sudo::configs:
 
 profiles::accounts::sysadmin::sshkeys:
   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ8SRLlPiDylBpdWR9LpvPg4fDVD+DZst4yRPFwMMhta4mnB1H9XuvZkptDhXywWQ7QIcqa2WbhCen0OQJCtwn3s7EYtacmF5MxmwBYocPoK2AArGuh6NA9rwTdLrPdzhZ+gwe88PAzRLNzjm0ZBR+mA9saMbPJdqpKp0AWeAM8QofRQAWuCzQg9i0Pn1KDMvVDRHCZof4pVlHSTyHNektq4ifovn0zhKC8jD/cYu95mc5ftBbORexpGiQWwQ3HZw1IBe0ZETB1qPIPwsoJpt3suvMrL6T2//fcIIUE3TcyJKb/yhztja4TZs5jT8370G/vhlT70He0YPxqHub8ZfBv0khlkY93VBWYpNGJwM1fVqlw7XbfBNdOuJivJac8eW317ZdiDnKkBTxapThpPG3et9ib1HoPGKRsd/fICzNz16h2R3tddSdihTFL+bmTCa6Lo+5t5uRuFjQvhSLSgO2/gRAprc3scYOB4pY/lxOFfq3pU2VvSJtRgLNEYMUYKk= ben@unkin.net
-profiles::accounts::rundeck::sshkeys:
-  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD4F7VcorbGpyZzBFexz7c/o1JBscrl7hZU0UkWV7fq6YLizW0r6fOzD99hMwu1kdYCjPxbvuUSDEHfyBIp2EgLWU6wFVoufQqlMyOV85+ivQZUc1VNV+X9T+U4v3u/01hkAmlpXtbkwhMSR4Wi+tdABd04+D3CuMDM37mvnFmBBmi41X4Mr1rJhOQumn1XHQ7EYbsdw2mxfEVVeWpZIHz5BjNKSGzEIAYZbFt6s0Y7X3J5RT+Gjqmu043Tc8nNIUFlR9E10qd3Euf9RiBYxBx3z+yfOzJPBzWNBSHv1+PIbO5Mq+z5JaAfoFZO41L7nw+FjV6JJUCVLr6Vq+bCxyA7LW4Oq9ZahSrt/vrT0kTa0tA5U9bqK6e7pB//dm7PzoROtTq0XksV8RseA/fvIje20uaN1z9dynx+UcbszXu9pQ5GIg1o7b5DEi3OZHJwpgdudiCyEeR4+00G0z4PjpEMnTSMHAJ53WxtjzrPAOBnAmPE7hPu4coU+XrCWEXAvRMloJmca68e+zFX7VvFK82KVDuQ99vQ6w4X73IESKoLzyAVxpelwHaDG4fN+zqYfqubVQU1L5cUeYKxqm5r3Us6VvMaYs1ZMUmDGXHOq4FNhGUJYxSjkLvunM6qyAAJQCd6Pw/2TV3UQVerbouGOZaeBLvRguHWSbDrO99Zu+t87w== rundeck_runner
 
 networking::interface_defaults:
   ensure: present

hieradata/country/au/region/syd1/infra/halb/haproxy.yaml

@@ -1,31 +1,4 @@
 ---
-hiera_include:
-  - keepalived
-
-# keepalived
-profiles::haproxy::dns::vrrp_ipaddr: '198.18.13.250'
-profiles::haproxy::dns::vrrp_cnames:
-  - sonarr.main.unkin.net
-  - radarr.main.unkin.net
-  - lidarr.main.unkin.net
-  - readarr.main.unkin.net
-  - prowlarr.main.unkin.net
-  - nzbget.main.unkin.net
-
-keepalived::vrrp_script:
-  check_haproxy:
-    script: '/usr/bin/killall -0 haproxy'
-
-keepalived::vrrp_instance:
-  VI_250:
-    interface: 'eth0'
-    virtual_router_id: 250
-    auth_type: 'PASS'
-    auth_pass: 'quiiK7oo'
-    virtual_ipaddress: '198.18.13.250/32'
-    track_script:
-      - check_haproxy
-
 # mappings
 profiles::haproxy::mappings:
   fe_http:
@@ -260,7 +233,6 @@ profiles::haproxy::dns::cnames:
   - au-syd1-pve-api.main.unkin.net
 
 # letsencrypt certificates
-certbot::client::service: haproxy
 certbot::client::domains:
   - au-syd1-pve.main.unkin.net
   - au-syd1-pve-api.main.unkin.net

hieradata/country/au/region/syd1/infra/sql/galera.eyaml

@@ -1,3 +1,2 @@
 ---
 mysql::db::grafana::pass: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAozi1vFf9KfwsGSdxXvhOWRn9Vqbr9AZ+cVJuIOmmLVZMRP4AJkkNgCCly+o1pxtMiU8EISUQuBWCBHUi+u2Y1YAjIABzTa2K+PCU7qqkdrJaxvKqmmKS7C/CWFKp1stYvYIvIofyvl9Q854nMcpvxQKL0PBGh3rIaUHHV3L0PH1UDLqL5j6OPXaNvKL4UzwMDDIVAd7F5yMbtSx2PT23pBLbPYsbG1jRx7pUS/d1ZE9E8h3OA2jxW/CBf68Sb2Xlrh7IAB/6RiLLpIsUyRMv9zrbPrMuKg/q5lzO0i9fejh5z3Z3YkdnhH61doUT/RSjAjz3JrWDGxomOSK0y8TxjjBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCg1kVqFs/mf4r+6EI32b8qgCBm6cL3JhVzj3Btit9D8VYU8mQcrIaXJZ3qF31zJMzCkw==]
-mysql::db::rundeck::pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAcWmZuTro0DNX8X/6DCJdmxm85hawng2cjSm/M26/sAzlr7i3XLIjg5TQc3BpeiKWZvQ2XZWygOEcW7g0bHH7FBS6XTXswDiLCf7ssd0DYL+eQbh4p6VijBKObug33fp4+YJaqGV7YRUNqBjXQv/SSmxFqbNaRahUqwbMidJCyjGNmfCfbSd9WxI4/8j0L38rjXR3/i+/xzgVIhgz/qymmw0rky6jN14YrwRIkdW6loMFzVd12tqdX9kh7UBdE7j58ntQgJSilQn2pLmQs6dgcXSOeIi8Sln4R0MfAtOQ1c6LoKMUdb7k8xEszpGbhX7sw51kpwvnL1LS6PQ+T8T9wDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDm1sAUc6LFtslrIuwk1JlJgDAngDM/0g4dpgyNOZDsvAU8OualEL6HZ2RFGfibteUc11wZzHkdFZlvHz2JZdO7Huo=]

hieradata/country/au/region/syd1/infra/sql/galera.yaml

@@ -13,12 +13,3 @@ mysql::db:
       - INSERT
       - UPDATE
       - DELETE
-  rundeck:
-    name: rundeck
-    user: rundeck
-    password: "%{alias('mysql::db::rundeck::pass')}"
-    grant:
-      - SELECT
-      - INSERT
-      - UPDATE
-      - DELETE

hieradata/nodes/ausyd1nxvm1015.main.unkin.net.yaml

@@ -5,9 +5,3 @@ networking::interfaces:
 networking::routes:
   default:
     gateway: 198.18.13.254
-
-profiles::haproxy::dns::vrrp_master: true
-keepalived::vrrp_instance:
-  VI_250:
-    state: 'MASTER'
-    priority: 101

hieradata/nodes/ausyd1nxvm1016.main.unkin.net.yaml

@@ -5,8 +5,3 @@ networking::interfaces:
 networking::routes:
   default:
     gateway: 198.18.13.254
-
-keepalived::vrrp_instance:
-  VI_250:
-    state: 'BACKUP'
-    priority: 100

hieradata/nodes/ausyd1nxvm1049.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.59
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1050.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.60
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1051.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.61
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1052.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.62
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1053.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.63
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1054.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.64
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1055.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.65
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1056.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.66
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1057.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.67
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1058.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.68
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1059.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.69
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1060.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.70
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1061.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.71
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1062.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.72
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1063.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.73
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1064.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.74
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.74
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.64.254/24'

hieradata/nodes/ausyd1nxvm1065.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.75
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.75
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.65.254/24'

hieradata/nodes/ausyd1nxvm1066.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.76
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.76
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.66.254/24'

hieradata/nodes/ausyd1nxvm1067.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.77
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.77
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.67.254/24'

hieradata/nodes/ausyd1nxvm1068.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.78
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.78
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.68.254/24'

hieradata/nodes/ausyd1nxvm1069.main.unkin.net.yaml

@@ -1,15 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.79
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.79
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-docker::bip: '198.18.69.254/24'

hieradata/nodes/ausyd1nxvm1070.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.80
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1071.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.81
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm2000.main.unkin.net.yaml

@@ -1,5 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.14  # management loopback
-networking::interfaces:
-  eth0:
-    mac: 00:16:3e:69:0f:3b

hieradata/nodes/ausyd1nxvm2001.main.unkin.net.yaml

@@ -1,5 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.15  # management loopback
-networking::interfaces:
-  eth0:
-    mac: 00:16:3e:55:46:bd

hieradata/nodes/ausyd1nxvm2002.main.unkin.net.yaml

@@ -1,5 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.16  # management loopback
-networking::interfaces:
-  eth0:
-    mac: 00:16:3e:6a:25:6b

hieradata/nodes/ausyd1nxvm2003.main.unkin.net.yaml

@@ -1,5 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.17  # management loopback
-networking::interfaces:
-  eth0:
-    mac: 00:16:3e:63:89:f2

hieradata/nodes/ausyd1nxvm2004.main.unkin.net.yaml

@@ -1,5 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.18  # management loopback
-networking::interfaces:
-  eth0:
-    mac: 00:16:3e:ca:e1:51

hieradata/nodes/prodnxsr0009.main.unkin.net.yaml

@@ -1,18 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.9  # management loopback
-networking_loopback1_ip: 198.18.22.9  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.9  # ceph-public loopback
-networking_br10_ip: 198.18.25.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:8d
-    ipaddress: 198.18.15.9
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:5d
-    ipaddress: 198.18.21.9
-
-#zfs::zpools:
-#  fastpool:
-#    ensure: present
-#    disk: /dev/nvme0n1

hieradata/nodes/prodnxsr0010.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.10  # management loopback
-networking_loopback1_ip: 198.18.22.10  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.10  # ceph-public loopback
-networking_br10_ip: 198.18.26.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:37
-    ipaddress: 198.18.15.10
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:de
-    ipaddress: 198.18.21.10

hieradata/nodes/prodnxsr0011.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.11  # management loopback
-networking_loopback1_ip: 198.18.22.11  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.11  # ceph-public loopback
-networking_br10_ip: 198.18.27.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:38:e9:0f
-    ipaddress: 198.18.15.11
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:55
-    ipaddress: 198.18.21.11

hieradata/nodes/prodnxsr0012.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.12  # management loopback
-networking_loopback1_ip: 198.18.22.12  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.12  # ceph-public loopback
-networking_br10_ip: 198.18.28.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:4f:05:1e
-    ipaddress: 198.18.15.12
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:e5
-    ipaddress: 198.18.21.12

hieradata/nodes/prodnxsr0013.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.13  # management loopback
-networking_loopback1_ip: 198.18.22.13  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.13  # ceph-public loopback
-networking_br10_ip: 198.18.29.254
-networking::interfaces:
-  enp2s0:
-    mac: 70:b5:e8:4f:04:b0
-    ipaddress: 198.18.15.13
-    gateway: 198.18.15.254
-  enp3s0:
-    mac: 00:e0:4c:68:0f:36
-    ipaddress: 198.18.21.13

hieradata/os/AlmaLinux/AlmaLinux8.yaml

@@ -1,23 +1,2 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
-crypto_policies::policy: 'DEFAULT'
-
-profiles::packages::include:
-  network-scripts: {}
-
-profiles::yum::global::repos:
-  powertools:
-    name: powertools
-    descr: powertools repository
-    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
-    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el8
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent

hieradata/os/AlmaLinux/AlmaLinux9.yaml

@@ -1,36 +1,2 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
-crypto_policies::policy: 'DEFAULT:SHA1'
-
-profiles::yum::global::repos:
-  baseos:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  extras:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  appstream:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  highavailability:
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  crb:
-    name: crb
-    descr: crb repository
-    target: /etc/yum.repos.d/crb.repo
-    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
-    mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el9
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent

hieradata/os/AlmaLinux/all_releases.yaml

@@ -3,16 +3,17 @@
 profiles::firewall::firewalld::ensure_package: 'absent'
 profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
-profiles::puppet::agent::puppet_version: '7.34.0'
+profiles::puppet::agent::puppet_version: '7.26.0'
 
 hiera_include:
   - profiles::almalinux::base
 
-profiles::packages::include:
-  lzo: {}
-  policycoreutils: {}
-  unar: {}
-  xz: {}
+profiles::packages::install:
+  - lzo
+  - network-scripts
+  - policycoreutils
+  - unar
+  - xz
 
 lm-sensors::package: lm_sensors
 
@@ -38,6 +39,13 @@ profiles::yum::global::repos:
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
+  powertools:
+    name: powertools
+    descr: powertools repository
+    target: /etc/yum.repos.d/powertools.repo
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
   highavailability:
     name: highavailability
     descr: highavailability repository
@@ -56,12 +64,12 @@ profiles::yum::global::repos:
     name: puppet
     descr: puppet repository
     target: /etc/yum.repos.d/puppet.repo
-    baseurl: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/
-    gpgkey: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-puppet-20250406
+    baseurl: https://yum.puppet.com/puppet7/el/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406
     mirrorlist: absent
-  unkinben:
-    name: unkinben
-    descr: unkinben repository
+  unkin:
+    name: unkin
+    descr: unkin repository
     target: /etc/yum.repos.d/unkin.repo
     baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
     gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key

hieradata/os/Debian/all_releases.yaml

@@ -1,19 +1,15 @@
 # hieradata/os/debian/all_releases.yaml
 ---
-profiles::apt::base::mirrorurl: http://edgecache.query.consul/debian/
+profiles::apt::base::mirrorurl: https://edgecache.query.consul/debian/
 profiles::apt::base::secureurl: http://security.debian.org/debian-security
 profiles::apt::puppet7::mirror: http://apt.puppetlabs.com
 profiles::apt::puppet7::repo: puppet7
 profiles::pki::vaultca::ca_cert-path: /usr/local/share/ca-certificates/
 
-profiles::packages::include:
-  lzop: {}
-  python3.11-venv: {}
-  xz-utils: {}
+profiles::packages::install:
+  - lzop
+  - python3.11-venv
+  - xz-utils
 
 lm-sensors::package: lm-sensors
 networking::nwmgr_dns_none: false
-
-consul::install_method: 'url'
-consul::manage_repo: false
-consul::bin_dir: /usr/local/bin

hieradata/roles/apps/jupyter/hub.eyaml

@@ -1 +0,0 @@
-profiles::jupyter::jupyterhub::ldap_bind_pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJspN3e2WzA0uZaLgFZ0Ewqii9dY0tTgbirsW70M2VZtLY+s+C6HE8ZZUtpfnRsFwUUhOj7s25X9xVOZNTpZIGPyfx9MWlSyFw2RFuXSEwaydf1DcBbg8261YrTTysA4Jsa1L4DLsX55q+XJUyeUbimVQkIacVIvzTdnZCBKnVNUh3U2PNAmV7SOL2KH8Jpbfs/EQfBt8XuGMCg3I/4RDyoNERqthW6W2KiMX2Gmd8iQ5+W9udH0lEAMx415oyImmN+dEuThcx9FGMi8BWYtnxH96yWafpT5qltwW6EVzIGWuLhiD1LcWYc5RB8jc3DhbeouChpKsN6c4EHoKt3aWsTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC8jcnqilJgY1/AnHWHfX4bgDCi2a3Rj43Z0dgfB5HaHdpfked3Cx+u94r2S5+Cg3QogU1AIF04rjzOL+bD2HdaMfo=]

hieradata/roles/apps/jupyter/hub.yaml

@@ -1,74 +0,0 @@
----
-profiles::packages::include:
-  python3.12: {}
-  python3.12-pip: {}
-
-hiera_include:
-  - docker
-  - profiles::nginx::simpleproxy
-
-# manage docker
-docker::version: latest
-docker::curl_ensure: false
-docker::root_dir: /data/docker
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'jupyterhub.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - jupyterhub.service.consul
-  - jupyterhub.query.consul
-  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
-profiles::nginx::simpleproxy::proxy_port: 8000
-profiles::nginx::simpleproxy::proxy_path: '/'
-profiles::nginx::simpleproxy::use_default_location: false
-nginx::client_max_body_size: 20M
-
-profiles::nginx::simpleproxy::locations:
-  # authorised access from external
-  default:
-    ensure: 'present'
-    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
-    ssl_only: true
-    location: '/'
-    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
-    proxy_set_header:
-      - 'Host $host'
-      - 'X-Real-IP $remote_addr'
-      - 'X-Forwarded-For $proxy_add_x_forwarded_for'
-      - 'X-Forwarded-Host $host'
-      - 'X-Forwarded-Proto $scheme'
-      - 'Upgrade $http_upgrade'
-      - 'Connection $http_connection'
-      - 'X-Scheme $scheme'
-    proxy_redirect: 'off'
-    proxy_http_version: '1.1'
-    proxy_buffering: 'off'
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - jupyterhub.service.consul
-  - jupyterhub.query.consul
-  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  jupyterhub:
-    service_name: 'jupyterhub'
-    tags:
-      - 'jupyterhub'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'jupyterhub_http_check'
-        name: 'jupyterhub HTTP Check'
-        http: "https://%{facts.networking.fqdn}"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: jupyterhub
-    disposition: write

hieradata/roles/apps/media/lidarr.yaml

@@ -2,6 +2,7 @@
 hiera_include:
   - lidarr
   - profiles::nginx::ldapauth
+  - profiles::metrics::exportarr
 
 # manage lidarr
 lidarr::params::user: lidarr
@@ -54,3 +55,11 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: lidarr
     disposition: write
+
+profiles::metrics::exportarr:
+  app: 'lidarr'
+  config_path: '/opt/lidarr/config.xml'
+  api_key: "%{hiera('lidarr::api_key')}"
+  version: '2.0.1'
+  app_port: "%hiera('lidarr::params::port')"
+  enable_additional_metrics: true

hieradata/roles/apps/media/nzbget.yaml

@@ -59,19 +59,3 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: nzbget
     disposition: write
-
-profiles::yum::global::repos:
-  rpmfusion-free:
-    name: rpmfusion-free
-    descr: rpmfusion-free repository
-    target: /etc/yum.repos.d/rpmfusion.repo
-    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
-    mirrorlist: absent
-  rpmfusion-nonfree:
-    name: rpmfusion-nonfree
-    descr: rpmfusion-nonfree repository
-    target: /etc/yum.repos.d/rpmfusion.repo
-    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
-    mirrorlist: absent

hieradata/roles/apps/media/prowlarr.yaml

@@ -2,6 +2,7 @@
 hiera_include:
   - prowlarr
   - profiles::nginx::ldapauth
+  - profiles::metrics::exportarr
 
 # manage prowlarr
 prowlarr::params::user: prowlarr
@@ -55,11 +56,10 @@ profiles::consul::client::node_rules:
     segment: prowlarr
     disposition: write
 
-profiles::nginx::simpleproxy::locations:
-  arrstack_web_external:
-    location_satisfy: any
-    location_allow:
-      - 198.18.13.47
-      - 198.18.13.50
-      - 198.18.13.51
-      - 198.18.13.52
+profiles::metrics::exportarr:
+  app: 'prowlarr'
+  config_path: '/opt/prowlarr/config.xml'
+  api_key: "%{hiera('prowlarr::api_key')}"
+  version: '2.0.1'
+  app_port: "%hiera('prowlarr::params::port')"
+  enable_additional_metrics: true

hieradata/roles/apps/media/radarr.yaml

@@ -2,6 +2,7 @@
 hiera_include:
   - radarr
   - profiles::nginx::ldapauth
+  - profiles::metrics::exportarr
 
 # manage radarr
 radarr::params::user: radarr
@@ -55,3 +56,11 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: radarr
     disposition: write
+
+profiles::metrics::exportarr:
+  app: 'radarr'
+  config_path: '/opt/radarr/config.xml'
+  api_key: "%{hiera('radarr::api_key')}"
+  version: '2.0.1'
+  app_port: "%hiera('radarr::params::port')"
+  enable_additional_metrics: true

hieradata/roles/apps/media/readarr.yaml

@@ -2,6 +2,7 @@
 hiera_include:
   - readarr
   - profiles::nginx::ldapauth
+  - profiles::metrics::exportarr
 
 # manage readarr
 readarr::params::user: readarr
@@ -54,3 +55,11 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: readarr
     disposition: write
+
+profiles::metrics::exportarr:
+  app: 'readarr'
+  config_path: '/opt/readarr/config.xml'
+  api_key: "%{hiera('readarr::api_key')}"
+  version: '2.0.1'
+  app_port: "%hiera('readarr::params::port')"
+  enable_additional_metrics: true

hieradata/roles/apps/media/sonarr.yaml

@@ -2,6 +2,7 @@
 hiera_include:
   - sonarr
   - profiles::nginx::ldapauth
+  - profiles::metrics::exportarr
 
 # manage sonarr
 sonarr::params::user: sonarr

hieradata/roles/infra.yaml

@@ -1,6 +1,6 @@
 ---
-profiles::packages::include:
-  policycoreutils: {}
+profiles::packages::install:
+  - policycoreutils
 
 puppetdb::master::config::create_puppet_service_resource: false
 #puppetdb::master::config::puppetdb_host: "%{lookup('profiles::puppet::puppetdb::puppetdb_host')}"

hieradata/roles/infra/auth/glauth.yaml

@@ -59,12 +59,6 @@ glauth::users:
       - 20014
       - 20015
       - 20016
-      - 20017
-      - 20018
-      - 20023
-      - 20024
-      - 20025   # jupyterhub_admin
-      - 20026   # jupyterhub_user
     loginshell: '/bin/bash'
     homedir: '/home/benvin'
     passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
@@ -88,109 +82,6 @@ glauth::users:
     loginshell: '/bin/bash'
     homedir: '/home/matsol'
     passsha256: '369263e2455a57c8c21388860c417b640fcf045a303cfc88def18c5197493600'
-  seablo:
-    user_name: 'seablo'
-    givenname: 'Sean'
-    sn: 'Bloomfield'
-    mail: 'seablo@users.main.unkin.net'
-    uidnumber: 20002
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/seablo'
-    passsha256: '2db12484b2b5fdae7f3a1f9f870143c363af14bf2c31a415a9a7afcb02520df2'
-  marbal:
-    user_name: 'marbal'
-    givenname: 'Mark'
-    sn: 'Balch'
-    mail: 'marbal@users.main.unkin.net'
-    uidnumber: 20003
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/marbal'
-    passsha256: 'cc20cee6269b9970a76549c66b51d0c543352796180d4122260a47f0f7a442a9'
-  kelren:
-    user_name: 'kelren'
-    givenname: 'Kelly'
-    sn: 'Rennie'
-    mail: 'kelren@users.main.unkin.net'
-    uidnumber: 20004
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/kelren'
-    passsha256: '5b01659bca1ecb27847d2f746fab03eb169879ebcc86547024753dac7cb184c4'
-  ryadun:
-    user_name: 'ryadun'
-    givenname: 'Ryan'
-    sn: 'Dunbar'
-    mail: 'ryadun@users.main.unkin.net'
-    uidnumber: 20005
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/ryadun'
-    passsha256: 'ee17174d49545f6f7257ae79eb173de4acf2b2edf55e181de90decd0e4b4e617'
-  margol:
-    user_name: 'margol'
-    givenname: 'Maree'
-    sn: 'Goldsworthy'
-    mail: 'margol@users.main.unkin.net'
-    uidnumber: 20006
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-    loginshell: '/bin/bash'
-    homedir: '/home/margol'
-    passsha256: '31a66085fb7eaeb059e51d1376233db72b54f96a6c45947aafbb350c83e618ef'
-  sudobo:
-    user_name: 'sudobo'
-    givenname: 'Sudaporn'
-    sn: 'Obom'
-    mail: 'sudobo@users.main.unkin.net'
-    uidnumber: 20007
-    primarygroup: 20000
-    othergroups:
-      - 20010 # jelly
-      - 20011 # sonarr
-      - 20012 # radarr
-      - 20013 # lidarr
-      - 20014 # readarr
-      - 20016 # nzbget
-      - 20026 # jupyterhub_user
-    loginshell: '/bin/bash'
-    homedir: '/home/sudobo'
-    passsha256: 'a326e049c2a615226877946220a978a0a8247c569be1adcd73539b09b14136d0'
 
 glauth::services:
   svc_jellyfin:
@@ -235,38 +126,6 @@ glauth::services:
     uidnumber: 30006
     primarygroup: 20001
     passsha256: 'c9d38f687fcbea754a9f78675d89276d2347f9d15190fff267c3ae1a75f61be6'
-  svc_nzbsubmit:
-    service_name: 'svc_nzbsubmit'
-    mail: 'nzbsubmit@service.main.unkin.net'
-    uidnumber: 30007
-    primarygroup: 20001
-    othergroups:
-      - 20016
-    passsha256: '7af7e12fdc56e9050d16c167f4e34091ad3cf938283e13451b35f9b3d212bfa2'
-  svc_rundeck:
-    service_name: 'svc_rundeck'
-    mail: 'rundeck@service.main.unkin.net'
-    uidnumber: 30007
-    primarygroup: 20001
-    passsha256: 'b27786b22c5938d24ffc9be049de366b055c9f054bf38fb73bbd6fba9e1bd525'
-  svc_terraform:
-    service_name: 'svc_terraform'
-    mail: 'terraform@service.main.unkin.net'
-    uidnumber: 30008
-    primarygroup: 20001
-    passsha256: 'b27786b22c5938d24ffc9be049de366b055c9f054bf38fb73bbd6fba9e1bd525'
-  svc_vault:
-    service_name: 'svc_vault'
-    mail: 'vault@service.main.unkin.net'
-    uidnumber: 30009
-    primarygroup: 20001
-    passsha256: 'd63b04884d5c7d630b0c06896046065a0926ac5c3d6177ef85320e5fa1be00b9'
-  svc_jupyterhub:
-    service_name: 'svc_jupyterhub'
-    mail: 'jupyterhub@service.main.unkin.net'
-    uidnumber: 30010
-    primarygroup: 20001
-    passsha256: '09db1e0c2498214da35f3f2ed46a90a7b90635c207f8725e7abf76b48345a39b'
 
 glauth::groups:
   users:
@@ -296,33 +155,3 @@ glauth::groups:
   nzbget_access:
     group_name: 'nzbget_access'
     gidnumber: 20016
-  rundeck_access:
-    group_name: 'rundeck_access'
-    gidnumber: 20017
-  rundeck_globaladmin:
-    group_name: 'rundeck_globaladmin'
-    gidnumber: 20018
-  rundeck_selfservice_admin:
-    group_name: 'rundeck_selfservice_admin'
-    gidnumber: 20019
-  rundeck_selfservice_user:
-    group_name: 'rundeck_selfservice_user'
-    gidnumber: 20020
-  rundeck_infrastructure_admin:
-    group_name: 'rundeck_infrastructure_admin'
-    gidnumber: 20021
-  rundeck_infrastructure_user:
-    group_name: 'rundeck_infrastructure_user'
-    gidnumber: 20022
-  vault_access:
-    group_name: 'vault_access'
-    gidnumber: 20023
-  vault_admin:
-    group_name: 'vault_admin'
-    gidnumber: 20024
-  jupyterhub_admin:
-    group_name: 'jupyterhub_admin'
-    gidnumber: 20025
-  jupyterhub_user:
-    group_name: 'jupyterhub_user'
-    gidnumber: 20026

hieradata/roles/infra/automation/rundeck.yaml

@@ -1,205 +0,0 @@
----
-hiera_include:
-  - profiles::rundeck::server
-  - profiles::nginx::simpleproxy
-
-hiera_exclude:
-  - profiles::accounts::rundeck
-
-profiles::packages::exclude:
-  - jq
-
-profiles::ssh::sign::principals:
-  - rundeck.main.unkin.net
-  - rundeck.service.consul
-  - rundeck.query.consul
-
-# manage a simple nginx reverse proxy
-profiles::nginx::simpleproxy::nginx_vhost: 'rundeck.query.consul'
-profiles::nginx::simpleproxy::nginx_aliases:
-  - rundeck.main.unkin.net
-  - rundeck.service.consul
-  - rundeck.query.consul
-  - "rundeck.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::nginx::simpleproxy::proxy_port: 4440
-profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 20M
-# additional altnames
-profiles::pki::vault::alt_names:
-  - rundeck.main.unkin.net
-  - rundeck.service.consul
-  - rundeck.query.consul
-  - "rundeck.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  rundeck:
-    service_name: 'rundeck'
-    tags:
-      - 'automation'
-      - 'rundeck'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'glauth_http_check'
-        name: 'glauth HTTP Check'
-        http: "http://%{facts.networking.fqdn}:4440"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: rundeck
-    disposition: write
-
-profiles::rundeck::server::mysql_backend: true
-profiles::rundeck::server::mysql_host: mariadb-prod.service.au-syd1.consul
-profiles::rundeck::server::grails_server_url: https://rundeck.service.consul
-profiles::rundeck::server::auth_config:
-  file:
-    auth_flag: 'sufficient'
-    jaas_config:
-      file: '/etc/rundeck/realm.properties'
-    realm_config:
-      admin_user: 'admin'
-      admin_password: "%{hiera('rundeck_admin_pass')}"
-  ldap:
-    jaas_config:
-      debug: 'true'
-      providerUrl: 'ldap://ldap.service.consul:389'
-      bindDn: 'cn=svc_rundeck,ou=services,ou=users,dc=main,dc=unkin,dc=net'
-      bindPassword: "%{hiera('ldap_bindpass')}"
-      authenticationMethod: 'simple'
-      forceBindingLogin: 'true'
-      userBaseDn: 'ou=people,ou=users,dc=main,dc=unkin,dc=net'
-      userRdnAttribute: 'uid'
-      userIdAttribute: 'uid'
-      userPasswordAttribute: 'userPassword'
-      userObjectClass: 'posixAccount'
-      roleBaseDn: 'ou=groups,dc=main,dc=unkin,dc=net'
-      roleNameAttribute: 'uid'
-      roleMemberAttribute: 'uniqueMember'
-      roleObjectClass: 'groupOfUniqueNames'
-      nestedGroups: 'true'
-
-profiles::rundeck::server::key_storage_config:
-  - type: 'db'
-    path: 'keys'
-  - type: 'vault-storage'
-    path: 'vault'
-    config:
-      prefix: 'rundeck'
-      address: https://vault.query.consul:8200
-      storageBehaviour: 'vault'
-      secretBackend: rundeck
-      engineVersion: '2'
-      authBackend: approle
-      approleAuthMount: approle
-      approleId: "%{hiera('vault::roleid')}"
-
-profiles::rundeck::server::cli_projects:
-  Self-Service:
-    update_method: 'set'
-    config:
-      project.description: 'self-service tasks'
-      project.disable.executions: 'false'
-  Infrastructure:
-    config:
-      project.description: 'infrastructure management'
-      project.disable.schedule: 'false'
-
-profiles::rundeck::server::acl_policies:
-  global_admin_policy:
-    acl_policies:
-      - description: 'Global Admin, all access'
-        context:
-          application: "rundeck"
-        for:
-          project:
-            - allow: '*'
-          resource:
-            - allow: '*'
-          storage:
-            - allow: '*'
-        by:
-          - group: ['rundeck_globaladmin']
-      - description: 'Global Admin, all access'
-        context:
-          project: '.*'
-        for:
-          resource:
-            - allow: '*'
-          adhoc:
-            - allow: '*'
-          job:
-            - allow: '*'
-          node:
-            - allow: '*'
-        by:
-          - group: ['rundeck_globaladmin']
-  selfservice_admin_policy:
-    acl_policies:
-      - description: 'Admin, all access for Self-Service project'
-        context:
-          project: 'Self-Service'
-        for:
-          resource:
-            - allow: '*'
-          adhoc:
-            - allow: '*'
-          job:
-            - allow: '*'
-          node:
-            - allow: '*'
-        by:
-          - group: ['rundeck_selfserice_admin']
-  selfservice_user_policy:
-    acl_policies:
-      - description: 'Users can execute tasks but not edit for Self-Service project'
-        context:
-          project: 'Self-Service'
-        for:
-          resource:
-            - allow: ['read']
-          adhoc:
-            - allow: ['run']
-          job:
-            - allow: ['read', 'run']
-          node:
-            - allow: ['read', 'run']
-        by:
-          - group: ['rundeck_selfserice_user']
-  infrastructure_admin_policy:
-    acl_policies:
-      - description: 'Admin, all access for Infrastructure project'
-        context:
-          project: 'Infrastructure'
-        for:
-          resource:
-            - allow: '*'
-          adhoc:
-            - allow: '*'
-          job:
-            - allow: '*'
-          node:
-            - allow: '*'
-        by:
-          - group: ['rundeck_infrastructure_admin']
-  infrastructure_user_policy:
-    acl_policies:
-      - description: 'Users can execute tasks but not edit for Infrastructure project'
-        context:
-          project: 'Infrastructure'
-        for:
-          resource:
-            - allow: ['read']
-          adhoc:
-            - allow: ['run']
-          job:
-            - allow: ['read', 'run']
-          node:
-            - allow: ['read', 'run']
-        by:
-          - group: ['rundeck_infrastructure_user']

hieradata/roles/infra/cobbler/server.yaml

@@ -1,15 +1,15 @@
 ---
-profiles::packages::include:
-  cobbler: {}
-  cobbler3.2-web: {}
-  httpd: {}
-  syslinux: {}
-  dnf-plugins-core: {}
-  debmirror: {}
-  pykickstart: {}
-  fence-agents: {}
-  selinux-policy-devel: {}
-  ipxe-bootimgs: {}
+profiles::packages::install:
+  - cobbler
+  - cobbler3.2-web
+  - httpd
+  - syslinux
+  - dnf-plugins-core
+  - debmirror
+  - pykickstart
+  - fence-agents
+  - selinux-policy-devel
+  - ipxe-bootimgs
 
 profiles::pki::vault::alt_names:
   - cobbler.main.unkin.net

hieradata/roles/infra/db/redis.eyaml

@@ -1,2 +0,0 @@
----
-redisha::masterauth: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAV8znsSGAbPpPUhAcyOIWFltVyAcx3yVcIvC+JFndkkuVBT1813GSURrXIreXSilvJEHlwRC03A9NhjWJSsHBIS12uUb+7ap95oh2JJ7OHmeWSVD1GDDRpTQAgDEOikAnioRNJfQ83jUa11nJrsavt46hSq8vDq+rZ2P8ugiNk59mNX5vgYthCPXcEJd7UmpLZhgxZ8+42l4TKo7QpqKRcIMteJXk1NvyYfYGnGTZhknuyHM3xPGauGjKzamMlTzD9dGnn2K0/Q7I4PUyT24ZEG3kNVyDlVHTYcKnIT5q8qvmJdDQfZwOETF3SrzcqhQ2nqFvmI19sCTsQVmveb/2ITBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC9KML3vzwF4vGZdtiu++jmgDAWPZspCckgoXPkgNRMePov3pXSlKUAGxwmdsuIM75rJMxlSTiil2lzMMBWXmUofys=]

hieradata/roles/infra/db/redis.yaml

@@ -1,67 +0,0 @@
----
-# additional altnames
-profiles::pki::vault::alt_names:
-  - redis.main.unkin.net
-  - redis.service.consul
-  - redis.query.consul
-  - "redis.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - redis.main.unkin.net
-  - redis.service.consul
-  - redis.query.consul
-
-
-hiera_include:
-  - redisha
-
-redisha::manage_repo: false
-redisha::redisha_members_lookup: true
-redisha::redisha_members_role: roles::infra::db::redis
-#redisha::redis::requirepass: "%{hiera('redisha::masterauth')}"
-#redisha::redis::masterauth: "%{hiera('redisha::masterauth')}"
-redisha::sentinel::master_name: "%{facts.country}-%{facts.region}"
-redisha::sentinel::requirepass: "%{hiera('redisha::masterauth')}"
-redisha::sentinel::auth_pass: "%{hiera('redisha::masterauth')}"
-redisha::tools::requirepass: "%{hiera('redisha::masterauth')}"
-
-sudo::configs:
-  consul:
-    priority: 20
-    content: |
-      consul ALL=(ALL) NOPASSWD: /usr/local/sbin/sentineladm info
-consul::services:
-  redis-replica:
-    service_name: "redis-replica-%{facts.environment}"
-    tags:
-      - 'redis'
-      - 'redis-replica'
-    address: "%{facts.networking.ip}"
-    port: 6379
-    checks:
-      - id: 'redis-replica_tcp_check'
-        name: 'Redis Replica TCP Check'
-        tcp: "%{facts.networking.ip}:6379"
-        interval: '10s'
-        timeout: '1s'
-  redis-master:
-    service_name: "redis-master-%{facts.environment}"
-    tags:
-      - 'redis'
-      - 'redis-master'
-    address: "%{facts.networking.ip}"
-    port: 6379
-    checks:
-      - id: 'redis-master_tcp_check'
-        name: "Redis Master Check"
-        args:
-          - '/usr/local/bin/check_redis_master'
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: "redis-replica-%{facts.environment}"
-    disposition: write
-  - resource: service
-    segment: "redis-master-%{facts.environment}"
-    disposition: write

hieradata/roles/infra/dns/resolver.yaml

@@ -10,30 +10,6 @@ profiles::dns::resolver::acls:
       - 198.18.15.0/24
       - 198.18.16.0/24
       - 198.18.17.0/24
-      - 198.18.18.0/24
-      - 198.18.19.0/24
-      - 198.18.20.0/24
-      - 198.18.21.0/24
-      - 198.18.22.0/24
-      - 198.18.23.0/24
-  acl-dmz:
-    addresses:
-      - 198.18.24.0/24
-  acl-common:
-    addresses:
-      - 198.18.25.0/24
-      - 198.18.26.0/24
-      - 198.18.27.0/24
-      - 198.18.28.0/24
-      - 198.18.29.0/24
-  acl-nomad-jobs:
-    addresses:
-      - 198.18.64.0/24
-      - 198.18.65.0/24
-      - 198.18.66.0/24
-      - 198.18.67.0/24
-      - 198.18.68.0/24
-      - 198.18.69.0/24
 
 profiles::dns::resolver::zones:
   8.10.10.in-addr.arpa-forward:
@@ -57,6 +33,13 @@ profiles::dns::resolver::zones:
       - 10.10.16.32
       - 10.10.16.33
     forward: 'only'
+  unkin.net-forward:
+    domain: 'unkin.net'
+    zone_type: 'forward'
+    forwarders:
+      - 10.10.16.32
+      - 10.10.16.33
+    forward: 'only'
   dmz.unkin.net-forward:
     domain: 'dmz.unkin.net'
     zone_type: 'forward'
@@ -84,6 +67,7 @@ profiles::dns::resolver::views:
     recursion: true
     zones:
       - main.unkin.net-forward
+      - unkin.net-forward
       - dmz.unkin.net-forward
       - network.unkin.net-forward
       - prod.unkin.net-forward
@@ -98,5 +82,3 @@ profiles::dns::resolver::views:
       - 20.10.10.in-addr.arpa-forward
     match_clients:
       - acl-main.unkin.net
-      - acl-nomad-jobs
-      - acl-common

hieradata/roles/infra/droneci.eyaml

@@ -1,2 +0,0 @@
----
-droneci_server::rpc_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAF8cEANj72ACYYdilP52Oz4EXVt+stx838tFVV4SFukoCTmN+kJ3GUUEM9x+oDvo17CsZhDzx5dX0JGo7N9MCLHsR4XKx3GSoAKvaSiD73TbzbdTNJgTIE1tRP9HNbJKizwWLo4lo+OUNtwnu0Z5dkMLYRHyvZ1hG24qmdXVn9DI06gVGQw9YXGmNy8AvA0BKnaHvUnE5XoLNVKZ4g1yvc/nkYpK6nLB+X4sZ96PRig7khiuFVvAfpg5c2iWnF13ljIajnG9uY12RyGaAGfH4l/d3UEyuHyQL4zzT8N7gGt8fvg7eNFx51TyEpVRFLyQ7dqq/lzn0moXVT35PQr9K3DBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCGJ+rkxhqmyUUiIQLG7PnggDBPH9gyYAW5/XjDp5xd6GnuSt/WWOwOGxhg+1BoPzbV5o+Xufg5zyMVdYeI1MWD/u8=]

hieradata/roles/infra/droneci/runner.yaml

@@ -1,25 +0,0 @@
----
-hiera_include:
-  - profiles::base::datavol
-  - docker
-  - droneci::runner
-
-docker::version: latest
-docker::curl_ensure: false
-
-droneci::runner::ports:
-  - 3000:3000
-droneci::runner::volumes:
-  - type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock
-  - type=bind,source=/data,target=/data
-  - type=bind,source=/etc/pki/tls/vault/certificate.crt,target=/etc/pki/tls/vault/certificate.crt,readonly
-  - type=bind,source=/etc/pki/tls/vault/private.key,target=/etc/pki/tls/vault/private.key,readonly
-  - type=bind,source=/etc/pki/tls/certs/ca-bundle.crt,target=/etc/pki/tls/certs/ca-bundle.crt,readonly
-  - type=bind,source=/etc/pki/tls/certs/ca-bundle.crt,target=/etc/ssl/certs/ca-certificates.crt,readonly
-droneci::runner::env_vars:
-  DRONE_RPC_PROTO: https
-  DRONE_RPC_HOST: droneci.query.consul
-  DRONE_RPC_SECRET: "%{hiera('droneci_server::rpc_secret')}"
-  DRONE_RUNNER_CAPACITY: 2
-  DRONE_RUNNER_NAME: "%{facts.networking.fqdn}"
-  DRONE_RUNNER_VOLUMES: /etc/pki/tls/certs/ca-bundle.crt:/etc/ssl/certs/ca-certificates.crt

hieradata/roles/infra/droneci/server.eyaml

@@ -1,6 +0,0 @@
----
-droneci_server::gitea_client_secret: ENC[PKCS7,MIIBqQYJKoZIhvcNAQcDoIIBmjCCAZYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJLcMKV4EevB8V/vjex+Srq47pWLvPozjSb+vjS/crFpKq3/dgtkJ8WkqF98fPnXxkMowP/BpNexJBCmPtTR2pPTKHIYkXjxGax0g3P2gcgeT7wsNl24mnUJDWZs1/z8ibwUXv4Zg0nbKi+YdomjsvT3vl2IPI88TKZDkq6HBoturwqx2l/edC5IeAi8vgPRXF8hn2TVuslkmoNXoI28Qp10b2XNOCss6KUJ4rbOwpIgdOVFbXqi7CFjhGz/3uS9xK+2m3iuE/gXi8KSKfiQ+QcGuXL9Zy5PH5rrNg4mbrFiaFfTevsHInl1wwRmULilQ0kEY3NW4b/URXqBBuwcN/TBsBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDlv7tA+6OQwDuL7z3xGYZjgEBcEAj3TQ9R9TntxTyBa9mKFRXimFTDDxdZ2zD96qFNz+7ZZFGD6pFQNHSMC9AYlAue94UsIHJZaXwgAo5zc98Q]
-droneci_server::cookie_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAKTWrB7Cca8RgFEeP46puzhVWOAiI6nB+m5+/sgz1qNnn6VgNh9Q6D26p9HISrMp4k60KVuGXrIbZYpkvKZmv4zHgK2et+50sr/F1anhDRX4rsmGWVV9n8VhaIJFAyQkW4de9YxV9LAgk0tWs1BgfXv4cV4+sDBv0OSVIFJDst3LUWpBR6lsiV9IifvNNUrdOHkdt5XjuL4JVmc0nkjetAg9HSvJ9VHYLIQagFHnTQp0FWluE1/ibGNc2kz7D4K7cPz2bBxRJWomckSUwgQK0NrGID4D13haZXhKXAO/8QpQOwPra8vD9FYrFenMeFLwdw43NzSr2g/W1ss5PekbWGjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBASshs2UwkGqK4ShFfXni7cgDCDCnEiqcfxIz4X/Bq71IpRKan3uQbHOewFqjNGqoR+1oWupjRxzNL39H9YF1a6i6s=]
-droneci_server::database_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEASu4C45TYWZKgIoyqC3YdwYYXn+T+ruP6oIvhYFJ5dxeZ+6HtWbRMViErvpPuWYfgs5qt6Zj9eLz2hqimFCvKiAvzANeZ9hkhw/jkpmvG8iXpDFw6x8QKcPJteRo896KSLiGiVlZfRbgQCGAqiEMw6y6M9CvfCLzE/mZ9gOKjSJVKiioAnXU2fyq0Y0M6g0iLRw0VXl2BVc4ORCnVECARQPo48T3U+TT39q0ar4mRO1AFO0VA5iDJ6/EMPBcH3ekKO/1dB1UbV6VkD3s9BAHGyL5a5Wr6ztg/5Yl6VBCXmECZqpCx8jx8KDUoaj1R/+I83YQxbw9ch76j79haIK6+jzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAh6MmfbUELaWbSNZ9/Dev2gDD/E3G/uYJGXNGl1+PIVwGmi0z2BTXNqg7ax/b/uF5Xc9ZtBSPiSxR6BPRXN3GleNo=]
-droneci_server::postgres_password: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEANpDnrpratpuYheXFrN4nwRTauPm9rZz2ubDyJlcxmah+kOWqsWIeEkv5GuATlymfAx5UuHPOv3dJPCSK+YuyQY+kGW/8uEFM68QrNi38NdRqEpdXuPBe5+AmWxcjYK3mdJ4maEwsbbxtYJmD8TF6kskS2P/KhnIzYR5PPHZTaYbEf/W5Da3l+J5WnFYpStuLq+86yZokBAygFPI+y/Ic+zJIdhpzVdLyGuqxGLXZq7nNMrjuNyFPKkCj1BBpuJTMCS4oPKCUTlm5hIIeeC2pFREI0CMTV5siZB8NphobPNn/ZbJrcs9q75LtIa47pkFYRbmV4WPctCwZXg6jtMleuzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDHJaChyidZq/5FN5n+ASJWgDCqUcR/DG9e8AD7fRmTb5BZM8XQ77a1hUJoaCycnMQ/5UyKmqU/7fLPrsxCf2vZU1M=]
-droneci_server::redis_password: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAYMoZlVXHC1qfkDptPy3PyWGrUs5y9M9AOv5Vn1AK6DYViixhjwPZUCfwTONmt7CiBuqmkDOpR5isWFiBo/+TMeMXlM9C/D+Svc9tpeHLpVaXAYeoz5um2InyBFkLWSaUaWSftF9U7O5Nv/OiLIsd7nn4T8Dd21rfUiRfUN/2HPLMCs+mW15Az9XNOcvfm+kPXDAcB+ukHde0vvtYTZEFWjMdwJjjE43DiCmAoLTcpvQxdlclojotBpFeBLZs/F21FDQ4hvBUvPBMuZ1o7ImSP5fuomYSFK8etbD7JO5gg5BN59lGl1ljyR83phv6wmmqlzB8wQl0pjEpni9o7fa9hTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCKJrkPA78qx3wAu1eroIjRgDA72N9U0YZf1MzACcGSOMU5RGO242RwlIKUrnuYcdC0dKkjLXtP+yVpSKkX5WxcsDQ=]

hieradata/roles/infra/droneci/server.yaml

@@ -1,79 +0,0 @@
----
-# additional altnames
-profiles::pki::vault::alt_names:
-  - droneci.main.unkin.net
-  - droneci.service.consul
-  - droneci.query.consul
-  - "droneci.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - droneci.main.unkin.net
-  - droneci.service.consul
-  - droneci.query.consul
-
-hiera_include:
-  - docker
-  - profiles::sql::postgresdb
-  - droneci
-
-docker::version: latest
-docker::curl_ensure: false
-
-profiles::sql::postgresdb::dbname: droneci
-profiles::sql::postgresdb::dbuser: droneci
-profiles::sql::postgresdb::dbpass: "%{hiera('droneci_server::postgres_password')}"
-profiles::sql::postgresdb::members_lookup: true
-profiles::sql::postgresdb::members_role: roles::infra::droneci::server
-
-droneci::ports:
-  - 80:80
-  - 443:443
-droneci::volumes:
-  - type=bind,source=/var/lib/drone,target=/data
-  - type=bind,source=/etc/pki/tls/vault/certificate.crt,target=/etc/pki/tls/vault/certificate.crt,readonly
-  - type=bind,source=/etc/pki/tls/vault/private.key,target=/etc/pki/tls/vault/private.key,readonly
-  - type=bind,source=/etc/pki/tls/certs/ca-bundle.crt,target=/etc/pki/tls/certs/ca-bundle.crt,readonly
-  - type=bind,source=/etc/pki/tls/certs/ca-bundle.crt,target=/etc/ssl/certs/ca-certificates.crt,readonly
-droneci::env_vars:
-  DRONE_GITEA_SERVER: https://git.query.consul
-  DRONE_GITEA_CLIENT_ID: dda67581-86df-4e65-88ae-1e505b849082
-  DRONE_USER_CREATE: username:unkinben,admin:true
-  DRONE_GITEA_CLIENT_SECRET: "%{hiera('droneci_server::gitea_client_secret')}"
-  DRONE_RPC_SECRET: "%{hiera('droneci_server::rpc_secret')}"
-  DRONE_SERVER_HOST: droneci.query.consul
-  DRONE_SERVER_PROTO: https
-  DRONE_TLS_CERT: /etc/pki/tls/vault/certificate.crt
-  DRONE_TLS_KEY: /etc/pki/tls/vault/private.key
-  DRONE_COOKIE_SECRET: "%{hiera('droneci_server::cookie_secret')}"
-  DRONE_COOKIE_TIMEOUT: 720h
-  DRONE_HTTP_SSL_REDIRECT: true
-  DRONE_HTTP_SSL_TEMPORARY_REDIRECT: true
-  DRONE_HTTP_SSL_HOST: droneci.query.consul
-  DRONE_LOGS_TEXT: true
-  DRONE_LOGS_PRETTY: true
-  DRONE_LOGS_COLOR: true
-  DRONE_DATABASE_SECRET: "%{hiera('droneci_server::database_secret')}"
-  DRONE_DATABASE_DRIVER: postgres
-  DRONE_DATABASE_DATASOURCE: "postgres://droneci:%{hiera('droneci_server::postgres_password')}@master.patroni-prod.service.au-syd1.consul:5432/droneci?sslmode=disable"
-  DRONE_REDIS_CONNECTION: "redis://%{hiera('droneci_server::redis_password')}@redis-master-prod.service.au-syd1.consul:6379/2"
-
-consul::services:
-  droneci:
-    service_name: 'droneci'
-    tags:
-      - 'drone'
-      - 'droneci'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'droneci_https_check'
-        name: 'droneci HTTPS Check'
-        http: "https://%{facts.networking.fqdn}:443"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: droneci
-    disposition: write

hieradata/roles/infra/etcd/node.eyaml

@@ -1,2 +0,0 @@
----
-profiles::etcd::node::initial_cluster_token: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAhLyXszXUU6Dkiw9bEJTH0RXGaV2751NzvLH94i7QHfNukvOslF/kaDOA+FwqG06xSKSKo24Qyj4ewYA3BzhN8XLf2E9uW2LuDrUoA6aXUP2tYPqiTw8zmmgsVV5t7Y5PeNcleV3KmfcJZJKp33yGCKtGF7ggvNvnied5slO6E1BDkcVnqO7sdyI0MqSvsvH4IvEmeiSWAcBRBnwVLIwfn10frIvUg0fH4uZR7DASfO/HstYWKAEacz4xYBv74TtVVtYHlPvnVwC20YIYDMrgBsm3XngyWIQvruQCgyIkRzHjUKCpp76HpyEqzdJdEdaywkODYNOT6ab1B5uUu9WaMjBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBADXLPOqFHdnVgJW5+iXJYcgCDK1Eyr+RwvMA+3VszYALU5B6OCH5maplwC5aUgiQZ7ew==]

hieradata/roles/infra/etcd/node.yaml

@@ -1,62 +0,0 @@
----
-hiera_include:
-  - profiles::etcd::node
-
-profiles::etcd::node::members_lookup: true
-profiles::etcd::node::members_role: roles::infra::etcd::node
-
-profiles::etcd::node::config:
-  data-dir: /data/etcd
-  client-cert-auth: false
-  client-transport-security:
-    cert-file: /etc/pki/tls/vault/certificate.crt
-    key-file: /etc/pki/tls/vault/private.key
-    client-cert-auth: false
-    auto-tls: false
-  peer-transport-security:
-    cert-file: /etc/pki/tls/vault/certificate.crt
-    key-file: /etc/pki/tls/vault/private.key
-    client-cert-auth: false
-    auto-tls: false
-  allowed-cn:
-  max-wals: 5
-  max-snapshots: 5
-  snapshot-count: 10000
-  heartbeat-interval: 100
-  election-timeout: 1000
-  cipher-suites: [
-    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-  ]
-  tls-min-version: 'TLS1.2'
-  tls-max-version: 'TLS1.3'
-
-profiles::pki::vault::alt_names:
-  - etcd.service.consul
-  - etcd.query.consul
-  - "etcd.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - etcd.query.consul
-  - etcd.service.consul
-  - etcd.service.%{facts.country}-%{facts.region}.consul
-
-consul::services:
-  etcd:
-    service_name: 'etcd'
-    tags:
-      - 'etcd'
-    address: "%{facts.networking.ip}"
-    port: 2379
-    checks:
-      - id: 'etcd_http_health_check'
-        name: 'ETCD HTTP Health Check'
-        http: "https://%{facts.networking.ip}:2379/health"
-        method: 'GET'
-        interval: '10s'
-        timeout: '1s'
-        tls_skip_verify: true
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: etcd
-    disposition: write

hieradata/roles/infra/git/gitea.yaml

@@ -41,7 +41,7 @@ profiles::nginx::simpleproxy::nginx_aliases:
   - "git.service.%{facts.country}-%{facts.region}.consul"
 profiles::nginx::simpleproxy::proxy_port: 3000
 profiles::nginx::simpleproxy::proxy_path: '/'
-nginx::client_max_body_size: 1024M
+nginx::client_max_body_size: 250M
 
 profiles::gitea::init::root:
   APP_NAME: 'Gitea'

hieradata/roles/infra/git/runner.eyaml

@@ -1 +0,0 @@
-profiles::gitea::runner::registration_token: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAOL/ug4IPhEW1n+Lq+SsMSEJUYsDDK2s0+oNF3unxcbH3QDqWo7kuYKkDWQ+W3otcxvuRlbC8+0W2fO2udhF7sSGrF93INsTCDqWlLnaaAgxlgNSXthA4OCJlI8DCLeD/Sr0TTCchUdpQrIpDo6Gh0EUjgRv5574q26or7c/vvtQ4nfLVQOqEV9UpsCgEYiQvXVcf55LEpgaDp4mFL0qCnfzDnGNbZ0GUo6552ka19IocqOqILPnZO0qDcEoLbQ90sP197+5Jw611i1Akx1C4lFP81bazFMpbdiEP0V4Ax+33LfZEb0KnXuMbKOF23vIwwwfpFJaSOAjA5YehA3xM2zBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDPJHB2uL+VEyntgZocyoMXgDBJ1dnRWiJM77XomzbNdDUO+ktIHLOTL5do0m4CkXZ1s42KtaAwWL+/EGdxg80UMC8=]

hieradata/roles/infra/git/runner.yaml

@@ -1,54 +0,0 @@
----
-hiera_include:
-  - docker
-  - profiles::gitea::runner
-
-docker::version: latest
-docker::curl_ensure: false
-docker::root_dir: /data/docker
-
-profiles::gitea::runner::home: /data/runner
-profiles::gitea::runner::version: '0.2.10'
-profiles::gitea::runner::source: "https://gitea.com/gitea/act_runner/releases/download/v%{hiera('profiles::gitea::runner::version')}/act_runner-%{hiera('profiles::gitea::runner::version')}-linux-amd64"
-profiles::gitea::runner::config:
-  log:
-    level: info
-  runner:
-    file: "%{hiera('profiles::gitea::runner::home')}/.runner"
-    capacity: 2
-    envs:
-      A_TEST_ENV_NAME_1: a_test_env_value_1
-      A_TEST_ENV_NAME_2: a_test_env_value_2
-    env_file: .env
-    timeout: 3h
-    insecure: false
-    fetch_timeout: 5s
-    fetch_interval: 2s
-    labels:
-      - "almalinux-latest"
-      - "almalinux-8:docker"
-      - "almalinux-8.10:docker"
-  cache:
-    enabled: true
-    dir: "%{hiera('profiles::gitea::runner::home')}/.cache/actcache"
-    host: ""
-    port: 0
-    external_server: ""
-  container:
-    network: ""
-    privileged: false
-    options:
-    workdir_parent: /workspace
-    valid_volumes: []
-    docker_host: ""
-    force_pull: true
-    force_rebuild: false
-  host:
-    workdir_parent: "%{hiera('profiles::gitea::runner::home')}/.cache/act"
-
-# enable ip forwarding for docker containers
-sysctl::base::values:
-  net.ipv4.conf.all.forwarding:
-    value: '1'
-  net.ipv6.conf.all.forwarding:
-    value: '1'

hieradata/roles/infra/incus/imagehost.yaml

@@ -1,125 +0,0 @@
----
-hiera_include:
-  - incus
-  - zfs
-
-profiles::packages::include:
-  bridge-utils: {}
-  dnsmasq: {}
-
-profiles::pki::vault::alt_names:
-  - incus-images.service.consul
-  - incus-images.query.consul
-  - "incus-images.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - incus-images.service.consul
-  - incus-images.query.consul
-  - "incus-images.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  incus-images:
-    service_name: 'incus-images'
-    tags:
-      - 'incus'
-      - 'images'
-      - 'container'
-      - 'lxd'
-    address: "%{facts.networking.ip}"
-    port: 8443
-    checks:
-      - id: 'incus_https_check'
-        name: 'incus HTTPS Check'
-        http: "https://%{facts.networking.fqdn}:8443"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: incus-images
-    disposition: write
-
-# additional repos
-profiles::yum::global::repos:
-  zfs-kmod:
-    name: zfs-kmod
-    descr: zfs-kmod repository
-    target: /etc/yum.repos.d/zfs-kmod.repo
-    baseurl: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-openzfs-2022
-    mirrorlist: absent
-
-# zfs settings
-zfs::manage_repo: false
-zfs::zfs_arc_min: ~
-zfs::zfs_arc_max: 429496729 # 400MB
-zfs::zpools:
-  fastpool:
-    ensure: present
-    disk: /dev/vdb
-    ashift: 12
-zfs::datasets:
-  fastpool:
-    canmount: 'off'
-    acltype: posix
-    atime: 'off'
-    relatime: 'off'
-    compression: 'zstd'
-    xattr: 'sa'
-  fastpool/data:
-    canmount: 'on'
-    mountpoint: '/data'
-  fastpool/data/incus:
-    canmount: 'on'
-    mountpoint: '/data/incus'
-
-# manage incus
-incus::init: true
-incus::server_port: 8443
-incus::storage_images_volume: fastpool/imagestore
-
-# add sysadmin to incus-admin group
-profiles::accounts::sysadmin::extra_groups:
-  - incus-admin
-
-# sysctl recommendations
-sysctl::base::values:
-  fs.aio-max-nr:
-    value: '524288'
-  fs.inotify.max_queued_events:
-    value: '1048576'
-  fs.inotify.max_user_instances:
-    value: '1048576'
-  fs.inotify.max_user_watches:
-    value: '1048576'
-  kernel.dmesg_restrict:
-    value: '1'
-  kernel.keys.maxbytes:
-    value: '2000000'
-  kernel.keys.maxkeys:
-    value: '2000'
-  net.core.bpf_jit_limit:
-    value: '1000000000'
-  net.ipv4.neigh.default.gc_thresh3:
-    value: '8192'
-  net.ipv6.neigh.default.gc_thresh3:
-    value: '8192'
-  vm.max_map_count:
-    value: '262144'
-  net.ipv4.conf.all.forwarding:
-    value: '1'
-  net.ipv6.conf.all.forwarding:
-    value: '1'
-
-# limits.d recommendations
-limits::entries:
-  '*/nofile':
-    both: 1048576
-  'root/nofile':
-    both: 1048576
-  '*/memlock':
-    both: unlimited
-  'root/memlock':
-    both: unlimited

hieradata/roles/infra/incus/node.yaml

@@ -1,220 +0,0 @@
----
-hiera_include:
-  - profiles::selinux::frr
-  - frrouting
-  - incus
-  - zfs
-
-profiles::packages::include:
-  bridge-utils: {}
-
-profiles::pki::vault::alt_names:
-  - incus.service.consul
-  - incus.query.consul
-  - "incus.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - incus.service.consul
-  - incus.query.consul
-  - "incus.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  incus:
-    service_name: 'incus'
-    tags:
-      - 'incus'
-      - 'container'
-      - 'lxd'
-    address: "%{facts.networking.ip}"
-    port: 8443
-    checks:
-      - id: 'incus_https_check'
-        name: 'incus HTTPS Check'
-        http: "https://%{facts.networking.fqdn}:8443"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: incus
-    disposition: write
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  zfs-kmod:
-    name: zfs-kmod
-    descr: zfs-kmod repository
-    target: /etc/yum.repos.d/zfs-kmod.repo
-    baseurl: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-openzfs-2022
-    mirrorlist: absent
-
-# networking
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-#networking::use_networkd: true
-networking::interfaces:
-  enp2s0:
-    type: physical
-    txqueuelen: 10000
-    forwarding: true
-  enp3s0:
-    type: physical
-    mtu: 9000
-    txqueuelen: 10000
-    forwarding: true
-  loopback0:
-    type: dummy
-    ipaddress: "%{hiera('networking_loopback0_ip')}"
-    netmask: 255.255.255.255
-    mtu: 9000
-  loopback1:
-    type: dummy
-    ipaddress: "%{hiera('networking_loopback1_ip')}"
-    netmask: 255.255.255.255
-    mtu: 9000
-  loopback2:
-    type: dummy
-    ipaddress: "%{hiera('networking_loopback2_ip')}"
-    netmask: 255.255.255.255
-    mtu: 9000
-
-# frrouting
-frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  enp2s0:
-    area: 0.0.0.0
-  enp3s0:
-    area: 0.0.0.0
-  loopback0:
-    area: 0.0.0.0
-  loopback1:
-    area: 0.0.0.0
-  loopback2:
-    area: 0.0.0.0
-  brmplscore:
-    area: 0.0.0.0
-frrouting::mpls_te_enabled: true
-frrouting::mpls_ldp_router_id: "%{hiera('networking_loopback0_ip')}"
-frrouting::mpls_ldp_transport_addr: "%{hiera('networking_loopback0_ip')}"
-frrouting::mpls_ldp_interfaces:
-  - loopback0
-  - enp2s0
-  - enp3s0
-  - brmplscore
-frrouting::daemons:
-  ldpd: true
-  ospfd: true
-
-# add loopback interfaces to ssh list
-ssh::server::options:
-  ListenAddress:
-    - "%{hiera('networking_loopback0_ip')}"
-
-# zfs settings
-zfs::manage_repo: false
-zfs::zfs_arc_min: ~
-zfs::zfs_arc_max: 4294967296 # 4GB
-zfs::zpools:
-  fastpool:
-    ensure: present
-    disk: /dev/nvme1n1
-    ashift: 12
-zfs::datasets:
-  fastpool:
-    canmount: 'off'
-    acltype: posix
-    atime: 'off'
-    relatime: 'off'
-    compression: 'zstd'
-    xattr: 'sa'
-  fastpool/data:
-    canmount: 'on'
-    mountpoint: '/data'
-  fastpool/data/incus:
-    canmount: 'on'
-    mountpoint: '/data/incus'
-
-# manage incus
-incus::init: true
-incus::bridge: br10
-incus::server_port: 8443
-incus::server_addr: "%{hiera('networking_loopback0_ip')}"
-
-# add sysadmin to incus-admin group
-profiles::accounts::sysadmin::extra_groups:
-  - incus-admin
-
-# sysctl recommendations
-sysctl::base::values:
-  fs.aio-max-nr:
-    value: '524288'
-  fs.inotify.max_queued_events:
-    value: '1048576'
-  fs.inotify.max_user_instances:
-    value: '1048576'
-  fs.inotify.max_user_watches:
-    value: '1048576'
-  kernel.dmesg_restrict:
-    value: '1'
-  kernel.keys.maxbytes:
-    value: '2000000'
-  kernel.keys.maxkeys:
-    value: '2000'
-  net.core.bpf_jit_limit:
-    value: '1000000000'
-  net.ipv4.neigh.default.gc_thresh3:
-    value: '8192'
-  net.ipv6.neigh.default.gc_thresh3:
-    value: '8192'
-  vm.max_map_count:
-    value: '262144'
-  net.ipv4.conf.all.forwarding:
-    value: '1'
-  net.ipv6.conf.all.forwarding:
-    value: '1'
-  net.ipv4.tcp_l3mdev_accept:
-    value: '0'
-  net.ipv4.conf.default.rp_filter:
-    value: '0'
-  net.ipv4.conf.all.rp_filter:
-    value: '0'
-  net.mpls.platform_labels:
-    value: '1048575'
-  net.mpls.conf.enp2s0.input:
-    value: '1'
-  net.mpls.conf.enp3s0.input:
-    value: '1'
-  net.mpls.conf.brmplscore.input:
-    value: '1'
-  net.mpls.conf.loopback0.input:
-    value: '1'
-
-# limits.d recommendations
-limits::entries:
-  '*/nofile':
-    both: 1048576
-  'root/nofile':
-    both: 1048576
-  '*/memlock':
-    both: unlimited
-  'root/memlock':
-    both: unlimited

hieradata/roles/infra/metrics/prometheus.yaml

@@ -9,5 +9,4 @@ profiles::metrics::server::scrape_jobs:
   - puppetdb
   - systemd
   - haproxy
-  - postgres
 profiles::metrics::server::localstorage: /data/prometheus

hieradata/roles/infra/mpls/rr.yaml

@@ -1,79 +0,0 @@
----
-hiera_include:
-  - profiles::selinux::frr
-  - frrouting
-
-# additional repos
-profiles::yum::global::repos:
-  frr-extras:
-    name: frr-extras
-    descr: frr-extras repository
-    target: /etc/yum.repos.d/frr-extras.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-  frr-stable:
-    name: frr-stable
-    descr: frr-stable repository
-    target: /etc/yum.repos.d/frr-stable.repo
-    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
-    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
-    mirrorlist: absent
-
-# networking
-systemd::manage_networkd: true
-systemd::manage_all_network_files: true
-networking::interfaces:
-  eth0:
-    dhcp: true
-    type: physical
-    mtu: 8000
-    forwarding: true
-  loopback0:
-    type: dummy
-    ipaddress: "%{hiera('networking_loopback0_ip')}"
-    netmask: 255.255.255.255
-    mtu: 8000
-
-# frrouting
-frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  loopback0:
-    area: 0.0.0.0
-frrouting::mpls_te_enabled: true
-frrouting::mpls_ldp_router_id: "%{hiera('networking_loopback0_ip')}"
-frrouting::mpls_ldp_transport_addr: "%{hiera('networking_loopback0_ip')}"
-frrouting::mpls_ldp_interfaces:
-  - eth0
-  - loopback0
-frrouting::daemons:
-  ldpd: true
-  ospfd: true
-
-# add loopback interfaces to ssh list
-ssh::server::options:
-  ListenAddress:
-    - "%{hiera('networking_loopback0_ip')}"
-
-# sysctl recommendations
-sysctl::base::values:
-  net.ipv4.conf.all.forwarding:
-    value: '1'
-  net.ipv6.conf.all.forwarding:
-    value: '1'
-  net.ipv4.tcp_l3mdev_accept:
-    value: '0'
-  net.ipv4.conf.default.rp_filter:
-    value: '0'
-  net.ipv4.conf.all.rp_filter:
-    value: '0'
-  net.mpls.platform_labels:
-    value: '1048575'
-  net.mpls.conf.eth0.input:
-    value: '1'
-  net.mpls.conf.loopback0.input:
-    value: '1'

hieradata/roles/infra/nomad/agent.eyaml

@@ -1,2 +0,0 @@
----
-ceph::key::media: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEzl2zX8ok6iURymPLbvkFE/dZhunzwisNCsLE5Tx6Pmil0PNx7iFULHXxWU6HMVOxzJmgcnTY+NsRnoTMSpXHGeC3wmD525T4xO4wvG/l9apzmPs1NTI4hcyYCj4NkAKyo249xXEodU4uM2AZp3ZgLBLf2cZpOe0/SPngWSq0kC4pJMnxWH+YsQ/O/1EMxpjSgMMna4YcMtcW2M0+wRhASNSTV7icsiAp6F/cInZuP44ASviHmM6+aMEhygBariOT80kaHZZI+aP6vqSd9lChXCV5qjRzeoEBIKOzT2ZBj41RTsF75J8UYFPwY7dp584tDpiIedUSR9IRCJe4d0uTjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCau9oXJiYiCGgvxZl62EsagDDgX2cU3+3QCkImEGS1oBahkPl3fYHKynbRi0ZQW1CoW0UFRzY8FmWmGkowns9OsIM=]

hieradata/roles/infra/nomad/agent.yaml

@@ -1,72 +0,0 @@
----
-
-hiera_include:
-  - docker
-  - docker::networks
-  - frrouting
-  - profiles::nomad::node
-
-docker::version: latest
-docker::curl_ensure: false
-docker::root_dir: /data/docker
-docker::ip_forward: true
-docker::ip_masq: false
-docker::iptables: false
-
-frrouting::ospfd_redistribute:
-  - connected
-frrouting::ospfd_interfaces:
-  eth0:
-    area: 0.0.0.0
-  ens19:
-    passive: true
-  docker0:
-    area: 0.0.0.1
-
-profiles::yum::global::repos:
-  ceph-reef:
-    name: ceph-reef
-    descr: ceph reef repository
-    target: /etc/yum.repos.d/ceph-reef.repo
-    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
-    gpgcheck: 0,
-    mirrorlist: absent
-
-profiles::ceph::client::keyrings:
-  nomad:
-    key: "%{hiera('ceph::key::media')}"
-
-profiles::packages::include:
-  nomad: {}
-  cni-plugins: {}
-
-profiles::nomad::node::client: true
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - client.global.nomad
-  - client.au-syd1.nomad
-  - nomad-client.service.consul
-  - nomad-client.query.consul
-  - "nomad-client.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: nomad-client
-    disposition: write
-  - resource: agent_prefix
-    segment: ''
-    disposition: read
-  - resource: node_prefix
-    segment: ''
-    disposition: write
-  - resource: service_prefix
-    segment: ''
-    disposition: write
-  - resource: key_prefix
-    segment: "nomad"
-    disposition: write
-  - resource: session_prefix
-    segment: ""
-    disposition: write

hieradata/roles/infra/nomad/server.yaml

@@ -1,34 +0,0 @@
----
-
-hiera_include:
-  - profiles::nomad::node
-
-profiles::packages::include:
-  nomad: {}
-
-profiles::nomad::node::server: true
-
-# additional altnames
-profiles::pki::vault::alt_names:
-  - client.global.nomad
-  - client.au-syd1.nomad
-  - server.global.nomad
-  - server.au-syd1.nomad
-  - nomad.service.consul
-  - nomad.query.consul
-  - "nomad.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: nomad
-    disposition: write
-  - resource: agent_prefix
-    segment: ''
-    disposition: read
-  - resource: node_prefix
-    segment: ''
-    disposition: write
-  - resource: service_prefix
-    segment: ''
-    disposition: write

hieradata/roles/infra/proxy/jumphost.yaml

@@ -1,29 +0,0 @@
-profiles::pki::vault::alt_names:
-  - jumphost.service.consul
-  - jumphost.query.consul
-  - "jumphost.service.%{facts.country}-%{facts.region}.consul"
-
-profiles::ssh::sign::principals:
-  - jumphost.query.consul
-  - jumphost.service.consul
-  - jumphost.service.%{facts.country}-%{facts.region}.consul
-
-consul::services:
-  jumphost:
-    service_name: 'jumphost'
-    tags:
-      - 'jumphost'
-      - 'proxy'
-      - 'ssh'
-    address: "%{facts.networking.ip}"
-    port: 22
-    checks:
-      - id: 'ssh_tcp_check'
-        name: 'SSH TCP Check'
-        tcp: "%{facts.networking.ip}:22"
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: jumphost
-    disposition: write

hieradata/roles/infra/puppet.yaml

@@ -1,3 +1,3 @@
 ---
-profiles::packages::include:
-  puppetserver: {}
+profiles::packages::install:
+  - puppetserver

hieradata/roles/infra/puppet/master.yaml

@@ -5,13 +5,6 @@ profiles::puppet::autosign::subnet_ranges:
   - '198.18.15.0/24'
   - '198.18.16.0/24'
   - '198.18.17.0/24'
-  - '198.18.20.0/24'
-  - '198.18.24.0/24'
-  - '198.18.25.0/24'
-  - '198.18.26.0/24'
-  - '198.18.27.0/24'
-  - '198.18.28.0/24'
-  - '198.18.29.0/24'
 
 profiles::puppet::autosign::domains:
   - '*.main.unkin.net'
@@ -26,7 +19,7 @@ profiles::puppet::cobbler_enc::packages:
   - 'requests'
   - 'PyYAML'
 profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-enc.git
-profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkin/puppet-r10k.git
+profiles::puppet::r10k::r10k_repo: https://git.service.au-syd1.consul/unkinben/puppet-r10k.git
 profiles::puppet::g10k::bin_path: '/opt/puppetlabs/bin/g10k'
 profiles::puppet::g10k::cfg_path: '/etc/puppetlabs/r10k/r10k.yaml'
 profiles::puppet::g10k::environments_path: '/etc/puppetlabs/code/environments'

hieradata/roles/infra/puppetboard/server.eyaml

@@ -1 +0,0 @@
-profiles::puppet::puppetboard::secret_key: ENC[PKCS7,MIIB+wYJKoZIhvcNAQcDoIIB7DCCAegCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAoCr9JTtrnMaVjJlEpA0NYNt/QAgTGiEmS3kPn2oJ80Ay7fUl79pop95uLQIfw6C3e8WGUhxYt31wmzent4Bfbced7uF/tjhP2cniKPmZGuf/tmVrGIHIh4T4g0Wz2K0DIU/dGWUlgE03ICRxXlAy0atjUuAp02ehj7bzLuMf+vZbghm8vnOoDCTKjeZNAJEkDvBkIzwUu9JiM9Gn6BzoLLGdEERqs/LR832vjjNmF7KUEH/Ntt47wbLdfCzawsZsBNLggEb1HNGu0aSb0qBXYBPRq6w1L/RU8gX2dCqGRbhDZymihebaOcwU1AtbLEBdHTYQpga+c4bcTz9rJplLtjCBvQYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQAdSjLEaZPK47TY7LDCB7b4CBkOTvHbi4nb+pB/Kng+Z3N9ocZPZdGbV6WzMNGxsxmhWXoi+XKEzEvfB10UhQwDcvZXd2W9hhiRkakq7+S0uLWzCX1jNMH2LXZAzoiyGM4FFvGpx7Z64OhmVrOJuKnxD+3zK6PZqvMb3g7CjZeAr5vyhcT/zO75krhJuYp11ZFpLCRcuASf0ru+Jq5OKD4+ZI/g==]

hieradata/roles/infra/reposync/syncer.yaml

@@ -1,162 +1,111 @@
 ---
-profiles::packages::include:
-  createrepo: {}
+profiles::packages::install:
+  - createrepo
 
-profiles::ssh::sign::principals:
-  - packagerepo.service.consul
-  - packagerepo.query.consul
-  - "packagerepo.service.%{facts.country}-%{facts.region}.consul"
-
-# additional altnames
 profiles::pki::vault::alt_names:
-  - packagerepo.main.unkin.net
-  - packagerepo.service.consul
-  - packagerepo.query.consul
-  - "packagerepo.service.%{facts.country}-%{facts.region}.consul"
-
-# configure consul service
-consul::services:
-  jupyterhub:
-    service_name: 'packagerepo'
-    tags:
-      - 'packagerepo'
-    address: "%{facts.networking.ip}"
-    port: 443
-    checks:
-      - id: 'packagerepo_http_check'
-        name: 'packagerepo HTTP Check'
-        http: "https://%{facts.networking.fqdn}"
-        method: 'GET'
-        tls_skip_verify: true
-        interval: '10s'
-        timeout: '1s'
-profiles::consul::client::node_rules:
-  - resource: service
-    segment: packagerepo
-    disposition: write
+  - repos.main.unkin.net
 
 profiles::reposync::webserver::nginx_listen_mode: both
 profiles::reposync::webserver::nginx_cert_type: vault
 profiles::reposync::repos_list:
-  almalinux_9_5_baseos:
-    repository: 'baseos'
-    description: 'AlmaLinux 9.5 BaseOS'
+  almalinux_8_9_baseos:
+    repository: 'BaseOS'
+    description: 'AlmaLinux 8.9 - BaseOS'
     osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/baseos'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_5_appstream:
-    repository: 'appstream'
-    description: 'AlmaLinux 9.5 AppStream'
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/baseos
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  almalinux_8_9_appstream:
+    repository: 'AppStream'
+    description: 'AlmaLinux 8.9 - AppStream'
     osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/appstream'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_5_crb:
-    repository: 'crb'
-    description: 'AlmaLinux 9.5 CRB'
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/appstream
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  almalinux_8_9_highavailability:
+    repository: 'HighAvailability'
+    description: 'AlmaLinux 8.9 - HighAvailability'
     osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/crb'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_5_ha:
-    repository: 'ha'
-    description: 'AlmaLinux 9.5 HighAvailability'
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/ha
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  almalinux_8_9_powertools:
+    repository: 'PowerTools'
+    description: 'AlmaLinux 8.9 - PowerTools'
     osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/highavailability'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_5_extras:
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/powertools
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  almalinux_8_9_extras:
     repository: 'extras'
-    description: 'AlmaLinux 9.5 extras'
+    description: 'AlmaLinux 8.9 - extras'
     osname: 'almalinux'
-    release: '9.5'
-    mirrorlist: 'https://mirrors.almalinux.org/mirrorlist/9.5/extras'
-    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_baseos:
-    repository: 'baseos'
-    description: 'AlmaLinux 9.4 BaseOS'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/BaseOS/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/BaseOS/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_appstream:
-    repository: 'appstream'
-    description: 'AlmaLinux 9.4 AppStream'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/AppStream/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/AppStream/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_crb:
-    repository: 'crb'
-    description: 'AlmaLinux 9.4 CRB'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/CRB/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/CRB/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_ha:
-    repository: 'ha'
-    description: 'AlmaLinux 9.4 HighAvailability'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/HighAvailability/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/HighAvailability/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  almalinux_9_4_extras:
-    repository: 'extras'
-    description: 'AlmaLinux 9.4 extras'
-    osname: 'almalinux'
-    release: '9.4'
-    baseurl: 'https://vault.almalinux.org/9.4/extras/x86_64/os/'
-    gpgkey: 'https://vault.almalinux.org/9.4/extras/x86_64/os/RPM-GPG-KEY-AlmaLinux-9'
-  docker_stable_el8:
-    repository: 'stable'
-    description: 'Docker CE Stable EL8'
-    osname: 'docker'
-    release: 'el8'
-    baseurl: 'https://download.docker.com/linux/centos/8/x86_64/stable/'
-    gpgkey: 'https://download.docker.com/linux/centos/gpg'
-  docker_stable_el9:
-    repository: 'stable'
-    description: 'Docker CE Stable EL9'
-    osname: 'docker'
-    release: 'el9'
-    baseurl: 'https://download.docker.com/linux/centos/9/x86_64/stable/'
-    gpgkey: 'https://download.docker.com/linux/centos/gpg'
-  frr_stable_el8:
-    repository: 'stable'
-    description: 'FRR Stable EL8'
-    osname: 'frr'
-    release: 'el8'
-    baseurl: 'https://rpm.frrouting.org/repo/el8/frr/'
-    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
-  frr_extras_el8:
-    repository: 'extras'
-    description: 'FRR Extras EL8'
-    osname: 'frr'
-    release: 'el8'
-    baseurl: 'https://rpm.frrouting.org/repo/el8/extras/'
-    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
-  frr_stable_el9:
-    repository: 'stable'
-    description: 'FRR Stable EL9'
-    osname: 'frr'
-    release: 'el9'
-    baseurl: 'https://rpm.frrouting.org/repo/el9/frr/'
-    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
-  frr_extras_el9:
-    repository: 'extras'
-    description: 'FRR Extras el9'
-    osname: 'frr'
-    release: 'el9'
-    baseurl: 'https://rpm.frrouting.org/repo/el9/extras/'
-    gpgkey: 'https://packagerepo.service.consul/frr/gpg/RPM-GPG-KEY-FRR'
-  k8s_1.32:
-    repository: '1.32'
-    description: 'Kubernetes 1.32'
-    osname: 'k8s'
-    release: '1.32'
-    baseurl: 'https://pkgs.k8s.io/core:/stable:/v1.32/rpm/'
-    gpgkey: 'https://pkgs.k8s.io/core:/stable:/v1.32/rpm/repodata/repomd.xml.key'
+    release: '8.9'
+    mirrorlist: https://mirrors.almalinux.org/mirrorlist/8.9/extras
+    gpgkey: 'http://mirror.aarnet.edu.au/pub/almalinux/RPM-GPG-KEY-AlmaLinux'
+  centos_8_advanced_virtualization:
+    repository: 'virt-advanced-virtualization'
+    description: 'CentOS Advanced Virtualization'
+    osname: 'centos'
+    release: '8' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8&arch=x86_64&repo=virt-advanced-virtualization' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
+  centos_8_ceph_pacific:
+    repository: 'storage-ceph-pacific'
+    description: 'CentOS Ceph Pacific'
+    osname: 'centos'
+    release: '8' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8&arch=x86_64&repo=storage-ceph-pacific' # Assuming '8' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
+  centos_8_rabbitmq_38:
+    repository: 'messaging-rabbitmq-38'
+    description: 'CentOS RabbitMQ 38'
+    osname: 'centos'
+    release: '8-stream' # Specified based on the repository name
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=messaging-rabbitmq-38' # Assuming '8' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Messaging'
+  centos_8_nfv_openvswitch:
+    repository: 'nfv-openvswitch-2'
+    description: 'CentOS NFV OpenvSwitch'
+    osname: 'centos'
+    release: '8-stream' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=nfv-openvswitch-2' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-NFV'
+  centos_8_openstack_xena:
+    repository: 'cloud-openstack-xena'
+    description: 'CentOS OpenStack Xena'
+    osname: 'centos'
+    release: '8-stream' # Directly taken from the provided mirrorlist
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=cloud-openstack-xena' # Assuming 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Cloud'
+  centos_8_opstools:
+    repository: 'opstools-collectd-5'
+    description: 'CentOS OpsTools - collectd'
+    osname: 'centos'
+    release: '8-stream' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?arch=x86_64&release=8-stream&repo=opstools-collectd-5' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools'
+  centos_8_ovirt45:
+    repository: 'virt-ovirt-45'
+    description: 'CentOS oVirt 4.5'
+    osname: 'centos'
+    release: '8-stream' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=virt-ovirt-45' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Virtualization'
+  centos_8_stream_gluster10:
+    repository: 'storage-gluster-10'
+    description: 'CentOS oVirt 4.5 - Glusterfs 10'
+    osname: 'centos'
+    release: '8-stream' # Assumed static value for demonstration
+    mirrorlist: 'http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=storage-gluster-10' # Assuming 'stream' and 'x86_64'
+    gpgkey: 'https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-Storage'
+  epel_8_everything:
+    repository: 'Everything'
+    description: 'EPEL 8 Everything'
+    osname: 'epel'
+    release: '8'
+    mirrorlist: 'https://mirrors.fedoraproject.org/mirrorlist?repo=epel-8&arch=x86_64'
+    gpgkey: 'https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8'
   mariadb_11_2_el8:
     repository: 'el8'
     description: 'MariaDB 11.2'
@@ -171,27 +120,6 @@ profiles::reposync::repos_list:
     release: 'el'
     baseurl: 'https://yum.puppet.com/puppet7/el/8/x86_64/'
     gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
-  puppet7_el9:
-    repository: '9'
-    description: 'Puppet 7 EL9'
-    osname: 'puppet7'
-    release: 'el'
-    baseurl: 'https://yum.puppet.com/puppet7/el/9/x86_64/'
-    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
-  puppet8_el8:
-    repository: '8'
-    description: 'Puppet 8 EL8'
-    osname: 'puppet8'
-    release: 'el'
-    baseurl: 'https://yum.puppet.com/puppet8/el/8/x86_64/'
-    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
-  puppet8_el9:
-    repository: '9'
-    description: 'Puppet 8 EL9'
-    osname: 'puppet8'
-    release: 'el'
-    baseurl: 'https://yum.puppet.com/puppet8/el/9/x86_64/'
-    gpgkey: 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406'
   postgresql_rhel8_common:
     repository: 'common'
     description: 'PostgreSQL Common RHEL 8'
@@ -199,13 +127,6 @@ profiles::reposync::repos_list:
     release: 'rhel8'
     baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-8-x86_64/'
     gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  postgresql_rhel9_common:
-    repository: 'common'
-    description: 'PostgreSQL Common RHEL 9'
-    osname: 'postgresql'
-    release: 'rhel9'
-    baseurl: 'https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-9-x86_64/'
-    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
   postgresql_rhel8_16:
     repository: '16'
     description: 'PostgreSQL 16 RHEL 8'
@@ -213,38 +134,3 @@ profiles::reposync::repos_list:
     release: 'rhel8'
     baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-8-x86_64/'
     gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  postgresql_rhel9_16:
-    repository: '16'
-    description: 'PostgreSQL 16 RHEL 9'
-    osname: 'postgresql'
-    release: 'rhel9'
-    baseurl: 'https://download.postgresql.org/pub/repos/yum/16/redhat/rhel-9-x86_64/'
-    gpgkey: 'https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-KEY-RHEL'
-  zfs_dkms_rhel8:
-    repository: 'dkms'
-    description: 'ZFS DKMS RHEL 8'
-    osname: 'zfs'
-    release: 'rhel8'
-    baseurl: 'http://download.zfsonlinux.org/epel/8/x86_64/'
-    gpgkey: 'https://packagerepo.service.consul/zfs/gpg/RPM-GPG-KEY-openzfs-2013'
-  zfs_kmod_rhel8:
-    repository: 'kmod'
-    description: 'ZFS KMOD RHEL 8'
-    osname: 'zfs'
-    release: 'rhel8'
-    baseurl: 'http://download.zfsonlinux.org/epel/8/kmod/x86_64/'
-    gpgkey: 'https://packagerepo.service.consul/zfs/gpg/RPM-GPG-KEY-openzfs-2013'
-  zfs_dkms_rhel9:
-    repository: 'dkms'
-    description: 'ZFS DKMS RHEL 9'
-    osname: 'zfs'
-    release: 'rhel9'
-    baseurl: 'http://download.zfsonlinux.org/epel/9/x86_64/'
-    gpgkey: 'https://packagerepo.service.consul/zfs/gpg/RPM-GPG-KEY-openzfs-2022'
-  zfs_kmod_rhel9:
-    repository: 'kmod'
-    description: 'ZFS KMOD RHEL 9'
-    osname: 'zfs'
-    release: 'rhel9'
-    baseurl: 'http://download.zfsonlinux.org/epel/9/kmod/x86_64/'
-    gpgkey: 'https://packagerepo.service.consul/zfs/gpg/RPM-GPG-KEY-openzfs-2022'

hieradata/roles/infra/sql/patroni.eyaml

@@ -1,4 +0,0 @@
----
-profiles::sql::patroni::superuser_password: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAImaYEH6ktU6KYDu96OtuJu11FbmE+b9YwrkJiv72QfuVivR7lGfieRKcvkrq3IsNcwhhnl1lzyMZHteib7jLEIiaq59AZFiZyfF2E5bhNYfW4QcDJd4QOheU2awkZkl6oaoMUxgWOnqvihYVLDfoJ0lj6hBTFuqIzO/KU+AJ4NMO3+/+AK9+HB0u/8Iyuev4RQBkvaRAoszCcFCWTAZJTmhOgWe4xJIxfbh0/5k/dmT5WQ1JPEQK7hnVly9iToROZJDjuyndNHbrhCQUg4+DYMPS2fZVWvcESfxN8lJjBFPojj9ZbG5mLlq1e4A4KiZNwHfA1V4D88VWOkRg65XtZDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBzToImdK5/pk3UeZPyavjTgDCcYBzwY/g353Pbh0xr/we8KmvsQEtfxPDuPm4Kv4hsD5X0dHu2nGzBAZq5uWcE3RE=]
-profiles::sql::patroni::replication_password: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAWyCj+7WfzpTcpBg6uQ5ykGmLZmb/avW3Pc+VWj9bGvxSQCA8LA6HJlEhhL3mrJSTGUyHLgeEebEup9AVHe2k2l/JHIvhyfx7LI+mNDp8u5p40pM6ZxTdIJFOZmOS/nGjAR6mTv6Ennhpw4sWSDYXU0mJPTHGAked2FXV1xsS0zpTY7hccJHuww5ixOw6jP8E1Pu0ex4LmefOXApowf0jZ2pARndlsXwZldahUHIF48XejclpgCK9rTrb4eQsOZr5ozcj0BBpWg/JKNkQt8mQU5l5/z0GDT08Op8g6MVdJuOWr92uPqjc8sydrz0QAx4l8t1KY2fMWK7BPKqSdcOxiDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDEZBNd56BHVGRVfHDPPwZHgDAZKnqicbF/MVKPi1PwwyHrXMW/fWqocgr1zWx6RXWgXICqjJdEFXwFerXXb39RSDg=]
-profiles::sql::patroni::postgres_exporter_pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAL5brQt9CGFU7okDXZWF1jL1j+RbrQZhKfzGWyWl+SqRK6q+xH0LIzYQhOAji7tlDBzvFZpzglmzj0xDrAkQA46jg1DkR5+9Ozru9jL1nhg/6z/F54DlhAG7Ui0hjgSLal79VABLXa/cb9xJThx97b9xoOW+/vpfSKa4izFtkN9fliClFTVafxLlLLD/yABW99aq1OK+9MyCsppvs/rjWbXvjEKL+C0jawh4dBnc+tYJMHC/k5NIK0th4A/zSYVH5q6gFakpxrV2ubETIbVTDncC8zfRLhnrikZYNbCy5PuJb2a4vW1O0AOzUWqvqbRkWpYF7dJB9fzW/Tu8f8d10KTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAJS5PcA9aJvjGIfKSciLLpgDAU7xXGF+Sj+g1ABMvsenEmgXsdSKVU9ZYusIiGnPdFdN4EF9usi7g4SahochlG0NU=]

hieradata/roles/infra/sql/patroni.yaml

@@ -1,28 +0,0 @@
----
-profiles::yum::global::repos:
-  postgresql-15:
-    name: postgresql-15
-    descr: postgresql-15 repository
-    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://edgecache.query.consul/postgres/yum/15/redhat/rhel-%{facts.os.release.full}-%{facts.os.architecture}
-    gpgkey: https://edgecache.query.consul/postgres/yum/keys/PGDG-RPM-GPG-KEY-RHEL
-  postgresql-common:
-    name: postgresql-common
-    descr: postgresql-common repository
-    target: /etc/yum.repos.d/postgresql.repo
-    baseurl: https://edgecache.query.consul/postgres/yum/common/redhat/rhel-%{facts.os.release.full}-%{facts.os.architecture}
-    gpgkey: https://edgecache.query.consul/postgres/yum/keys/PGDG-RPM-GPG-KEY-RHEL
-
-profiles::sql::patroni::cluster_name: "patroni-%{facts.environment}"
-profiles::sql::patroni::postgres_exporter_enabled: true
-profiles::sql::patroni::postgres_exporter_user: postgres_exporter
-profiles::consul::client::node_rules:
-  - resource: service_prefix
-    segment: "%{hiera('profiles::sql::patroni::cluster_name')}"
-    disposition: write
-  - resource: key_prefix
-    segment: "service/%{hiera('profiles::sql::patroni::cluster_name')}"
-    disposition: write
-  - resource: session_prefix
-    segment: ""
-    disposition: write

hieradata/roles/infra/storage/consul.yaml

@@ -89,9 +89,3 @@ profiles::consul::prepared_query::rules:
     service_failover_n: 3
     service_only_passing: true
     ttl: 10
-  droneci:
-    ensure: 'present'
-    service_name: 'droneci'
-    service_failover_n: 3
-    service_only_passing: true
-    ttl: 10

hieradata/roles/infra/storage/edgecache.yaml

@@ -125,12 +125,12 @@ profiles::edgecache::params::mirrors:
     ensure: present
     location: '~* ^/ceph/yum/.*/repodata/'
     rewrite_rules:
-      - '^/ceph/yum/(.*)$ /rpm-18.2.2/$1 break'
+      - '^/ceph/yum/(.*)$ /rpm-reef/$1 break'
     proxy: http://158.69.68.124
   ceph_yum_data:
     ensure: present
     location: /ceph/yum
-    proxy: http://158.69.68.124/rpm-18.2.2
+    proxy: http://158.69.68.124/rpm-reef
     proxy_cache: cache
     proxy_cache_valid:
       - '200 302 1440h'

hieradata/virtual/physical.yaml

@@ -1,3 +1,3 @@
 ---
-profiles::packages::include:
-  "%{hiera('lm-sensors::package')}": {}
+profiles::packages::install:
+  - "%{hiera('lm-sensors::package')}"

modules/certbot/manifests/client.pp

@@ -1,14 +1,7 @@
-# used by certbot clients to request letsencrypt certificates
-# - domains: list of certificates to generate
-# - webserver: where the client downloads certificates from
-# - data_dir: where to store the certificates on the client
-# - services: the services to notify when certificates change
-#
 class certbot::client (
   Array[Stdlib::Fqdn]   $domains,
   Stdlib::Fqdn          $webserver,
   Stdlib::Absolutepath  $data_dir = '/etc/pki/tls/letsencrypt/',
-  Optional[String]      $service = undef,
 ) {
 
   mkdir::p {$data_dir:}
@@ -21,11 +14,10 @@ class certbot::client (
 
   $domains.each |$domain| {
     certbot::client::cert {"${facts['networking']['fqdn']}_download_${domain}":
-      domain         => $domain,
-      destination    => "${data_dir}/${domain}",
-      webserver      => $webserver,
-      require        => File[$data_dir],
-      notify_service => $service,
+      domain      => $domain,
+      destination => "${data_dir}/${domain}",
+      webserver   => $webserver,
+      require     => File[$data_dir],
     }
   }
 }

modules/certbot/manifests/client/cert.pp

@@ -1,13 +1,7 @@
-# a define for creating a single certificate
-# - domain: the domain to generate a certificate for
-# - webserver: where to download the certificate from
-# - destination: the data directory on the client
-# - notify_service: what service to notify when the concat exec completes
 define certbot::client::cert (
   Stdlib::Fqdn          $domain,
   Stdlib::Fqdn          $webserver,
   Stdlib::Absolutepath  $destination = "/etc/pki/tls/letsencrypt/${domain}",
-  Optional[String]      $notify_service = undef,
 ) {
 
   file { $destination:
@@ -40,16 +34,8 @@ define certbot::client::cert (
       }
     }
 
-    # create file resources
     create_resources(file, $files_to_create)
 
-    # if notify_service is specified
-    if $notify_service != undef {
-      $service = Service[$notify_service]
-    }else{
-      $service = undef
-    }
-
     exec { "concat_${domain}_certs":
       command     => "cat ${destination}/fullchain.pem ${destination}/privkey.pem > ${destination}/fullchain_combined.pem",
       path        => ['/bin', '/usr/bin'],
@@ -58,7 +44,6 @@ define certbot::client::cert (
         File["${destination}/fullchain.pem"],
         File["${destination}/privkey.pem"],
       ],
-      notify      => $service,
     }
   } else {
     notify { 'Certificates are not yet ready on the generator server.': }

modules/droneci/manifests/init.pp

@@ -1,24 +0,0 @@
-class droneci (
-  Hash $env_vars = {},
-  String $docker_image = 'drone/drone:2',
-  Array[String] $ports = [],
-  Array[String] $volumes = [],
-  Stdlib::Absolutepath $env_file = '/etc/sysconfig/droneci',
-) {
-
-  # Create the environment file from a template
-  file { $env_file:
-    ensure  => file,
-    content => template('droneci/droneci_env.erb'),
-    mode    => '0644',
-  }
-
-  # Define the systemd service for Drone CI
-  systemd::unit_file { 'droneci.service':
-    ensure    => present,
-    content   => template('droneci/droneci_service.erb'),
-    enable    => true,
-    active    => true,
-    subscribe => File[$env_file],
-  }
-}

modules/droneci/manifests/runner.pp

@@ -1,24 +0,0 @@
-class droneci::runner (
-  Hash $env_vars = {},
-  String $docker_image = 'drone/drone-runner-docker:1',
-  Array[String] $ports = [],
-  Array[String] $volumes = [],
-  Stdlib::Absolutepath $env_file = '/etc/sysconfig/droneci_runner',
-) {
-
-  # Create the environment file from a template
-  file { $env_file:
-    ensure  => file,
-    content => template('droneci/droneci_env.erb'),
-    mode    => '0644',
-  }
-
-  # Define the systemd service for Drone CI runner
-  systemd::unit_file { 'droneci-runner.service':
-    ensure    => present,
-    content   => template('droneci/droneci_runner_service.erb'),
-    enable    => true,
-    active    => true,
-    subscribe => File[$env_file],
-  }
-}

modules/droneci/templates/droneci_env.erb

@@ -1,3 +0,0 @@
-<% @env_vars.each do |key, value| -%>
-<%= key.upcase %>=<%= value %>
-<% end -%>

modules/droneci/templates/droneci_runner_service.erb

@@ -1,20 +0,0 @@
-[Unit]
-Description=Drone CI Runner
-After=docker.service
-Requires=docker.service
-
-[Service]
-ExecStart=/usr/bin/docker run --rm \
-  --name=drone-runner \
-<% @ports.each do |port| -%>
-  -p <%= port %> \
-<% end -%>
-<% @volumes.each do |volume| -%>
-  --mount <%= volume %> \
-<% end -%>
-  --env-file <%= @env_file %> \
-  <%= @docker_image %>
-Restart=always
-
-[Install]
-WantedBy=multi-user.target

modules/droneci/templates/droneci_service.erb

@@ -1,20 +0,0 @@
-[Unit]
-Description=Drone CI Service
-After=docker.service
-Requires=docker.service
-
-[Service]
-ExecStart=/usr/bin/docker run --rm \
-  --name=drone \
-<% @ports.each do |port| -%>
-  -p <%= port %> \
-<% end -%>
-<% @volumes.each do |volume| -%>
-  --mount <%= volume %> \
-<% end -%>
-  --env-file <%= @env_file %> \
-  <%= @docker_image %>
-Restart=always
-
-[Install]
-WantedBy=multi-user.target

modules/etcd/manifests/init.pp

@@ -1,110 +0,0 @@
-# manage etcd
-class etcd (
-  Boolean $manage_user = true,
-  Boolean $manage_group = true,
-  Boolean $manage_package = true,
-  Boolean $manage_service = true,
-  String[1] $package_name = 'etcd',
-  String[1] $user = 'etcd',
-  String[1] $group = 'etcd',
-  Stdlib::Absolutepath $config_path = '/etc/etcd',
-  Stdlib::Absolutepath $config_file = "${config_path}/etcd.yaml",
-  Hash $config = { 'data-dir' => '/var/lib/etcd' },
-  Integer $max_open_files = 40000,
-) {
-  if downcase($facts['kernel']) != 'linux' {
-    fail("Module etcd only supports Linux, not ${facts['kernel']}")
-  }
-  if $facts['service_provider'] != 'systemd' {
-    fail('Module etcd only supported on systems using systemd')
-  }
-  if ! $config['data-dir'] {
-    fail('Module etcd requires data-dir be specified in config Hash')
-  }
-
-  if $manage_package {
-    package { $package_name:
-      ensure => installed,
-    }
-  }
-
-  if $manage_user {
-    user { 'etcd':
-      ensure     => 'present',
-      name       => $user,
-      forcelocal => true,
-      shell      => '/bin/false',
-      gid        => $group,
-      home       => $config['data-dir'],
-      managehome => false,
-      system     => true,
-      before     => Systemd::Unit_file['etcd.service'],
-    }
-  }
-  if $manage_group {
-    group { 'etcd':
-      ensure     => 'present',
-      name       => $group,
-      forcelocal => true,
-      system     => true,
-      before     => Systemd::Unit_file['etcd.service'],
-    }
-  }
-
-  mkdir::p { $config_path: }
-  mkdir::p { $config['data-dir']: }
-
-  file { $config_file:
-    ensure  => 'file',
-    owner   => $user,
-    group   => $group,
-    mode    => '0600',
-    content => to_yaml($config),
-    notify  => Systemd::Unit_file['etcd.service'],
-    require => Mkdir::P[$config_path],
-  }
-
-  file { 'etcd-data-dir':
-    ensure  => 'directory',
-    path    => $config['data-dir'],
-    owner   => $user,
-    group   => $group,
-    mode    => '0700',
-    notify  => Systemd::Unit_file['etcd.service'],
-    require => Mkdir::P[$config['data-dir']],
-  }
-
-  file { 'etcd-data-dir-wal.tmp':
-    ensure  => 'directory',
-    path    => "${config['data-dir']}/wal.tmp",
-    owner   => $user,
-    group   => $group,
-    mode    => '0700',
-    notify  => Systemd::Unit_file['etcd.service'],
-    require => File['etcd-data-dir'],
-  }
-
-  if $config['wal-dir'] {
-    mkdir::p { $config['wal-dir']: }
-    file { 'etcd-wal-dir':
-      ensure  => 'directory',
-      path    => $config['wal-dir'],
-      owner   => $user,
-      group   => $group,
-      mode    => '0700',
-      notify  => Systemd::Unit_file['etcd.service'],
-      require => Mkdir::P[$config['wal-dir']],
-    }
-  }
-
-  if $manage_service {
-    include ::systemd
-
-    systemd::unit_file { 'etcd.service':
-      content => template('etcd/etcd.service.erb'),
-      enable  => true,
-      active  => true,
-      require => Package[$package_name],
-    }
-  }
-}

modules/etcd/templates/etcd.service.erb

@@ -1,17 +0,0 @@
-# DO NOT EDIT: This file is being managed by Puppet.
-[Unit]
-Description=etcd key-value store
-Documentation=https://github.com/etcd-io/etcd
-After=network.target
-
-[Service]
-User=<%= @user %>
-Group=<%= @group %>
-Type=notify
-ExecStart=/usr/bin/etcd --config-file <%= @config_file %>
-Restart=always
-RestartSec=10s
-LimitNOFILE=<%= @max_open_files %>
-
-[Install]
-WantedBy=multi-user.target

modules/frrouting/manifests/init.pp

@@ -1,89 +0,0 @@
-class frrouting (
-  Boolean $manage_package           = true,
-  Boolean $manage_config            = true,
-  Boolean $manage_service           = true,
-  String  $package_name             = 'frr',
-  String  $service_name             = 'frr',
-  Hash    $daemons                  = {},
-  Hash    $ospfd_interfaces         = {},
-  String  $ospfd_router_id          = $facts['networking']['ip'],
-  Array[String] $ospfd_redistribute = [],
-  Array[String] $ospfd_networks     = [],
-  Boolean $ospfd_default_originate_always = false,
-  Boolean $mpls_te_enabled                   = false,
-  Optional[String] $mpls_ldp_router_id       = undef,
-  Optional[String] $mpls_ldp_transport_addr  = undef,
-  Array[String] $mpls_ldp_interfaces         = [],
-) {
-
-  $daemons_defaults = {
-    'bgpd'    => false,
-    'ospfd'   => true,
-    'ospf6d'  => false,
-    'ldpd'    => false,
-    'ripd'    => false,
-    'ripngd'  => false,
-    'isisd'   => false,
-    'pimd'    => false,
-    'pim6d'   => false,
-    'nhrpd'   => false,
-    'eigrpd'  => false,
-    'sharpd'  => false,
-    'pbrd'    => false,
-    'bfdd'    => false,
-    'fabricd' => false,
-    'vrrpd'   => false,
-    'pathd'   => false,
-    'staticd' => false,
-  }
-
-  $daemons_merged = merge($daemons_defaults, $daemons)
-
-  if $manage_package {
-    package { $package_name:
-      ensure => installed,
-    }
-  }
-
-  if $manage_config {
-    file { '/etc/frr/frr.conf':
-      ensure  => file,
-      content => template('frrouting/frr.conf.erb'),
-      notify  => Service[$service_name],
-    }
-
-    file { '/etc/frr/daemons':
-      ensure  => file,
-      content => template('frrouting/daemons.erb'),
-      notify  => Service[$service_name],
-    }
-  }
-
-  if $manage_service {
-    service { $service_name:
-      ensure     => running,
-      enable     => true,
-      hasstatus  => true,
-      hasrestart => true,
-    }
-  }
-
-  if $mpls_ldp_router_id and $mpls_ldp_transport_addr and !empty($mpls_ldp_interfaces) {
-    file { '/etc/modules-load.d/mpls_ldp_modules.conf':
-      ensure  => file,
-      content => @(EOT/L),
-        # Load MPLS Kernel Modules
-        mpls_router
-        mpls_iptunnel
-        | EOT
-    }
-
-    ['mpls_router', 'mpls_iptunnel'].each |$mod| {
-      exec { "load_${mod}":
-        command => "/sbin/modprobe ${mod}",
-        unless  => "/sbin/lsmod | /bin/grep -q ^${mod}",
-        path    => ['/sbin', '/bin', '/usr/sbin', '/usr/bin'],
-      }
-    }
-  }
-}

modules/frrouting/templates/daemons.erb

@@ -1,29 +0,0 @@
-# THIS FILE IS MANAGED BY PUPPET
-<% @daemons_merged.each do |daemon, status| -%>
-<% if status -%>
-<%= daemon %>=yes
-<% else -%>
-<%= daemon %>=no
-<% end -%>
-<% end -%>
-
-vtysh_enable=yes
-zebra_options="  -A 127.0.0.1 -s 90000000"
-bgpd_options="   -A 127.0.0.1"
-ospfd_options="  -A 127.0.0.1"
-ospf6d_options=" -A ::1"
-ldpd_options="   -A 127.0.0.1"
-ripd_options="   -A 127.0.0.1"
-ripngd_options=" -A ::1"
-isisd_options="  -A 127.0.0.1"
-pimd_options="   -A 127.0.0.1"
-pim6d_options="  -A ::1"
-nhrpd_options="  -A 127.0.0.1"
-eigrpd_options=" -A 127.0.0.1"
-sharpd_options=" -A 127.0.0.1"
-pbrd_options="   -A 127.0.0.1"
-staticd_options="-A 127.0.0.1"
-bfdd_options="   -A 127.0.0.1"
-fabricd_options="-A 127.0.0.1"
-vrrpd_options="  -A 127.0.0.1"
-pathd_options="  -A 127.0.0.1"

modules/frrouting/templates/frr.conf.erb

@@ -1,48 +0,0 @@
-# THIS FILE IS MANAGED BY PUPPET
-frr defaults traditional
-hostname <%= @hostname %>
-no ipv6 forwarding
-<% @ospfd_interfaces.each do |iface, params| -%>
-interface <%= iface %>
-<% if params['area'] -%>
- ip ospf area <%= params['area'] %>
-<% end -%>
-<% if params['passive'] == true -%>
- ip ospf passive
-<% end -%>
-<% if @mpls_ldp_interfaces and @mpls_ldp_interfaces.include?(iface) -%>
- mpls enable
-<% end -%>
-exit
-<% end -%>
-router ospf
- ospf router-id <%= @ospfd_router_id %>
- log-adjacency-changes detail
-<% @ospfd_redistribute.each do |type| -%>
- redistribute <%= type %>
-<% end -%>
-<% @ospfd_networks.each do |network| -%>
- network <%= network %>
-<% end -%>
-<% if @ospfd_default_originate_always -%>
- default-information originate always
-<% end -%>
-<% if @mpls_te_enabled -%>
- capability opaque
- mpls-te on
- mpls-te router-address <%= @ospfd_router_id %>
- mpls-te inter-as area 0.0.0.0
-<% end -%>
-exit
-<% if @mpls_ldp_router_id and @mpls_ldp_transport_addr and @mpls_ldp_interfaces.any? -%>
-mpls ldp
- router-id <%= @mpls_ldp_router_id %>
- address-family ipv4
-  discovery transport-address <%= @mpls_ldp_transport_addr %>
-<% @mpls_ldp_interfaces.each do |iface| -%>
-  interface <%= iface %>
-  exit
-<% end -%>
- exit-address-family
-exit
-<% end -%>

modules/glauth/manifests/obj/service.pp

@@ -6,12 +6,7 @@ define glauth::obj::service (
   Integer $primarygroup,
   String $passsha256,
   Stdlib::Absolutepath $config_path,
-  Optional[Array[Integer]] $othergroups = [],
 ) {
-  $formatted_othergroups = $othergroups.empty ? {
-    true    => '[]',
-    false   => "[${othergroups.join(', ')}]",
-  }
   concat::fragment { "glauth_service_${service_name}":
     target  => $config_path,
     content => epp('glauth/obj/service.epp', {
@@ -20,7 +15,6 @@ define glauth::obj::service (
       'uidnumber'    => $uidnumber,
       'primarygroup' => $primarygroup,
       'passsha256'   => $passsha256,
-      'othergroups'  => $formatted_othergroups,
     }),
     order   => '80',
   }