feat: allow specifying consul addr for exporters

- ensure frr/node exporter reachable on hosts with loopbacks

.gitea/workflows/build.yaml

@@ -0,0 +1,24 @@
+name: Build
+
+on:
+  pull_request:
+
+jobs:
+  precommit:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Install requirements
+        run: |
+          dnf groupinstall -y "Development Tools" -y
+          dnf install rubygems ruby-devel gcc make redhat-rpm-config glibc-headers glibc-devel -y
+
+      - name: Pre-Commit All Files
+        run: |
+          uvx pre-commit run --all-files

.reek.yml

@@ -3,3 +3,8 @@
 detectors:
   FeatureEnvy:
     enabled: false
+  TooManyStatements:
+    enabled: false
+  UncommunicativeVariableName:
+    accept:
+      - e

.rubocop.yml

@@ -8,3 +8,6 @@ Style/Documentation:
 
 Layout/LineLength:
   Max: 140
+
+Metrics/BlockNesting:
+  Max: 4

Puppetfile

@@ -2,48 +2,54 @@ forge 'forge.puppetlabs.com'
 moduledir 'external_modules'
 
 # puppetlabs
-mod 'puppetlabs-stdlib', '9.1.0'
+mod 'puppetlabs-stdlib', '9.7.0'
-mod 'puppetlabs-inifile', '6.0.0'
+mod 'puppetlabs-inifile', '6.2.0'
-mod 'puppetlabs-concat', '9.0.0'
+mod 'puppetlabs-concat', '9.1.0'
-mod 'puppetlabs-vcsrepo', '6.1.0'
+mod 'puppetlabs-vcsrepo', '7.0.0'
-mod 'puppetlabs-yumrepo_core', '2.0.0'
+mod 'puppetlabs-yumrepo_core', '2.1.0'
-mod 'puppetlabs-apt', '9.4.0'
+mod 'puppetlabs-apt', '10.0.1'
-mod 'puppetlabs-lvm', '2.1.0'
+mod 'puppetlabs-lvm', '3.0.1'
-mod 'puppetlabs-puppetdb', '7.13.0'
+mod 'puppetlabs-puppetdb', '7.14.0'
-mod 'puppetlabs-postgresql', '9.1.0'
+mod 'puppetlabs-postgresql', '9.2.0'
-mod 'puppetlabs-firewall', '6.0.0'
+mod 'puppetlabs-firewall', '8.1.4'
-mod 'puppetlabs-accounts', '8.1.0'
+mod 'puppetlabs-accounts', '8.2.2'
-mod 'puppetlabs-mysql', '15.0.0'
+mod 'puppetlabs-mysql', '16.2.0'
 mod 'puppetlabs-xinetd', '3.4.1'
-mod 'puppetlabs-haproxy', '8.0.0'
+mod 'puppetlabs-haproxy', '8.2.0'
-mod 'puppetlabs-java', '10.1.2'
+mod 'puppetlabs-java', '11.1.0'
-mod 'puppetlabs-reboot', '5.0.0'
+mod 'puppetlabs-reboot', '5.1.0'
+mod 'puppetlabs-docker', '10.2.0'
 
 # puppet
-mod 'puppet-python', '7.0.0'
+mod 'puppet-python', '7.4.0'
-mod 'puppet-systemd', '5.1.0'
+mod 'puppet-systemd', '8.1.0'
-mod 'puppet-yum', '7.0.0'
+mod 'puppet-yum', '7.2.0'
-mod 'puppet-archive', '7.0.0'
+mod 'puppet-archive', '7.1.0'
-mod 'puppet-chrony', '2.6.0'
+mod 'puppet-chrony', '3.0.0'
-mod 'puppet-puppetboard', '9.0.0'
+mod 'puppet-puppetboard', '11.0.0'
-mod 'puppet-nginx', '5.0.0'
+mod 'puppet-nginx', '6.0.1'
-mod 'puppet-selinux', '4.1.0'
+mod 'puppet-selinux', '5.0.0'
-mod 'puppet-prometheus', '13.4.0'
+mod 'puppet-prometheus', '16.0.0'
-mod 'puppet-grafana', '13.1.0'
+mod 'puppet-grafana', '14.1.0'
-mod 'puppet-consul', '8.0.0'
+mod 'puppet-consul', '9.1.0'
-mod 'puppet-vault', '4.1.0'
+mod 'puppet-vault', '4.1.1'
 mod 'puppet-dhcp', '6.1.0'
-mod 'puppet-keepalived', '3.6.0'
+mod 'puppet-keepalived', '5.1.0'
-mod 'puppet-extlib', '7.0.0'
+mod 'puppet-extlib', '7.5.1'
-mod 'puppet-network', '2.2.0'
+mod 'puppet-network', '2.2.1'
-mod 'puppet-kmod', '4.0.1'
+mod 'puppet-kmod', '4.1.0'
 mod 'puppet-filemapper', '4.0.0'
+mod 'puppet-letsencrypt', '11.1.0'
+mod 'puppet-rundeck', '9.2.0'
+mod 'puppet-redis', '11.1.0'
+mod 'puppet-nodejs', '11.0.0'
 
 # other
-mod 'ghoneycutt-puppet', '3.3.0'
+mod 'saz-sudo', '9.0.2'
-mod 'saz-sudo', '8.0.0'
+mod 'saz-ssh', '13.1.0'
-mod 'saz-ssh', '12.1.0'
+mod 'saz-limits', '5.0.0'
 mod 'ghoneycutt-timezone', '4.0.0'
+mod 'ghoneycutt-puppet', '3.3.0'
 mod 'dalen-puppetdbquery', '3.0.1'
 mod 'markt-galera', '3.1.0'
 mod 'kogitoapp-minio', '1.1.4'
@@ -51,6 +57,9 @@ mod 'broadinstitute-certs', '3.0.1'
 mod 'stm-file_capability', '6.0.0'
 mod 'h0tw1r3-gitea', '3.2.0'
 mod 'rehan-mkdir', '2.0.0'
+mod 'tailoredautomation-patroni', '2.0.0'
+mod 'ssm-crypto_policies', '0.3.3'
+mod 'thias-sysctl', '1.0.8'
 
 mod 'bind',
   :git => 'https://git.service.au-syd1.consul/unkinben/puppet-bind.git',

hieradata/common.yaml

@@ -3,16 +3,10 @@ lookup_options:
   hiera_classes:
     merge:
       strategy: deep
-  profiles::packages::install:
+  profiles::packages::include:
     merge:
       strategy: deep
-  profiles::packages::install_exclude:
+  profiles::packages::exclude:
-    merge:
-      strategy: deep
-  profiles::packages::remove:
-    merge:
-      strategy: deep
-  profiles::packages::remove_exclude:
     merge:
       strategy: deep
   profiles::pki::vault::alt_names:
@@ -42,6 +36,12 @@ lookup_options:
   profiles::haproxy::server::listeners:
     merge:
       strategy: deep
+  profiles::accounts::root::sshkeys:
+    merge:
+      strategy: deep
+  profiles::accounts::sysadmin::sshkeys:
+    merge:
+      strategy: deep
   haproxy::backend:
     merge:
       strategy: deep
@@ -129,6 +129,32 @@ lookup_options:
   profiles::ceph::client::keyrings:
     merge:
       strategy: deep
+  profiles::nginx::simpleproxy::locations:
+    merge:
+      strategy: deep
+  certbot::client::domains:
+    merge:
+      strategy: deep
+  keepalived::vrrp_script:
+    merge:
+      strategy: deep
+  keepalived::vrrp_instance:
+    merge:
+      strategy: deep
+  profiles::etcd::node::initial_cluster_token:
+    convert_to: Sensitive
+  sysctl::base::values:
+    merge:
+      strategy: deep
+  limits::entries:
+    merge:
+      strategy: deep
+  zfs::zpools:
+    merge:
+      strategy: deep
+  zfs::datasets:
+    merge:
+      strategy: deep
 
 facts_path: '/opt/puppetlabs/facter/facts.d'
 
@@ -136,21 +162,36 @@ hiera_include:
   - timezone
   - networking
   - ssh::server
+  - profiles::accounts::rundeck
+  - limits
+  - sysctl::base
+  - exporters::node_exporter
 
-profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
-profiles::ntp::client::use_ntp: 'region'
 profiles::ntp::client::peers:
-  - 0.pool.ntp.org
+  - 0.au.pool.ntp.org
-  - 1.pool.ntp.org
+  - 1.au.pool.ntp.org
-  - 2.pool.ntp.org
+  - 2.au.pool.ntp.org
-  - 3.pool.ntp.org
+  - 3.au.pool.ntp.org
 
 profiles::base::puppet_servers:
   - 'prodinf01n01.main.unkin.net'
 
+consul::install_method: 'package'
+consul::manage_repo: false
+consul::bin_dir: /usr/bin
+
+vault::install_method: 'repo'
+vault::manage_repo: false
+vault::bin_dir: /usr/bin
+vault::manage_service_file: true
+vault::manage_config_dir: true
+vault::disable_mlock: false
+
+profiles::dns::base::nameservers:
+  - 198.18.19.16
 profiles::dns::master::basedir: '/var/named/sources'
-profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
+#profiles::dns::base::ns_role: 'roles::infra::dns::resolver'
-profiles::dns::base::use_ns: 'region'
+#profiles::dns::base::use_ns: 'region'
 profiles::consul::server::members_role: roles::infra::storage::consul
 profiles::consul::token::node_editor::accessor_id: '024e27bd-c5bb-41e7-a578-b766509e11bc'
 profiles::consul::client::members_lookup: true
@@ -165,60 +206,74 @@ profiles::consul::client::node_rules:
   - resource: node
     segment: ''
     disposition: read
+  - resource: service
+    segment: node_exporter
+    disposition: write
 
-profiles::packages::install:
+profiles::packages::include:
-  - bash-completion
+  bash-completion: {}
-  - bzip2
+  bzip2: {}
-  - ccze
+  ccze: {}
-  - curl
+  curl: {}
-  - dstat
+  dstat: {}
-  - expect
+  expect: {}
-  - gcc
+  gzip: {}
-  - gzip
+  git: {}
-  - git
+  htop: {}
-  - htop
+  inotify-tools: {}
-  - inotify-tools
+  iotop: {}
-  - iotop
+  jq: {}
-  - jq
+  lz4: {}
-  - lz4
+  mtr: {}
-  - mtr
+  ncdu: {}
-  - ncdu
+  neovim: {}
-  - neovim
+  p7zip: {}
-  - p7zip
+  pbzip2: {}
-  - pbzip2
+  pigz: {}
-  - pigz
+  pv: {}
-  - pv
+  python3.11: {}
-  - python3.11
+  rsync: {}
-  - rsync
+  screen: {}
-  - screen
+  socat: {}
-  - socat
+  strace: {}
-  - strace
+  sysstat: {}
-  - sysstat
+  tar: {}
-  - tar
+  tmux: {}
-  - tmux
+  traceroute: {}
-  - traceroute
+  unzip: {}
-  - unzip
+  vim: {}
-  - vim
+  vnstat: {}
-  - vnstat
+  wget: {}
-  - wget
+  zsh: {}
-  - zsh
+  zstd: {}
-  - zstd
+  iwl100-firmware:
-
+    ensure: absent
-profiles::packages::remove:
+  iwl1000-firmware:
-  - iwl100-firmware
+    ensure: absent
-  - iwl1000-firmware
+  iwl105-firmware:
-  - iwl105-firmware
+    ensure: absent
-  - iwl135-firmware
+  iwl135-firmware:
-  - iwl2000-firmware
+    ensure: absent
-  - iwl2030-firmware
+  iwl2000-firmware:
-  - iwl3160-firmware
+    ensure: absent
-  - iwl5000-firmware
+  iwl2030-firmware:
-  - iwl5150-firmware
+    ensure: absent
-  - iwl6000-firmware
+  iwl3160-firmware:
-  - iwl6000g2a-firmware
+    ensure: absent
-  - iwl6050-firmware
+  iwl5000-firmware:
-  - iwl7260-firmware
+    ensure: absent
-  - puppet7-release
+  iwl5150-firmware:
+    ensure: absent
+  iwl6000-firmware:
+    ensure: absent
+  iwl6000g2a-firmware:
+    ensure: absent
+  iwl6050-firmware:
+    ensure: absent
+  iwl7260-firmware:
+    ensure: absent
+  puppet7-release:
+    ensure: absent
 
 profiles::base::scripts::scripts:
   puppet: puppetwrapper.py
@@ -237,7 +292,8 @@ profiles::puppet::client::dns_alt_names:
 puppetdbapi: puppetdbapi.query.consul
 puppetdbsql: puppetdbsql.service.au-syd1.consul
 
-prometheus::node_exporter::export_scrape_job: true
+exporters::node_exporter::enable: true
+exporters::node_exporter::cleanup_old_node_exporter: true
 prometheus::systemd_exporter::export_scrape_job: true
 
 ssh::server::storeconfigs_enabled: false
@@ -287,6 +343,8 @@ sudo::configs:
 
 profiles::accounts::sysadmin::sshkeys:
   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ8SRLlPiDylBpdWR9LpvPg4fDVD+DZst4yRPFwMMhta4mnB1H9XuvZkptDhXywWQ7QIcqa2WbhCen0OQJCtwn3s7EYtacmF5MxmwBYocPoK2AArGuh6NA9rwTdLrPdzhZ+gwe88PAzRLNzjm0ZBR+mA9saMbPJdqpKp0AWeAM8QofRQAWuCzQg9i0Pn1KDMvVDRHCZof4pVlHSTyHNektq4ifovn0zhKC8jD/cYu95mc5ftBbORexpGiQWwQ3HZw1IBe0ZETB1qPIPwsoJpt3suvMrL6T2//fcIIUE3TcyJKb/yhztja4TZs5jT8370G/vhlT70He0YPxqHub8ZfBv0khlkY93VBWYpNGJwM1fVqlw7XbfBNdOuJivJac8eW317ZdiDnKkBTxapThpPG3et9ib1HoPGKRsd/fICzNz16h2R3tddSdihTFL+bmTCa6Lo+5t5uRuFjQvhSLSgO2/gRAprc3scYOB4pY/lxOFfq3pU2VvSJtRgLNEYMUYKk= ben@unkin.net
+profiles::accounts::rundeck::sshkeys:
+  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD4F7VcorbGpyZzBFexz7c/o1JBscrl7hZU0UkWV7fq6YLizW0r6fOzD99hMwu1kdYCjPxbvuUSDEHfyBIp2EgLWU6wFVoufQqlMyOV85+ivQZUc1VNV+X9T+U4v3u/01hkAmlpXtbkwhMSR4Wi+tdABd04+D3CuMDM37mvnFmBBmi41X4Mr1rJhOQumn1XHQ7EYbsdw2mxfEVVeWpZIHz5BjNKSGzEIAYZbFt6s0Y7X3J5RT+Gjqmu043Tc8nNIUFlR9E10qd3Euf9RiBYxBx3z+yfOzJPBzWNBSHv1+PIbO5Mq+z5JaAfoFZO41L7nw+FjV6JJUCVLr6Vq+bCxyA7LW4Oq9ZahSrt/vrT0kTa0tA5U9bqK6e7pB//dm7PzoROtTq0XksV8RseA/fvIje20uaN1z9dynx+UcbszXu9pQ5GIg1o7b5DEi3OZHJwpgdudiCyEeR4+00G0z4PjpEMnTSMHAJ53WxtjzrPAOBnAmPE7hPu4coU+XrCWEXAvRMloJmca68e+zFX7VvFK82KVDuQ99vQ6w4X73IESKoLzyAVxpelwHaDG4fN+zqYfqubVQU1L5cUeYKxqm5r3Us6VvMaYs1ZMUmDGXHOq4FNhGUJYxSjkLvunM6qyAAJQCd6Pw/2TV3UQVerbouGOZaeBLvRguHWSbDrO99Zu+t87w== rundeck_runner
 
 networking::interface_defaults:
   ensure: present
@@ -300,6 +358,11 @@ networking::route_defaults:
   netmask: 0.0.0.0
   network: default
 
+# logging:
+victorialogs::client::journald::enable: true
+victorialogs::client::journald::inserturl: https://vlinsert.service.consul:9428/insert/journald
+
+# FIXME these are for the proxmox ceph cluster
 profiles::ceph::client::fsid: 7f7f00cb-95de-498c-8dcc-14b54e4e9ca8
 profiles::ceph::client::mons:
   - 10.18.15.1

hieradata/country/au/region/drw1.yaml

@@ -1,2 +1,9 @@
 ---
 timezone::timezone: 'Australia/Darwin'
+profiles_dns_upstream_forwarder_unkin:
+  - 198.18.17.23
+  - 198.18.17.24
+profiles_dns_upstream_forwarder_consul:
+  - 198.18.17.34
+  - 198.18.17.35
+  - 198.18.17.36

hieradata/country/au/region/drw1/infra/dns/resolver.yaml

@@ -1,52 +1 @@
 ---
-profiles::dns::resolver::zones:
-  main.unkin.net-forward:
-    domain: 'main.unkin.net'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  13.18.198.in-addr.arpa-forward:
-    domain: '13.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  14.18.198.in-addr.arpa-forward:
-    domain: '14.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  15.18.198.in-addr.arpa-forward:
-    domain: '15.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  16.18.198.in-addr.arpa-forward:
-    domain: '16.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  17.18.198.in-addr.arpa-forward:
-    domain: '17.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.23
-      - 198.18.17.24
-    forward: 'only'
-  consul-forward:
-    domain: 'consul'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.17.34
-      - 198.18.17.35
-      - 198.18.17.36
-    forward: 'only'

hieradata/country/au/region/syd1.yaml

@@ -1,2 +1,7 @@
 ---
 timezone::timezone: 'Australia/Sydney'
+certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
+profiles_dns_upstream_forwarder_unkin:
+  - 198.18.19.15
+profiles_dns_upstream_forwarder_consul:
+  - 198.18.19.14

hieradata/country/au/region/syd1/infra/dns/resolver.yaml

@@ -1,52 +1 @@
 ---
-profiles::dns::resolver::zones:
-  main.unkin.net-forward:
-    domain: 'main.unkin.net'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  13.18.198.in-addr.arpa-forward:
-    domain: '13.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  14.18.198.in-addr.arpa-forward:
-    domain: '14.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  15.18.198.in-addr.arpa-forward:
-    domain: '15.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  16.18.198.in-addr.arpa-forward:
-    domain: '16.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  17.18.198.in-addr.arpa-forward:
-    domain: '17.18.198.in-addr.arpa'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.14
-      - 198.18.13.15
-    forward: 'only'
-  consul-forward:
-    domain: 'consul'
-    zone_type: 'forward'
-    forwarders:
-      - 198.18.13.19
-      - 198.18.13.20
-      - 198.18.13.21
-    forward: 'only'

hieradata/country/au/region/syd1/infra/halb/haproxy.yaml

@@ -1,4 +1,31 @@
 ---
+hiera_include:
+  - keepalived
+
+# keepalived
+profiles::haproxy::dns::ipaddr: '198.18.13.250'
+profiles::haproxy::dns::vrrp_cnames:
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - nzbget.main.unkin.net
+
+keepalived::vrrp_script:
+  check_haproxy:
+    script: '/usr/bin/killall -0 haproxy'
+
+keepalived::vrrp_instance:
+  VI_250:
+    interface: 'eth0'
+    virtual_router_id: 250
+    auth_type: 'PASS'
+    auth_pass: 'quiiK7oo'
+    virtual_ipaddress: '198.18.13.250/32'
+    track_script:
+      - check_haproxy
+
 # mappings
 profiles::haproxy::mappings:
   fe_http:
@@ -11,6 +38,9 @@ profiles::haproxy::mappings:
       - 'lidarr.main.unkin.net be_lidarr'
       - 'readarr.main.unkin.net be_readarr'
       - 'prowlarr.main.unkin.net be_prowlarr'
+      - 'nzbget.main.unkin.net be_nzbget'
+      - 'jellyfin.main.unkin.net be_jellyfin'
+      - 'fafflix.unkin.net be_jellyfin'
   fe_https:
     ensure: present
     mappings:
@@ -21,6 +51,9 @@ profiles::haproxy::mappings:
       - 'lidarr.main.unkin.net be_lidarr'
       - 'readarr.main.unkin.net be_readarr'
       - 'prowlarr.main.unkin.net be_prowlarr'
+      - 'nzbget.main.unkin.net be_nzbget'
+      - 'jellyfin.main.unkin.net be_jellyfin'
+      - 'fafflix.unkin.net be_jellyfin'
 
 profiles::haproxy::frontends:
   fe_http:
@@ -30,7 +63,15 @@ profiles::haproxy::frontends:
   fe_https:
     options:
       acl:
-        - 'acl_ausyd1pve req.hdr(host) -i https://au-syd1-pve.main.unkin.net'
+        - 'acl_ausyd1pve req.hdr(host) -i au-syd1-pve.main.unkin.net'
+        - 'acl_sonarr req.hdr(host) -i sonarr.main.unkin.net'
+        - 'acl_radarr req.hdr(host) -i radarr.main.unkin.net'
+        - 'acl_lidarr req.hdr(host) -i lidarr.main.unkin.net'
+        - 'acl_readarr req.hdr(host) -i readarr.main.unkin.net'
+        - 'acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net'
+        - 'acl_nzbget req.hdr(host) -i nzbget.main.unkin.net'
+        - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
+        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
         - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
       use_backend:
         - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -38,6 +79,14 @@ profiles::haproxy::frontends:
         - 'deny if { hdr_dom(host) -i au-syd1-pve.main.unkin.net } !acl_internalsubnets'
       http-response:
         - 'set-header X-Frame-Options DENY if acl_ausyd1pve'
+        - 'set-header X-Frame-Options DENY if acl_sonarr'
+        - 'set-header X-Frame-Options DENY if acl_radarr'
+        - 'set-header X-Frame-Options DENY if acl_lidarr'
+        - 'set-header X-Frame-Options DENY if acl_readarr'
+        - 'set-header X-Frame-Options DENY if acl_prowlarr'
+        - 'set-header X-Frame-Options DENY if acl_nzbget'
+        - 'set-header X-Frame-Options DENY if acl_jellyfin'
+        - 'set-header X-Frame-Options DENY if acl_fafflix'
         - 'set-header X-Content-Type-Options nosniff'
         - 'set-header X-XSS-Protection 1;mode=block'
 
@@ -79,7 +128,7 @@ profiles::haproxy::backends:
     options:
       balance: roundrobin
       option:
-        - httpchk GET /
+        - httpchk GET /consul/health
         - forwardfor
         - http-keep-alive
         - prefer-last-server
@@ -95,7 +144,7 @@ profiles::haproxy::backends:
     options:
       balance: roundrobin
       option:
-        - httpchk GET /
+        - httpchk GET /consul/health
         - forwardfor
         - http-keep-alive
         - prefer-last-server
@@ -111,7 +160,7 @@ profiles::haproxy::backends:
     options:
       balance: roundrobin
       option:
-        - httpchk GET /
+        - httpchk GET /consul/health
         - forwardfor
         - http-keep-alive
         - prefer-last-server
@@ -127,7 +176,7 @@ profiles::haproxy::backends:
     options:
       balance: roundrobin
       option:
-        - httpchk GET /
+        - httpchk GET /consul/health
         - forwardfor
         - http-keep-alive
         - prefer-last-server
@@ -140,6 +189,38 @@ profiles::haproxy::backends:
   be_prowlarr:
     description: Backend for au-syd1 prowlarr
     collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_nzbget:
+    description: Backend for au-syd1 nzbget
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_jellyfin:
+    description: Backend for au-syd1 jellyfin
+    collect_exported: false # handled in custom function
     options:
       balance: roundrobin
       option:
@@ -156,10 +237,31 @@ profiles::haproxy::backends:
 
 profiles::haproxy::certlist::enabled: true
 profiles::haproxy::certlist::certificates:
+  - /etc/pki/tls/letsencrypt/au-syd1-pve.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/au-syd1-pve-api.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/sonarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/radarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/lidarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/readarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/prowlarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/vault/certificate.pem
 
 # additional altnames
 profiles::pki::vault::alt_names:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+  - jellyfin.main.unkin.net
+
+# additional cnames
+profiles::haproxy::dns::cnames:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+
+# letsencrypt certificates
+certbot::client::service: haproxy
+certbot::client::domains:
   - au-syd1-pve.main.unkin.net
   - au-syd1-pve-api.main.unkin.net
   - sonarr.main.unkin.net
@@ -167,8 +269,5 @@ profiles::pki::vault::alt_names:
   - lidarr.main.unkin.net
   - readarr.main.unkin.net
   - prowlarr.main.unkin.net
-
+  - nzbget.main.unkin.net
-# additional cnames
+  - fafflix.unkin.net
-profiles::haproxy::dns::cnames:
-  - au-syd1-pve.main.unkin.net
-  - au-syd1-pve-api.main.unkin.net

hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

@@ -0,0 +1,305 @@
+---
+profiles::haproxy::dns::ipaddr: "%{hiera('anycast_ip')}"
+profiles::haproxy::dns::vrrp_cnames:
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - nzbget.main.unkin.net
+  - git.unkin.net
+  - fafflix.unkin.net
+  - grafana.unkin.net
+
+profiles::haproxy::mappings:
+  fe_http:
+    ensure: present
+    mappings:
+      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
+      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
+      - 'sonarr.main.unkin.net be_sonarr'
+      - 'radarr.main.unkin.net be_radarr'
+      - 'lidarr.main.unkin.net be_lidarr'
+      - 'readarr.main.unkin.net be_readarr'
+      - 'prowlarr.main.unkin.net be_prowlarr'
+      - 'nzbget.main.unkin.net be_nzbget'
+      - 'jellyfin.main.unkin.net be_jellyfin'
+      - 'fafflix.unkin.net be_jellyfin'
+      - 'git.unkin.net be_gitea'
+      - 'grafana.unkin.net be_grafana'
+  fe_https:
+    ensure: present
+    mappings:
+      - 'au-syd1-pve.main.unkin.net be_ausyd1pve_web'
+      - 'au-syd1-pve-api.main.unkin.net be_ausyd1pve_api'
+      - 'sonarr.main.unkin.net be_sonarr'
+      - 'radarr.main.unkin.net be_radarr'
+      - 'lidarr.main.unkin.net be_lidarr'
+      - 'readarr.main.unkin.net be_readarr'
+      - 'prowlarr.main.unkin.net be_prowlarr'
+      - 'nzbget.main.unkin.net be_nzbget'
+      - 'jellyfin.main.unkin.net be_jellyfin'
+      - 'fafflix.unkin.net be_jellyfin'
+      - 'git.unkin.net be_gitea'
+      - 'grafana.unkin.net be_grafana'
+
+profiles::haproxy::frontends:
+  fe_http:
+    options:
+      use_backend:
+        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_http.map,be_default)]"
+  fe_https:
+    options:
+      acl:
+        - 'acl_ausyd1pve req.hdr(host) -i au-syd1-pve.main.unkin.net'
+        - 'acl_sonarr req.hdr(host) -i sonarr.main.unkin.net'
+        - 'acl_radarr req.hdr(host) -i radarr.main.unkin.net'
+        - 'acl_lidarr req.hdr(host) -i lidarr.main.unkin.net'
+        - 'acl_readarr req.hdr(host) -i readarr.main.unkin.net'
+        - 'acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net'
+        - 'acl_nzbget req.hdr(host) -i nzbget.main.unkin.net'
+        - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
+        - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
+        - 'acl_gitea req.hdr(host) -i git.unkin.net'
+        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
+        - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
+      use_backend:
+        - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
+      http-request:
+        - 'deny if { hdr_dom(host) -i au-syd1-pve.main.unkin.net } !acl_internalsubnets'
+      http-response:
+        - 'set-header X-Frame-Options DENY if acl_ausyd1pve'
+        - 'set-header X-Frame-Options DENY if acl_sonarr'
+        - 'set-header X-Frame-Options DENY if acl_radarr'
+        - 'set-header X-Frame-Options DENY if acl_lidarr'
+        - 'set-header X-Frame-Options DENY if acl_readarr'
+        - 'set-header X-Frame-Options DENY if acl_prowlarr'
+        - 'set-header X-Frame-Options DENY if acl_nzbget'
+        - 'set-header X-Frame-Options DENY if acl_jellyfin'
+        - 'set-header X-Frame-Options DENY if acl_fafflix'
+        - 'set-header X-Frame-Options DENY if acl_gitea'
+        - 'set-header X-Frame-Options DENY if acl_grafana'
+        - 'set-header X-Content-Type-Options nosniff'
+        - 'set-header X-XSS-Protection 1;mode=block'
+
+profiles::haproxy::backends:
+  be_ausyd1pve_web:
+    description: Backend for au-syd1 pve cluster (Web)
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_ausyd1pve_api:
+    description: Backend for au-syd1 pve cluster (API only)
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_sonarr:
+    description: Backend for au-syd1 sonarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_radarr:
+    description: Backend for au-syd1 radarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_lidarr:
+    description: Backend for au-syd1 lidarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_readarr:
+    description: Backend for au-syd1 readarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_prowlarr:
+    description: Backend for au-syd1 prowlarr
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_nzbget:
+    description: Backend for au-syd1 nzbget
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /consul/health
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_jellyfin:
+    description: Backend for au-syd1 jellyfin
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+  be_gitea:
+    description: Backend for gitea cluster
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      stick-table: 'type ip size 200k expire 30m'
+      stick: 'on src'
+  be_grafana:
+    description: Backend for grafana nodes
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      stick-table: 'type ip size 200k expire 30m'
+      stick: 'on src'
+
+profiles::haproxy::certlist::enabled: true
+profiles::haproxy::certlist::certificates:
+  - /etc/pki/tls/letsencrypt/au-syd1-pve.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/au-syd1-pve-api.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/sonarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/radarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/lidarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/readarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/prowlarr.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/vault/certificate.pem
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+  - jellyfin.main.unkin.net
+
+# additional cnames
+profiles::haproxy::dns::cnames:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+
+# letsencrypt certificates
+certbot::client::service: haproxy
+certbot::client::domains:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - nzbget.main.unkin.net
+  - fafflix.unkin.net
+  - git.unkin.net
+  - grafana.unkin.net

hieradata/country/au/region/syd1/infra/sql/galera.eyaml

@@ -1,2 +1,3 @@
 ---
 mysql::db::grafana::pass: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAozi1vFf9KfwsGSdxXvhOWRn9Vqbr9AZ+cVJuIOmmLVZMRP4AJkkNgCCly+o1pxtMiU8EISUQuBWCBHUi+u2Y1YAjIABzTa2K+PCU7qqkdrJaxvKqmmKS7C/CWFKp1stYvYIvIofyvl9Q854nMcpvxQKL0PBGh3rIaUHHV3L0PH1UDLqL5j6OPXaNvKL4UzwMDDIVAd7F5yMbtSx2PT23pBLbPYsbG1jRx7pUS/d1ZE9E8h3OA2jxW/CBf68Sb2Xlrh7IAB/6RiLLpIsUyRMv9zrbPrMuKg/q5lzO0i9fejh5z3Z3YkdnhH61doUT/RSjAjz3JrWDGxomOSK0y8TxjjBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCg1kVqFs/mf4r+6EI32b8qgCBm6cL3JhVzj3Btit9D8VYU8mQcrIaXJZ3qF31zJMzCkw==]
+mysql::db::rundeck::pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAcWmZuTro0DNX8X/6DCJdmxm85hawng2cjSm/M26/sAzlr7i3XLIjg5TQc3BpeiKWZvQ2XZWygOEcW7g0bHH7FBS6XTXswDiLCf7ssd0DYL+eQbh4p6VijBKObug33fp4+YJaqGV7YRUNqBjXQv/SSmxFqbNaRahUqwbMidJCyjGNmfCfbSd9WxI4/8j0L38rjXR3/i+/xzgVIhgz/qymmw0rky6jN14YrwRIkdW6loMFzVd12tqdX9kh7UBdE7j58ntQgJSilQn2pLmQs6dgcXSOeIi8Sln4R0MfAtOQ1c6LoKMUdb7k8xEszpGbhX7sw51kpwvnL1LS6PQ+T8T9wDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDm1sAUc6LFtslrIuwk1JlJgDAngDM/0g4dpgyNOZDsvAU8OualEL6HZ2RFGfibteUc11wZzHkdFZlvHz2JZdO7Huo=]

hieradata/country/au/region/syd1/infra/sql/galera.yaml

@@ -13,3 +13,12 @@ mysql::db:
       - INSERT
       - UPDATE
       - DELETE
+  rundeck:
+    name: rundeck
+    user: rundeck
+    password: "%{alias('mysql::db::rundeck::pass')}"
+    grant:
+      - SELECT
+      - INSERT
+      - UPDATE
+      - DELETE

hieradata/nodes/ausyd1nxvm1000.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.10
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1001.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.11
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1002.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.12
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1003.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.13
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1004.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.14
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1005.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.15
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1006.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.16
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1007.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.17
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1008.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.18
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1009.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.19
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1010.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.20
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1011.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.21
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1012.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.22
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1013.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.23
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1014.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.24
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1015.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.25
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1016.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.26
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1017.main.unkin.net.yaml

@@ -1,11 +0,0 @@
----
-profiles::cobbler::params::is_cobbler_master: true
-networking::interfaces:
-  ens18:
-    ipaddress: 198.18.13.27
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-    interface: ens18
-
-profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1018.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.28
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1019.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.29
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1020.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.30
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1021.main.unkin.net.yaml

@@ -1,10 +0,0 @@
----
-networking::interfaces:
-  ens18:
-    ipaddress: 198.18.13.31
-networking::routes:
-  default:
-    gateway: 198.18.13.254
-    interface: ens18
-
-profiles::almalinux::base::remove_ens18: false

hieradata/nodes/ausyd1nxvm1022.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.32
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1023.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.33
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1024.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.34
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1025.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.35
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1026.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.36
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1027.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.37
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1028.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.38
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1029.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.39
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1030.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.40
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1031.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.41
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1032.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.42
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1033.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.43
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1034.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.44
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1035.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.45
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1037.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.47
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.47
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1038.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.48
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1039.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.49
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1040.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.50
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.50
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1041.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.51
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.51
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1042.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.52
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.52
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1043.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.53
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.53
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1044.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.54
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1045.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.55
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1046.main.unkin.net.yaml

@@ -1,7 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.56
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm1047.main.unkin.net.yaml

@@ -1,14 +0,0 @@
----
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.57
-  ens19:
-    ensure: present
-    family: inet
-    method: static
-    ipaddress: 10.18.15.57
-    netmask: 255.255.255.0
-    onboot: true
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm2097.main.unkin.net.yaml

@@ -13,9 +13,3 @@ profiles::ssh::sign::principals:
 
 profiles::puppet::puppetca::is_puppetca: true
 profiles::puppet::puppetca::allow_subject_alt_names: true
-networking::interfaces:
-  eth0:
-    ipaddress: 198.18.13.46
-networking::routes:
-  default:
-    gateway: 198.18.13.254

hieradata/nodes/ausyd1nxvm2098.main.unkin.net.yaml

@@ -0,0 +1,2 @@
+---
+profiles::cobbler::params::is_cobbler_master: true

hieradata/nodes/prodinf01n01.main.unkin.net.yaml

@@ -1,12 +0,0 @@
----
-profiles::puppet::server::dns_alt_names:
-  - puppetca.main.unkin.net
-  - puppetca.service.consul
-  - puppetca.query.consul
-  - puppetca
-
-profiles::puppet::puppetca::is_puppetca: false
-profiles::puppet::puppetca::allow_subject_alt_names: true
-
-hiera_exclude:
-  - networking

hieradata/nodes/prodnxsr0001.main.unkin.net.yaml

@@ -1,5 +1,13 @@
 ---
-profiles::proxmox::params::pve_clusterinit_master: true
+networking_loopback0_ip: 198.18.19.1  # management loopback
-profiles::proxmox::params::pve_ceph_mon: true
+networking_loopback1_ip: 198.18.22.1  # ceph-cluster loopback
-profiles::proxmox::params::pve_ceph_mgr: true
+networking_loopback2_ip: 198.18.23.1  # ceph-public loopback
-profiles::proxmox::params::pve_ceph_osd: true
+networking_1000_ip: 198.18.15.1       # 1gbe network
+networking_2500_ip: 198.18.21.1       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:75:c3:60
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:ac:d0:00:00:50

hieradata/nodes/prodnxsr0002.main.unkin.net.yaml

@@ -1,4 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_mon: true
+networking_loopback0_ip: 198.18.19.2  # management loopback
-profiles::proxmox::params::pve_ceph_mgr: true
+networking_loopback1_ip: 198.18.22.2  # ceph-cluster loopback
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback2_ip: 198.18.23.2  # ceph-public loopback
+networking_1000_ip: 198.18.15.2       # 1gbe network
+networking_2500_ip: 198.18.21.2       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:74:b6:08
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:e0:4c:68:08:43

hieradata/nodes/prodnxsr0003.main.unkin.net.yaml

@@ -1,4 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_mon: true
+networking_loopback0_ip: 198.18.19.3  # management loopback
-profiles::proxmox::params::pve_ceph_mgr: true
+networking_loopback1_ip: 198.18.22.3  # ceph-cluster loopback
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback2_ip: 198.18.23.3  # ceph-public loopback
+networking_1000_ip: 198.18.15.3       # 1gbe network
+networking_2500_ip: 198.18.21.3       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: b8:85:84:a3:25:c5
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:e0:4c:68:07:82

hieradata/nodes/prodnxsr0004.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.4  # management loopback
+networking_loopback1_ip: 198.18.22.4  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.4  # ceph-public loopback
+networking_1000_ip: 198.18.15.4       # 1gbe network
+networking_2500_ip: 198.18.21.4       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:75:d5:00
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:ac:d0:00:00:43

hieradata/nodes/prodnxsr0005.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.5  # management loopback
+networking_loopback1_ip: 198.18.22.5  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.5  # ceph-public loopback
+networking_1000_ip: 198.18.15.5       # 1gbe network
+networking_2500_ip: 198.18.21.5       # 2.5gbe network
+networking_1000_iface: enp1s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: 54:bf:64:a0:08:64
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:e0:4c:68:07:79

hieradata/nodes/prodnxsr0006.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.6  # management loopback
+networking_loopback1_ip: 198.18.22.6  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.6  # ceph-public loopback
+networking_1000_ip: 198.18.15.6       # 1gbe network
+networking_2500_ip: 198.18.21.6       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:75:10:8d
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:ac:d0:00:00:53

hieradata/nodes/prodnxsr0007.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.7  # management loopback
+networking_loopback1_ip: 198.18.22.7  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.7  # ceph-public loopback
+networking_1000_ip: 198.18.15.7       # 1gbe network
+networking_2500_ip: 198.18.21.7       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:74:b4:27
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:ac:d0:00:00:5b

hieradata/nodes/prodnxsr0008.main.unkin.net.yaml

@@ -1,2 +1,13 @@
 ---
-profiles::proxmox::params::pve_ceph_osd: true
+networking_loopback0_ip: 198.18.19.8  # management loopback
+networking_loopback1_ip: 198.18.22.8  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.8  # ceph-public loopback
+networking_1000_ip: 198.18.15.8       # 1gbe network
+networking_2500_ip: 198.18.21.8       # 2.5gbe network
+networking_1000_iface: enp2s0
+networking_2500_iface: enp3s0
+networking::interfaces:
+  "%{hiera('networking_1000_iface')}":
+    mac: d8:9e:f3:75:06:18
+  "%{hiera('networking_2500_iface')}":
+    mac: 00:e0:4c:68:08:4b

hieradata/nodes/prodnxsr0009.main.unkin.net.yaml

@@ -0,0 +1,18 @@
+---
+networking_loopback0_ip: 198.18.19.9  # management loopback
+networking_loopback1_ip: 198.18.22.9  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.9  # ceph-public loopback
+networking_br10_ip: 198.18.25.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:38:e9:8d
+    ipaddress: 198.18.15.9
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:5d
+    ipaddress: 198.18.21.9
+
+#zfs::zpools:
+#  fastpool:
+#    ensure: present
+#    disk: /dev/nvme0n1

hieradata/nodes/prodnxsr0010.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking_loopback0_ip: 198.18.19.10  # management loopback
+networking_loopback1_ip: 198.18.22.10  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.10  # ceph-public loopback
+networking_br10_ip: 198.18.26.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:38:e9:37
+    ipaddress: 198.18.15.10
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:de
+    ipaddress: 198.18.21.10

hieradata/nodes/prodnxsr0011.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking_loopback0_ip: 198.18.19.11  # management loopback
+networking_loopback1_ip: 198.18.22.11  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.11  # ceph-public loopback
+networking_br10_ip: 198.18.27.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:38:e9:0f
+    ipaddress: 198.18.15.11
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:55
+    ipaddress: 198.18.21.11

hieradata/nodes/prodnxsr0012.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking_loopback0_ip: 198.18.19.12  # management loopback
+networking_loopback1_ip: 198.18.22.12  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.12  # ceph-public loopback
+networking_br10_ip: 198.18.28.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:4f:05:1e
+    ipaddress: 198.18.15.12
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:e5
+    ipaddress: 198.18.21.12

hieradata/nodes/prodnxsr0013.main.unkin.net.yaml

@@ -0,0 +1,13 @@
+---
+networking_loopback0_ip: 198.18.19.13  # management loopback
+networking_loopback1_ip: 198.18.22.13  # ceph-cluster loopback
+networking_loopback2_ip: 198.18.23.13  # ceph-public loopback
+networking_br10_ip: 198.18.29.254
+networking::interfaces:
+  enp2s0:
+    mac: 70:b5:e8:4f:04:b0
+    ipaddress: 198.18.15.13
+    gateway: 198.18.15.254
+  enp3s0:
+    mac: 00:e0:4c:68:0f:36
+    ipaddress: 198.18.21.13

hieradata/os/AlmaLinux/AlmaLinux8.yaml

@@ -1,2 +1,23 @@
 # hieradata/os/AlmaLinux/AlmaLinux8.yaml
 ---
+crypto_policies::policy: 'DEFAULT'
+
+profiles::packages::include:
+  network-scripts: {}
+
+profiles::yum::global::repos:
+  powertools:
+    name: powertools
+    descr: powertools repository
+    target: /etc/yum.repos.d/powertools.repo
+    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
+    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
+    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el8
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/os/AlmaLinux/AlmaLinux9.yaml

@@ -1,2 +1,36 @@
 # hieradata/os/AlmaLinux/AlmaLinux9.yaml
 ---
+crypto_policies::policy: 'DEFAULT:SHA1'
+
+profiles::yum::global::repos:
+  baseos:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/baseos-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  extras:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/extras-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  appstream:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/appstream-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  highavailability:
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/ha-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  crb:
+    name: crb
+    descr: crb repository
+    target: /etc/yum.repos.d/crb.repo
+    baseurl: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os/
+    gpgkey: https://packagerepo.service.consul/almalinux/%{facts.os.release.full}/crb-daily/%{facts.os.architecture}/os//RPM-GPG-KEY-AlmaLinux-9
+    mirrorlist: absent
+  unkin:
+    name: unkin
+    descr: unkin repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el9
+    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/os/AlmaLinux/all_releases.yaml

@@ -3,17 +3,17 @@
 profiles::firewall::firewalld::ensure_package: 'absent'
 profiles::firewall::firewalld::ensure_service: 'stopped'
 profiles::firewall::firewalld::enable_service: false
-profiles::puppet::agent::puppet_version: '7.26.0'
+profiles::puppet::agent::puppet_version: '7.34.0'
 
 hiera_include:
   - profiles::almalinux::base
 
-profiles::packages::install:
+profiles::packages::include:
-  - lzo
+  crypto-policies-scripts: {}
-  - network-scripts
+  lzo: {}
-  - policycoreutils
+  policycoreutils: {}
-  - unar
+  unar: {}
-  - xz
+  xz: {}
 
 lm-sensors::package: lm_sensors
 
@@ -39,13 +39,6 @@ profiles::yum::global::repos:
     baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/AppStream/%{facts.os.architecture}/os
     gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
     mirrorlist: absent
-  powertools:
-    name: powertools
-    descr: powertools repository
-    target: /etc/yum.repos.d/powertools.repo
-    baseurl: https://edgecache.query.consul/almalinux/%{facts.os.release.full}/PowerTools/%{facts.os.architecture}/os
-    gpgkey: http://edgecache.query.consul/almalinux/RPM-GPG-KEY-AlmaLinux-%{facts.os.release.major}
-    mirrorlist: absent
   highavailability:
     name: highavailability
     descr: highavailability repository
@@ -57,20 +50,21 @@ profiles::yum::global::repos:
     name: epel
     descr: epel repository
     target: /etc/yum.repos.d/epel.repo
-    baseurl: https://edgecache.query.consul/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
+    baseurl: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/
-    gpgkey: http://edgecache.query.consul/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
+    gpgkey: https://packagerepo.service.consul/epel/%{facts.os.release.major}/everything-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
     mirrorlist: absent
   puppet:
     name: puppet
     descr: puppet repository
     target: /etc/yum.repos.d/puppet.repo
-    baseurl: https://yum.puppet.com/puppet7/el/%{facts.os.release.major}/%{facts.os.architecture}
+    baseurl: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/
-    gpgkey: https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406
+    gpgkey: https://packagerepo.service.consul/puppet7/el/%{facts.os.release.major}-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-puppet-20250406
     mirrorlist: absent
-  unkin:
+  unkinben:
-    name: unkin
+    name: unkinben
-    descr: unkin repository
+    descr: unkinben repository
     target: /etc/yum.repos.d/unkin.repo
     baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
     gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
+    gpgcheck: false
     mirrorlist: absent

hieradata/os/Debian/all_releases.yaml

@@ -1,15 +1,19 @@
 # hieradata/os/debian/all_releases.yaml
 ---
-profiles::apt::base::mirrorurl: https://edgecache.query.consul/debian/
+profiles::apt::base::mirrorurl: http://edgecache.query.consul/debian/
 profiles::apt::base::secureurl: http://security.debian.org/debian-security
 profiles::apt::puppet7::mirror: http://apt.puppetlabs.com
 profiles::apt::puppet7::repo: puppet7
 profiles::pki::vaultca::ca_cert-path: /usr/local/share/ca-certificates/
 
-profiles::packages::install:
+profiles::packages::include:
-  - lzop
+  lzop: {}
-  - python3.11-venv
+  python3.11-venv: {}
-  - xz-utils
+  xz-utils: {}
 
 lm-sensors::package: lm-sensors
 networking::nwmgr_dns_none: false
+
+consul::install_method: 'url'
+consul::manage_repo: false
+consul::bin_dir: /usr/local/bin

hieradata/roles/apps/jupyter/hub.eyaml

@@ -0,0 +1 @@
+profiles::jupyter::jupyterhub::ldap_bind_pass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAJspN3e2WzA0uZaLgFZ0Ewqii9dY0tTgbirsW70M2VZtLY+s+C6HE8ZZUtpfnRsFwUUhOj7s25X9xVOZNTpZIGPyfx9MWlSyFw2RFuXSEwaydf1DcBbg8261YrTTysA4Jsa1L4DLsX55q+XJUyeUbimVQkIacVIvzTdnZCBKnVNUh3U2PNAmV7SOL2KH8Jpbfs/EQfBt8XuGMCg3I/4RDyoNERqthW6W2KiMX2Gmd8iQ5+W9udH0lEAMx415oyImmN+dEuThcx9FGMi8BWYtnxH96yWafpT5qltwW6EVzIGWuLhiD1LcWYc5RB8jc3DhbeouChpKsN6c4EHoKt3aWsTBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC8jcnqilJgY1/AnHWHfX4bgDCi2a3Rj43Z0dgfB5HaHdpfked3Cx+u94r2S5+Cg3QogU1AIF04rjzOL+bD2HdaMfo=]

hieradata/roles/apps/jupyter/hub.yaml

@@ -0,0 +1,74 @@
+---
+profiles::packages::include:
+  python3.12: {}
+  python3.12-pip: {}
+
+hiera_include:
+  - docker
+  - profiles::nginx::simpleproxy
+
+# manage docker
+docker::version: latest
+docker::curl_ensure: false
+docker::root_dir: /data/docker
+
+# manage a simple nginx reverse proxy
+profiles::nginx::simpleproxy::nginx_vhost: 'jupyterhub.query.consul'
+profiles::nginx::simpleproxy::nginx_aliases:
+  - jupyterhub.service.consul
+  - jupyterhub.query.consul
+  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
+
+profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
+profiles::nginx::simpleproxy::proxy_port: 8000
+profiles::nginx::simpleproxy::proxy_path: '/'
+profiles::nginx::simpleproxy::use_default_location: false
+nginx::client_max_body_size: 20M
+
+profiles::nginx::simpleproxy::locations:
+  # authorised access from external
+  default:
+    ensure: 'present'
+    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
+    ssl_only: true
+    location: '/'
+    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
+    proxy_set_header:
+      - 'Host $host'
+      - 'X-Real-IP $remote_addr'
+      - 'X-Forwarded-For $proxy_add_x_forwarded_for'
+      - 'X-Forwarded-Host $host'
+      - 'X-Forwarded-Proto $scheme'
+      - 'Upgrade $http_upgrade'
+      - 'Connection $http_connection'
+      - 'X-Scheme $scheme'
+    proxy_redirect: 'off'
+    proxy_http_version: '1.1'
+    proxy_buffering: 'off'
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - jupyterhub.service.consul
+  - jupyterhub.query.consul
+  - "jupyterhub.service.%{facts.country}-%{facts.region}.consul"
+
+# configure consul service
+consul::services:
+  jupyterhub:
+    service_name: 'jupyterhub'
+    tags:
+      - 'jupyterhub'
+    address: "%{facts.networking.ip}"
+    port: 443
+    checks:
+      - id: 'jupyterhub_http_check'
+        name: 'jupyterhub HTTP Check'
+        http: "https://%{facts.networking.fqdn}"
+        method: 'GET'
+        tls_skip_verify: true
+        interval: '10s'
+        timeout: '1s'
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: jupyterhub
+    disposition: write

hieradata/roles/apps/media.yaml

@@ -1,4 +1,7 @@
 ---
+hiera_include:
+  - profiles::nginx::simpleproxy
+
 profiles::yum::global::repos:
   ceph-reef:
     name: ceph-reef
@@ -18,3 +21,80 @@ profiles::base::groups::local:
     gid: 20000
     allowdupe: false
     forcelocal: true
+
+ldap_host: 'ldap.service.consul'
+ldap_basedn: 'dc=main,dc=unkin,dc=net'
+
+profiles::nginx::simpleproxy::locations:
+  # authentication proxy
+  authproxy:
+    ensure: 'present'
+    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
+    ssl_only: true
+    internal: true
+    location: '= /auth-proxy'
+    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:8888"
+    proxy_set_header:
+      - 'Content-Length ""'
+      - "X-Ldap-URL ldap://%{lookup('ldap_host')}"
+      - 'X-Ldap-Starttls "false"'
+      - "X-Ldap-BaseDN %{lookup('ldap_basedn')}"
+      - "X-Ldap-BindDN %{lookup('ldap_binddn')}"
+      - "X-Ldap-BindPass %{lookup('ldap_bindpass')}"
+      - 'X-CookieName "nginxauth"'
+      - 'Cookie nginxauth=$cookie_nginxauth'
+      - "X-Ldap-Template %{lookup('ldap_template')}"
+      - 'X-Ldap-Realm "Restricted"'
+    proxy_cache: 'cache'
+    proxy_cache_valid: '200 10m'
+    proxy_cache_key: '"$http_authorization$cookie_nginxauth"'
+    location_cfg_append:
+      proxy_pass_request_body: 'off'
+  # health checks by consul/haproxy
+  arrstack_web_healthcheck:
+    ensure: 'present'
+    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
+    ssl_only: true
+    location: '/consul/health'
+    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
+    proxy_set_header:
+      - 'Host $host'
+      - 'X-Forwarded-For $proxy_add_x_forwarded_for'
+      - 'X-Forwarded-Host $host'
+      - 'X-Forwarded-Proto $scheme'
+      - 'Upgrade $http_upgrade'
+      - 'Connection $http_connection'
+    proxy_redirect: 'off'
+    proxy_http_version: '1.1'
+    location_allow:
+      - 127.0.0.1
+      - "%{facts.networking.ip}"
+      - 198.18.24.0/24
+    location_deny:
+      - all
+  # authorised access from external
+  arrstack_web_external:
+    ensure: 'present'
+    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
+    ssl_only: true
+    location: '/'
+    auth_request: '/auth-proxy'
+    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
+    proxy_set_header:
+      - 'Host $host'
+      - 'X-Forwarded-For $proxy_add_x_forwarded_for'
+      - 'X-Forwarded-Host $host'
+      - 'X-Forwarded-Proto $scheme'
+      - 'Upgrade $http_upgrade'
+      - 'Connection $http_connection'
+    proxy_redirect: 'off'
+    proxy_http_version: '1.1'
+  # location for api, which should be accessible without authentication
+  arrstack_api:
+    ensure: 'present'
+    server: "%{lookup('profiles::nginx::simpleproxy::nginx_vhost')}"
+    ssl_only: true
+    location: '~ /api'
+    proxy: "http://%{lookup('profiles::nginx::simpleproxy::proxy_host')}:%{lookup('profiles::nginx::simpleproxy::proxy_port')}"
+    location_cfg_append:
+      client_max_body_size: '20m'

hieradata/roles/apps/media/jellyfin.yaml

@@ -0,0 +1,77 @@
+---
+hiera_include:
+  - jellyfin
+
+profiles::packages::include:
+  intel-media-driver: {}
+  libva-intel-driver: {}
+  libva-intel-hybrid-driver: {}
+  intel-mediasdk: {}
+
+# manage jellyfin
+jellyfin::params::service_enable: true
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - jellyfin.main.unkin.net
+  - jellyfin.service.consul
+  - jellyfin.query.consul
+  - "jellyfin.service.%{facts.country}-%{facts.region}.consul"
+
+# manage a simple nginx reverse proxy
+profiles::nginx::simpleproxy::nginx_vhost: 'jellyfin.query.consul'
+profiles::nginx::simpleproxy::nginx_aliases:
+  - jellyfin.main.unkin.net
+  - jellyfin.service.consul
+  - jellyfin.query.consul
+  - "jellyfin.service.%{facts.country}-%{facts.region}.consul"
+profiles::nginx::simpleproxy::proxy_port: 8096
+profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
+profiles::nginx::simpleproxy::proxy_path: '/'
+
+# configure consul service
+nginx::client_max_body_size: 10M
+consul::services:
+  jellyfin:
+    service_name: 'jellyfin'
+    tags:
+      - 'media'
+      - 'jellyfin'
+    address: "%{facts.networking.ip}"
+    port: 443
+    checks:
+      - id: 'jellyfin_http_check'
+        name: 'jellyfin HTTP Check'
+        http: "https://%{facts.networking.fqdn}:443"
+        method: 'GET'
+        tls_skip_verify: true
+        interval: '10s'
+        timeout: '1s'
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: jellyfin
+    disposition: write
+
+profiles::yum::global::repos:
+  rpmfusion-free:
+    name: rpmfusion-free
+    descr: rpmfusion-free repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    mirrorlist: absent
+  rpmfusion-nonfree:
+    name: rpmfusion-nonfree
+    descr: rpmfusion-nonfree repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    mirrorlist: absent
+  unkinben:
+    name: unkinben
+    descr: unkinben repository
+    target: /etc/yum.repos.d/unkin.repo
+    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el8
+    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
+    gpgcheck: false
+    mirrorlist: absent

hieradata/roles/apps/media/lidarr.eyaml

@@ -1,2 +1,3 @@
 ---
 lidarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAeIT5i5yJ/KCmEBEgF8r36dl2RK/0/LQWPl6bgth7KOdtfNynhH4bCxembrJwzXasT1KBrPWYmTc2IObBz2tqu7BIHoioI2y+GVs2ulhx63lrfeDI/I4QFs5EOh9fIoyOxlIkvKm+p0WVfaegKOKM63XHHvG2TmBwTypEHB1IXaCMVl87tY+3xmMEaiqVPik3llqLCog1rmRLbIQx+whAFPtlhHur0ozfdYLKiM57YHAsQpGgASYkAAjvZuKabOrRZsIhhsHCb4JQ/evvIrhkviK7nP4xHdeqRSJgdEDmIldr2FW3uHCzuq033K3T7HNc3HbUM/5lC0ygP8sZnnM8rDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAyfQkaBPJJWVsc2FGiyCyMgDAYuYDAwBBAJzfVZ4RFrQyi48VZeS8MTjf2HNAXBYoYgTtdZAk9i+pIV22p9ee+KsU=]
+ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAEDEyk6fBBnrjZvfK8MnUVOTWxhFGtgY34/2CuIq55MoVLsk2ZgVrL7Kt+94bqFhwEB67kuNpMGXqTgW5ose2yWs5iVSJLECsf9C+tvGBGwaV35LNwP5S3aQmFagyTpZZz9QlGKC7818jlXz7vZWDtiUhy5TGMHeyS0fdjCveavtZR28A+ZrvWjJeLdN47mmvYwYfFnQBs3kSgkl5KyMVhFWSFOSLeHsuEzCVXHoQ1jQG+2TV5m18wV0RR/sOju2E+vsulqlDgCyifgoiry4GzJeKNrNDI2bifzHCAi6yZqHL/klyqbGTnKLlA4xKoXsHF+xEwcoq4S9JDLAdWeH1SDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCdvh4yn8knozcYhinybRq3gDAwTKv8VakQG7XK/mcEplwtoiKqLnj9IIGdIUh1zPi2Sg48ET5rfZyl0p7ddIYoHjU=]

hieradata/roles/apps/media/lidarr.yaml

@@ -1,7 +1,8 @@
 ---
 hiera_include:
   - lidarr
-  - profiles::nginx::simpleproxy
+  - profiles::nginx::ldapauth
+  - profiles::media::lidarr
 
 # manage lidarr
 lidarr::params::user: lidarr
@@ -27,9 +28,13 @@ profiles::nginx::simpleproxy::nginx_aliases:
 profiles::nginx::simpleproxy::proxy_port: 8000
 profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
 profiles::nginx::simpleproxy::proxy_path: '/'
+profiles::nginx::simpleproxy::use_default_location: false
+nginx::client_max_body_size: 20M
+
+ldap_binddn: 'cn=svc_lidarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
+ldap_template: '(&(uid=%(username)s)(memberOf=ou=lidarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
 
 # configure consul service
-nginx::client_max_body_size: 10M
 consul::services:
   lidarr:
     service_name: 'lidarr'
@@ -41,7 +46,7 @@ consul::services:
     checks:
       - id: 'lidarr_http_check'
         name: 'Lidarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443"
+        http: "https://%{facts.networking.fqdn}:443/consul/health"
         method: 'GET'
         tls_skip_verify: true
         interval: '10s'

hieradata/roles/apps/media/nzbget.eyaml

@@ -0,0 +1,2 @@
+---
+ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAPomn4iZbT0JEysvDo7OgblpoQLFp9DzryY558UfVWQq6HDAkgoSC42cbgZGBPFclCgLaO/LfBrFpRXkafEVV33Vg2AmP/FiS9SmmwREc3t/ZTvENlDIgasY3pDIph0/i5u0S45mjyzzciBK0KY6cMZvPDVRvU+d0SyVnbSBlef6VmyZOhUk6ILpaYTGu+suVR/BAL/DTKsmmY7iTotTWN+IW/1cY3vprvBMJQVftaO1WSqKftmX29/PAsxbQo6AMpuQFx/dMcMe3d5JTB0mgzIhAFaKmSC8vJFqe21Nrr8F+PxJMSEl1saBJTwJc5RyPVm9ejVKfcPhDfWK5stNNvjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAo205Hvo/Z+rhnSGgkTS2YgDB7pTHdgnQz1UOK323DRljWcqx+SnCA7izyF1SNMlzlCck79Fr4zKh0qnbYsMZDWZU=]

hieradata/roles/apps/media/nzbget.yaml

@@ -0,0 +1,87 @@
+---
+
+hiera_include:
+  - nzbget
+  - profiles::media::nzbget
+  - profiles::nginx::ldapauth
+  - exporters::nzbget_exporter
+
+profiles::packages::include:
+  unrar: {}
+
+# manage nzbget
+nzbget::params::user: nzbget
+nzbget::params::group: media
+nzbget::params::manage_group: false
+
+# nzbget_exporter
+exporters::nzbget_exporter::enable: true
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - nzbget.main.unkin.net
+  - nzbget.service.consul
+  - nzbget.query.consul
+  - "nzbget.service.%{facts.country}-%{facts.region}.consul"
+
+# manage a simple nginx reverse proxy
+profiles::nginx::simpleproxy::nginx_vhost: 'nzbget.query.consul'
+profiles::nginx::simpleproxy::nginx_aliases:
+  - nzbget.main.unkin.net
+  - nzbget.service.consul
+  - nzbget.query.consul
+  - "nzbget.service.%{facts.country}-%{facts.region}.consul"
+profiles::nginx::simpleproxy::proxy_port: 6789
+profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
+profiles::nginx::simpleproxy::proxy_path: '/'
+profiles::nginx::simpleproxy::use_default_location: false
+nginx::client_max_body_size: 20M
+
+ldap_binddn: 'cn=svc_nzbget,ou=services,ou=users,dc=main,dc=unkin,dc=net'
+ldap_template: '(&(uid=%(username)s)(memberOf=ou=nzbget_access,ou=groups,dc=main,dc=unkin,dc=net))'
+
+profiles::nginx::simpleproxy::locations:
+  arrstack_web_healthcheck:
+    location_cfg_append:
+      rewrite: '/consul/health / break'
+
+# configure consul service
+consul::services:
+  nzbget:
+    service_name: 'nzbget'
+    tags:
+      - 'media'
+      - 'nzbget'
+    address: "%{facts.networking.ip}"
+    port: 443
+    checks:
+      - id: 'nzbget_http_check'
+        name: 'nzbget HTTP Check'
+        http: "https://%{facts.networking.fqdn}:443/consul/health"
+        method: 'GET'
+        tls_skip_verify: true
+        interval: '10s'
+        timeout: '1s'
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: nzbget
+    disposition: write
+  - resource: service
+    segment: nzbget_exporter
+    disposition: write
+
+profiles::yum::global::repos:
+  rpmfusion-free:
+    name: rpmfusion-free
+    descr: rpmfusion-free repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/free/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/free/el/RPM-GPG-KEY-rpmfusion-free-el-%{facts.os.release.major}
+    mirrorlist: absent
+  rpmfusion-nonfree:
+    name: rpmfusion-nonfree
+    descr: rpmfusion-nonfree repository
+    target: /etc/yum.repos.d/rpmfusion.repo
+    baseurl: https://download1.rpmfusion.org/nonfree/el/updates/%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download1.rpmfusion.org/nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
+    mirrorlist: absent

hieradata/roles/apps/media/prowlarr.eyaml

@@ -1,2 +1,3 @@
 ---
 prowlarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAdAzvi5Z2cX7KWdMlMfR5N+Jz9Pmh3k9yvPgM1JnTM8ZODs5VyQf/d3goWJ5Fn+jcjVqQ+aBga2CHfbdjgg5dGC19Jr8CmxVkYpMVb+e6Md4LEglUD6g70LK8JHB1FAM0fqW82/zqBL73KFKcu71Hpbf9YylJD4LXCr/k4D7hPX3tgEOzFn1iGl/DqxJFWnorj0btk3/2AmA3AMjvFy4r39PwbMfr2jNFSmAdJa7j7W+ESyE08Cc795VORIa/lbrT0ZfBMGXqzNTIpcdJ7uabcrH0qHNM8FPh4eHBzGMqLvIba487bs2TUb8eIivwT2EAwmGDWX1QkG2o6lGyO8PyqzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBO8BQpHvHYOA2tjyxpjGw4gDATwt1wP0aPFPnbRoqPdwClfOzbWmtbT/rCBmCQH0HkyA8sqr2I2qlOsuJukCjBDHo=]
+ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAhduPAqoZuq/xeRs4f/KX4r88evPMogQX79yofLAB5Qqdr48s2X0BAa1iiw0vMdL6Tf0uc794WJN5MP2Yp365Vk1yhwgqH92rt5hKPI+wBN5uak2iLgLzLWsp0HOx7d1ukDWBbj0lI6G5LiofsL3KJbbTnkovn06L4PRJXgn44+ynfywiCl2tPy2294DhfooeM6/Cy+t9lA6blzHLCOHtt/rBKmk1GT2y3YBCPhRfOumWXQWnv4Q+f6KkQkvpfPyAFYNiQxQYBv5bGwLnwiDk3xQnPM4FfcutVuAOKjsoeMa+K1KShDFyEfBxIER8JSpigj2/khstyihcVW0Xrod3uDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCRqqRwMThwn1F/6byFhTWxgDAfucfkFhmqxBv/u5H+wWnjvK5EH7eU/fECrajYPBW/cmsYjLgXlwrAzFGqWze3AZc=]

hieradata/roles/apps/media/prowlarr.yaml

@@ -1,7 +1,9 @@
 ---
 hiera_include:
   - prowlarr
-  - profiles::nginx::simpleproxy
+  - profiles::nginx::ldapauth
+  - profiles::media::prowlarr
+  - exporters::exportarr
 
 # manage prowlarr
 prowlarr::params::user: prowlarr
@@ -10,6 +12,12 @@ prowlarr::params::manage_group: false
 prowlarr::params::archive_version: 1.19.0
 prowlarr::params::port: 8000
 
+# exportarr
+exporters::exportarr::enable: true
+exporters::exportarr::app: prowlarr
+exporters::exportarr::api_key: "%{hiera('prowlarr::api_key')}"
+exporters::exportarr::backfill: true
+
 # additional altnames
 profiles::pki::vault::alt_names:
   - prowlarr.main.unkin.net
@@ -27,9 +35,13 @@ profiles::nginx::simpleproxy::nginx_aliases:
 profiles::nginx::simpleproxy::proxy_port: 8000
 profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
 profiles::nginx::simpleproxy::proxy_path: '/'
+profiles::nginx::simpleproxy::use_default_location: false
+nginx::client_max_body_size: 20M
+
+ldap_binddn: 'cn=svc_prowlarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
+ldap_template: '(&(uid=%(username)s)(memberOf=ou=prowlarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
 
 # configure consul service
-nginx::client_max_body_size: 10M
 consul::services:
   prowlarr:
     service_name: 'prowlarr'
@@ -41,7 +53,7 @@ consul::services:
     checks:
       - id: 'prowlarr_http_check'
         name: 'Prowlarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443"
+        http: "https://%{facts.networking.fqdn}:443/consul/health"
         method: 'GET'
         tls_skip_verify: true
         interval: '10s'
@@ -50,3 +62,15 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: prowlarr
     disposition: write
+  - resource: service
+    segment: exportarr
+    disposition: write
+
+profiles::nginx::simpleproxy::locations:
+  arrstack_web_external:
+    location_satisfy: any
+    location_allow:
+      - 198.18.13.47
+      - 198.18.13.50
+      - 198.18.13.51
+      - 198.18.13.52

hieradata/roles/apps/media/radarr.eyaml

@@ -1,2 +1,3 @@
 ---
 radarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEALtNnNr2N7DpP9zx5anmQavFmsTLIyPkpJGCkJpUTHMYFSScS/3FOUuufajk4Cmu4FbPswp/N/U1nHO8oLF6xNQ+H77+xXuKPalW/3R1IRqGoczwsAfstJ6nYF+PLjjeK2TDP+KMs3Eg2+nrXB7NOVOP88RvDLyZq93Wn9qR+1VG6Y2gLqGSJArZpNilV5ygUYRgbMeckjqfLynYBXtgDQQLYNhxDO6WGRRv+0X773nmOdrWFAUjqF6/K+Ejjk5ZbaqnGyjljMstSrhg7NWxtMRbCjeMpjUjUS4Hn/Vayg2M2Ag2s87gsE1e4QFa6KP7GVRu3swvyZ3D54Ba/xrebxzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDD6gIEfNGPXA8zv/vysgxJgDADMi7Fx5q+aqTMeqcKLg1AukTlCnJ62zykm6RNGdS0KlpJsvTSmWF4So3v/9BsKdk=]
+ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAf6LbAXy3EsJqkf4KO8xikpXfSVIVOD2obnwZLPEiCfbC0iJyZ2Uc/RbHM9NnIpg8dgEnYGgaBM9HC+kFKYFP4skLsPQ0mpqOv13WbOAHOphhyBxWc/n4Eg4HqMAiHsC4qA9Sj5j4F29tNiMmpNM0eqDXD6YIrajV5IF+SKQQzZrNSrcDrzjqENaMnJWVc2gj7Zb9kPB1LdM5ZfljpPtfQHXHhh9ShTDKuWMx46nc+UYaRcJqHEns7OExwpsEAtA1SSunD81PTijJ6Bn1Y6cAsZoBot5YgFGaWtgQ4jvEqj7EbG8gDJuHMSwa9RzA9SMsVwEh2g1pko7wYbBR/arV7jBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAhZlVaEdaLNh60gAY0KwEKgDAHPoXfFRq0I2K2J+NFgNFm/A00jYGVRfuPsX6VZfPaJ499dtMiJifrK3Kfk1oXpvk=]

hieradata/roles/apps/media/radarr.yaml

@@ -1,7 +1,9 @@
 ---
 hiera_include:
   - radarr
-  - profiles::nginx::simpleproxy
+  - profiles::nginx::ldapauth
+  - profiles::media::radarr
+  - exporters::exportarr
 
 # manage radarr
 radarr::params::user: radarr
@@ -10,6 +12,10 @@ radarr::params::manage_group: false
 radarr::params::archive_version: 5.7.0
 radarr::params::port: 8000
 
+# exportarr
+exporters::exportarr::enable: true
+exporters::exportarr::app: radarr
+exporters::exportarr::api_key: "%{hiera('radarr::api_key')}"
 
 # additional altnames
 profiles::pki::vault::alt_names:
@@ -28,9 +34,13 @@ profiles::nginx::simpleproxy::nginx_aliases:
 profiles::nginx::simpleproxy::proxy_port: 8000
 profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
 profiles::nginx::simpleproxy::proxy_path: '/'
+profiles::nginx::simpleproxy::use_default_location: false
+nginx::client_max_body_size: 20M
+
+ldap_binddn: 'cn=svc_radarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
+ldap_template: '(&(uid=%(username)s)(memberOf=ou=radarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
 
 # configure consul service
-nginx::client_max_body_size: 10M
 consul::services:
   radarr:
     service_name: 'radarr'
@@ -42,7 +52,7 @@ consul::services:
     checks:
       - id: 'radarr_http_check'
         name: 'radarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443"
+        http: "https://%{facts.networking.fqdn}:443/consul/health"
         method: 'GET'
         tls_skip_verify: true
         interval: '10s'
@@ -51,3 +61,6 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: radarr
     disposition: write
+  - resource: service
+    segment: exportarr
+    disposition: write

hieradata/roles/apps/media/readarr.eyaml

@@ -1,2 +1,3 @@
 ---
 readarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAlJ5RLp6pVTGQgtbzO5cQSrHBMg80S1ImFprHDeWC3GPN2KbheM80b1FKxvN+oVUJ8/kfiV6zstLOoYPUJQfmJNa/Xe95W/5+9hH2IS/oQ0yVdfLOjRq//qp+mVvSJ7JrtOyYSIrU3HjxaD+eXTPYp4UEJKfdSmGyDr7XuCOVIZe0Lu7OHczs8VKrowN99RJZ589HoMqrqCZWPlx14l/uNFjYdK/w6VcUWoo9y/5z1jtsNIObV8kSAYQQLwSr3tmjJdEE3au4sjeMOOJDpGcd5aJRWpKp12+8oHdVR5BV5326aCb13tkp6Td0jq/W9J2Jyv05vUdpP3PnVH9mHPDh6TBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDA+2mMNGwfYM+mRoVTQiZMgDBanhVFmpYe42vZgMBKpNcNRjTnoCl27RpxD3KnjYwkE1zw/NeEOLoSZ1Try3GrlaA=]
+ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAcOegaqGEsivQAlhSYvaiVUij4QJ/kterSg+wX/7P/oWjSN1oSNAFfco6lg5fYUsR7HDKZ4IwYuO1Q/q8hOxYkqzYrH/MIAhZatfQxyxriKuekxqOMuXgwrWCzAexQL0Fb4s5gcHQ4fwy5OxsM1CxFXnSSm1eYNXl5IERd//c0dFoIcshiGlOCFsj8Ne9mookFTJQDZrxM4VMXaVb+Fl9mOyy1ppDBKHTP/1ise/6LIUi+9YngamAWLIrsur5KvR45kvRoxDNLfJZasAqhD/5QLceDdSxqKBDur57QzmoPo2lFdT4WlzphKOdyHZtYOYr7BPdbtCqkXTWdkXvqFlRxjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCXhYe6zoRW7/OxVrZnAEoTgDDPFTz5S4nZWiwzjdT7Yd88Ii6I/v6ckaKTx0gd0pZKsVZkFYQBBhIfqFS2ho0UG3Y=]

hieradata/roles/apps/media/readarr.yaml

@@ -1,7 +1,8 @@
 ---
 hiera_include:
   - readarr
-  - profiles::nginx::simpleproxy
+  - profiles::nginx::ldapauth
+  - profiles::media::readarr
 
 # manage readarr
 readarr::params::user: readarr
@@ -27,9 +28,13 @@ profiles::nginx::simpleproxy::nginx_aliases:
 profiles::nginx::simpleproxy::proxy_port: 8000
 profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
 profiles::nginx::simpleproxy::proxy_path: '/'
+profiles::nginx::simpleproxy::use_default_location: false
+nginx::client_max_body_size: 20M
+
+ldap_binddn: 'cn=svc_readarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
+ldap_template: '(&(uid=%(username)s)(memberOf=ou=readarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
 
 # configure consul service
-nginx::client_max_body_size: 10M
 consul::services:
   readarr:
     service_name: 'readarr'
@@ -41,7 +46,7 @@ consul::services:
     checks:
       - id: 'readarr_http_check'
         name: 'Readarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443"
+        http: "https://%{facts.networking.fqdn}:443/consul/health"
         method: 'GET'
         tls_skip_verify: true
         interval: '10s'

hieradata/roles/apps/media/sonarr.eyaml

@@ -1 +1,2 @@
 sonarr::api_key: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEANhwc0Vk0htkacwqGA/ZEVR7hpC1V2+nyP3lxyqkVNWERdcIsoMjlfwp2QNoLVirALY10Kon1wKXiRLT+QOqF9aTapS2Vb2YH3ZujR5yT6T1z4e0o4EA3IlNJZemVIziIqrK8+8zZzVafYdOYwMwpbc5EzoJPBtdqNHbDaQu4bRTCp2yMISTOzFjZpOoEJlRyC8YrffNU2xzA5mh5Cw+00MdIfPd8enrCnA4b1ddqP/IsfEYRt91ANQBULwKC5wenKdJAN5qKSKW6KU9TUM5YvGvUPgTvcYgXNf3/INL6G3/HwISTE5A7S6lqwYLyRTT1fMHtgDIqS936DPqCdAZtzjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBZ4e3jAM0zvV43IrCzQOGIgDBwOWgm+wJG+jAU8r1awWDvzQXgF3h65nAKfoOuGEztsjeBEruU4EmZy6llLbfSSb8=]
+ldap_bindpass: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAF5/sP43SJX/FB6cAS0GPqxC78JS7jSNKoUqWB/IXkv8uXYiClqk+Xw4nFx8EtknNn628DHBY3vCLQ59Xk89p0fyimP70m3BM6or5iRGdCqEAOzL399GbYX8WFHjyQRBmGdaLR5h2r5UnmjuPpDtV+fgsqxo4gNpXnuQ+46ZZPQce/dzHzux+4aEK4Q6UbD/ZZSQklD6zEUV+Agj6E9cQlJPBiHtTyUdXOYHYlJN1HhFPXu3C6KIz63YioVCah1n6T/rJtPQ07pVUfizIaJiPpzcUN91+ZWyyjUPo0bRGZtYKVs/uCAYXht4F5ttKQDaGa3wd4a5IdtacmEWQWFqk3TBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDtB/68xkjxK3nrNh0MilACgDDt85aBvSp/Oj9EY67eNPr+JcnQ7WfyuqAYAnmYqfbQI8MDtYAx7br0+inJXvQ1BvI=]

hieradata/roles/apps/media/sonarr.yaml

@@ -1,7 +1,9 @@
 ---
 hiera_include:
   - sonarr
-  - profiles::nginx::simpleproxy
+  - profiles::nginx::ldapauth
+  - profiles::media::sonarr
+  - exporters::exportarr
 
 # manage sonarr
 sonarr::params::user: sonarr
@@ -10,6 +12,11 @@ sonarr::params::manage_group: false
 sonarr::params::archive_version: 4.0.5
 sonarr::params::port: 8000
 
+# exportarr
+exporters::exportarr::enable: true
+exporters::exportarr::app: sonarr
+exporters::exportarr::api_key: "%{hiera('sonarr::api_key')}"
+
 # additional altnames
 profiles::pki::vault::alt_names:
   - sonarr.main.unkin.net
@@ -27,9 +34,13 @@ profiles::nginx::simpleproxy::nginx_aliases:
 profiles::nginx::simpleproxy::proxy_port: 8000
 profiles::nginx::simpleproxy::proxy_host: 127.0.0.1
 profiles::nginx::simpleproxy::proxy_path: '/'
+profiles::nginx::simpleproxy::use_default_location: false
+nginx::client_max_body_size: 20M
+
+ldap_binddn: 'cn=svc_sonarr,ou=services,ou=users,dc=main,dc=unkin,dc=net'
+ldap_template: '(&(uid=%(username)s)(memberOf=ou=sonarr_access,ou=groups,dc=main,dc=unkin,dc=net))'
 
 # configure consul service
-nginx::client_max_body_size: 10M
 consul::services:
   sonarr:
     service_name: 'sonarr'
@@ -41,7 +52,7 @@ consul::services:
     checks:
       - id: 'sonarr_http_check'
         name: 'Sonarr HTTP Check'
-        http: "https://%{facts.networking.fqdn}:443"
+        http: "https://%{facts.networking.fqdn}:443/consul/health"
         method: 'GET'
         tls_skip_verify: true
         interval: '10s'
@@ -50,3 +61,6 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: sonarr
     disposition: write
+  - resource: service
+    segment: exportarr
+    disposition: write

hieradata/roles/ceph.yaml

@@ -0,0 +1,60 @@
+---
+hiera_include:
+  - frrouting
+
+# networking
+systemd::manage_networkd: true
+systemd::manage_all_network_files: true
+networking::interfaces:
+  eth0:
+    type: physical
+    forwarding: true
+    dhcp: true
+  loopback0:
+    type: dummy
+    ipaddress: "%{hiera('networking_loopback0_ip')}" # ceph public network
+    netmask: 255.255.255.255
+    mtu: 1500
+
+# frrouting
+frrouting::ospfd_router_id: "%{facts.networking.ip}"
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_interfaces:
+  eth0:
+    area: 0.0.0.0
+  loopback0:
+    area: 0.0.0.0
+frrouting::daemons:
+  ospfd: true
+
+# additional repos
+profiles::yum::global::repos:
+  ceph:
+    name: ceph
+    descr: ceph repository
+    target: /etc/yum.repos.d/ceph.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
+  ceph-noarch:
+    name: ceph-noarch
+    descr: ceph-noarch repository
+    target: /etc/yum.repos.d/ceph-noarch.repo
+    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
+    gpgkey: https://download.ceph.com/keys/release.asc
+    mirrorlist: absent
+  frr-extras:
+    name: frr-extras
+    descr: frr-extras repository
+    target: /etc/yum.repos.d/frr-extras.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent
+  frr-stable:
+    name: frr-stable
+    descr: frr-stable repository
+    target: /etc/yum.repos.d/frr-stable.repo
+    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
+    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
+    mirrorlist: absent

hieradata/roles/infra.yaml

@@ -1,6 +1,6 @@
 ---
-profiles::packages::install:
+profiles::packages::include:
-  - policycoreutils
+  policycoreutils: {}
 
 puppetdb::master::config::create_puppet_service_resource: false
 #puppetdb::master::config::puppetdb_host: "%{lookup('profiles::puppet::puppetdb::puppetdb_host')}"

hieradata/roles/infra/auth/glauth.yaml

@@ -0,0 +1,357 @@
+---
+hiera_include:
+  - glauth
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - ldap.main.unkin.net
+  - ldap.service.consul
+  - ldap.query.consul
+  - "ldap.service.%{facts.country}-%{facts.region}.consul"
+
+glauth::params::download_version: 2.3.2
+glauth::params::ldap_enabled: true
+glauth::params::ldaps_enabled: true
+glauth::params::basedn: 'dc=main,dc=unkin,dc=net'
+glauth::params::behaviors_ignorecapabilities: true
+glauth::params::ldap_tlscertpath: /etc/pki/tls/vault/certificate.crt
+glauth::params::ldap_tlskeypath: /etc/pki/tls/vault/private.key
+glauth::params::ldaps_cert: /etc/pki/tls/vault/certificate.crt
+glauth::params::ldaps_key: /etc/pki/tls/vault/private.key
+glauth::params::api_cert: /etc/pki/tls/vault/certificate.crt
+glauth::params::api_key: /etc/pki/tls/vault/private.key
+
+# configure consul service
+consul::services:
+  ldap:
+    service_name: 'ldap'
+    tags:
+      - 'media'
+      - 'ldap'
+    address: "%{facts.networking.ip}"
+    port: 636
+    checks:
+      - id: 'glauth_http_check'
+        name: 'glauth HTTP Check'
+        http: "https://%{facts.networking.fqdn}:5555"
+        method: 'GET'
+        tls_skip_verify: true
+        interval: '10s'
+        timeout: '1s'
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: ldap
+    disposition: write
+
+glauth::users:
+  benvin:
+    user_name: 'benvin'
+    givenname: 'Ben'
+    sn: 'Vincent'
+    mail: 'benvin@users.main.unkin.net'
+    uidnumber: 20000
+    primarygroup: 20000
+    othergroups:
+      - 20010
+      - 20011
+      - 20012
+      - 20013
+      - 20014
+      - 20015
+      - 20016
+      - 20017
+      - 20018
+      - 20023
+      - 20024
+      - 20025   # jupyterhub_admin
+      - 20026   # jupyterhub_user
+      - 20027   # grafana_user
+    loginshell: '/bin/bash'
+    homedir: '/home/benvin'
+    passsha256: 'd2434f6b4764ef75d5b7b96a876a32deedbd6aa726a109c3f32e823ca66f604a'
+    sshkeys:
+      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ8SRLlPiDylBpdWR9LpvPg4fDVD+DZst4yRPFwMMhta4mnB1H9XuvZkptDhXywWQ7QIcqa2WbhCen0OQJCtwn3s7EYtacmF5MxmwBYocPoK2AArGuh6NA9rwTdLrPdzhZ+gwe88PAzRLNzjm0ZBR+mA9saMbPJdqpKp0AWeAM8QofRQAWuCzQg9i0Pn1KDMvVDRHCZof4pVlHSTyHNektq4ifovn0zhKC8jD/cYu95mc5ftBbORexpGiQWwQ3HZw1IBe0ZETB1qPIPwsoJpt3suvMrL6T2//fcIIUE3TcyJKb/yhztja4TZs5jT8370G/vhlT70He0YPxqHub8ZfBv0khlkY93VBWYpNGJwM1fVqlw7XbfBNdOuJivJac8eW317ZdiDnKkBTxapThpPG3et9ib1HoPGKRsd/fICzNz16h2R3tddSdihTFL+bmTCa6Lo+5t5uRuFjQvhSLSgO2/gRAprc3scYOB4pY/lxOFfq3pU2VvSJtRgLNEYMUYKk= ben@unkin.net'
+  matsol:
+    user_name: 'matsol'
+    givenname: 'Matt'
+    sn: 'Solomon'
+    mail: 'matsol@users.main.unkin.net'
+    uidnumber: 20001
+    primarygroup: 20000
+    othergroups:
+      - 20010
+      - 20011
+      - 20012
+      - 20013
+      - 20014
+      - 20015
+      - 20016
+      - 20027 # grafana user
+    loginshell: '/bin/bash'
+    homedir: '/home/matsol'
+    passsha256: '369263e2455a57c8c21388860c417b640fcf045a303cfc88def18c5197493600'
+  seablo:
+    user_name: 'seablo'
+    givenname: 'Sean'
+    sn: 'Bloomfield'
+    mail: 'seablo@users.main.unkin.net'
+    uidnumber: 20002
+    primarygroup: 20000
+    othergroups:
+      - 20010 # jelly
+      - 20011 # sonarr
+      - 20012 # radarr
+      - 20013 # lidarr
+      - 20014 # readarr
+      - 20016 # nzbget
+      - 20027 # grafana user
+    loginshell: '/bin/bash'
+    homedir: '/home/seablo'
+    passsha256: '2db12484b2b5fdae7f3a1f9f870143c363af14bf2c31a415a9a7afcb02520df2'
+  marbal:
+    user_name: 'marbal'
+    givenname: 'Mark'
+    sn: 'Balch'
+    mail: 'marbal@users.main.unkin.net'
+    uidnumber: 20003
+    primarygroup: 20000
+    othergroups:
+      - 20010 # jelly
+      - 20011 # sonarr
+      - 20012 # radarr
+      - 20013 # lidarr
+      - 20014 # readarr
+      - 20016 # nzbget
+      - 20027 # grafana user
+    loginshell: '/bin/bash'
+    homedir: '/home/marbal'
+    passsha256: 'cc20cee6269b9970a76549c66b51d0c543352796180d4122260a47f0f7a442a9'
+  kelren:
+    user_name: 'kelren'
+    givenname: 'Kelly'
+    sn: 'Rennie'
+    mail: 'kelren@users.main.unkin.net'
+    uidnumber: 20004
+    primarygroup: 20000
+    othergroups:
+      - 20010 # jelly
+      - 20011 # sonarr
+      - 20012 # radarr
+      - 20013 # lidarr
+      - 20014 # readarr
+      - 20016 # nzbget
+      - 20027 # grafana user
+    loginshell: '/bin/bash'
+    homedir: '/home/kelren'
+    passsha256: '5b01659bca1ecb27847d2f746fab03eb169879ebcc86547024753dac7cb184c4'
+  ryadun:
+    user_name: 'ryadun'
+    givenname: 'Ryan'
+    sn: 'Dunbar'
+    mail: 'ryadun@users.main.unkin.net'
+    uidnumber: 20005
+    primarygroup: 20000
+    othergroups:
+      - 20010 # jelly
+      - 20011 # sonarr
+      - 20012 # radarr
+      - 20013 # lidarr
+      - 20014 # readarr
+      - 20016 # nzbget
+      - 20027 # grafana user
+    loginshell: '/bin/bash'
+    homedir: '/home/ryadun'
+    passsha256: 'ee17174d49545f6f7257ae79eb173de4acf2b2edf55e181de90decd0e4b4e617'
+  margol:
+    user_name: 'margol'
+    givenname: 'Maree'
+    sn: 'Goldsworthy'
+    mail: 'margol@users.main.unkin.net'
+    uidnumber: 20006
+    primarygroup: 20000
+    othergroups:
+      - 20010 # jelly
+      - 20011 # sonarr
+      - 20012 # radarr
+      - 20013 # lidarr
+      - 20014 # readarr
+      - 20016 # nzbget
+      - 20027 # grafana user
+    loginshell: '/bin/bash'
+    homedir: '/home/margol'
+    passsha256: '31a66085fb7eaeb059e51d1376233db72b54f96a6c45947aafbb350c83e618ef'
+  sudobo:
+    user_name: 'sudobo'
+    givenname: 'Sudaporn'
+    sn: 'Obom'
+    mail: 'sudobo@users.main.unkin.net'
+    uidnumber: 20007
+    primarygroup: 20000
+    othergroups:
+      - 20010 # jelly
+      - 20011 # sonarr
+      - 20012 # radarr
+      - 20013 # lidarr
+      - 20014 # readarr
+      - 20016 # nzbget
+      - 20026 # jupyterhub_user
+      - 20027 # grafana user
+    loginshell: '/bin/bash'
+    homedir: '/home/sudobo'
+    passsha256: 'a326e049c2a615226877946220a978a0a8247c569be1adcd73539b09b14136d0'
+  waewak:
+    user_name: 'waewak'
+    givenname: 'Waew'
+    sn: 'Wakul'
+    mail: 'waewak@users.main.unkin.net'
+    uidnumber: 20008
+    primarygroup: 20000
+    othergroups:
+      - 20010 # jelly
+    loginshell: '/bin/bash'
+    homedir: '/home/waewak'
+    passsha256: 'd9bb99634215fe031c3bdca94149a165192fe8384ecaa238a19354c2f760a811'
+
+glauth::services:
+  svc_jellyfin:
+    service_name: 'svc_jellyfin'
+    mail: 'jellyfin@service.main.unkin.net'
+    uidnumber: 30000
+    primarygroup: 20001
+    passsha256: '97f7b1eb24deb0a86e812d79c56f4901d39a24128dc9f6fde033e7195f7d0739'
+  svc_sonarr:
+    service_name: 'svc_sonarr'
+    mail: 'sonarr@service.main.unkin.net'
+    uidnumber: 30001
+    primarygroup: 20001
+    passsha256: '2c32d4cb831183cfbef15835cc76f99b401d0159621bc580e852253d4d8f8722'
+  svc_radarr:
+    service_name: 'svc_radarr'
+    mail: 'radarr@service.main.unkin.net'
+    uidnumber: 30002
+    primarygroup: 20001
+    passsha256: '805b0182d90c2b5b3ba43e50988447a0bff0115eb5fedd8eeae8eac00ba53025'
+  svc_lidarr:
+    service_name: 'svc_lidarr'
+    mail: 'lidarr@service.main.unkin.net'
+    uidnumber: 30003
+    primarygroup: 20001
+    passsha256: '6d04cd2a45784bacbd50e6714710b55805c7e9886665a6d7790e6d8712b67aff'
+  svc_readarr:
+    service_name: 'svc_readarr'
+    mail: 'readarr@service.main.unkin.net'
+    uidnumber: 30004
+    primarygroup: 20001
+    passsha256: '751f22fbd9c052b2cd0c1cb4be514d8710f1a51f84ce44f607ab3a5591162f8c'
+  svc_prowlarr:
+    service_name: 'svc_prowlarr'
+    mail: 'prowlarr@service.main.unkin.net'
+    uidnumber: 30005
+    primarygroup: 20001
+    passsha256: 'd1e6bcc4a9f2d15b6e3c349155a88e433902dfe765e57bf3c10e6830f151a043'
+  svc_nzbget:
+    service_name: 'svc_nzbget'
+    mail: 'nzbget@service.main.unkin.net'
+    uidnumber: 30006
+    primarygroup: 20001
+    passsha256: 'c9d38f687fcbea754a9f78675d89276d2347f9d15190fff267c3ae1a75f61be6'
+  svc_nzbsubmit:
+    service_name: 'svc_nzbsubmit'
+    mail: 'nzbsubmit@service.main.unkin.net'
+    uidnumber: 30007
+    primarygroup: 20001
+    othergroups:
+      - 20016
+    passsha256: '7af7e12fdc56e9050d16c167f4e34091ad3cf938283e13451b35f9b3d212bfa2'
+  svc_rundeck:
+    service_name: 'svc_rundeck'
+    mail: 'rundeck@service.main.unkin.net'
+    uidnumber: 30007
+    primarygroup: 20001
+    passsha256: 'b27786b22c5938d24ffc9be049de366b055c9f054bf38fb73bbd6fba9e1bd525'
+  svc_terraform:
+    service_name: 'svc_terraform'
+    mail: 'terraform@service.main.unkin.net'
+    uidnumber: 30008
+    primarygroup: 20001
+    passsha256: 'b27786b22c5938d24ffc9be049de366b055c9f054bf38fb73bbd6fba9e1bd525'
+  svc_vault:
+    service_name: 'svc_vault'
+    mail: 'vault@service.main.unkin.net'
+    uidnumber: 30009
+    primarygroup: 20001
+    passsha256: 'd63b04884d5c7d630b0c06896046065a0926ac5c3d6177ef85320e5fa1be00b9'
+  svc_jupyterhub:
+    service_name: 'svc_jupyterhub'
+    mail: 'jupyterhub@service.main.unkin.net'
+    uidnumber: 30010
+    primarygroup: 20001
+    passsha256: '09db1e0c2498214da35f3f2ed46a90a7b90635c207f8725e7abf76b48345a39b'
+  svc_grafana:
+    service_name: 'svc_grafana'
+    mail: 'grafana@service.main.unkin.net'
+    uidnumber: 30011
+    primarygroup: 20001
+    passsha256: '1ca9db29c964011d7e535a5c1a5ea2caa6a4c674bd7242974d9f95b24f49f98a'
+
+glauth::groups:
+  users:
+    group_name: 'people'
+    gidnumber: 20000
+  services:
+    group_name: 'services'
+    gidnumber: 20001
+  jellyfin_access:
+    group_name: 'jellyfin_access'
+    gidnumber: 20010
+  sonarr_access:
+    group_name: 'sonarr_access'
+    gidnumber: 20011
+  radarr_access:
+    group_name: 'radarr_access'
+    gidnumber: 20012
+  lidarr_access:
+    group_name: 'lidarr_access'
+    gidnumber: 20013
+  readarr_access:
+    group_name: 'readarr_access'
+    gidnumber: 20014
+  prowlarr_access:
+    group_name: 'prowlarr_access'
+    gidnumber: 20015
+  nzbget_access:
+    group_name: 'nzbget_access'
+    gidnumber: 20016
+  rundeck_access:
+    group_name: 'rundeck_access'
+    gidnumber: 20017
+  rundeck_globaladmin:
+    group_name: 'rundeck_globaladmin'
+    gidnumber: 20018
+  rundeck_selfservice_admin:
+    group_name: 'rundeck_selfservice_admin'
+    gidnumber: 20019
+  rundeck_selfservice_user:
+    group_name: 'rundeck_selfservice_user'
+    gidnumber: 20020
+  rundeck_infrastructure_admin:
+    group_name: 'rundeck_infrastructure_admin'
+    gidnumber: 20021
+  rundeck_infrastructure_user:
+    group_name: 'rundeck_infrastructure_user'
+    gidnumber: 20022
+  vault_access:
+    group_name: 'vault_access'
+    gidnumber: 20023
+  vault_admin:
+    group_name: 'vault_admin'
+    gidnumber: 20024
+  jupyterhub_admin:
+    group_name: 'jupyterhub_admin'
+    gidnumber: 20025
+  jupyterhub_user:
+    group_name: 'jupyterhub_user'
+    gidnumber: 20026
+  grafana_user:
+    group_name: 'grafana_user'
+    gidnumber: 20027