unkin-agent
2651449d57
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
169 lines
4.1 KiB
YAML
169 lines
4.1 KiB
YAML
---
|
|
hiera_include:
|
|
- frrouting
|
|
- exporters::frr_exporter
|
|
|
|
profiles::consul::server::members_lookup: true
|
|
profiles::consul::server::data_dir: /data/consul
|
|
profiles::consul::server::addresses:
|
|
dns: "%{::networking.ip}"
|
|
http: "%{::networking.ip}"
|
|
https: "%{::networking.ip}"
|
|
grpc: "%{::networking.ip}"
|
|
grpc_tls: "%{::networking.ip}"
|
|
profiles::consul::server::ports:
|
|
grpc: 8502
|
|
grpc_tls: 8503
|
|
dns: 8600
|
|
http: 8500
|
|
https: -1
|
|
profiles::consul::server::tls:
|
|
defaults:
|
|
ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
|
|
cert_file: /etc/pki/tls/vault/full_chain.crt
|
|
key_file: /etc/pki/tls/vault/private.key
|
|
internal_rpc:
|
|
verify_incoming: false
|
|
verify_outgoing: false
|
|
verify_server_hostname: false
|
|
profiles::consul::server::acl:
|
|
enabled: true
|
|
default_policy: 'deny'
|
|
down_policy: 'extend-cache'
|
|
tokens:
|
|
initial_management: "%{alias('profiles::consul::server::acl_tokens_initial_management')}"
|
|
default: "%{alias('profiles::consul::server::acl_tokens_default')}"
|
|
replication: "%{alias('profiles::consul::server::acl_tokens_replication')}"
|
|
|
|
# additional altnames
|
|
profiles::pki::vault::alt_names:
|
|
- consul.main.unkin.net
|
|
- consul.service.consul
|
|
- "consul.service.%{facts.country}-%{facts.region}.consul"
|
|
- consul
|
|
- "server.%{facts.country}-%{facts.region}.consul"
|
|
- "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"
|
|
|
|
# manage a simple nginx reverse proxy
|
|
profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'
|
|
profiles::nginx::simpleproxy::nginx_aliases:
|
|
- consul
|
|
- consul.main.unkin.net
|
|
profiles::nginx::simpleproxy::proxy_port: 8500
|
|
profiles::nginx::simpleproxy::proxy_path: '/'
|
|
nginx::client_max_body_size: 512M
|
|
|
|
# consul
|
|
profiles::consul::client::node_rules:
|
|
- resource: service
|
|
segment: frr_exporter
|
|
disposition: write
|
|
- resource: service
|
|
segment: mesh-gateway
|
|
disposition: write
|
|
- resource: service_prefix
|
|
segment: ''
|
|
disposition: read
|
|
- resource: node_prefix
|
|
segment: ''
|
|
disposition: read
|
|
- resource: agent_prefix
|
|
segment: ''
|
|
disposition: read
|
|
profiles::consul::prepared_query::rules:
|
|
vault:
|
|
ensure: 'present'
|
|
service_name: 'vault'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
puppet:
|
|
ensure: 'present'
|
|
service_name: 'puppet'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
puppetca:
|
|
ensure: 'present'
|
|
service_name: 'puppetca'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
edgecache:
|
|
ensure: 'present'
|
|
service_name: 'edgecache'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
puppetdbapi:
|
|
ensure: 'present'
|
|
service_name: 'puppetdbapi'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
puppetboard:
|
|
ensure: 'present'
|
|
service_name: 'puppetboard'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
git:
|
|
ensure: 'present'
|
|
service_name: 'git'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
ntp:
|
|
ensure: 'present'
|
|
service_name: 'ntp'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
grafana:
|
|
ensure: 'present'
|
|
service_name: 'grafana'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
droneci:
|
|
ensure: 'present'
|
|
service_name: 'droneci'
|
|
service_failover_n: 3
|
|
service_only_passing: true
|
|
ttl: 10
|
|
|
|
# networking
|
|
profiles::consul::server::anycast_ip: 198.18.19.14
|
|
systemd::manage_networkd: true
|
|
systemd::manage_all_network_files: true
|
|
networking::interfaces:
|
|
eth0:
|
|
type: physical
|
|
forwarding: true
|
|
dhcp: true
|
|
anycast0:
|
|
type: dummy
|
|
ipaddress: "%{hiera('profiles::consul::server::anycast_ip')}"
|
|
netmask: 255.255.255.255
|
|
mtu: 1500
|
|
|
|
# frrouting
|
|
exporters::frr_exporter::enable: true
|
|
frrouting::ospfd_router_id: "%{facts.networking.ip}"
|
|
frrouting::ospfd_redistribute:
|
|
- connected
|
|
frrouting::ospfd_interfaces:
|
|
eth0:
|
|
area: 0.0.0.0
|
|
anycast0:
|
|
area: 0.0.0.0
|
|
frrouting::daemons:
|
|
ospfd: true
|
|
|
|
# additional repos - enable needed repositories
|
|
profiles::yum::global::repos:
|
|
frr-extras:
|
|
ensure: present
|
|
frr-stable:
|
|
ensure: present
|