puppet-prod/hieradata/roles/infra/incus/node.yaml

---
hiera_include:
  - profiles::selinux::frr
  - frrouting
  - incus
  - zfs

profiles::packages::include:
  bridge-utils: {}

profiles::pki::vault::alt_names:
  - incus.service.consul
  - incus.query.consul
  - "incus.service.%{facts.country}-%{facts.region}.consul"

profiles::ssh::sign::principals:
  - incus.service.consul
  - incus.query.consul
  - "incus.service.%{facts.country}-%{facts.region}.consul"

# configure consul service
consul::services:
  incus:
    service_name: 'incus'
    tags:
      - 'incus'
      - 'container'
      - 'lxd'
    address: "%{facts.networking.ip}"
    port: 8443
    checks:
      - id: 'incus_https_check'
        name: 'incus HTTPS Check'
        http: "https://%{facts.networking.fqdn}:8443"
        method: 'GET'
        tls_skip_verify: true
        interval: '10s'
        timeout: '1s'
profiles::consul::client::node_rules:
  - resource: service
    segment: incus
    disposition: write

# additional repos
profiles::yum::global::repos:
  frr-extras:
    name: frr-extras
    descr: frr-extras repository
    target: /etc/yum.repos.d/frr-extras.repo
    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
    mirrorlist: absent
  frr-stable:
    name: frr-stable
    descr: frr-stable repository
    target: /etc/yum.repos.d/frr-stable.repo
    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
    mirrorlist: absent
  zfs-kmod:
    name: zfs-kmod
    descr: zfs-kmod repository
    target: /etc/yum.repos.d/zfs-kmod.repo
    baseurl: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os
    gpgkey: https://packagerepo.service.consul/zfs/rhel9/kmod-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-openzfs-2022
    mirrorlist: absent

# networking
systemd::manage_networkd: true
systemd::manage_all_network_files: true
#networking::use_networkd: true
networking::interfaces:
  enp2s0:
    type: physical
    txqueuelen: 10000
    forwarding: true
  enp3s0:
    type: physical
    mtu: 9000
    txqueuelen: 10000
    forwarding: true
  loopback0:
    type: dummy
    ipaddress: "%{hiera('networking_loopback0_ip')}"
    netmask: 255.255.255.255
    mtu: 9000
  loopback1:
    type: dummy
    ipaddress: "%{hiera('networking_loopback1_ip')}"
    netmask: 255.255.255.255
    mtu: 9000
  loopback2:
    type: dummy
    ipaddress: "%{hiera('networking_loopback2_ip')}"
    netmask: 255.255.255.255
    mtu: 9000

# frrouting
frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
frrouting::ospfd_redistribute:
  - connected
frrouting::ospfd_interfaces:
  enp2s0:
    area: 0.0.0.0
  enp3s0:
    area: 0.0.0.0
  loopback0:
    area: 0.0.0.0
  loopback1:
    area: 0.0.0.0
  loopback2:
    area: 0.0.0.0
  brmplscore:
    area: 0.0.0.0
frrouting::mpls_te_enabled: true
frrouting::mpls_ldp_router_id: "%{hiera('networking_loopback0_ip')}"
frrouting::mpls_ldp_transport_addr: "%{hiera('networking_loopback0_ip')}"
frrouting::mpls_ldp_interfaces:
  - loopback0
  - enp2s0
  - enp3s0
  - brmplscore
frrouting::daemons:
  ldpd: true
  ospfd: true

# add loopback interfaces to ssh list
ssh::server::options:
  ListenAddress:
    - "%{hiera('networking_loopback0_ip')}"

# zfs settings
zfs::manage_repo: false
zfs::zfs_arc_min: ~
zfs::zfs_arc_max: 4294967296 # 4GB
zfs::zpools:
  fastpool:
    ensure: present
    disk: /dev/nvme1n1
    ashift: 12
zfs::datasets:
  fastpool:
    canmount: 'off'
    acltype: posix
    atime: 'off'
    relatime: 'off'
    compression: 'zstd'
    xattr: 'sa'
  fastpool/data:
    canmount: 'on'
    mountpoint: '/data'
  fastpool/data/incus:
    canmount: 'on'
    mountpoint: '/data/incus'

# manage incus
incus::init: true
incus::bridge: br10
incus::server_port: 8443
incus::server_addr: "%{hiera('networking_loopback0_ip')}"

# add sysadmin to incus-admin group
profiles::accounts::sysadmin::extra_groups:
  - incus-admin

# sysctl recommendations
sysctl::base::values:
  fs.aio-max-nr:
    value: '524288'
  fs.inotify.max_queued_events:
    value: '1048576'
  fs.inotify.max_user_instances:
    value: '1048576'
  fs.inotify.max_user_watches:
    value: '1048576'
  kernel.dmesg_restrict:
    value: '1'
  kernel.keys.maxbytes:
    value: '2000000'
  kernel.keys.maxkeys:
    value: '2000'
  net.core.bpf_jit_limit:
    value: '1000000000'
  net.ipv4.neigh.default.gc_thresh3:
    value: '8192'
  net.ipv6.neigh.default.gc_thresh3:
    value: '8192'
  vm.max_map_count:
    value: '262144'
  net.ipv4.conf.all.forwarding:
    value: '1'
  net.ipv6.conf.all.forwarding:
    value: '1'
  net.ipv4.tcp_l3mdev_accept:
    value: '0'
  net.ipv4.conf.default.rp_filter:
    value: '0'
  net.ipv4.conf.all.rp_filter:
    value: '0'
  net.mpls.platform_labels:
    value: '1048575'
  net.mpls.conf.enp2s0.input:
    value: '1'
  net.mpls.conf.enp3s0.input:
    value: '1'
  net.mpls.conf.brmplscore.input:
    value: '1'
  net.mpls.conf.loopback0.input:
    value: '1'

# limits.d recommendations
limits::entries:
  '*/nofile':
    both: 1048576
  'root/nofile':
    both: 1048576
  '*/memlock':
    both: unlimited
  'root/memlock':
    both: unlimited