80 lines
2.8 KiB
Plaintext
80 lines
2.8 KiB
Plaintext
#cloud-config
|
|
hostname: ${hostname}
|
|
fqdn: ${fqdn}
|
|
prefer_fqdn_over_hostname: true
|
|
|
|
write_files:
|
|
%{ if vpn != null ~}
|
|
- path: /etc/wireguard/wg0.conf
|
|
permissions: "0600"
|
|
content: |
|
|
[Interface]
|
|
Address = ${vpn.address}
|
|
ListenPort = ${vpn.port}
|
|
PrivateKey = ${vpn.private_key}
|
|
|
|
[Peer]
|
|
PublicKey = ${vpn.router_key}
|
|
Endpoint = ${vpn.router}
|
|
AllowedIPs = ${vpn.allowed_ips}
|
|
PersistentKeepalive = 25
|
|
- path: /etc/sysctl.d/90-ip-forward.conf
|
|
content: |
|
|
net.ipv4.ip_forward = 1
|
|
%{ endif ~}
|
|
- path: /usr/local/sbin/lab-bootstrap
|
|
permissions: "0755"
|
|
content: |
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
if ! rpm -q openvox-agent >/dev/null; then
|
|
rpm -q openvox7-release >/dev/null || dnf install -y https://yum.voxpupuli.org/openvox7-release-el-9.noarch.rpm
|
|
dnf install -y openvox-agent
|
|
fi
|
|
/opt/puppetlabs/bin/puppet config set --section main certname ${fqdn}
|
|
/opt/puppetlabs/bin/puppet config set --section main server puppet.k8s.syd1.au.unkin.net
|
|
/opt/puppetlabs/bin/puppet config set --section main ca_server puppetca.k8s.syd1.au.unkin.net
|
|
/opt/puppetlabs/bin/puppet config set --section main report_server puppet.k8s.syd1.au.unkin.net
|
|
/opt/puppetlabs/bin/puppet config set --section main environment production
|
|
%{ if vpn != null ~}
|
|
rpm -q wireguard-tools >/dev/null || dnf install -y wireguard-tools
|
|
sysctl -p /etc/sysctl.d/90-ip-forward.conf
|
|
systemctl enable --now wg-quick@wg0
|
|
wg show wg0 latest-handshakes | awk '$2 > 0 { ok = 1 } END { exit !ok }'
|
|
%{ endif ~}
|
|
%{ if routes != null ~}
|
|
if ! ip route show 198.18.200.3 | grep -q .; then
|
|
dev=$(ip -o -4 addr show to ${routes.vpc} | awk '{ print $2; exit }')
|
|
con=$(nmcli -g GENERAL.CONNECTION device show "$dev")
|
|
nmcli connection modify "$con" ipv4.routes "${routes.list}"
|
|
nmcli device reapply "$dev"
|
|
fi
|
|
%{ endif ~}
|
|
timeout 5 bash -c '</dev/tcp/198.18.200.3/8140'
|
|
printf '[main]\ndns=none\n' > /etc/NetworkManager/conf.d/90-dns-none.conf
|
|
nmcli general reload
|
|
rm -f /etc/resolv.conf
|
|
printf 'search main.unkin.net\nnameserver 198.18.200.7\n' > /etc/resolv.conf
|
|
systemctl enable --now puppet
|
|
systemctl disable lab-bootstrap
|
|
- path: /etc/systemd/system/lab-bootstrap.service
|
|
content: |
|
|
[Unit]
|
|
Description=Install openvox, wait for the lab via the vpn host, then switch to internal DNS and start puppet
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/lab-bootstrap
|
|
Restart=on-failure
|
|
RestartSec=30
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
runcmd:
|
|
- systemctl daemon-reload
|
|
- systemctl enable --now --no-block lab-bootstrap
|