rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pull in gnunn's cluster-config repo

Browse Source
This commit is contained in:
Ryan Blundon
2025-03-29 14:24:43 -05:00
parent 28fc82623a
commit 413b2a9b7c
77 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
infra-config/00-network/README.md Normal file
View File

@@ -0,0 +1,9 @@
# Networks
My homelab is segmented into a set of networks. Each network is a separate subnet, and each subnet is a separate VLAN that usually corresponds to the 3rd octet of the IPv4 block it aligns to. The following table shows the network and VLAN information:
| Network | VLAN | DHCP Range | Description |
|-----------------|------|------------------|------------------------|
| 10.1.71.0/24 | 71 | 10.71.1.10-250 | Server network |
| 10.10.22.0/24 | 22 | Static IPs | Cluster network |
| 10.10.121.0/24 | 121 | Static IPs | Storage network |

0
infra-config/01-storage/README.md Normal file
View File

33
infra-config/02-proxmox/README.md Normal file
View File

@@ -0,0 +1,33 @@
# Proxmox
In this iteration of my homelab, core services are running as VMs in Proxmox.
The proxmox cluster will be installed via ISO Image and manually configured. (Future iterations will gitops this configuration via Ansible playbooks.)
## Primary Networking
| Hostname | VLAN | IP Address | NIC | Notes |
|-------------|------|------------------|-----------------|----------------------------|
| pve01 | | 10.1.71.51 | On-board 1 GbE | VLAN 71 set on switch port |
| pve02 | | 10.1.71.52 | On-board 1 GbE | VLAN 71 set on switch port |
| pve03 | | 10.1.71.53 | On-board 1 GbE | VLAN 71 set on switch port |
## Additional Networking
| Hostname | VLAN | IP Address | NIC | Notes |
|-------------|------|--------------------|--------------|------------------------------|
| pve01 | 22 | 10.10.22.51 | PCIe 10 GbE | Cluster Network, VLAN tagged |
| pve01 | 121 | 10.10.121.51 | PCIe 10 GbE | Storage Network, VLAN tagged |
| pve02 | 22 | 10.10.22.52 | PCIe 10 GbE | Cluster Network, VLAN tagged |
| pve02 | 121 | 10.10.121.52 | PCIe 10 GbE | Storage Network, VLAN tagged |
| pve03 | 22 | 10.10.22.53 | PCIe 10 GbE | Cluster Network, VLAN tagged |
| pve03 | 121 | 10.10.121.53 | PCIe 10 GbE | Storage Network, VLAN tagged |
## Hosted Services
- Recursive DNS (Unbound)
- Authoritative DNS (FreeIPA)
- Identity Management (FreeIPA)
- iPXE (Matchbox)
- VM Backup (Proxmox Backup)
- VM Tempalate Creation (Terraform/Packer)

0
infra-config/03-infra01-server/03-unbound-dns/README.md Normal file
View File

0
infra-config/03-infra01-server/04-free-ipa/README.md Normal file
View File

0
infra-config/03-infra01-server/05-templates/README.md Normal file
View File

0
infra-config/03-infra01-server/06-matchbox/README.md Normal file
View File

43
infra-config/03-infra01-server/install.yml Normal file
View File

@@ -0,0 +1,43 @@
---
- name: Install all software on infra01
hosts: infra01
gather_facts: true
become: true
tasks:
# - Update all packages
# - Install ansible-core
# - Copy .vault_pass.txt from laptop and set env variable
# - Clone git repo
# - Install ansible required packages
- name: Install ansible-core
ansible.builtin.package:
name: ansible-core
state: present
become: true
- name: Install dnf-plugins-core
ansible.builtin.package:
name: dnf-plugins-core
state: present
become: true
- name: Register status of /usr/local/bin/terraform
ansible.builtin.stat:
path: /usr/local/bin/terraform
register: terraform_path
- name: Download and installt erraform version
when: not terraform_path.stat.exists
block:
- name: Download and install terraform
ansible.builtin.unarchive:
src: "https://releases.hashicorp.com/terraform/{{ terraform_version }}/terraform_{{ terraform_version }}_linux_amd64.zip"
dest: "/usr/local/bin/"
remote_src: true
mode: '0755'
exclude: "LICENSE.txt"
roles:
- somaz94.ansible_k8s_iac_tool.install_kustomize

13
infra-config/10-sno-hub-cluster/01-dhcp/host-reservations.yml Normal file
View File

@@ -0,0 +1,13 @@
---
- name: Dnsmasq
hosts: localhost
become: yes
vars:
- additional_dhcp_hosts:
ethernet_switch:
desc: "SNO Hub Cluster"
mac: 98:b7:85:1e:c6:f1
ip: 10.1.71.10
roles:
- role: ricsanfre.dnsmasq

24
infra-config/10-sno-hub-cluster/01-dns/.terraform.lock.hcl generated Normal file
View File

@@ -0,0 +1,24 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/rework-space-com/freeipa" {
version = "5.0.0"
constraints = "5.0.0"
hashes = [
"h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=",
"zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c",
"zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290",
"zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c",
"zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e",
"zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333",
"zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3",
"zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70",
"zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d",
"zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839",
"zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c",
"zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580",
"zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713",
"zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa",
"zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84",
]
}

3
infra-config/10-sno-hub-cluster/01-dns/README.md Normal file
View File

@@ -0,0 +1,3 @@
# DNS Provider Configuration
This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster.

39
infra-config/10-sno-hub-cluster/01-dns/dns.tf Normal file
View File

@@ -0,0 +1,39 @@
resource "freeipa_dns_record" "ocp-hub" {
zone_name = "int.mk-labs.cloud."
name = "ocp-hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "api" {
zone_name = "int.mk-labs.cloud."
name = "api.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "api-int" {
zone_name = "int.mk-labs.cloud."
name = "api-int.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "wildcard-apps" {
zone_name = "int.mk-labs.cloud."
name = "*.apps.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}

22
infra-config/10-sno-hub-cluster/01-dns/provider.tf Normal file
View File

@@ -0,0 +1,22 @@
# Configure the DNS Provider
provider "freeipa" {
host = "infra01.int.mk-labs.cloud"
username = "admin"
password = var.freeipa_password
insecure = true
}
variable "freeipa_password" {
description = "The password for the FreeIPA provider"
type = string
sensitive = true
}
terraform {
required_providers {
freeipa = {
source = "rework-space-com/freeipa"
version = "5.0.0"
}
}
}

1
infra-config/10-sno-hub-cluster/02-dhcp/README.md Normal file
View File

@@ -0,0 +1 @@
# Add/modify entry in DNSmasq

28
infra-config/10-sno-hub-cluster/02-dhcp/ip-reservations.yml Normal file
View File

@@ -0,0 +1,28 @@
---
- name: Ensure dnsmasq is installed
ansible.builtin.apt:
name: dnsmasq
state: present
become: true
when: ansible_os_family == "Debian"
- name: Ensure dnsmasq is installed
ansible.builtin.dnf:
name: dnsmasq
state: present
become: true
when: ansible_os_family == "RedHat"
- name: Add host reservation to dnsmasq
ansible.builtin.lineinfile:
path: /etc/dnsmasq.d/hosts.conf
regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}"
line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}"
state: present
become: true
- name: Restart dnsmasq service
ansible.builtin.service:
name: dnsmasq
state: restarted
become: true

7
infra-config/10-sno-hub-cluster/03-openshift-image/README.md Normal file
View File

@@ -0,0 +1,7 @@
# Configure the OpenShift Agent Installer and Matchbox
## Reference Document
<https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/epub/installing_an_on-premise_cluster_with_the_agent-based_installer/prepare-pxe-assets-agent#prepare-pxe-assets-agent>
Recap of image creation is in 10-sno-hub-cluster/02-matchbox/.openshift_install.log

5
infra-config/10-sno-hub-cluster/03-openshift-image/create-openshift-image.yml Normal file
View File

@@ -0,0 +1,5 @@
---
- name: OpenShift image creation
ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
args:
chdir: 03-openshift-image

16
infra-config/10-sno-hub-cluster/03-openshift-image/move-pxe-assets.yml Normal file
View File

@@ -0,0 +1,16 @@
---
- name: Create a directory if it does not exist
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}"
state: directory
mode: '0755'
become: true
- name: Copy file with owner and permissions
ansible.builtin.copy:
src: 03-openshift-image/boot-artifacts/
dest: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/"
owner: matchbox
group: matchbox
mode: '0644'
become: true

33
infra-config/10-sno-hub-cluster/03-openshift-image/templates/agent-config.yaml.j2 Normal file
View File

@@ -0,0 +1,33 @@
apiVersion: v1alpha1
kind: AgentConfig
metadata:
name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
rendezvousIP: {{ hostvars['ocp-hub'].ip_address }}
bootArtifactsBaseURL: {{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/hub/
hosts:
- hostname: {{ hostvars['ocp-hub'].hostname }}
role: master
interfaces:
- name: {{ hostvars['ocp-hub'].primary_interface }}
macAddress: {{ hostvars['ocp-hub'].mac_address }}
networkConfig:
interfaces:
- name: {{ hostvars['ocp-hub'].primary_interface }}
type: ethernet
state: up
identifier: mac-address
mac-address: {{ hostvars['ocp-hub'].mac_address }}
ipv4:
enabled: true
dhcp: true
dns-resolver:
config:
server:
- 10.1.71.254
- 10.1.71.253
routes:
config:
- destination: 0.0.0.0/0
next-hop-address: 10.1.71.1
next-hop-interface: {{ hostvars['ocp-hub'].primary_interface }}
table-id: 254

25
infra-config/10-sno-hub-cluster/03-openshift-image/templates/install-config.yaml.j2 Normal file
View File

@@ -0,0 +1,25 @@
apiVersion: v1
baseDomain: {{ hostvars[groups['hub-cluster'][0]].base_domain }}
compute:
- name: worker
replicas: {{ hostvars[groups['hub-cluster'][0]].worker_node_count }}
controlPlane:
hyperthreading: Enabled
name: master
replicas: {{ hostvars[groups['hub-cluster'][0]].master_node_count }}
metadata:
name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
networking:
clusterNetwork:
- cidr: {{ hostvars[groups['hub-cluster'][0]].cluster_network }}
hostPrefix: {{ hostvars[groups['hub-cluster'][0]].cluster_network_host_prefix }}
machineNetwork:
- cidr: {{ hostvars[groups['hub-cluster'][0]].machine_network }}
networkType: OVNKubernetes
serviceNetwork:
- {{ hostvars[groups['hub-cluster'][0]].service_network }}
platform:
{{ hostvars[groups['hub-cluster'][0]].platform_type }}: {}
fips: false
pullSecret: '{{ vault_pull_secret }}'
sshKey: '{{ vault_ssh_key }}'

8
infra-config/10-sno-hub-cluster/04-matchbox/templates/groups.tf.j2 Normal file
View File

@@ -0,0 +1,8 @@
// Matcher group for OCP Internal machines
resource "matchbox_group" "{{ hostvars[groups['hub-cluster'][0]].cluster_name }}" {
name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server
profile = matchbox_profile.openshift-agent-install.name
selector = {
mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC
}
}

16
infra-config/10-sno-hub-cluster/04-matchbox/templates/profiles.tf.j2 Normal file
View File

@@ -0,0 +1,16 @@
// Fedora CoreOS profile
resource "matchbox_profile" "openshift-agent-install" {
name = "{{ hostvars[groups['hub-cluster'][0]].cluster_name }}"
kernel = "/assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz"
initrd = [
"--name initrd /assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-initrd.img"
]
args = [
"initrd=initrd",
"coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img",
"rw",
"ignition.firstboot",
"ignition.platform.id=metal",
]
}

20
infra-config/10-sno-hub-cluster/04-matchbox/templates/provider.tf.j2 Normal file
View File

@@ -0,0 +1,20 @@
// Configure the matchbox provider
provider "matchbox" {
endpoint = "{{ hostvars[groups['matchbox'][0]].rpc_endpoint }}"
client_cert = file("/etc/matchbox/client.crt")
client_key = file("/etc/matchbox/client.key")
ca = file("/etc/matchbox/ca.crt")
}
terraform {
required_providers {
ct = {
source = "poseidon/ct"
version = "0.13.0"
}
matchbox = {
source = "poseidon/matchbox"
version = "0.5.4"
}
}
}

0
infra-config/10-sno-hub-cluster/05-bootstrap-acm/README.md Normal file
View File

13
infra-config/10-sno-hub-cluster/05-bootstrap-acm/install2.yml Normal file
View File

@@ -0,0 +1,13 @@
---
- name: Run all tasks necessary to configure matchbox to install the cluster
hosts: matchbox
connection: local
gather_facts: true
tasks:
- name: Clone Git repository
ansible.builtin.git:
repo: "https://github.com/redhatryan/acm-hub-bootstrap.git"
dest: 05-bootstrap-acm
version: main
become: true

62
infra-config/10-sno-hub-cluster/install.yml Normal file
View File

@@ -0,0 +1,62 @@
---
- name: Run all tasks necessary to configure matchbox to install the cluster
hosts: matchbox
connection: local
gather_facts: true
tasks:
- name: Deploy DNS entries for cluster via Terraform
community.general.terraform:
project_path: 01-dns/
variables:
freeipa_password: "{{ vault_freeipa_password }}"
state: present
force_init: true
- name: Deploy DHCP entries for cluster via Terraform
ansible.builtin.include_tasks:
file: 02-dhcp/ip-reservations.yml
- name: OpenShift Installer install-config.yaml
ansible.builtin.template:
src: 03-openshift-image/templates/install-config.yaml.j2
dest: 03-openshift-image/install-config.yaml
mode: '0644'
- name: OpenShift Installer agent-config.yaml
ansible.builtin.template:
src: 03-openshift-image/templates/agent-config.yaml.j2
dest: 03-openshift-image/agent-config.yaml
mode: '0644'
- name: Create OpenShift image
ansible.builtin.include_tasks:
file: 03-openshift-image/create-openshift-image.yml
- name: Move PXE assets to matchbox
ansible.builtin.include_tasks:
file: 03-openshift-image/move-pxe-assets.yml
- name: Terraform matchbox groups file
ansible.builtin.template:
src: 04-matchbox/templates/groups.tf.j2
dest: 04-matchbox/groups.tf
mode: '0644'
- name: Terraform matchbox profiles file
ansible.builtin.template:
src: 04-matchbox/templates/profiles.tf.j2
dest: 04-matchbox/profiles.tf
mode: '0644'
- name: Terraform matchbox provider file
ansible.builtin.template:
src: 04-matchbox/templates/provider.tf.j2
dest: 04-matchbox/provider.tf
mode: '0644'
- name: Configure Matchbox via Terraform
community.general.terraform:
project_path: 04-matchbox/
state: present
force_init: true

3
infra-config/README.md Normal file
View File

@@ -0,0 +1,3 @@
# infra-config

43
infra-config/ansible/README.md Normal file
View File

@@ -0,0 +1,43 @@
# README
inventory # inventory file for all servers
group_vars/
group1.yml # here we assign variables to particular groups
group2.yml
host_vars/
hostname1.yml # here we assign variables to particular systems
hostname2.yml
library/ # if any custom modules, put them here (optional)
module_utils/ # if any custom module_utils to support modules, put them here (optional)
filter_plugins/ # if any custom filter plugins, put them here (optional)
site.yml # master playbook
webservers.yml # playbook for webserver tier
dbservers.yml # playbook for dbserver tier
roles/
common/ # this hierarchy represents a "role"
tasks/ #
main.yml # <-- tasks file can include smaller files if warranted
handlers/ #
main.yml # <-- handlers file
templates/ # <-- files for use with the template resource
ntp.conf.j2 # <------- templates end in .j2
files/ #
bar.txt # <-- files for use with the copy resource
foo.sh # <-- script files for use with the script resource
vars/ #
main.yml # <-- variables associated with this role
defaults/ #
main.yml # <-- default lower priority variables for this role
meta/ #
main.yml # <-- role dependencies
library/ # roles can also include custom modules
module_utils/ # roles can also include custom module_utils
lookup_plugins/ # or other types of plugins, like lookup in this case
webtier/ # same kind of structure as "common" was above, done for the webtier role
monitoring/ # ""
fooapp/ # ""

13
infra-config/ansible/ansible-ssh-key.yml Normal file
View File

@@ -0,0 +1,13 @@
- name: "Add SSH key to servers for Ansible"
hosts: ipaserver
vars_files:
- ansible-vault.yml
roles:
- role: rywillia.ssh-copy-id
vars:
hostname: "{{ ansible_hostname }}"
username: "{{ vault_ansible_user }}"
password: "{{ vault_ansible_password }}"
ssh_public_key: "/Users/rblundon/git/MK-Labs/ansible/files/ansible"

8
infra-config/ansible/ansible-vault.yml Normal file
View File

@@ -0,0 +1,8 @@
$ANSIBLE_VAULT;1.1;AES256
37663530616632333938363737366639623261366264616231396533366432303034376365643633
3632383464666637343765366439333964646637643936380a326335353639326362366263373466
63646562353737636333653333373765363331323065386137626161633333643034323962316630
6263373464613033360a376633663236333464393866373733643839336165363761373931623761
37646139633036646435323361326366326134656630656366366434363335353165356431613731
39653364653465613066323164663261363461316662623433663637333330306663633864303862
643261393832643433326332366166383239

19
infra-config/ansible/ansible.cfg Normal file
View File

@@ -0,0 +1,19 @@
[defaults]
# Chick-Fil-A would like a word...
nocows = True
# Installs collections into [current dir]/ansible_collections/namespace/collection_name
collections_paths = ./collections:~/.ansible/collections
# Installs roles into [current dir]/roles/namespace.rolename
roles_path = ./roles
inventory = ./inventory
# default user to use for playbooks if user is not specified
# (/usr/bin/ansible will use current user as default)
remote_user = wed
private_key_file = ~/.ssh/ansible
allow_world_readable_tmpfiles = True

5
infra-config/ansible/collections/requirements.yml Normal file
View File

@@ -0,0 +1,5 @@
---
roles: []
collections: []
# - name: community.docker

23
infra-config/ansible/debub.yml Normal file
View File

@@ -0,0 +1,23 @@
- name: "Playbook to test the inventory_hostname and ansible_hostname"
hosts: ipaserver
# gather_facts: true
tasks:
- name: "What is my inventory_hostname"
ansible.builtin.debug:
var: inventory_hostname
- name: "What is my hostname"
ansible.builtin.debug:
var: hostname
- name: "What is my ansible_hostname"
ansible.builtin.debug:
var: ansible_hostname
- name: "What is my ansible_host"
ansible.builtin.debug:
var: ansible_host
# - name: "Ansible | List all known variables and facts"
# ansible.builtin.debug:
# var: hostvars[inventory_hostname]

14
infra-config/ansible/group_vars/ipaserver/main.yml Normal file
View File

@@ -0,0 +1,14 @@
---
ipaadmin_password: "{{ vault_ipaadmin_password }}"
ipadm_password: "{{ vault_ipadm_password }}"
ipaserver_domain: int.mk-labs.cloud
ipaserver_realm: INT.MK-LABS.CLOUD
ipaserver_setup_firewalld: true
ipaserver_setup_dns: true
ipaserver_forwarders: 1.1.1.1,1.0.0.1
ipaserver_random_serial_numbers: true
#dns_ip_addresses: "{{ ansible_hostname }}"
#dns_reverse_zones:
#domain: int.mk-labs.cloud
forwarders: 1.1.1.1,1.0.0.1
#hostname: "{{ hostname }}"

5
infra-config/ansible/group_vars/unbound_servers/main.yml Normal file
View File

@@ -0,0 +1,5 @@
---
unbound_do_ip6: "no"
#unbound_forward_zones:
unbound_chroot: "/etc/unbound"
#unbound_pidfile: "/etc/unbound/unbound.pid"

2
infra-config/ansible/host_vars/infra01/vars/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
hostname: infra01.int.mk-labs.cloud

6
infra-config/ansible/host_vars/infra01/vault/main.yml Normal file
View File

@@ -0,0 +1,6 @@
$ANSIBLE_VAULT;1.1;AES256
36383531343863313331636462653666393131633533346433343237653433633938343737363531
3330616336336635313037356130373231643531613237340a613663303764333837333438343433
38373264316533613763373634343735323764316364376138613934323339653735303562636631
6166393933356663660a393036653937386239396331653037376564663232666561306631306331
6362

9
infra-config/ansible/host_vars/infra01/vault/vault.yml Normal file
View File

@@ -0,0 +1,9 @@
$ANSIBLE_VAULT;1.1;AES256
36393261393537313432333136623438383339303162636464353239386433316134613537336263
6462326336363562613431653435353032383064303166340a333761633530643265336465663634
65633864653830653738333563326162326430666237303362336537306238356231393761376539
3335336333316231620a633562633731396464393366323762323365383664326430323038646566
34643339303863303734623038393336313264636439636663616462613465303232643337653539
39386231373231306639343561613665626634383932393836616239643662376237353965316162
64623934616533386664333732343230626130343630393235303863366536363033323335323337
61356536323131383438

2
infra-config/ansible/host_vars/unbound/vars/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
hostname: unbound.int.mk-labs.cloud

2
infra-config/ansible/host_vars/unbound01.yml Normal file
View File

@@ -0,0 +1,2 @@
---
hostname: unbound01.int.mk-labs.cloud

2
infra-config/ansible/host_vars/unbound02.yml Normal file
View File

@@ -0,0 +1,2 @@
---
hostname: unbound02.int.mk-labs.cloud

10
infra-config/ansible/idm-servers.yml Normal file
View File

@@ -0,0 +1,10 @@
---
- name: Playbook to configure IPA server
hosts: ipaserver
become: true
vars_files:
- idm-vault.yml
roles:
- role: freeipa.ansible_freeipa.ipaserver
state: present

9
infra-config/ansible/idm-vault.yml Normal file
View File

@@ -0,0 +1,9 @@
$ANSIBLE_VAULT;1.1;AES256
62613936343461366134333738386435646236386662663434373563663433393437383961336634
6234303634383134623162396130623562353332313463620a373364393561633038383662643561
37636232366532623364306638373064623433626364383639353137653139353764343466386463
3237373565653262630a383633353438303934643064623464313639623963386661393562333738
39316136633733386166663433633434653636333239323236306161653864353666653137653935
34636236353635336631313432386362616462383763346162363466323432333064633336646439
38656362306337393065366362653864363438313934333235616338653934626535363266633039
38626466343338313239

32
infra-config/ansible/inventory Normal file
View File

@@ -0,0 +1,32 @@
---
proxmox:
hosts:
pve01:
ansible_host: 10.10.21.51
pve02:
ansible_host: 10.10.21.52
pve03:
ansible_host: 10.10.21.53
unbound_servers:
hosts:
unbound:
ansible_host: 10.1.71.254
unbound01:
ansible_host: 10.1.71.254
unbound02:
ansible_host: 10.1.71.253
ipaserver:
hosts:
infra01:
ansible_host: 10.1.71.5
ipareplicas:
hosts:
# infra02.int.mk-labs.cloud:
# ansible_host: 10.1.71.6
#infra:
# hosts:
# awx.int.mk-labs.cloud:

0
infra-config/ansible/lightspeed.yml Normal file
View File

1
infra-config/ansible/roles/common/files/ansible.pub Normal file
View File

@@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnSM/9fO8rz/amqkyoGUzUKNNzzmtSXPwOCr1O9zKNO ansible

4
infra-config/ansible/roles/unbound/files/resolved_unbound.conf Normal file
View File

@@ -0,0 +1,4 @@
[Resolve]
DNS=127.0.0.1
DNSSEC=yes
DNSStubListener=no

236
infra-config/ansible/roles/unbound/files/unbound.conf Normal file
View File

@@ -0,0 +1,236 @@
## Authoritative, validating, recursive caching DNS
## unbound.conf -- https://calomel.org
#
server:
# log verbosity
verbosity: 1
chroot: ""
# specify the interfaces to answer queries from by ip-address. The default
# is to listen to localhost (127.0.0.1 and ::1). specify 0.0.0.0 and ::0 to
# bind to all available interfaces. specify every interface[@port] on a new
# 'interface:' labeled line. The listen interfaces are not changed on
# reload, only on restart.
interface: 0.0.0.0
# port to answer queries from
port: 53
# Enable IPv4, "yes" or "no".
do-ip4: yes
# Enable IPv6, "yes" or "no".
do-ip6: no
# Enable UDP, "yes" or "no".
do-udp: yes
# Enable TCP, "yes" or "no". If TCP is not needed, Unbound is actually
# quicker to resolve as the functions related to TCP checks are not done.i
# NOTE: you may need tcp enabled to get the DNSSEC results from *.edu domains
# due to their size.
do-tcp: yes
# control which client ips are allowed to make (recursive) queries to this
# server. Specify classless netblocks with /size and action. By default
# everything is refused, except for localhost. Choose deny (drop message),
# refuse (polite error reply), allow (recursive ok), allow_snoop (recursive
# and nonrecursive ok)
access-control: 192.168.1.0/24 allow
access-control: 192.168.3.0/24 allow
access-control: 192.168.10.0/24 allow
access-control: 10.1.71.0/24 allow
# Read the root hints from this file. Default is nothing, using built in
# hints for the IN class. The file has the format of zone files, with root
# nameserver names and addresses only. The default may become outdated,
# when servers change, therefore it is good practice to use a root-hints
# file. get one from https://www.internic.net/domain/named.root
root-hints: "/etc/unbound/root.hints"
# enable to not answer id.server and hostname.bind queries.
hide-identity: yes
# enable to not answer version.server and version.bind queries.
hide-version: yes
# Will trust glue only if it is within the servers authority.
# Harden against out of zone rrsets, to avoid spoofing attempts.
# Hardening queries multiple name servers for the same data to make
# spoofing significantly harder and does not mandate dnssec.
harden-glue: yes
# Require DNSSEC data for trust-anchored zones, if such data is absent, the
# zone becomes bogus. Harden against receiving dnssec-stripped data. If you
# turn it off, failing to validate dnskey data for a trustanchor will trigger
# insecure mode for that zone (like without a trustanchor). Default on,
# which insists on dnssec data for trust-anchored zones.
harden-dnssec-stripped: yes
# Use 0x20-encoded random bits in the query to foil spoof attempts.
# http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
# While upper and lower case letters are allowed in domain names, no significance
# is attached to the case. That is, two names with the same spelling but
# different case are to be treated as if identical. This means calomel.org is the
# same as CaLoMeL.Org which is the same as CALOMEL.ORG.
use-caps-for-id: yes
# the time to live (TTL) value lower bound, in seconds. Default 0.
# If more than an hour could easily give trouble due to stale data.
cache-min-ttl: 3600
# the time to live (TTL) value cap for RRsets and messages in the
# cache. Items are not cached for longer. In seconds.
cache-max-ttl: 86400
# perform prefetching of close to expired message cache entries. If a client
# requests the dns lookup and the TTL of the cached hostname is going to
# expire in less than 10% of its TTL, unbound will (1st) return the ip of the
# host to the client and (2nd) pre-fetch the dns request from the remote dns
# server. This method has been shown to increase the amount of cached hits by
# local clients by 10% on average.
prefetch: yes
# number of threads to create. 1 disables threading. This should equal the number
# of CPU cores in the machine. Our example machine has 4 CPU cores.
num-threads: 2
## Unbound Optimization and Speed Tweaks ###
# the number of slabs to use for cache and must be a power of 2 times the
# number of num-threads set above. more slabs reduce lock contention, but
# fragment memory usage.
msg-cache-slabs: 8
rrset-cache-slabs: 8
infra-cache-slabs: 8
key-cache-slabs: 8
# Increase the memory size of the cache. Use roughly twice as much rrset cache
# memory as you use msg cache memory. Due to malloc overhead, the total memory
# usage is likely to rise to double (or 2.5x) the total cache memory. The test
# box has 4gig of ram so 256meg for rrset allows a lot of room for cacheed objects.
rrset-cache-size: 256m
msg-cache-size: 128m
# buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
# the kernel buffer larger so that no messages are lost in spikes in the traffic.
so-rcvbuf: 1m
## Unbound Optimization and Speed Tweaks ###
# Enforce privacy of these addresses. Strips them away from answers. It may
# cause DNSSEC validation to additionally mark it as bogus. Protects against
# 'DNS Rebinding' (uses browser as network proxy). Only 'private-domain' and
# 'local-data' names are allowed to have these private addresses. No default.
private-address: 192.168.1.0/24
private-address: 192.168.3.0/24
private-address: 192.168.10.0/24
private-address: 10.1.71.0/24
# Allow the domain (and its subdomains) to contain private addresses.
# local-data statements are allowed to contain private addresses too.
private-domain: "mk-labs.cloud"
# If nonzero, unwanted replies are not only reported in statistics, but also
# a running total is kept per thread. If it reaches the threshold, a warning
# is printed and a defensive action is taken, the cache is cleared to flush
# potential poison out of it. A suggested value is 10000000, the default is
# 0 (turned off). We think 10K is a good value.
unwanted-reply-threshold: 10000
# IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND on
# localhost you will want to allow the resolver to send queries to localhost.
# Make sure to set do-not-query-localhost: yes . If yes, the above default
# do-not-query-address entries are present. if no, localhost can be queried
# (for testing and debugging).
do-not-query-localhost: no
# File with trusted keys, kept up to date using RFC5011 probes, initial file
# like trust-anchor-file, then it stores metadata. Use several entries, one
# per domain name, to track multiple zones. If you use forward-zone below to
# query the Google DNS servers you MUST comment out this option or all DNS
# queries will fail.
#auto-trust-anchor-file: "/etc/unbound/root.key"
# Should additional section of secure message also be kept clean of unsecure
# data. Useful to shield the users of this validator from potential bogus
# data in the additional section. All unsigned data in the additional section
# is removed from secure messages.
val-clean-additional: yes
# Blocking Ad Server domains. Google's AdSense, DoubleClick and Yahoo
# account for a 70 percent share of all advertising traffic. Block them.
# local-zone: "doubleclick.net" redirect
# local-data: "doubleclick.net A 127.0.0.1"
# local-zone: "googlesyndication.com" redirect
# local-data: "googlesyndication.com A 127.0.0.1"
# local-zone: "googleadservices.com" redirect
# local-data: "googleadservices.com A 127.0.0.1"
# local-zone: "google-analytics.com" redirect
# local-data: "google-analytics.com A 127.0.0.1"
# local-zone: "ads.youtube.com" redirect
# local-data: "ads.youtube.com A 127.0.0.1"
# local-zone: "adserver.yahoo.com" redirect
# local-data: "adserver.yahoo.com A 127.0.0.1"
# local-zone: "ask.com" redirect
# local-data: "ask.com A 127.0.0.1"
# Unbound will not load if you specify the same local-zone and local-data
# servers in the main configuration as well as in this "include:" file. We
# suggest commenting out any of the local-zone and local-data lines above if
# you suspect they could be included in the unbound_ad_servers servers file.
#include: "/etc/unbound/unbound_ad_servers"
# locally served zones can be configured for the machines on the LAN.
# local-zone: "home.lan." static
# local-data: "firewall.home.lan. IN A 10.0.0.1"
# local-data-ptr: "10.0.0.1 firewall.home.lan"
# Unbound can query your NSD or BIND server for private domain queries too.
# On our NSD page we have NSD configured to serve the private domain,
# "home.lan". Here we can tell Unbound to connect to the NSD server when it
# needs to resolve a *.home.lan hostname or IP.
#
# private-domain: "home.lan"
# local-zone: "0.0.10.in-addr.arpa." nodefault
# stub-zone:
# name: "home.lan"
# stub-addr: 10.0.0.111@53
# If you have an internal or private DNS names the external DNS servers can
# not resolve, then you can assign domain name strings to be redirected to a
# seperate dns server. For example, our comapny has the domain
# organization.com and the domain name internal.organization.com can not be
# resolved by Google's public DNS, but can be resolved by our private DNS
# server located at 1.1.1.1. The following tells Unbound that any
# organization.com domain, i.e. *.organization.com be dns resolved by 1.1.1.1
# instead of the public dns servers.
#
forward-zone:
name: "int.mk-labs.cloud"
forward-addr: 10.1.71.5 # Internal or private DNS
# Use the following forward-zone to forward all queries to Google DNS,
# OpenDNS.com or your local ISP's dns servers for example. To test resolution
# speeds use "drill calomel.org @8.8.8.8" and look for the "Query time:" in
# milliseconds.
#
forward-zone:
name: "."
forward-addr: 1.0.0.1@53#one.one.one.one
forward-addr: 1.1.1.1@53#one.one.one.one
# forward-addr: 8.8.8.8@53#dns.google
# forward-addr: 9.9.9.9@53#dns.quad9.net
# forward-addr: 1.0.0.1@53#one.one.one.one
# forward-addr: 8.8.4.4@53#dns.google
# forward-addr: 149.112.112.112@53#dns.quad9.net
#
#
## Authoritative, validating, recursive caching DNS
## unbound.conf -- https://calomel.org

15
infra-config/ansible/set_hostname.yml Normal file
View File

@@ -0,0 +1,15 @@
---
- name: Set hostname
hosts: ipa_server
become: true
gather_facts: true
tasks:
- name: Set hostname
ansible.builtin.hostname:
name: "{{ hostname }}"
register: result
- name: Print result
ansible.builtin.debug:
var: result

14
infra-config/ansible/set_sudoers.yml Normal file
View File

@@ -0,0 +1,14 @@
---
- name: Update sudoers for passwordless
hosts: unbound_servers
become: true
gather_facts: true
tasks:
- name: Update sudoers for passwordless
ansible.builtin.lineinfile:
path: /etc/sudoers
state: present
regexp: '^%wheel'
line: '%wheel ALL=(ALL) NOPASSWD:ALL'
validate: 'visudo -cf %s'

4
infra-config/ansible/site.yml Normal file
View File

@@ -0,0 +1,4 @@
---
# file: site.yml
#- import_playbook: webservers.yml
#- import_playbook: dbservers.yml

8
infra-config/ansible/uninstall-ipa.yml Normal file
View File

@@ -0,0 +1,8 @@
---
- name: Playbook to unconfigure IPA servers
hosts: ipaserver
become: true
roles:
- role: freeipa.ansible_freeipa.ipaserver
state: absent

10
infra-config/ansible/vault/mk-labs.vault Normal file
View File

@@ -0,0 +1,10 @@
$ANSIBLE_VAULT;1.1;AES256
66323366323966373436343163303131323239343134323434373762383539663539363464393234
3762666265303430373832333865613538316261386162640a653562666130323138313533616334
37623336653332353830306534633165626634376636396166356235353937323965616161323437
3536643537623931380a633730366330396538373836326439306566666663633932393230323563
30643032646366393530663138376638386538336466633532303563636163303637303933646465
37316239393136383638636436646230643338616438646564396238376136653639393865363666
39346337356133313938303938643866346636663737323238333762386234373563633761333166
36373063643438303930313366653436363731656163376666323330633763373361393663633631
39353232346634633836623134383861656337663062393232373932353431323730

44
infra-config/dns-entry.yml Normal file
View File

@@ -0,0 +1,44 @@
---
# file: dns-entry.yml
# This playbook is used to create a DNS entry for a given server if it's IP address is a host variable.
# It will create a Terraform file in the homelab/terraform/dns directory.
# It will then run the Terraform apply command to create the DNS entry.
# It will then notify the update-dns handler to update the DNS entry.
# Future work:
# - Add a check to see if the DNS entry already exists.
# - Add a check to see if the Terraform provider is already configured.
# - Add a check to see if the Terraform DNS entry is already created.
- name: Validate Terraform DNS provider
delegate_to: "{{ terraform_server }}"
run_once: true
block:
- name: Check if terraform directory exists
ansible.builtin.stat:
path: homelab/terraform/dns
register: terraform_dir
- name: Create Terraform directory for DNS entries
ansible.builtin.file:
path: homelab/terraform/dns
state: directory
mode: '0755'
when: not terraform_dir.stat.exists
- name: "Create/Update Terraform DNS provider"
ansible.builtin.template:
src: templates/dns_provider.tf.j2
dest: homelab/terraform/dns/provider.tf
mode: '0644'
- name: Create Terraform files for DNS
delegate_to: "{{ terraform_server }}"
ansible.builtin.template:
src: templates/dns.tf.j2
dest: homelab/terraform/dns/{{ inventory_hostname }}.tf
mode: '0644'
changed_when: true
notify:
- Update DNS

59
infra-config/frr-openshift.conf Normal file
View File

@@ -0,0 +1,59 @@
!
frr version 8.1
frr defaults traditional
hostname WorldDrive
domainname int.mk-labs.cloud
log syslog informational
service integrated-vtysh-config
!
router bgp 65002
bgp router-id 10.1.71.1
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor internal peer-group
neighbor internal remote-as 65001
neighbor external peer-group
neighbor external remote-as 65003
neighbor 10.1.71.141 peer-group external
neighbor 10.1.71.141 description Compact1
neighbor 10.1.71.142 peer-group external
neighbor 10.1.71.142 description Compact2
neighbor 10.1.71.143 peer-group external
neighbor 10.1.71.143 description Compact3
neighbor 10.1.71.131 peer-group internal
neighbor 10.1.71.131 description MF 3
neighbor 10.1.71.132 peer-group internal
neighbor 10.1.71.132 description NUC2
neighbor 10.1.71.133 peer-group internal
neighbor 10.1.71.133 description NUC3
neighbor 10.1.71.134 peer-group internal
neighbor 10.1.71.134 description MF 3
neighbor 10.1.71.135 peer-group internal
neighbor 10.1.71.135 description NUC2
neighbor 10.1.71.136 peer-group internal
neighbor 10.1.71.136 description NUC3
!
address-family ipv4 unicast
! no need to redistribute connected, as we are not advertising our own routes
! redistribute connected
neighbor external activate
neighbor external soft-reconfiguration inbound
neighbor external route-map allow-external in
neighbor internal activate
neighbor internal soft-reconfiguration inbound
neighbor internal route-map allow-internal in
exit-address-family
exit
!
! allow any advertised routes in this range with up to 32 bits mask length
ip prefix-list external seq 5 permit 10.1.182.0/24 le 32
ip prefix-list internal seq 5 permit 10.1.82.0/24 le 32
!
route-map allow-external permit 10
match ip address prefix-list external
exit
!
route-map allow-internal permit 10
match ip address prefix-list internal
exit
!

10
infra-config/group_vars/all/vars Normal file
View File

@@ -0,0 +1,10 @@
---
# file: group_vars/all
# DNS variables
dns_server: "infra01.int.mk-labs.cloud"
dns_admin: "admin"
base_domain: "int.mk-labs.cloud"
# Terraform variables
terraform_server: "infra01"

153
infra-config/group_vars/all/vault Normal file
View File

@@ -0,0 +1,153 @@
$ANSIBLE_VAULT;1.1;AES256
64343766343632623130366435613934363465653264663165616466303364306632633930326333
6336663534313662373938666530363636313561343738340a366131323836633061316338313766
32303032626135373264396638643031326264383637343162343432373731303530333565653761
3735303536396366630a666136373437353038333664306665333938666262646566396430623664
32343163643863326566303635653032346266656538653034383266663566343064313261396561
66313062333630656564653339353065666462626330653738353333623038623836653462633538
61323235303339363836306434643033346234626238626136366534636463303163633130663533
64646562346566386365336466346434656138306665623833313933383939323438393935623937
33636131386430383861663363386532396664383239643133663738363635353736303262326462
65613038353731363337633935623662666361646364653534643561306561623535663232366134
33353466666561376262623062613563363662363461306434656361666233303763313732353466
66616532613262313531363361343963343062396463396130356436666331323036383135663638
36303364323436653730386365656332346164656139383436653836613066353334383335633661
30393761363738626438393761623435326139343034306632653039666336633566653863653264
35653734646466316564343036646237346534333139643735306636626664646361633035623362
63376439656664323564363765386630613662393735633162316135653735636231633730346132
61653930343238393262623439326635636630626234326338333163353139303833336339333361
39376165343064383032313533636165613261623735646432313131363035626539653038616436
39643737363238353536386236316434363066626164633837333264386163393831646439343631
31363365333736353965393132363535613363663138643432386633653764383738346431626133
63633864613533366536633130316662333761366330313535333363653038623763316561353264
65663033636134343833656336633762353364306537303837343939373066616430376565393137
62383030323563363236343765383235626139393137626663353537613037663539316565663662
37373165636630633664303362386331633662303136653132356234383435376665636430303937
38396639653363643839376166653436636435326464613939353439316463613462343631663565
66346466376332366135323932656265353234393735346132333932306537353862356436346133
65663637396662623665653334313464353339303362396139366639383866353061383062303337
63633863366432383435363866613939323433613164323132376436323236353335353337646663
64303338323830386337636463663738376566616630633663383165313332643438323137326565
34333035616533393961653531323466303032383765303065323464373130663839343661633063
39353761396430313035376365653031396232316464343662323734386538326431653065646331
63336465386261326338646632363565623132663264623832303565346261663531393463396239
36326236383231363530383566393937616636666335626364623239396463346566643066343736
62396632383839346463613735613730373762383435343065306562356462383630383962653139
63323739306437313065663139303037363365656365343038633466346339353437393439393166
37333033623531313333666363353230323339666232393936663331666433386238383532343634
61613531646438363466626565373033356365343931636265303633666539306639303237373130
38656239343065643830623739343236343062356162663165656537636238653265643039643834
63353039656362373365646466626135353438663865643861313238633539336666323535343637
61666533356533626563346664333338373832396162363534393130613561663335323134653030
62333038616235383637313736353264346233303437303632393933376463343133396638613366
34366165336339313932633866623663353736373965303666653334383239326362633836636437
30313564353835343564356334353862373761643861336536326338623334656539663934323865
61303430316265663464316330643032313732353763393165636133616232386635363333346164
65393864623939343430343435386638333735363838646530633036396530666233303231653366
31316333343530323962383430616336323638623735616431323366303132613533373937376135
63326431653832356137656535393763646134666239376164346330633637613631303236333632
35616266616431383333656530663838346238616331363635326532396566386461353362353035
63633138666561653063333566373637623433643666346534313938666361376431396234666265
33323563323139326333396633383537623564333636626461633333623264626363303161346139
32616432663737303764353366323766333665326561343463373339346331366338326432613230
33653165343835393564373334306631363334646462656665643631303539303065346638653031
64343862373665363231353464373639356139373338373639656161646135393665373738303866
65353262623536366636316137336633383434306463656336643233363837376238386166663438
38393762353962353365366333623336336631353133636238313238616234333564313530383036
66343964353564303434316137653261613635313430656335316534633339373964383765623865
34333930343033373234326561333432336165306533313237343866363330393334616130366336
34316330336165393034336135633465313566346265616238656362363762356664643564313132
39326434303163656166373965373338383439616132303065333762326465376136653562663339
32373063313837643339323062323361643766376366386563386431353563363736323933356333
33633737336239316164653533626231393037343664616536393039356332363338303765653833
65363134646238356534653037383631303866633234313331383066666233336262303062383064
30366362663736353632393032363030653537666162356230343261623463353439623538613863
35623564353465313335373763373538333537333938363536646231396132646364383135343534
34323635346663383361616664306530353038653436376638656464386334626238356239363231
32393365376462323035366432326165366138646163343734646136623033376134643737666635
35663962653662353039623737353466306662323664643430373835313832666363346133366261
32386435633366613337333933326564623230663631373964663832633662616239373262366264
62663164636263646538653037646136353433383937393434313362656262356532613331383232
36646361326332666634383435373632613231316165326637333439633638323265373437336461
64313163326364306236613162653036646163383164646237623938333934343366643930666530
36633763663730386432653461613833376462336162343334346435323537633537633161363464
62313136346362323433623137323935366235393334336139363731336332303362643664373038
66366437353332313464656131396434663132656531363762663432373632306332653163633765
36663165656562383063333538393261323062336662346539623335643463336437636334396661
62656163356530333534313539356436323733393663313265656431613130613137306530643538
32393362623237393764313930646661636565363331643431303533323838323030366562376231
62636536363733623536346339356634303236656531393737333834396231386637353638666638
62323964666530313361333666326238626439323834393434633831316466623938653431396434
37326136396134326162383331656563346339623032646565336262636632636433313439383264
34336432393761613938623839396138376533326663656161393331383461353234626637343633
65633765363064663636363031653636313034636563326565353931656633626236333037633261
30666633306133386536343133383538636336353261376531626566383134613966343766386232
30386464343731626634626234386633343462366434303763383733386263396361353132343339
62636130346262336637643934643838333762623931323230333137366363333062343763393762
35616630333138383034386232626532636532623962636534353130323732613937323231313637
39323837396133366363366261326232656464356338336362336163333362313661303433356562
64353431333761376237343062333266343664386439663964333538653134663237396538333031
61323031376235363137623364393735383337383661333762343561373433376137373234613938
64633531656230333465303666643034346236373532306139323466383134636361613262636162
31336135636237393565313334666230646630376462393937393565333531643735616432306665
66313361313835363333373562333764353236653331666431363838653565613562343437353432
34653933363131323932363333336466346631303036613134323063376364363763313730646465
37663637613866623432316165616463613739336632646332386532313438363766656566373430
64383930373333396135663662646230656565613161616238306338376332653362353430646637
61666636363332343733613263343030613164393237616238363562373938383865643031343032
37613238353935366638363564643461326330383339343431396434643430643434383365383162
66643535353565333838636265386365666261656637633133633164616566323061363837323364
65653037386133393039353062313630353065653436666333613637376534653665633261623239
66616134613766353264353864323464396364653838363363393036343132633630393132343631
35656434643631323630343230323537653334663135393439356263666237333662373631323538
31653839336436636130653035373061323038623339623336313935373530646331346131663838
32313835376566366464656634633261353562323566383330386336396335653731636636343062
66623533663539326461393739663063343666636239633839643330356537346231653034353934
63396662363133386635666232333535373038333632656336633736393733643566393462663631
64353137653032653263366266623531323633346661343561306161643334633237633532353434
36373532383532373936383532633936616436623135653263613338393232623739363132666166
37343337333561346331313336396331346666653138666262356434646536313731613938616634
34626466333630653765343665653465643933306533626634333635336565646236613633366532
36313539373736383834373833373836316137313639336231386662663836303861353465306639
32303035303832666564653032636339663830333930313630316536333966366536653133656338
32666432663064376436653865366138353337393665616562356434663031626138386334633661
62393565303164343965313166646361356262353063623134333936313963316139636432383738
34663736306663373666623538633732663630646136333135663433356336666635306132343032
64333565396635346337303663383865323262636365356537376465656631613462326264643835
37333933363339323836346338623562323737356535323762356235363964383265333836343761
65666465306539666437386436666262663163393639663662393363306237356630616630363863
39363338366365366430333730323133396633366136353039306437383162313131656563623664
39343639663037323535363437623936336235353237356164316161343364383736373630626335
37333539633064323232373330366239636631306264353661343861333530366439366131643936
32643132616537643339653730303835623235636561316261396238353463643133313263383463
63323332393939303564656436326238386266366464373038376263633135303164383261376235
61323830386537323762393134666163663064613330636235383837623436353339336561633732
38363130633338666334383864383935326131376566313133313166333639653338653037393139
31626138643339643137613864633662303162343166643039623062663338346561633430643065
62316535373631353665323938646464623863323632346463336430663031393435333463303930
36363434306135313332623839313138353132323266636163333661383634306434306164363735
32333632343265313831323235363764343061363537323963646430333031363534353065303063
63303265383234303335383638343438323636323235663230313762313566663833333866383134
62663061383464616565626635313732343335356536633932323639306661663430336230353064
36393066633330633438353431373761653761373439353463346163646232653865366533396462
39306462383862646436353339313734333463336530326433326634336264313034343431353037
65393461616361666462366234666563393234633862616532323966346662643533393832626133
34313435626264376334313066333638376562666633356231613037303536343431623666643937
63326330303830356436393131376331393732636161306633643630663836306266343766306332
63656331353438643636623763323866376435616161633734613532636663653939333434356333
66613162616664373561666232313036323733353535343238393665636433326234653163663834
31616336653664316337393762626463353065643837303737313336656264613230663430636466
31326537306662373062303761623261363766643665393835613733646161623361356132353265
30366336616463386334643966633633643261333833636130353362643233666339303235356366
34626564633062363336383431376631343836366561653634396638326262323062303237336566
64643365636232633338643035353030326130643164303231363537646465353562363938626265
64393464333330333635313338666565366138643866663966643362633237366634643465353366
31646262623865366664646662613931343963343364323234613935373362316539633430353535
30386531343932373537376137373335313965313763623333303935643965633338373530626661
34353439626664383639623665336135623234336435653261316635646364366233383034346533
66633736613636396336323665666431346135346336656538623361336236653262653063386562
64373634643065663765313331353438313139386333313263643639633861663431313833653263
61363930386632663937663863333561363533363434346132396366626234306136646161653935
61336362313439336439356663666264343935313137653264336539386262666536333930356235
39323263623461373336336364666466336631643738333731366230616232323737353164356361
61346530373561383864

3
infra-config/group_vars/freeipa/vars Normal file
View File

@@ -0,0 +1,3 @@
---
#freeipa_user: "admin"
#freeipa_password: "{{ vault_freeipa_password }}"

10
infra-config/group_vars/hub_cluster/vars Normal file
View File

@@ -0,0 +1,10 @@
cluster_name: "hub"
cluster_version: "4.17.20"
#base_domain: "int.mk-labs.cloud"
worker_node_count: 0
master_node_count: 1
cluster_network: "10.128.0.0/14"
cluster_network_host_prefix: 23
machine_network: "10.1.71.0/24"
service_network: "172.30.0.0/16"
platform_type: "none"

9
infra-config/group_vars/matchbox/vars Normal file
View File

@@ -0,0 +1,9 @@
---
# Variables for Matchbox
assets: "/var/lib/matchbox/assets"
http_endpoint: "http://matchbox.int.mk-labs.cloud:8080"
rpc_endpoint: "matchbox.int.mk-labs.cloud:8081"
# Variables for OpenShift Installer
#openshift_installer_pull_secret: "{{ vault_pull_secret }}"
#openshift_installer_ssh_key: "{{ vault_ssh_key }}"

11
infra-config/host_vars/infra01/vars Normal file
View File

@@ -0,0 +1,11 @@
---
# file: host_vars/infra01/vars
# Networking
# primary_interface: "enp1s0f0"
# mac_address: "98:b7:85:1e:c6:f1"
#ip_address: 10.1.71.51
hostname: "infra01.{{ base_domain }}"
# Software
terraform_version: "1.11.3"

5
infra-config/host_vars/ocp-hub/vars Normal file
View File

@@ -0,0 +1,5 @@
---
mac_address: "98:b7:85:1e:c6:f1"
ip_address: "10.1.71.10"
hostname: "ocp-hub"
primary_interface: "enp1s0f0"

6
infra-config/host_vars/pve01/vars Normal file
View File

@@ -0,0 +1,6 @@
---
# file: host_vars/pve01/vars
# mac_address: "98:b7:85:1e:c6:f1"
ip_address: "10.1.71.51"
hostname: "pve01.{{ base_domain }}"
# primary_interface: "enp1s0f0"

16
infra-config/inventory.yml Normal file
View File

@@ -0,0 +1,16 @@
# file: inventory.yml
proxmox:
hosts:
pve0[1:3]:
freeipa:
hosts:
infra01:
matchbox:
hosts:
infra01:
hub_cluster:
hosts:
ocp-hub:

122
infra-config/playbooks/update-linux-os.yml Normal file
View File

@@ -0,0 +1,122 @@
---
- name: Linux OS Upgrade
hosts: all
gather_facts: true
become: true
tasks:
- name: Update all packages
ansible.builtin.package:
name: '*'
state: latest
update_cache: true
- name: Upgrade Debian and Ubuntu systems with apt
when: ansible_os_family == "Debian"
block:
- name: Dist-upgrade
ansible.builtin.apt:
upgrade: dist
update_cache: true
register: upgrade_result
- name: Debain check if reboot is required
ansible.builtin.shell: "[ -f /var/run/reboot-required ]"
failed_when: false
register: debian_reboot_required
changed_when: debian_reboot_required.rc == 0
notify:
- Reboot server
- name: Debian remove unneeded dependencies
ansible.builtin.apt:
autoremove: true
register: autoremove_result
- name: Debian print errors if upgrade failed
ansible.builtin.debug:
msg: |
Upgrade Result: {{ upgrade_result }}
Autoremove Result: {{ autoremove_result }}
- name: Upgrade RHEL systems with DNF
when: ansible_os_family == "RedHat" and not (ansible_distribution_major_version == "7")
block:
- name: Get packages that can be upgraded with DNF
ansible.builtin.dnf:
list: upgrades
state: latest
update_cache: true
register: reg_dnf_output_all
- name: List packages that can be upgraded with DNF
ansible.builtin.debug:
msg: "{{ reg_dnf_output_all.results | map(attribute='name') | list }}"
- name: Upgrade packages with DNF
become: true
ansible.builtin.dnf:
name: '*'
state: latest
update_cache: true
update_only: false
register: reg_upgrade_ok
- name: Print DNF errors if upgrade failed
ansible.builtin.debug:
msg: "Packages upgrade failed"
when: reg_upgrade_ok is not defined
- name: Install dnf-utils
when: reg_dnf_output_all is defined
become: true
ansible.builtin.dnf:
name: 'dnf-utils'
state: latest
update_cache: true
- name: Upgrade legacy RHEL systems with YUM
when: ansible_os_family == "RedHat" and ansible_distribution_major_version == "7"
block:
- name: Get packages that can be upgraded with YUM
ansible.builtin.yum:
list: upgrades
state: latest
update_cache: true
register: reg_yum_output_all
- name: List packages that can be upgraded with YUM
ansible.builtin.debug:
msg: "{{ reg_yum_output_all.results | map(attribute='name') | list }}"
- name: Upgrade packages with YUM
become: true
ansible.builtin.yum:
name: '*'
state: latest
update_cache: true
update_only: false
register: reg_yum_upgrade_ok
- name: Print YUM errors if upgrade failed
ansible.builtin.debug:
msg: "Packages upgrade failed"
when: reg_yum_upgrade_ok is not defined
- name: Check legacy RHEL system if a reboot is required
become: true
ansible.builtin.command: needs-restarting -r
register: reg_reboot_required
ignore_errors: true
failed_when: false
changed_when: reg_reboot_required.rc != 0
notify:
- Reboot server
handlers:
- name: Reboot server
ansible.builtin.reboot:
msg: "Reboot initiated by Ansible after OS update"
reboot_timeout: 3600
test_command: uptime

14
infra-config/print_ips.yml Normal file
View File

@@ -0,0 +1,14 @@
---
- name: Print host IP addresses
hosts: infra01
gather_facts: false
vars:
my_hosts: "{{ query('inventory_hostnames', 'all') }}"
tasks:
- name: Loop through all hosts
ansible.builtin.debug:
msg: "Host {{ item }} has IP address: {{ hostvars[my_hosts[my_idx]].ip_address | default('No IP address defined') }}"
when: hostvars[my_hosts[my_idx]].ip_address is defined
loop: "{{ my_hosts }}"
loop_control:
index_var: my_idx

2
infra-config/proxmox.yml Normal file
View File

@@ -0,0 +1,2 @@
---
# file: proxmox.yml

10
infra-config/requirements.yml Normal file
View File

@@ -0,0 +1,10 @@
# requirements.yml
collections:
- name: community.general
version: 10.4.0
- name: nccurry.openshift
version: 1.4.0
- name: somaz94.ansible_k8s_iac_tool
version: 1.1.6

28
infra-config/site.yml Normal file
View File

@@ -0,0 +1,28 @@
---
# file: site.yml
- name: Master playbook for home lab
hosts: all
gather_facts: false
tasks:
- name: Process DNS entries
when: ip_address is defined
ansible.builtin.import_tasks:
file: dns-entry.yml
tags:
- update-dns
- never
handlers:
- name: Update DNS
run_once: true
delegate_to: "{{ terraform_server }}"
community.general.terraform:
project_path: homelab/terraform/dns/
variables:
freeipa_server: "{{ dns_server }}"
freeipa_admin: "{{ dns_admin }}"
freeipa_password: "{{ vault_freeipa_password }}"
state: present
force_init: true

11
infra-config/templates/dns.tf.j2 Normal file
View File

@@ -0,0 +1,11 @@
// Terraform DNS entry template
resource "freeipa_dns_record" "{{ inventory_hostname }}" {
zone_name = "{{ base_domain }}."
name = "{{ inventory_hostname }}"
type = "A"
records = [
"{{ ip_address }}",
]
ttl = 60
}

32
infra-config/templates/dns_provider.tf.j2 Normal file
View File

@@ -0,0 +1,32 @@
# Configure the DNS Provider
provider "freeipa" {
host = var.freeipa_server
username = var.freeipa_admin
password = var.freeipa_password
insecure = true
}
variable "freeipa_server" {
description = "The server for the FreeIPA provider"
type = string
}
variable "freeipa_admin" {
description = "The admin username for the FreeIPA provider"
type = string
}
variable "freeipa_password" {
description = "The password for the FreeIPA provider"
type = string
sensitive = true
}
terraform {
required_providers {
freeipa = {
source = "rework-space-com/freeipa"
version = "5.0.0"
}
}
}

32
infra-config/test.yml Normal file
View File

@@ -0,0 +1,32 @@
---
- name: Run all tasks necessary to configure matchbox to install the cluster
hosts: all
#connection: local
gather_facts: false
tasks:
# - name: Print vars for debugging
# ansible.builtin.debug:
# msg: System {{ hostvars['infra01'].matchbox_assets }} / {{ hostvars['ocp-hub'].cluster_name }}
# - name: Print vars for debugging 2
# ansible.builtin.debug:
# msg: System {{ groups }}
# - name: Print vars for debugging 3
# ansible.builtin.debug:
# msg: System {{ groups['hub-cluster'][0] }}
# - name: Print vars for debugging 4
# ansible.builtin.debug:
# msg: System {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
# - name: Print all available facts
# ansible.builtin.debug:
# var: ansible_facts
- name: Print host IP address if defined
debug:
msg: "Host {{ inventory_hostname }} has IP address: {{ hostvars[inventory_hostname].ip_address | default('Not defined') }}"
when: hostvars[inventory_hostname].ip_address is defined