From c625e48dee4f94739914e7078313cec3dbc151c5 Mon Sep 17 00:00:00 2001 From: rblundon Date: Fri, 18 Jul 2025 14:20:58 -0500 Subject: [PATCH] Update ansible and add python3-libdnf5 to template installed packages --- .../04-vm-templates/fedora-42/http/ks.cfg | 4 +- .../group_vars/unbound_servers/vars.yml | 76 +++++++++++++++++++ infra-config/host_vars/unbound01/vars | 47 ++++++++++++ infra-config/host_vars/unbound02/vars | 52 +++++++++---- infra-config/inventory.yml | 5 +- infra-config/playbooks/configure_unbound.yml | 34 +++++++++ infra-config/playbooks/proxmox_clone_vm.yml | 1 + infra-config/{ => roles}/requirements.yml | 5 +- 8 files changed, 205 insertions(+), 19 deletions(-) create mode 100644 infra-config/group_vars/unbound_servers/vars.yml create mode 100644 infra-config/host_vars/unbound01/vars create mode 100644 infra-config/playbooks/configure_unbound.yml rename infra-config/{ => roles}/requirements.yml (73%) diff --git a/infra-config/04-vm-templates/fedora-42/http/ks.cfg b/infra-config/04-vm-templates/fedora-42/http/ks.cfg index adf5d45..37ed7a0 100644 --- a/infra-config/04-vm-templates/fedora-42/http/ks.cfg +++ b/infra-config/04-vm-templates/fedora-42/http/ks.cfg @@ -58,7 +58,9 @@ autopart --type=lvm reboot %packages --ignoremissing -qemu-guest-agent #Make sure that this package gets installed because if you use DHCP this is how Promxox and then Packer will know the IP address to connect to +qemu-guest-agent +python3-libdnf5 +#Make sure that this package gets installed because if you use DHCP this is how Promxox and then Packer will know the IP address to connect to #@^Infrastructure Server %end diff --git a/infra-config/group_vars/unbound_servers/vars.yml b/infra-config/group_vars/unbound_servers/vars.yml new file mode 100644 index 0000000..68775a1 --- /dev/null +++ b/infra-config/group_vars/unbound_servers/vars.yml @@ -0,0 +1,76 @@ +--- +# Variables for Unbound https://github.com/aruhier/ansible-role-unbound + +### Server ### + +unbound_num_threads: 1 +unbound_interfaces: + - "{{ ip_address }}" +#unbound_do_ip4: "yes" +unbound_do_ip6: "no" +#unbound_do_udp: "yes" +#unbound_do_tcp: "yes" + +# list of strings, as the order impact how policies are interpreted +unbound_outgoing_policies: [] + +unbound_access_control: + - '192.168.1.0/24 allow' + - '192.168.3.0/24 allow' + - '192.168.5.0/24 allow' + - '192.168.10.0/24 allow' + - '10.1.71.0/24 allow' + +unbound_access_control_tag: [] +unbound_access_control_tag_action: [] +unbound_access_control_tag_data: [] +unbound_access_control_view: [] + +unbound_private_addresses: + - '192.168.1.0/24' + - '192.168.3.0/24' + - '192.168.5.0/24' + - '192.168.10.0/24' + - '10.1.71.0/24' + +unbound_private_domains: + - 'mk-labs.cloud' + +unbound_domains_insecure: [] +unbound_do_not_query_addresses: [] +unbound_local_zones: [] +unbound_local_datas: [] +unbound_local_data_ptrs: [] +unbound_local_zone_tags: [] +unbound_local_zone_overrides: [] + +unbound_trust_anchors: [] +unbound_trusted_keys_files: [] + +### Remote Control ### + +unbound_control_enable: "no" +unbound_control_interface: [] + +### Stub, forward zones and others ### + +unbound_rpz_zones: [] # list of dicts +unbound_stub_zones: [] # list of dicts +unbound_forward_zones: + - name: 'int.mk-labs.cloud' + forward-addrs: + - '10.1.71.5' + - name: "." + forward-addrs: + - '1.0.0.1@53#one.one.one.one' + - '1.1.1.1@53#one.one.one.one' + +# For stub and forward zones, if a key inside one of the dict is an iterable, +# it will iterate inside it to duplicate the option with all the contained +# values. +# Can be useful in case of multiple forward-addr for a same zone: +# Example: +# unbound_forward_zones: +# - {name: "test.tld", "forward-addr": ["192.0.2.5", "192.0.2.6"]} + +unbound_views: [] # list of strings, as options can be multiples \ No newline at end of file diff --git a/infra-config/host_vars/unbound01/vars b/infra-config/host_vars/unbound01/vars new file mode 100644 index 0000000..de0c4c6 --- /dev/null +++ b/infra-config/host_vars/unbound01/vars @@ -0,0 +1,47 @@ +--- +# file: host_vars/unbound01/vars + +# Supported hypervisors: +# - Proxmox + +platform: "proxmox" + +# This is the Proxmox node where all the VM templates are stored. (Templates are not global.) + +proxmox_clone_node: "pve03" + +# Templates are named in the following format (all lower case): -- +# Current OS offerings are: +# - Fedora (42) +# Current VM sizes are: +# - Small: 2 cores, 2GB memory, 8 GiB virtual disk +# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk +# - Large: 4 cores, 4GB memory, 32 GiB virtual disk +# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk + +vm_clone_source: "fedora-42-small" + +# Proxmox storage target. + +vm_storage: "pve-general" + +# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups +# and backup groups. (ha_group will be factored out in the next functionality update.) + +ha_group: "pve03" +proxmox_host_target: "pve03" + +# Currently, only single NIC VMs using IPv4 are supported via cloning. The IP address also +# sets the Proxmox VMID. The VMID is a combination of the 3rd and 4th octet of the IPv4 address. + +ip_address: 10.1.71.251 + +# Software +# Future enhancement will allow specification of additional software to automatically deploy to +# the VM after creation. + +#terraform_version: "1.11.3" + +# --- + +hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn diff --git a/infra-config/host_vars/unbound02/vars b/infra-config/host_vars/unbound02/vars index 0dc2c44..70484b8 100644 --- a/infra-config/host_vars/unbound02/vars +++ b/infra-config/host_vars/unbound02/vars @@ -1,25 +1,47 @@ --- # file: host_vars/unbound02/vars -# Host Definition +# Supported hypervisors: +# - Proxmox + platform: "proxmox" -hostname: "{{ inventory_hostname }}.{{ base_domain }}" #change variable to fqdn -# Networking -ip_address: 10.1.71.252 -# primary_interface: "enp1s0f0" -# mac_address: "BC:24:11:03:A9:7B" # convert this to a proxmox read for VMs +# This is the Proxmox node where all the VM templates are stored. (Templates are not global.) + +proxmox_clone_node: "pve03" + +# Templates are named in the following format (all lower case): -- +# Current OS offerings are: +# - Fedora (42) +# Current VM sizes are: +# - Small: 2 cores, 2GB memory, 8 GiB virtual disk +# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk +# - Large: 4 cores, 4GB memory, 32 GiB virtual disk +# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk + +vm_clone_source: "fedora-42-small" + +# Proxmox storage target. -# VM Definition -proxmox_target_node: "pve02" -vm_cpus: 1 -vm_memory: 2048 vm_storage: "pve-general" -vm_disk_size: "16" # GB -vm_net_bridge: "vmbr1" -vm_net_vlan: ",tag=71" -# vm_disk_size: 20 -# vm_disk_type: "virtio" + +# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups +# and backup groups. (ha_group will be factored out in the next functionality update.) + +ha_group: "pve03" +proxmox_host_target: "pve03" + +# Currently, only single NIC VMs using IPv4 are supported via cloning. The IP address also +# sets the Proxmox VMID. The VMID is a combination of the 3rd and 4th octet of the IPv4 address. + +ip_address: 10.1.71.252 # Software +# Future enhancement will allow specification of additional software to automatically deploy to +# the VM after creation. + #terraform_version: "1.11.3" + +# --- + +hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn diff --git a/infra-config/inventory.yml b/infra-config/inventory.yml index 74bf17d..a5b39df 100644 --- a/infra-config/inventory.yml +++ b/infra-config/inventory.yml @@ -9,7 +9,8 @@ dhcp_server: unbound_servers: hosts: - unbound02: + unbound01: +# unbound02: backup_servers: hosts: @@ -19,7 +20,7 @@ freeipa: hosts: infra01: -prometheus: +prometheus_server: hosts: monitor: diff --git a/infra-config/playbooks/configure_unbound.yml b/infra-config/playbooks/configure_unbound.yml new file mode 100644 index 0000000..10c2fbd --- /dev/null +++ b/infra-config/playbooks/configure_unbound.yml @@ -0,0 +1,34 @@ +--- +- name: Master playbook to install and configure unbound + hosts: unbound_servers + + tasks: + - name: Install unbound via role +# delegate_to: "localhost" + ansible.builtin.import_role: + name: Anthony25.unbound + # vars: + # server: + # interface: "{{ ip_address }}" + # access_control: + # - '192.168.1.0/24 allow' + # - '192.168.3.0/24 allow' + # - '192.168.5.0/24 allow' + # - '192.168.10.0/24 allow' + # - '10.1.71.0/24 allow' + # private_address: + # - '192.168.1.0/24' + # - '192.168.3.0/24' + # - '192.168.5.0/24' + # - '192.168.10.0/24' + # - '10.1.71.0/24' + # private-domain: + # - 'mk-labs.cloud' + # forward_zone: + # - name: 'int.mk-labs.cloud' + # forward-addrs: + # - '10.1.71.5' + # - name: "." + # forward-addrs: + # - '1.0.0.1@53#one.one.one.one' + # - '1.1.1.1@53#one.one.one.one' diff --git a/infra-config/playbooks/proxmox_clone_vm.yml b/infra-config/playbooks/proxmox_clone_vm.yml index cef6a76..7a821d0 100644 --- a/infra-config/playbooks/proxmox_clone_vm.yml +++ b/infra-config/playbooks/proxmox_clone_vm.yml @@ -23,6 +23,7 @@ node: "{{ proxmox_clone_node }}" storage: "{{ vm_storage }}" format: raw + timeout: 600 # - name: Add VM to HA group # community.proxmox.proxmox_cluster_ha_resources: diff --git a/infra-config/requirements.yml b/infra-config/roles/requirements.yml similarity index 73% rename from infra-config/requirements.yml rename to infra-config/roles/requirements.yml index 596acfa..b6075f5 100644 --- a/infra-config/requirements.yml +++ b/infra-config/roles/requirements.yml @@ -1,10 +1,13 @@ # requirements.yml collections: - name: community.general - version: 10.4.0 + version: 11.1.0 - name: nccurry.openshift version: 1.4.0 - name: somaz94.ansible_k8s_iac_tool version: 1.1.6 + + - name: bodsch.dns + version: 1.2.0