llm-inference-multimodel: fix Phase 2 unexpectedly restarting both services

Phase 2 (systemd tag) notified per-service restart handlers and then
called meta: flush_handlers itself, so any run where either unit's
template content changed (including first apply) restarted BOTH
live services immediately in Phase 2 -- before Phase 3 firewall
scoping or Phase 4 smoke tests ran. This contradicted the phase's
documented purpose (units land on disk only, nothing starts/restarts
until Phase 4).

Fix: Phase 2 only reloads the systemd daemon and registers each
template task's changed result. Phase 4 (verify.yml) now decides
start vs restart per-service based on that recorded change, so
restarts remain independent per instance and never fire before
Phase 4.

.gitignore

@@ -1,15 +1,9 @@
-# macOS system files
+# macOS
 .DS_Store
 .AppleDouble
 .LSOverride
-
-# Icon must end with two \r
 Icon
-
-# Thumbnails
 ._*
-
-# Files that might appear in the root of a volume
 .DocumentRevisions-V100
 .fseventsd
 .Spotlight-V100
@@ -17,32 +11,53 @@ Icon
 .Trashes
 .VolumeIcon.icns
 .com.apple.timemachine.donotpresent
-
-# Directories potentially created on remote AFP share
 .AppleDB
 .AppleDesktop
 Network Trash Folder
 Temporary Items
 .apdisk
-
-# VS Code
-.vscode/
-
-# macOS metadata
 *.icloud
 
-# Terraform
+# IDE
+.vscode/
+.idea/
+.kiro/
+
+# Terraform (track .tf files, ignore state and runtime)
 .terraform/
 *.tfstate
 *.tfstate.backup
-
-# Crash log files
+# *.tfvars
+!*.tfvars.example
+!*.pkrvars.hcl
 crash.log
-
-# Ignore override files as they are usually used to override resources locally
 *.override.tf
 *.override.tf.json
-
-# Ignore CLI configuration files
 .terraformrc
-.terraformrc.json
+terraform.rc
+
+# Ansible
+*.retry
+ansible/vault/*.vault
+
+# Packer
+packer_cache/
+
+# Secrets
+*.pem
+*.key
+
+# Environment files with secrets
+boilerplates/**/.env
+
+# Local paths
+~/
+
+# Misc
+doppler-token.yaml
+
+# talhelper generated machine configs — contain secrets, never commit
+talos/talhelper/clusterconfig/
+# talenv.yaml plaintext — only commit the SOPS-encrypted version
+talos/talhelper/talenv.yaml
+!talos/talhelper/talenv.sops.yaml

.sops.yaml

@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: talos/talhelper/talenv.yaml
+    age: age1xkyuv8r8ce6lu3d64jfspz4e50k6pxlaxwmuplzrtnpfnnrnycaq6mfsrn

00-core-infra/ansible/README.md

@@ -1,43 +0,0 @@
-# README
-
-inventory                # inventory file for all servers
-
-group_vars/
-   group1.yml             # here we assign variables to particular groups
-   group2.yml
-host_vars/
-   hostname1.yml          # here we assign variables to particular systems
-   hostname2.yml
-
-library/                  # if any custom modules, put them here (optional)
-module_utils/             # if any custom module_utils to support modules, put them here (optional)
-filter_plugins/           # if any custom filter plugins, put them here (optional)
-
-site.yml                  # master playbook
-webservers.yml            # playbook for webserver tier
-dbservers.yml             # playbook for dbserver tier
-
-roles/
-    common/               # this hierarchy represents a "role"
-        tasks/            #
-            main.yml      #  <-- tasks file can include smaller files if warranted
-        handlers/         #
-            main.yml      #  <-- handlers file
-        templates/        #  <-- files for use with the template resource
-            ntp.conf.j2   #  <------- templates end in .j2
-        files/            #
-            bar.txt       #  <-- files for use with the copy resource
-            foo.sh        #  <-- script files for use with the script resource
-        vars/             #
-            main.yml      #  <-- variables associated with this role
-        defaults/         #
-            main.yml      #  <-- default lower priority variables for this role
-        meta/             #
-            main.yml      #  <-- role dependencies
-        library/          # roles can also include custom modules
-        module_utils/     # roles can also include custom module_utils
-        lookup_plugins/   # or other types of plugins, like lookup in this case
-
-    webtier/              # same kind of structure as "common" was above, done for the webtier role
-    monitoring/           # ""
-    fooapp/               # ""

00-core-infra/ansible/ansible-ssh-key.yml

@@ -1,13 +0,0 @@
-- name: "Add SSH key to servers for Ansible"
-  hosts: ipaserver
-  
-  vars_files:
-  - ansible-vault.yml
-
-  roles:
-  - role: rywillia.ssh-copy-id 
-    vars:
-      hostname: "{{ ansible_hostname }}"
-      username: "{{ vault_ansible_user }}"
-      password: "{{ vault_ansible_password }}"
-      ssh_public_key: "/Users/rblundon/git/MK-Labs/ansible/files/ansible"

00-core-infra/ansible/ansible-vault.yml

@@ -1,8 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-37663530616632333938363737366639623261366264616231396533366432303034376365643633
-3632383464666637343765366439333964646637643936380a326335353639326362366263373466
-63646562353737636333653333373765363331323065386137626161633333643034323962316630
-6263373464613033360a376633663236333464393866373733643839336165363761373931623761
-37646139633036646435323361326366326134656630656366366434363335353165356431613731
-39653364653465613066323164663261363461316662623433663637333330306663633864303862
-643261393832643433326332366166383239

00-core-infra/ansible/ansible.cfg

@@ -1,19 +0,0 @@
-[defaults]
-
-# Chick-Fil-A would like a word...
-nocows = True
-
-# Installs collections into [current dir]/ansible_collections/namespace/collection_name
-collections_paths = ./collections:~/.ansible/collections
-
-# Installs roles into [current dir]/roles/namespace.rolename
-roles_path = ./roles
-
-inventory = ./inventory
-
-# default user to use for playbooks if user is not specified
-# (/usr/bin/ansible will use current user as default)
-remote_user = wed
-private_key_file = ~/.ssh/ansible
-
-allow_world_readable_tmpfiles = True

00-core-infra/ansible/collections/requirements.yml

@@ -1,5 +0,0 @@
----
-roles: []
-
-collections: []
-#  - name: community.docker

00-core-infra/ansible/debub.yml

@@ -1,23 +0,0 @@
-- name: "Playbook to test the inventory_hostname and ansible_hostname"
-  hosts: ipaserver
-  # gather_facts: true
-  tasks:
-    - name: "What is my inventory_hostname"
-      ansible.builtin.debug:
-        var: inventory_hostname
-
-    - name: "What is my hostname"
-      ansible.builtin.debug:
-        var: hostname
-
-    - name: "What is my ansible_hostname"
-      ansible.builtin.debug:
-        var: ansible_hostname
-
-    - name: "What is my ansible_host"
-      ansible.builtin.debug:
-        var: ansible_host
-
-#    - name: "Ansible | List all known variables and facts"
-#      ansible.builtin.debug:
-#        var: hostvars[inventory_hostname]

00-core-infra/ansible/group_vars/ipaserver/main.yml

@@ -1,14 +0,0 @@
----
-ipaadmin_password: "{{ vault_ipaadmin_password }}"
-ipadm_password: "{{ vault_ipadm_password }}"
-ipaserver_domain: int.mk-labs.cloud
-ipaserver_realm: INT.MK-LABS.CLOUD
-ipaserver_setup_firewalld: true
-ipaserver_setup_dns: true
-ipaserver_forwarders: 1.1.1.1,1.0.0.1
-ipaserver_random_serial_numbers: true
-#dns_ip_addresses: "{{ ansible_hostname }}"
-#dns_reverse_zones:
-#domain: int.mk-labs.cloud
-forwarders: 1.1.1.1,1.0.0.1
-#hostname: "{{ hostname }}"

00-core-infra/ansible/group_vars/unbound_servers/main.yml

@@ -1,5 +0,0 @@
----
-unbound_do_ip6: "no"
-#unbound_forward_zones:
-unbound_chroot: "/etc/unbound"
-#unbound_pidfile: "/etc/unbound/unbound.pid"

00-core-infra/ansible/host_vars/infra01/vars/main.yml

@@ -1,2 +0,0 @@
----
-hostname: infra01.int.mk-labs.cloud

00-core-infra/ansible/host_vars/infra01/vault/main.yml

@@ -1,6 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-36383531343863313331636462653666393131633533346433343237653433633938343737363531
-3330616336336635313037356130373231643531613237340a613663303764333837333438343433
-38373264316533613763373634343735323764316364376138613934323339653735303562636631
-6166393933356663660a393036653937386239396331653037376564663232666561306631306331
-6362

00-core-infra/ansible/host_vars/infra01/vault/vault.yml

@@ -1,9 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-36393261393537313432333136623438383339303162636464353239386433316134613537336263
-6462326336363562613431653435353032383064303166340a333761633530643265336465663634
-65633864653830653738333563326162326430666237303362336537306238356231393761376539
-3335336333316231620a633562633731396464393366323762323365383664326430323038646566
-34643339303863303734623038393336313264636439636663616462613465303232643337653539
-39386231373231306639343561613665626634383932393836616239643662376237353965316162
-64623934616533386664333732343230626130343630393235303863366536363033323335323337
-61356536323131383438

00-core-infra/ansible/host_vars/unbound/vars/main.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound.int.mk-labs.cloud

00-core-infra/ansible/host_vars/unbound01.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound01.int.mk-labs.cloud

00-core-infra/ansible/host_vars/unbound02.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound02.int.mk-labs.cloud

00-core-infra/ansible/idm-servers.yml

@@ -1,10 +0,0 @@
----
-- name: Playbook to configure IPA server
-  hosts: ipaserver
-  become: true
-  vars_files:
-  - idm-vault.yml
-
-  roles:
-  - role: freeipa.ansible_freeipa.ipaserver
-    state: present

00-core-infra/ansible/idm-vault.yml

@@ -1,9 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-62613936343461366134333738386435646236386662663434373563663433393437383961336634
-6234303634383134623162396130623562353332313463620a373364393561633038383662643561
-37636232366532623364306638373064623433626364383639353137653139353764343466386463
-3237373565653262630a383633353438303934643064623464313639623963386661393562333738
-39316136633733386166663433633434653636333239323236306161653864353666653137653935
-34636236353635336631313432386362616462383763346162363466323432333064633336646439
-38656362306337393065366362653864363438313934333235616338653934626535363266633039
-38626466343338313239

00-core-infra/ansible/inventory

@@ -1,32 +0,0 @@
----
-proxmox:
-  hosts:
-    pve01:
-      ansible_host: 10.10.21.51
-    pve02:
-      ansible_host: 10.10.21.52
-    pve03:
-      ansible_host: 10.10.21.53
-
-unbound_servers:
-  hosts:
-    unbound:
-      ansible_host: 10.1.71.254
-    unbound01:
-      ansible_host: 10.1.71.254
-    unbound02:
-      ansible_host: 10.1.71.253
-
-ipaserver:
-  hosts:
-    infra01:
-      ansible_host: 10.1.71.5
-
-ipareplicas:
-  hosts:
-#    infra02.int.mk-labs.cloud:
-#      ansible_host: 10.1.71.6
-      
-#infra:
-#  hosts:
-#    awx.int.mk-labs.cloud:

00-core-infra/ansible/roles/unbound/files/resolved_unbound.conf

@@ -1,4 +0,0 @@
-[Resolve]
-DNS=127.0.0.1
-DNSSEC=yes
-DNSStubListener=no

00-core-infra/ansible/roles/unbound/files/unbound.conf

@@ -1,236 +0,0 @@
-## Authoritative, validating, recursive caching DNS
-## unbound.conf -- https://calomel.org
-#
-server:
-  # log verbosity
-    verbosity: 1
-    chroot: ""
-
-  # specify the interfaces to answer queries from by ip-address.  The default
-  # is to listen to localhost (127.0.0.1 and ::1).  specify 0.0.0.0 and ::0 to
-  # bind to all available interfaces.  specify every interface[@port] on a new
-  # 'interface:' labeled line.  The listen interfaces are not changed on
-  # reload, only on restart.
-    interface: 0.0.0.0
-
-  # port to answer queries from
-    port: 53
-
-  # Enable IPv4, "yes" or "no".
-    do-ip4: yes
-
-  # Enable IPv6, "yes" or "no".
-    do-ip6: no
-
-  # Enable UDP, "yes" or "no".
-    do-udp: yes
-
-  # Enable TCP, "yes" or "no". If TCP is not needed, Unbound is actually
-  # quicker to resolve as the functions related to TCP checks are not done.i
-  # NOTE: you may need tcp enabled to get the DNSSEC results from *.edu domains
-  # due to their size.
-    do-tcp: yes
-
-  # control which client ips are allowed to make (recursive) queries to this
-  # server. Specify classless netblocks with /size and action.  By default
-  # everything is refused, except for localhost.  Choose deny (drop message),
-  # refuse (polite error reply), allow (recursive ok), allow_snoop (recursive
-  # and nonrecursive ok)
-    access-control: 192.168.1.0/24 allow
-    access-control: 192.168.3.0/24 allow
-    access-control: 192.168.10.0/24 allow
-    access-control: 10.1.71.0/24 allow
-
-  # Read  the  root  hints from this file. Default is nothing, using built in
-  # hints for the IN class. The file has the format of  zone files,  with  root
-  # nameserver  names  and  addresses  only. The default may become outdated,
-  # when servers change,  therefore  it is good practice to use a root-hints
-  # file.  get one from https://www.internic.net/domain/named.root 
-    root-hints: "/etc/unbound/root.hints"
-
-  # enable to not answer id.server and hostname.bind queries.
-    hide-identity: yes
-
-  # enable to not answer version.server and version.bind queries.
-    hide-version: yes
-
-  # Will trust glue only if it is within the servers authority.
-  # Harden against out of zone rrsets, to avoid spoofing attempts. 
-  # Hardening queries multiple name servers for the same data to make
-  # spoofing significantly harder and does not mandate dnssec.
-    harden-glue: yes
-
-  # Require DNSSEC data for trust-anchored zones, if such data is absent, the
-  # zone becomes  bogus.  Harden against receiving dnssec-stripped data. If you
-  # turn it off, failing to validate dnskey data for a trustanchor will trigger
-  # insecure mode for that zone (like without a trustanchor).  Default on,
-  # which insists on dnssec data for trust-anchored zones.
-    harden-dnssec-stripped: yes
-
-  # Use 0x20-encoded random bits in the query to foil spoof attempts.
-  # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
-  # While upper and lower case letters are allowed in domain names, no significance
-  # is attached to the case. That is, two names with the same spelling but
-  # different case are to be treated as if identical. This means calomel.org is the
-  # same as CaLoMeL.Org which is the same as CALOMEL.ORG.
-    use-caps-for-id: yes
-
-  # the time to live (TTL) value lower bound, in seconds. Default 0.
-  # If more than an hour could easily give trouble due to stale data.
-    cache-min-ttl: 3600
-
-  # the time to live (TTL) value cap for RRsets and messages in the
-  # cache. Items are not cached for longer. In seconds.
-    cache-max-ttl: 86400
-
-  # perform prefetching of close to expired message cache entries.  If a client
-  # requests the dns lookup and the TTL of the cached hostname is going to
-  # expire in less than 10% of its TTL, unbound will (1st) return the ip of the
-  # host to the client and (2nd) pre-fetch the dns request from the remote dns
-  # server. This method has been shown to increase the amount of cached hits by
-  # local clients by 10% on average.
-    prefetch: yes
-
-  # number of threads to create. 1 disables threading. This should equal the number
-  # of CPU cores in the machine. Our example machine has 4 CPU cores.
-    num-threads: 2
-
-
-  ## Unbound Optimization and Speed Tweaks ###
-
-  # the number of slabs to use for cache and must be a power of 2 times the
-  # number of num-threads set above. more slabs reduce lock contention, but
-  # fragment memory usage.
-    msg-cache-slabs: 8
-    rrset-cache-slabs: 8
-    infra-cache-slabs: 8
-    key-cache-slabs: 8
-
-  # Increase the memory size of the cache. Use roughly twice as much rrset cache
-  # memory as you use msg cache memory. Due to malloc overhead, the total memory
-  # usage is likely to rise to double (or 2.5x) the total cache memory. The test
-  # box has 4gig of ram so 256meg for rrset allows a lot of room for cacheed objects.
-    rrset-cache-size: 256m
-    msg-cache-size: 128m
-
-  # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
-  # the kernel buffer larger so that no messages are lost in spikes in the traffic.
-    so-rcvbuf: 1m
-
-  ## Unbound Optimization and Speed Tweaks ###
-
-
-  # Enforce privacy of these addresses. Strips them away from answers.  It may
-  # cause DNSSEC validation to additionally mark it as bogus.  Protects against
-  # 'DNS Rebinding' (uses browser as network proxy).  Only 'private-domain' and
-  # 'local-data' names are allowed to have these private addresses. No default.
-    private-address: 192.168.1.0/24
-    private-address: 192.168.3.0/24
-    private-address: 192.168.10.0/24
-    private-address: 10.1.71.0/24
-
-  # Allow the domain (and its subdomains) to contain private addresses.
-  # local-data statements are allowed to contain private addresses too.
-    private-domain: "mk-labs.cloud"
-
-  # If nonzero, unwanted replies are not only reported in statistics, but also
-  # a running total is kept per thread. If it reaches the threshold, a warning
-  # is printed and a defensive action is taken, the cache is cleared to flush
-  # potential poison out of it.  A suggested value is 10000000, the default is
-  # 0 (turned off). We think 10K is a good value.
-    unwanted-reply-threshold: 10000
-
-  # IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND  on
-  # localhost you will want to allow the resolver to send queries to localhost.
-  # Make sure to set do-not-query-localhost: yes . If yes, the above default
-  # do-not-query-address entries are present.  if no, localhost can be queried
-  # (for testing and debugging). 
-    do-not-query-localhost: no
-
-  # File with trusted keys, kept up to date using RFC5011 probes, initial file
-  # like trust-anchor-file, then it stores metadata.  Use several entries, one
-  # per domain name, to track multiple zones. If you use forward-zone below to
-  # query the Google DNS servers you MUST comment out this option or all DNS
-  # queries will fail.
-   #auto-trust-anchor-file: "/etc/unbound/root.key"
-
-  # Should additional section of secure message also be kept clean of unsecure
-  # data. Useful to shield the users of this validator from potential bogus
-  # data in the additional section. All unsigned data in the additional section
-  # is removed from secure messages.
-    val-clean-additional: yes
-
-  # Blocking Ad Server domains. Google's AdSense, DoubleClick and Yahoo
-  # account for a 70 percent share of all advertising traffic. Block them.
-  # local-zone: "doubleclick.net" redirect
-  # local-data: "doubleclick.net A 127.0.0.1"
-  # local-zone: "googlesyndication.com" redirect
-  # local-data: "googlesyndication.com A 127.0.0.1"
-  # local-zone: "googleadservices.com" redirect
-  # local-data: "googleadservices.com A 127.0.0.1"
-  # local-zone: "google-analytics.com" redirect
-  # local-data: "google-analytics.com A 127.0.0.1"
-  # local-zone: "ads.youtube.com" redirect
-  # local-data: "ads.youtube.com A 127.0.0.1"
-  # local-zone: "adserver.yahoo.com" redirect
-  # local-data: "adserver.yahoo.com A 127.0.0.1"
-  # local-zone: "ask.com" redirect
-  # local-data: "ask.com A 127.0.0.1"
-
-  # Unbound will not load if you specify the same local-zone and local-data
-  # servers in the main configuration as well as in this "include:" file. We
-  # suggest commenting out any of the local-zone and local-data lines above if
-  # you suspect they could be included in the unbound_ad_servers servers file.
-  #include: "/etc/unbound/unbound_ad_servers"
-
-  # locally served zones can be configured for the machines on the LAN.
-
-#    local-zone: "home.lan." static
-
-#    local-data: "firewall.home.lan.  IN A 10.0.0.1"
-
-#    local-data-ptr: "10.0.0.1  firewall.home.lan"
-
-  # Unbound can query your NSD or BIND server for private domain queries too.
-  # On our NSD page we have NSD configured to serve the private domain,
-  # "home.lan". Here we can tell Unbound to connect to the NSD server when it
-  # needs to resolve a *.home.lan hostname or IP.
-  #
-  # private-domain: "home.lan"
-  # local-zone: "0.0.10.in-addr.arpa." nodefault
-  # stub-zone:
-  #      name: "home.lan"
-  #      stub-addr: 10.0.0.111@53
-
-  # If you have an internal or private DNS names the external DNS servers can
-  # not resolve, then you can assign domain name strings to be redirected to a
-  # seperate dns server. For example, our comapny has the domain
-  # organization.com and the domain name internal.organization.com can not be
-  # resolved by Google's public DNS, but can be resolved by our private DNS
-  # server located at 1.1.1.1. The following tells Unbound that any
-  # organization.com domain, i.e. *.organization.com be dns resolved by 1.1.1.1
-  # instead of the public dns servers.
-  #
-  forward-zone:
-      name: "int.mk-labs.cloud"
-      forward-addr: 10.1.71.5        # Internal or private DNS
-
-  # Use the following forward-zone to forward all queries to Google DNS,
-  # OpenDNS.com or your local ISP's dns servers for example. To test resolution
-  # speeds use "drill calomel.org @8.8.8.8" and look for the "Query time:" in
-  # milliseconds.
-  #
-  forward-zone:
-    name: "."
-    forward-addr: 1.0.0.1@53#one.one.one.one
-    forward-addr: 1.1.1.1@53#one.one.one.one
-#   forward-addr: 8.8.8.8@53#dns.google
-#   forward-addr: 9.9.9.9@53#dns.quad9.net
-#   forward-addr: 1.0.0.1@53#one.one.one.one
-#   forward-addr: 8.8.4.4@53#dns.google
-#   forward-addr: 149.112.112.112@53#dns.quad9.net
-
-#
-#
-## Authoritative, validating, recursive caching DNS
-## unbound.conf -- https://calomel.org

00-core-infra/ansible/set_hostname.yml

@@ -1,15 +0,0 @@
----
-- name: Set hostname
-  hosts: ipa_server
-  become: true
-  gather_facts: true
-
-  tasks:
-    - name: Set hostname
-      ansible.builtin.hostname:
-        name: "{{ hostname }}"
-      register: result
-
-    - name: Print result
-      ansible.builtin.debug:
-        var: result

00-core-infra/ansible/set_sudoers.yml

@@ -1,14 +0,0 @@
----
-- name: Update sudoers for passwordless
-  hosts: unbound_servers
-  become: true
-  gather_facts: true
-
-  tasks:
-    - name: Update sudoers for passwordless
-      ansible.builtin.lineinfile:
-        path: /etc/sudoers
-        state: present
-        regexp: '^%wheel'
-        line: '%wheel ALL=(ALL) NOPASSWD:ALL'
-        validate: 'visudo -cf %s'

00-core-infra/ansible/site.yml

@@ -1,4 +0,0 @@
----
-# file: site.yml
-#- import_playbook: webservers.yml
-#- import_playbook: dbservers.yml

00-core-infra/ansible/uninstall-ipa.yml

@@ -1,8 +0,0 @@
----
-- name: Playbook to unconfigure IPA servers
-  hosts: ipaserver
-  become: true
-
-  roles:
-  - role: freeipa.ansible_freeipa.ipaserver
-    state: absent

00-core-infra/ansible/vault/mk-labs.vault

@@ -1,10 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-66323366323966373436343163303131323239343134323434373762383539663539363464393234
-3762666265303430373832333865613538316261386162640a653562666130323138313533616334
-37623336653332353830306534633165626634376636396166356235353937323965616161323437
-3536643537623931380a633730366330396538373836326439306566666663633932393230323563
-30643032646366393530663138376638386538336466633532303563636163303637303933646465
-37316239393136383638636436646230643338616438646564396238376136653639393865363666
-39346337356133313938303938643866346636663737323238333762386234373563633761333166
-36373063643438303930313366653436363731656163376666323330633763373361393663633631
-39353232346634633836623134383861656337663062393232373932353431323730

00-network/README.md

@@ -1,9 +0,0 @@
-# Networks
-
-My homelab is segmented into a set of networks. Each network is a separate subnet, and each subnet is a separate VLAN that usually corresponds to the 3rd octet of the IPv4 block it aligns to. The following table shows the network and VLAN information:
-
-| Network         | VLAN | DHCP Range       | Description            |
-|-----------------|------|------------------|------------------------|
-| 10.1.71.0/24    |   71 | 10.71.1.10-250   | Server network         |
-| 10.10.22.0/24   |   22 | Static IPs       | Cluster network        |
-| 10.10.121.0/24  |  121 | Static IPs       | Storage network        |

02-proxmox/README.md

@@ -1,33 +0,0 @@
-# Proxmox
-
-In this iteration of my homelab, core services are running as VMs in Proxmox.
-
-The proxmox cluster will be installed via ISO Image and manually configured. (Future iterations will gitops this configuration via Ansible playbooks.)
-
-## Primary Networking
-
-| Hostname    | VLAN | IP Address       | NIC             | Notes                      |
-|-------------|------|------------------|-----------------|----------------------------|
-| pve01       |      | 10.1.71.51       | On-board 1 GbE  | VLAN 71 set on switch port |
-| pve02       |      | 10.1.71.52       | On-board 1 GbE  | VLAN 71 set on switch port |
-| pve03       |      | 10.1.71.53       | On-board 1 GbE  | VLAN 71 set on switch port |
-
-## Additional Networking
-
-| Hostname    | VLAN | IP Address         | NIC          | Notes                        |
-|-------------|------|--------------------|--------------|------------------------------|
-| pve01       |   22 |  10.10.22.51       | PCIe 10 GbE  | Cluster Network, VLAN tagged |
-| pve01       |  121 | 10.10.121.51       | PCIe 10 GbE  | Storage Network, VLAN tagged |
-| pve02       |   22 |  10.10.22.52       | PCIe 10 GbE  | Cluster Network, VLAN tagged |
-| pve02       |  121 | 10.10.121.52       | PCIe 10 GbE  | Storage Network, VLAN tagged |
-| pve03       |   22 |  10.10.22.53       | PCIe 10 GbE  | Cluster Network, VLAN tagged |
-| pve03       |  121 | 10.10.121.53       | PCIe 10 GbE  | Storage Network, VLAN tagged |
-
-## Hosted Services
-
-- Recursive DNS (Unbound)
-- Authoritative DNS (FreeIPA)
-- Identity Management (FreeIPA)
-- iPXE (Matchbox)
-- VM Backup (Proxmox Backup)
-- VM Tempalate Creation (Terraform/Packer)

03-infra01-server/install.yml

@@ -1,43 +0,0 @@
----
-- name: Install all software on infra01
-  hosts: infra01
-  gather_facts: true
-  become: true
-
-  tasks:
-  # - Update all packages
-  # - Install ansible-core
-  # - Copy .vault_pass.txt from laptop and set env variable
-  # - Clone git repo
-  # - Install ansible required packages
-
-    - name: Install ansible-core
-      ansible.builtin.package:
-        name: ansible-core
-        state: present
-      become: true
-
-    - name: Install dnf-plugins-core
-      ansible.builtin.package:
-        name: dnf-plugins-core
-        state: present
-      become: true
-
-    - name: Register status of /usr/local/bin/terraform
-      ansible.builtin.stat:
-        path: /usr/local/bin/terraform
-      register: terraform_path
-
-    - name: Download and installt erraform version
-      when: not terraform_path.stat.exists
-      block:
-        - name: Download  and install terraform
-          ansible.builtin.unarchive:
-            src: "https://releases.hashicorp.com/terraform/{{ terraform_version }}/terraform_{{ terraform_version }}_linux_amd64.zip"
-            dest: "/usr/local/bin/"
-            remote_src: true
-            mode: '0755'
-            exclude: "LICENSE.txt"
-
-  roles:
-    - somaz94.ansible_k8s_iac_tool.install_kustomize

10-sno-hub-cluster/01-dhcp/host-reservations.yml

@@ -1,13 +0,0 @@
----
-- name: Dnsmasq
-  hosts: localhost
-  become: yes
-  vars:
-    - additional_dhcp_hosts:
-        ethernet_switch:
-          desc: "SNO Hub Cluster"
-          mac: 98:b7:85:1e:c6:f1
-          ip: 10.1.71.10
-
-  roles:
-    - role: ricsanfre.dnsmasq

10-sno-hub-cluster/01-dns/.terraform.lock.hcl

@@ -1,24 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/rework-space-com/freeipa" {
-  version     = "5.0.0"
-  constraints = "5.0.0"
-  hashes = [
-    "h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=",
-    "zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c",
-    "zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290",
-    "zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c",
-    "zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e",
-    "zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333",
-    "zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3",
-    "zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70",
-    "zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d",
-    "zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839",
-    "zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c",
-    "zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580",
-    "zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713",
-    "zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa",
-    "zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84",
-  ]
-}

10-sno-hub-cluster/01-dns/README.md

@@ -1,3 +0,0 @@
-# DNS Provider Configuration
-
-This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster.

10-sno-hub-cluster/01-dns/dns.tf

@@ -1,39 +0,0 @@
-resource "freeipa_dns_record" "ocp-hub" {
-  zone_name = "int.mk-labs.cloud."
-  name = "ocp-hub"
-  type = "A"
-  records = [
-    "10.1.71.10",
-  ]
-  ttl = 60
-}
-
-resource "freeipa_dns_record" "api" {
-  zone_name = "int.mk-labs.cloud."
-  name = "api.hub"
-  type = "A"
-  records = [
-    "10.1.71.10",
-  ]
-  ttl = 60
-}
-
-resource "freeipa_dns_record" "api-int" {
-  zone_name = "int.mk-labs.cloud."
-  name = "api-int.hub"
-  type = "A"
-  records = [
-    "10.1.71.10",
-  ]
-  ttl = 60
-}
-
-resource "freeipa_dns_record" "wildcard-apps" {
-  zone_name = "int.mk-labs.cloud."
-  name = "*.apps.hub"
-  type = "A"
-  records = [
-    "10.1.71.10",
-  ]
-  ttl = 60
-}

10-sno-hub-cluster/01-dns/provider.tf

@@ -1,22 +0,0 @@
-# Configure the DNS Provider
-provider "freeipa" {
-  host        = "infra01.int.mk-labs.cloud"
-  username    = "admin"
-  password    = var.freeipa_password
-  insecure    = true
-}
-
-variable "freeipa_password" {
-  description = "The password for the FreeIPA provider"
-  type        = string
-  sensitive   = true
-}
-
-terraform {
-  required_providers {
-    freeipa = {
-      source = "rework-space-com/freeipa"
-      version = "5.0.0"
-    }
-  }
-}

10-sno-hub-cluster/02-dhcp/README.md

@@ -1 +0,0 @@
-# Add/modify entry in DNSmasq

10-sno-hub-cluster/02-dhcp/ip-reservations.yml

@@ -1,28 +0,0 @@
----
-- name: Ensure dnsmasq is installed
-  ansible.builtin.apt:
-    name: dnsmasq
-    state: present
-  become: true
-  when: ansible_os_family == "Debian"
-
-- name: Ensure dnsmasq is installed
-  ansible.builtin.dnf:
-    name: dnsmasq
-    state: present
-  become: true
-  when: ansible_os_family == "RedHat"
-
-- name: Add host reservation to dnsmasq
-  ansible.builtin.lineinfile:
-    path: /etc/dnsmasq.d/hosts.conf
-    regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}"
-    line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}"
-    state: present
-  become: true
-
-- name: Restart dnsmasq service
-  ansible.builtin.service:
-    name: dnsmasq
-    state: restarted
-  become: true

10-sno-hub-cluster/03-openshift-image/README.md

@@ -1,7 +0,0 @@
-# Configure the OpenShift Agent Installer and Matchbox
-
-## Reference Document
-
-<https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/epub/installing_an_on-premise_cluster_with_the_agent-based_installer/prepare-pxe-assets-agent#prepare-pxe-assets-agent>
-
-Recap of image creation is in 10-sno-hub-cluster/02-matchbox/.openshift_install.log

10-sno-hub-cluster/03-openshift-image/create-openshift-image.yml

@@ -1,5 +0,0 @@
----
-- name: OpenShift image creation
-  ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
-  args:
-    chdir: 03-openshift-image

10-sno-hub-cluster/03-openshift-image/move-pxe-assets.yml

@@ -1,16 +0,0 @@
----
-- name: Create a directory if it does not exist
-  ansible.builtin.file:
-    path: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}"
-    state: directory
-    mode: '0755'
-  become: true
-
-- name: Copy file with owner and permissions
-  ansible.builtin.copy:
-    src: 03-openshift-image/boot-artifacts/
-    dest: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/"
-    owner: matchbox
-    group: matchbox
-    mode: '0644'
-  become: true

10-sno-hub-cluster/03-openshift-image/templates/agent-config.yaml.j2

@@ -1,33 +0,0 @@
-apiVersion: v1alpha1
-kind: AgentConfig
-metadata:
-  name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
-rendezvousIP: {{ hostvars['ocp-hub'].ip_address }}
-bootArtifactsBaseURL: {{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/hub/
-hosts:
-  - hostname: {{ hostvars['ocp-hub'].hostname }}
-    role: master
-    interfaces:
-      - name: {{ hostvars['ocp-hub'].primary_interface }}
-        macAddress: {{ hostvars['ocp-hub'].mac_address }}
-    networkConfig:
-      interfaces:
-        - name: {{ hostvars['ocp-hub'].primary_interface }}
-          type: ethernet
-          state: up
-          identifier: mac-address
-          mac-address: {{ hostvars['ocp-hub'].mac_address }}
-          ipv4:
-            enabled: true
-            dhcp: true
-      dns-resolver:
-        config:
-          server:
-            - 10.1.71.254
-            - 10.1.71.253
-      routes:
-        config:
-          - destination: 0.0.0.0/0
-            next-hop-address: 10.1.71.1
-            next-hop-interface: {{ hostvars['ocp-hub'].primary_interface }}
-            table-id: 254

10-sno-hub-cluster/03-openshift-image/templates/install-config.yaml.j2

@@ -1,25 +0,0 @@
-apiVersion: v1
-baseDomain: {{ hostvars[groups['hub-cluster'][0]].base_domain }}
-compute:
-- name: worker
-  replicas: {{ hostvars[groups['hub-cluster'][0]].worker_node_count }}
-controlPlane:
-  hyperthreading: Enabled
-  name: master
-  replicas: {{ hostvars[groups['hub-cluster'][0]].master_node_count }}
-metadata:
-  name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
-networking:
-  clusterNetwork:
-  - cidr: {{ hostvars[groups['hub-cluster'][0]].cluster_network }}
-    hostPrefix: {{ hostvars[groups['hub-cluster'][0]].cluster_network_host_prefix }}
-  machineNetwork:
-  - cidr: {{ hostvars[groups['hub-cluster'][0]].machine_network }}
-  networkType: OVNKubernetes
-  serviceNetwork:
-  - {{ hostvars[groups['hub-cluster'][0]].service_network }}
-platform:
-  {{ hostvars[groups['hub-cluster'][0]].platform_type }}: {}
-fips: false
-pullSecret: '{{ vault_pull_secret }}'
-sshKey: '{{ vault_ssh_key }}'

10-sno-hub-cluster/04-matchbox/templates/groups.tf.j2

@@ -1,8 +0,0 @@
-// Matcher group for OCP Internal machines
-resource "matchbox_group" "{{ hostvars[groups['hub-cluster'][0]].cluster_name }}" {
-  name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server
-  profile = matchbox_profile.openshift-agent-install.name
-  selector = {
-    mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC
-  }
-}

10-sno-hub-cluster/04-matchbox/templates/profiles.tf.j2

@@ -1,16 +0,0 @@
-// Fedora CoreOS profile
-resource "matchbox_profile" "openshift-agent-install" {
-  name   = "{{ hostvars[groups['hub-cluster'][0]].cluster_name }}"
-  kernel = "/assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz"
-  initrd = [
-    "--name initrd /assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-initrd.img"
-  ]
-
-  args = [
-    "initrd=initrd",
-    "coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img",
-    "rw",
-    "ignition.firstboot",
-    "ignition.platform.id=metal",
-  ]
-}

10-sno-hub-cluster/05-bootstrap-acm/install2.yml

@@ -1,13 +0,0 @@
----
-- name: Run all tasks necessary to configure matchbox to install the cluster
-  hosts: matchbox
-  connection: local
-  gather_facts: true
-
-  tasks:
-    - name: Clone Git repository
-      ansible.builtin.git:
-        repo: "https://github.com/redhatryan/acm-hub-bootstrap.git"
-        dest: 05-bootstrap-acm
-        version: main
-      become: true

10-sno-hub-cluster/README.md

@@ -1 +0,0 @@
-# Moved to other documentation

10-sno-hub-cluster/install.yml

@@ -1,62 +0,0 @@
----
-- name: Run all tasks necessary to configure matchbox to install the cluster
-  hosts: matchbox
-  connection: local
-  gather_facts: true
-
-  tasks:
-    - name: Deploy DNS entries for cluster via Terraform
-      community.general.terraform:
-        project_path: 01-dns/
-        variables:
-          freeipa_password: "{{ vault_freeipa_password }}"
-        state: present
-        force_init: true
-
-    - name: Deploy DHCP entries for cluster via Terraform
-      ansible.builtin.include_tasks:
-        file: 02-dhcp/ip-reservations.yml
-
-    - name: OpenShift Installer install-config.yaml
-      ansible.builtin.template:
-        src: 03-openshift-image/templates/install-config.yaml.j2
-        dest: 03-openshift-image/install-config.yaml
-        mode: '0644'
-
-    - name: OpenShift Installer agent-config.yaml
-      ansible.builtin.template:
-        src: 03-openshift-image/templates/agent-config.yaml.j2
-        dest: 03-openshift-image/agent-config.yaml
-        mode: '0644'
-
-    - name: Create OpenShift image
-      ansible.builtin.include_tasks:
-        file: 03-openshift-image/create-openshift-image.yml
-
-    - name: Move PXE assets to matchbox
-      ansible.builtin.include_tasks:
-        file: 03-openshift-image/move-pxe-assets.yml
-
-    - name: Terraform matchbox groups file
-      ansible.builtin.template:
-        src: 04-matchbox/templates/groups.tf.j2
-        dest: 04-matchbox/groups.tf
-        mode: '0644'
-
-    - name: Terraform matchbox profiles file
-      ansible.builtin.template:
-        src: 04-matchbox/templates/profiles.tf.j2
-        dest: 04-matchbox/profiles.tf
-        mode: '0644'
-
-    - name: Terraform matchbox provider file
-      ansible.builtin.template:
-        src: 04-matchbox/templates/provider.tf.j2
-        dest: 04-matchbox/provider.tf
-        mode: '0644'
-
-    - name: Configure Matchbox via Terraform
-      community.general.terraform:
-        project_path: 04-matchbox/
-        state: present
-        force_init: true

COUCHDB-ERLANGCOOKIE-FIX.md

@@ -0,0 +1,160 @@
+# CouchDB erlangCookie Fix - Implementation Guide
+
+## Summary
+
+**Problem**: CouchDB deployment fails because `erlangCookie` is missing from the ExternalSecret configuration.
+
+**Decision**: Externalize `erlangCookie` to 1Password (pragmatic approach)
+
+**Rationale**: 
+- ExternalSecret architecture requires ownership of the entire secret
+- Mixing externalized and chart-generated fields in the same secret is not supported
+- Single-node deployment makes erlangCookie rotation unnecessary
+- This is an acceptable deviation from the pure Harbor pattern given the architectural constraints
+
+## Implementation Steps
+
+### 1. Generate erlangCookie Value
+
+```bash
+openssl rand -hex 20
+```
+
+Example output: `f4e3c2b1a9d8e7f6c5b4a3d2e1f0a9b8c7d6e5f4`
+
+### 2. Add to 1Password
+
+- **Vault**: `mk-labs`
+- **Item**: `couchdb`
+- **Field Name**: `erlang-cookie`
+- **Field Type**: password (concealed)
+- **Value**: `<paste generated value from step 1>`
+
+### 3. Update ExternalSecret Configuration
+
+File: `cluster/applications/couchdb/externalsecret.yaml`
+
+```yaml
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: couchdb-credentials
+  namespace: couchdb
+  labels:
+    app.kubernetes.io/name: couchdb
+    app.kubernetes.io/part-of: mk-labs
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: couchdb-admin
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        adminUsername: "admin"
+        adminPassword: "{{ .adminPassword }}"
+        cookieAuthSecret: "{{ .cookieAuthSecret }}"
+        erlangCookie: "{{ .erlangCookie }}"  # ← ADD THIS LINE
+  data:
+    - secretKey: adminPassword
+      remoteRef:
+        key: couchdb
+        property: admin-password
+    - secretKey: cookieAuthSecret
+      remoteRef:
+        key: couchdb
+        property: cookie-auth-secret
+    - secretKey: erlangCookie  # ← ADD THIS BLOCK
+      remoteRef:
+        key: couchdb
+        property: erlang-cookie
+```
+
+### 4. Update values.yaml Documentation (Optional)
+
+File: `cluster/applications/couchdb/values.yaml`
+
+Update the comment block at line 9-10:
+
+```yaml
+# Admin credentials managed via ExternalSecret
+# See externalsecret.yaml for 1Password integration
+#
+# NOTE: erlangCookie is externalized to 1Password for architectural
+# simplicity (ExternalSecret ownership model). In a pure Harbor pattern,
+# this would be chart-generated, but single-node deployment makes this
+# acceptable. The erlangCookie is treated as an immutable infrastructure
+# secret (generate once, never rotate).
+createAdminSecret: false
+extraSecretName: "couchdb-admin"
+```
+
+### 5. Commit and Push
+
+```bash
+cd ~/git/homelab
+git add cluster/applications/couchdb/externalsecret.yaml
+git add cluster/applications/couchdb/values.yaml  # if modified
+git commit -m "fix(couchdb): add erlangCookie to ExternalSecret from 1Password"
+git push origin main
+```
+
+### 6. Verify Deployment
+
+```bash
+# Watch ExternalSecret sync
+kubectl get externalsecret -n couchdb couchdb-credentials -w
+# Wait for: SecretSynced
+
+# Verify secret created with all four keys
+kubectl get secret -n couchdb couchdb-admin -o yaml
+# Should contain: adminUsername, adminPassword, cookieAuthSecret, erlangCookie
+
+# Watch ArgoCD sync
+kubectl get application -n argocd couchdb -w
+# Wait for: Healthy/Synced
+
+# Watch pod startup
+kubectl get pods -n couchdb -w
+# Wait for: Running
+
+# Test CouchDB access
+kubectl port-forward -n couchdb svc/couchdb-svc-couchdb 5984:5984 &
+curl http://localhost:5984/
+# Expected: {"couchdb":"Welcome","version":"3.5.1"}
+```
+
+## Why Not Follow Harbor Pattern Exactly?
+
+**Harbor Pattern**: Only user-facing credentials externalized, internal secrets chart-generated.
+
+**CouchDB Constraint**: ExternalSecret uses `creationPolicy: Owner`, which takes full ownership of the target secret. This prevents the Helm chart from adding auto-generated fields to the same secret.
+
+**Options Considered**:
+1. ✅ **Externalize erlangCookie** (SELECTED) - Works with current architecture
+2. ❌ Chart auto-generation - Conflicts with ExternalSecret ownership
+3. ❌ Dual-secret approach - Requires Helm chart customization
+4. ❌ Disable ExternalSecret - Loses 1Password integration for admin password
+
+**Decision**: Pragmatic approach wins. erlangCookie is treated as an infrastructure secret (generate once, never rotate), which is acceptable for a single-node deployment.
+
+## Secret Classification
+
+| Secret           | Type          | 1Password? | Rationale                          |
+|------------------|---------------|------------|------------------------------------|
+| adminUsername    | User-facing   | No*        | Static value, hardcoded in template |
+| adminPassword    | User-facing   | ✅ YES     | User login credential              |
+| cookieAuthSecret | Gray area     | ✅ YES     | Session security, periodic rotation |
+| erlangCookie     | Internal      | ✅ YES**   | Architectural constraint           |
+
+\* Hardcoded in ExternalSecret template (not fetched from 1Password)  
+\*\* Pragmatic deviation from Harbor pattern due to ExternalSecret architecture
+
+## References
+
+- Full analysis: `/home/hermes/couchdb-erlangcookie-analysis.txt`
+- Harbor pattern: `/home/hermes/harbor-simplification-complete.txt`
+- CouchDB Helm chart: `apache/couchdb` v4.6.3

README.md

@@ -1,95 +1,102 @@
-# A Homelab based on Red Hat Technologies
+# mk-labs
 
-This repository is the configuration of my homelab. In addition to providing services, the purpose of my homelab is to learn advanced concepts primarily based on Red Hat OpenShift.
+Automated infrastructure provisioning and configuration for a personal homelab, built on GitOps practices with clear tool responsibility boundaries.
 
-This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible.
+## Architecture
+
+A single operator action — setting a VM record's status to **Staged** in NetBox — triggers a fully automated provisioning pipeline:
+```
+NetBox (webhook) → n8n (validate & orchestrate) → Terraform (create VM + DHCP)
+                                                 → Ansible (OS config + DNS + status update)
+```
+
+| Tool | Host | IP | Responsibility |
+|------|------|----|---------------|
+| NetBox | fire-station | 10.1.71.102 | Source of truth — VM records, IP allocation, VLAN data |
+| n8n | tiki-room | 10.1.71.23 | Event orchestration, validation, pipeline sequencing |
+| Terraform | city-hall | 10.1.71.35 | Proxmox VM lifecycle, Unifi DHCP reservations |
+| Ansible / Semaphore | imagineering | 10.1.71.22 | OS configuration, DNS records, NetBox status updates |
+| Proxmox | fantasyland | 10.1.71.13 | Target hypervisor |
+
+All systems on the Server Trusted VLAN (10.1.71.0/24).
+
+## Repository Structure
+```
+homelab/
+├── ansible/
+│   ├── inventory/          # NetBox dynamic inventory + static
+│   ├── playbooks/          # Runnable playbooks (vm-provision, DNS, OS updates)
+│   ├── roles/              # vm-baseline, dns-manager, common, haproxy, n8n, observer, etc.
+│   ├── tasks/              # Shared includable task files
+│   ├── group_vars/         # Group variable definitions
+│   ├── host_vars/          # Per-host variable definitions
+│   ├── templates/          # Jinja2 templates
+│   └── ansible.cfg
+│
+├── terraform/
+│   ├── proxmox/vm/         # bpg/proxmox provider — VM creation from templates
+│   ├── unifi/dhcp/         # Unifi provider — DHCP static reservations on UDM Pro
+│   └── dns/                # DNS record management
+│
+├── packer/
+│   ├── ubuntu-24.04/       # Ubuntu 24.04 VM template (small → xlarge-plus sizes)
+│   └── fedora-42/          # Fedora 42 VM template
+│
+├── n8n/
+│   └── workflows/          # Exported n8n workflow JSON (vm-provisioning)
+│
+├── netbox/
+│   └── initializers/       # Custom fields, VLANs, IP prefixes as code
+│
+└── docs/
+    └── decisions/          # Architecture decision records
+```
+
+## Pipeline Flow
+
+| # | System | Action |
+|---|--------|--------|
+| 1 | NetBox | Operator sets VM status to Staged → webhook fires |
+| 2 | n8n | Validates payload (hostname, IP, VLAN, template, proxmox_node) |
+| 3 | n8n → city-hall | SSH + `terraform apply` — creates VM on Proxmox |
+| 4 | n8n | Queries Proxmox API for MAC address |
+| 5 | n8n → NetBox | Writes MAC to VM interface record |
+| 6 | n8n → city-hall | SSH + `terraform apply` — creates DHCP reservation on UDM Pro |
+| 7 | n8n → imagineering | Triggers Ansible via Semaphore API |
+| 8 | Ansible | OS baseline, SSH hardening, Technitium DNS A record |
+| 9 | Ansible → NetBox | Sets VM status to Active |
+
+On any failure, NetBox status is set to **Failed**. No auto-retry — operator investigates.
 
 ## Hardware
 
-- Dell 7050 SFF (7)
-- Minisforum TH60 (3)
-- Minisforum MS01 (2)
-- Synology 1621+
+- 7× Dell 7050 SFF
+- 3× Minisforum TH60
+- 2× Minisforum MS01
+- Synology DS1621+
+- Ubiquiti UDM Pro
 
-## Software
+## Software Stack
 
-- Proxmox (Virtualization)
-- Cloudflare (Domain Hosting, Public DNS)
-- Unbound (Recursive DNS)
-- FreeIPA (Identity management, Authoritive DNS)
-- Matchbox (iPXE)
-- Red Hat OpenShift
-- OpenShift Agent Based Installer (Install OpenShift)
-  - [Red Hat Advanced Cluster Management for Kubernetes](https://www.redhat.com/en/technologies/management/advanced-cluster-management)
-  - [Vault](https://www.hashicorp.com/en/products/vault)
-  - [OpenShift GitOps (ArgoCD)](https://www.redhat.com/en/technologies/cloud-computing/openshift/gitops)
-  - [Red Hat Ansible Automation Platform](https://www.redhat.com/en/technologies/management/ansible)
-
-## Prerequisites
-
-- Ansible user created
-- Ansible configured 
-- [Networking](docs/networks.md)
-- [Proxmox](docs/proxmox.md) (In my homelab, internal DNS, identity manangement, and ipxe are hosted here.)
-- Matchbox
-- DNS
-- Domain Registration
-
-## Assumptions
-
-There are a dozen different architectures you could use to deploy OpenShift in every which way.
-For the sake of this documentation we'll assume the following:
+- **Virtualization**: Proxmox
+- **Automation**: Terraform, Ansible, n8n, Semaphore
+- **DNS**: Technitium (authoritative), Unbound (recursive)
+- **IPAM/DCIM**: NetBox
+- **Networking**: Ubiquiti UDM Pro
+- **Templates**: Packer (Ubuntu 24.04, Fedora 42)
 
 ## Getting Started
 
-[Step-by-Step Walkthrough](step-by-step.md)
+See [docs/decisions/vm-provisioning-flow.md](docs/decisions/vm-provisioning-flow.md) for the full architecture decision record.
 
-### Hub Cluster
+Previous OpenShift/ACM/Fastpass content is preserved in the `archive/pre-mk-labs` branch.
 
-You'll need an OpenShift "Hub Cluster" with access to persistant storage.
-A Single Node OpenShift (SNO) instance, installed on bare metal, will act as a Hub cluster and run:
+## Security
 
-- Advanced Cluster Management
-- Ansible Automation Platform
-- Vault
-- OpenShift GitOps
-
-#### Network Prerequisites
-
-The prerequisites for OpenShift in traditional and HCP patterns are largely the same - it just kind of depends on where your DNS records go to.
-
-| Cluster           | Endpoint    | VIP           | DNS A Record                      | Notes                           |
-|------------------|-------------|---------------|-----------------------------------|----------------------------------|
-| Hub Cluster (SNO) | App Ingress | 192.168.0.10 | *.apps.hub-cluster.example.com    | SNO App VIP goes to IP of node  |
-| Hub Cluster (SNO) | API         | 192.168.0.10 | api.hub-cluster.example.com       | SNO API goes to IP of node      |
-
-These DNS entries should be put in your Authoratitive DNS.
-
-#### ACM & GitOps Configuration
-
-Before you start creating clusters you may want to create some Policies, integrate ACM and ArgoCD, etc. This step is optional in case you're just interested in trying out Hosted Control Planes or copy/paste around a cluster for testing purposes.
-
-Find additional details in the ./02-rhacm-config folder.
-
-#### Creating a Cluster
-
-With everything in its right place, you can now start to declaratively create clusters
-
-./05-clusters/hcp-bmh - HCP to Bare Metal Hosts
-
-### Internal Cluster
-
-Two additional bare metal nodes, to be added to Advanced Cluster Management (ACM) running on the SNO Hub. These will be used to create another HCP cluster.
-These servers have a BMC interface with Redfish - if not, then you'll need to manually manage the boot and installation of those servers.
-This makes it to where you just need 3 bare metal nodes. You could run one HCP Bare Metal cluster with both of the other nodes, but then you have a shared storage requirement that can't be satisfied by ODF since that needs at least 3 nodes.
-
-### External Cluster
-
-You'll also either need you just need at least 2 bare metal nodes.
+No sensitive data is stored in this repository. Secrets are managed via Ansible Vault and environment variables on pipeline hosts.
 
 ---
-## Credits
 
-- Ken Moini - As I used his [repo](https://github.com/kenmoini/ztp-for-you-and-me) as the baseline for this project.
-- Ryan Etten
-- Andrew Potozniak
+**Status**: 🚧 Active Development — VM Provisioning Pipeline
+
+**Last Updated**: February 2026

ansible/DNS_MANAGEMENT_REFACTOR.md

@@ -0,0 +1,193 @@
+# DNS Management Refactor - Modular & Repeatable
+
+This document explains the refactoring of DNS management from standalone playbooks to modular, reusable tasks.
+
+## 🎯 **What Changed**
+
+### **Before (Monolithic)**
+```yaml
+# Standalone playbook: add_technitium_dns_entry.yml
+- name: Add entry to Technitium DNS
+  hosts: all
+  tasks:
+    - name: Create DNS entry
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        # ... hardcoded parameters
+```
+
+### **After (Modular)**
+```yaml
+# Reusable task: tasks/add_technitium_dns_entry.yml
+- name: Create DNS entry for {{ dns_record_name }}
+  effectivelywild.technitium_dns.technitium_dns_add_record:
+    # ... parameterized with variables
+```
+
+## 📁 **New Structure**
+
+```
+ansible/
+├── playbooks/
+│   ├── tasks/
+│   │   └── add_technitium_dns_entry.yml    # ✅ Reusable task file
+│   ├── add_dns_entry.yml                   # ✅ New playbook using task
+│   ├── add_technitium_dns_entry.yml.backup # 📦 Backed up old version
+│   └── roles/
+│       └── dns-manager/                    # ✅ Enhanced role
+│           ├── tasks/main.yml              # Uses task file
+│           └── defaults/main.yml           # Technitium defaults
+└── scripts/
+    └── migrate-dns-references.sh           # ✅ Migration helper
+```
+
+## 🚀 **Usage Examples**
+
+### **1. In Playbooks (Direct Task Include)**
+```yaml
+- name: Add DNS entry for my server
+  hosts: my_servers
+  tasks:
+    - name: Create DNS entry
+      ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+      vars:
+        dns_record_name: "{{ inventory_hostname }}"
+        dns_zone: "{{ base_domain }}"
+        dns_ip_address: "{{ ansible_default_ipv4.address }}"
+```
+
+### **2. Using the DNS Manager Role**
+```yaml
+- name: Setup cluster DNS
+  hosts: control_plane[0]
+  roles:
+    - role: dns-manager
+      vars:
+        cluster_endpoint: "my-cluster.local.mk-labs.cloud"
+        cluster_vip: "10.1.71.100"
+```
+
+### **3. Using the New Playbook**
+```yaml
+# Import the new modular playbook
+- import_playbook: add_dns_entry.yml
+```
+
+### **4. In Cluster Network Setup**
+```yaml
+- name: Setup complete cluster network
+  ansible.builtin.include_role:
+    name: cluster-network-setup
+  vars:
+    cluster_name: "fastpass"
+    cluster_endpoint: "fastpass.local.mk-labs.cloud"
+    cluster_vip: "10.1.71.53"
+```
+
+## 🔧 **Migration Guide**
+
+### **Automatic Migration**
+```bash
+# Run the migration script to find references
+./scripts/migrate-dns-references.sh
+```
+
+### **Manual Updates**
+
+1. **Replace playbook imports:**
+   ```yaml
+   # OLD
+   - import_playbook: add_technitium_dns_entry.yml
+   
+   # NEW
+   - import_playbook: add_dns_entry.yml
+   ```
+
+2. **Use task includes in roles:**
+   ```yaml
+   - ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+     vars:
+       dns_record_name: "my-server"
+       dns_ip_address: "10.1.71.100"
+   ```
+
+3. **Use the dns-manager role:**
+   ```yaml
+   - ansible.builtin.include_role:
+       name: dns-manager
+   ```
+
+## 📋 **Variable Reference**
+
+### **Task Variables (`tasks/add_technitium_dns_entry.yml`)**
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `dns_record_name` | `inventory_hostname` | DNS record name |
+| `dns_zone` | `base_domain` | DNS zone |
+| `dns_ip_address` | `ip_address` | IP address for A record |
+| `dns_record_type` | `A` | DNS record type |
+| `dns_ttl` | `360` | TTL in seconds |
+| `dns_create_ptr` | `true` | Create PTR record |
+| `dns_debug` | `true` | Show debug output |
+
+### **DNS Manager Role Variables**
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `cluster_endpoint` | - | Full cluster FQDN |
+| `cluster_vip` | - | Cluster VIP address |
+| `dns_management_enabled` | `true` | Enable DNS management |
+| `use_hosts_file_fallback` | `true` | Add to /etc/hosts |
+| `dns_ttl` | `360` | DNS TTL |
+| `create_ptr_record` | `true` | Create PTR record |
+
+## 🎯 **Benefits**
+
+### ✅ **Modularity**
+- Single task file used across multiple contexts
+- Consistent DNS management approach
+- Easy to maintain and update
+
+### ✅ **Flexibility**
+- Works in playbooks, roles, and standalone
+- Parameterized for different use cases
+- Supports multiple DNS providers (extensible)
+
+### ✅ **Maintainability**
+- One place to update DNS logic
+- Clear variable interface
+- Better error handling and debugging
+
+### ✅ **Integration**
+- Seamlessly integrates with cluster setup
+- Works with existing homelab infrastructure
+- Compatible with Traefik load balancer setup
+
+## 🔄 **Integration with Cluster Setup**
+
+The DNS management now integrates seamlessly with your cluster deployment:
+
+```yaml
+# In fastpass-first-control-plane role
+- name: Setup network infrastructure for FastPass cluster
+  ansible.builtin.include_role:
+    name: cluster-network-setup
+  vars:
+    cluster_name: "{{ cluster_name }}"
+    cluster_endpoint: "{{ control_plane_endpoint }}"
+    cluster_vip: "{{ ansible_default_ipv4.address }}"
+    control_plane_nodes: "{{ groups['fastpass_control_plane'] }}"
+```
+
+This automatically:
+1. ✅ Creates DNS entry for `fastpass.local.mk-labs.cloud`
+2. ✅ Configures Traefik load balancer
+3. ✅ Tests connectivity
+4. ✅ Provides fallback to /etc/hosts
+
+## 🚀 **Next Steps**
+
+1. **Test the refactored approach** with your FastPass cluster
+2. **Extend to other clusters** (Hub, Internal) using the same pattern
+3. **Add support for other DNS providers** if needed
+4. **Create monitoring** for DNS health checks
+
+This modular approach makes your homelab's DNS management much more maintainable and repeatable across all your Kubernetes clusters!

ansible/ansible.cfg

@@ -54,7 +54,7 @@
 
 # (pathspec) Colon-separated paths in which Ansible will search for collections content. Collections must be in nested *subdirectories*, not directly in these directories. For example, if ``COLLECTIONS_PATHS`` includes ``'{{ ANSIBLE_HOME ~ "/collections" }}'``, and you want to add ``my.collection`` to that directory, it must be saved as ``'{{ ANSIBLE_HOME} ~ "/collections/ansible_collections/my/collection" }}'``.
 
-;collections_path=/Users/rblundon/.ansible/collections:/usr/share/ansible/collections
+collections_path=/opt/ansible-collections:/usr/share/ansible/collections
 
 # (boolean) A boolean to enable or disable scanning the sys.path for installed collections.
 ;collections_scan_sys_path=True
@@ -209,7 +209,7 @@ private_key_file=~/.ssh/ansible
 remote_user=wed
 
 # (pathspec) Colon-separated paths in which Ansible will search for Roles.
-;roles_path=/Users/rblundon/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
+roles_path=./roles
 
 # (string) Set the main callback used to display Ansible output. You can only have one at a time.
 # You can have many other callbacks, but just one can be in charge of stdout.
@@ -262,7 +262,7 @@ remote_user=wed
 
 # (path) The vault password file to use. Equivalent to ``--vault-password-file`` or ``--vault-id``.
 # If executable, it will be run and the resulting stdout will be used as the password.
-;vault_password_file=
+vault_password_file=/home/hermes/.vault_pass.txt
 
 # (integer) Sets the default verbosity, equivalent to the number of ``-v`` passed in the command line.
 ;verbosity=0

ansible/create_jarvis_user.yml

@@ -0,0 +1,6 @@
+---
+- name: Create jarvis user and deploy SSH key
+  hosts: all
+  become: true
+  roles:
+    - jarvis_user

ansible/group_vars/all/semaphore.yml

@@ -0,0 +1,154 @@
+---
+# ============================================================================
+# Semaphore configuration-as-code
+# ============================================================================
+# Drives a freshly-deployed Semaphore instance into its desired state via
+# the Semaphore REST API. Idempotent: every object is checked first; only
+# missing ones are created. Existing objects are left alone.
+#
+# Loaded from group_vars/all/semaphore.yml so that the configuration is
+# version-controlled in the homelab repo and survives a wipe-and-redeploy
+# of the Semaphore VM.
+# ============================================================================
+
+# ---------------------------------------------------------------------------
+# API connection (defaults to the local Traefik-fronted service-name URL).
+# Override semaphore_api_url to point at a specific instance if needed.
+# ---------------------------------------------------------------------------
+semaphore_api_url: "https://semaphore.local.mk-labs.cloud/api"
+semaphore_api_validate_certs: true
+semaphore_api_token: "{{ vault_semaphore_api_token }}"
+
+# Feature flag — keeps day1_deploy_semaphore.yml deploy-only by default.
+# Set true to also run the configuration pass.
+semaphore_configure: false
+
+# ---------------------------------------------------------------------------
+# Declarative configuration of the Semaphore instance.
+# ---------------------------------------------------------------------------
+#
+# Top-level shape:
+#
+#   semaphore_config:
+#     project:        single dict — the lab uses one project ("mk-labs")
+#     keys:           list of credentials Semaphore stores
+#     repositories:   git repos Semaphore can clone
+#     inventories:    Ansible inventories from those repos
+#     environments:   env-var bundles
+#     templates:      task templates that tie everything together
+#
+# Each list element has a unique "name" used as the natural identity key.
+# ---------------------------------------------------------------------------
+
+semaphore_config:
+  project:
+    name: mk-labs
+    alert: false
+    max_parallel_tasks: 0  # 0 = unlimited
+
+  keys:
+    # The ansible-vault password. login_password type with empty login
+    # — only the password field is consumed by Semaphore at runtime.
+    - name: ansible-vault-pass
+      type: login_password
+      login: ""
+      password: "{{ vault_ansible_vault_password }}"
+
+    # SSH key for the gitea deploy access (clone the homelab repo).
+    - name: gitea-deploy
+      type: ssh
+      ssh_login: git
+      ssh_private_key: "{{ vault_gitea_deploy_key }}"
+
+    # SSH key for the universal automation account 'wed' — pre-baked in
+    # every mk-labs VM template. This is the canonical user Semaphore
+    # uses to reach the fleet.
+    - name: wed-ssh
+      type: ssh
+      ssh_login: wed
+      ssh_private_key: "{{ vault_wed_ssh_private_key }}"
+
+    # SSH key Semaphore can use to reach the fleet as jarvis (admin
+    # account provisioned by linux-baseline). Retained for jobs that
+    # specifically need jarvis-level access; the default is wed-ssh.
+    - name: jarvis-ssh
+      type: ssh
+      ssh_login: jarvis
+      ssh_private_key: "{{ vault_jarvis_ssh_private_key }}"
+
+  repositories:
+    - name: homelab
+      git_url: "ssh://git@gitea.mk-labs.cloud:2221/rblundon/homelab.git"
+      git_branch: main
+      ssh_key: gitea-deploy
+
+  inventories:
+    - name: production
+      type: file
+      inventory_file: ansible/inventory.yml
+      repository: homelab
+      # wed is the universal automation account pre-baked in every VM
+      # template. Semaphore uses it for fleet-wide jobs.
+      ssh_key: wed-ssh
+      # become_key is Semaphore's sudo PASSWORD slot, not a second SSH
+      # key. wed has passwordless sudo on every host, so reference the
+      # built-in "None" key. (Semaphore rejects an SSH-type key here.)
+      become_key: None
+
+  environments:
+    - name: default
+      env:
+        ANSIBLE_HOST_KEY_CHECKING: "False"
+        ANSIBLE_FORCE_COLOR: "True"
+        # Semaphore runs ansible-playbook from the cloned REPO ROOT (not
+        # from the playbook's directory as I first assumed). Path is
+        # therefore relative to repo root, not playbook dir.
+        ANSIBLE_ROLES_PATH: "ansible/roles"
+        # Collections are installed by the semaphore role into a host-side
+        # directory bind-mounted into the container at this path.
+        ANSIBLE_COLLECTIONS_PATH: "/opt/ansible-collections"
+
+  templates:
+    - name: "day0_linux_baseline"
+      description: "Apply the mk-labs Linux baseline to one or more hosts."
+      app: ansible
+      playbook: ansible/playbooks/day0_linux_baseline.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--diff"]'
+      survey_vars:
+        - name: target
+          title: "Target host or group"
+          description: "Inventory target (e.g. figment, semaphore_server, all)"
+          required: true
+          type: TextVar
+          default_value: "all"
+
+    - name: "day1_deploy_semaphore"
+      description: "Re-deploy Semaphore + PostgreSQL on figment."
+      app: ansible
+      playbook: ansible/playbooks/day1_deploy_semaphore.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--diff"]'
+
+    - name: "day0_linux_baseline_check"
+      description: "Dry-run the baseline — shows diffs, applies nothing."
+      app: ansible
+      playbook: ansible/playbooks/day0_linux_baseline.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--check","--diff"]'
+      survey_vars:
+        - name: target
+          title: "Target host or group"
+          description: "Inventory target (e.g. figment, semaphore_server, all)"
+          required: true
+          type: TextVar
+          default_value: "all"

ansible/group_vars/all/step_ca.yml

@@ -0,0 +1,4 @@
+---
+step_ca_url: "https://turnstile.local.mk-labs.cloud:9000"
+step_ca_fingerprint: "f63c44e76381e359978bd2dca07c928d04ad44b575f0364fa66b5725c7e7891b"
+step_ca_provisioner_name: "admin"

ansible/group_vars/all/vars

@@ -0,0 +1,47 @@
+---
+# file: group_vars/all
+
+# Proxmox variables
+proxmox_user: "root@pam"
+proxmox_password: "{{ vault_proxmox_root_password }}"
+proxmox_host: "main-street-usa.local.mk-labs.cloud"
+
+# DNS variables
+dns_server: "monorail" # .local.mk-labs.cloud"
+#dns_admin: "admin"
+base_domain: "local.mk-labs.cloud"
+# DHCP server
+#dhcp_server: "matchbox"
+
+# Terraform variables
+terraform_server: "infra01"
+
+# Traefik variables
+traefik_server: "lightning-lane"
+
+# ---------------------------------------------------------------------------
+# JARVIS automation account
+# ---------------------------------------------------------------------------
+# Public key for the 'jarvis' user provisioned by the linux-baseline role on
+# every host. Public keys are not secret; the matching private key lives on
+# the JARVIS command centre (carousel-of-progress) and, when needed, in
+# group_vars/all/vault as vault_jarvis_ssh_private_key.
+jarvis_ssh_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5sym5ajFvDyzw395BkHv7qVb66XPTx/OF1p19MGuNo jarvis@mk-labs"
+
+step_ca_principal_mappings:
+  - local_user: wed
+    principals:
+      - ryan.blundon@protonmail.com
+      - ryan.blundon
+      - ryanblundon
+  - local_user: rblundon
+    principals:
+      - ryan.blundon@protonmail.com
+      - ryan.blundon
+      - ryanblundon
+
+# Leviton My Leviton API
+leviton_email: "{{ vault_leviton_email }}"
+leviton_password: "{{ vault_leviton_password }}"
+
+jmri_vnc_password: "{{ vault_jmri_vnc_password }}"

ansible/group_vars/all/vault

@@ -0,0 +1,365 @@
+$ANSIBLE_VAULT;1.1;AES256
+66393233316132396639356564316439343234383066633231646134313361666463656536323732
+6630616536646439613533363430306466306233643730350a343364633233333335643833326163
+64393933613963313533623733316339396236363663343635346663323366663166363839663837
+3331363062653239380a326566623264623837326636383939346430666537613361333638366630
+63353062393335316663633739313532366363623739653631366539323435336361353331386230
+39366634643964336233353961316630616462663166316266613037623363346335373638656365
+38353733396636386133373836346336383231663661346137373164386338623733393566373563
+35653933343036633365643535303934326537356136666539316137363433643266346630386439
+38613332646238366536333536343031356532656336613530663830613264346339353034323362
+66613530626361323535653232313730373463373332313561616631393461353730653464343063
+38616338363938346161616636316232313838616463326432353639613837343162646363343232
+33323064363139376566343866626364373662393138353666646234373461666163363139313631
+64343261326566363265323463663538343034306136326234386664333837333937333136653563
+61333531353434633339383661636363363535316366353330313566323133616438373161303135
+35353630613037316466353832333033393030636331386438393133366333653832393731366363
+62373638303737393162303461646239653865653834613662666636373364633165383062643831
+34386232376361323638353361666530366432356331353963303930326535663536373339333062
+32396266373430343339636635366434313635313766363863336464633961666332353834626163
+61653637316163636465343630353431313863653033643237356434313564366361373435376662
+63643737353830663236643862613533623237373531646136383763303766336139303632666235
+64623834323966363363663730626437323432623966663537346162656265363562643836633731
+65663631633462663764393132326165346639353033633035636432613039336164303538396632
+66396264393865306666643636353638613661313230313337383634663839363439656533333932
+36633432306131396539386539633063653230363932376264323537396434353364643432653661
+32643162363066636432336363323534316436613838646562313538326566666239633234646236
+30346534636533623365326564613561363362333364363037646561656635623935653466613565
+65646361313436356261643762313339333864356338386136306162386262636464393130303963
+38646464316432326431326661343632396235626234366133353461623862316662326432356234
+37626366383861373831633639616465663564643866356664623066386535646163336134356534
+33366664616232353863626465626364313530353335306565336665663866303736323162393362
+63626261653161663664363833313461653034326330653835393737616135646462366665383935
+30363639306330636634386433646231363530633061336364313338653632323831393630383934
+37316362326338313733646332336263386239626539383330353362616132333161613464313066
+34663434326662326233363432306433363666356132383866346336336261636435366332666135
+34616231613638363339356333616536643266636363643131653330396162306264303566396461
+64363763376365356533636430643866333361363062376237653237663731663934306265646630
+33393637656335643366383564373966343265393630333835303731316339373133633462383364
+33383435383331303264313334393532373932333334343862326635346135613932356337373034
+62316262326331313135376465343336373266663338396533666431616462613932663861646238
+62653563623535633738383033326235383666646333653731316233376231623661306462303732
+32643064373236613336396233323435393939386530323331336138353364663762356538316562
+33376530623664623733386133333433303031373337313366386236376539613964316135343865
+33363963366165333238356663663435386439336366646138313034343636653463323938633136
+39363966376238306662303265643034306136663661393738633436393432303139313132616534
+66323432313635386162333838323136623634653264643438303264636430633232323434666532
+32616664663063653735316237643539633133356661333132323238376333356464313262653836
+39303566316332663737323437633031353330333365383837636336643763313433313937396531
+38363536343438663966663436613132663661613134383431633765383164373762343435316161
+62303631646235343063383230343232383336356562303563373933346530393333316634316437
+32316330306163396434663031393965663163666537353031613365353437666466333464626238
+35313739646535356665323734393965303064306132626261363062363438383164346261393463
+30643438623363323161323230306230386332363635386234666639623566643536626637616533
+37396136643930633262333331656363376433333234343630306535313262306235663263663362
+32653434363035613732363136303363393939323337613661333439393637646262383039386661
+62326163323562333339323636363565623664396164383332633666386130613766393138346134
+33343338393536316431353439353062663164643634396363353131303038353965393466383030
+36656465383938353936346361393963356630666630373236626237303064303062383638373730
+35633866646535313432353338623462323235346433653431313031363163393666626432363238
+39623361316132626230633336636163623466313666346631656134343762656566353432353264
+30353436356237653231363564626134633039363035313232616333336436393638396233626638
+32663230396539323761313838313466376165646430346634383332346134653662393161363337
+62646161343665383364306665333164666231386531626465373366623761643161656462303733
+37653438616233353432626466623163316565353764323762613635333832343634323665356336
+35353162326233333836396337356466636131383838313436626336663132346339623261366465
+30623261303933396562353331636638376135663330643638643536346261626632626139386535
+66653332366361336636666437643165656239613031303638333232303836383132616636633938
+31343034643037623731643931316463303639656266323231313666356336333133323135363330
+63373365303131353161303630633738353536393631353034666139383435303461316131646138
+61333731356538366366613831303565613365633965323235366166313534653965366433656533
+62666136313662366638356237343734336333313034396465346632336262306531633535643238
+35333831366532386235316565303936616264373337356134643066396531383533353336303131
+31393837623564386535323532653733393734393164373235396566333565356237356438313762
+32623765326639386262393639376461326163333237313232386138643130643231626466643663
+39643061393566353434333136366335393536376234366266376265333234643536633035653933
+36316132663539306465343039323935356361373439346437386234386464623962643464643562
+61336434613834336161633237383361303930313464613666313834356330343138633735386530
+36616233323366323961653965613438346136373738366266316134356266623664313539636235
+37313033373466383134346361646562366531333338386330653736626530396238356639303131
+38363738396236386461316433316261326435646130383336316234363461393237623633633336
+30386630376565646337383738663939663462623232316635346635653830306664653336343033
+64316430396664393532313766326437636636626232613036666666656430323136356436333564
+36303334303562393832336433343438396430373833623137363736386665343866313064353063
+32303634393131326464656535633734386462646339663533666430336265653965333538633866
+61623666643839653239373335633735373738363736313665323365613635313766656635613832
+33616461643539636165383233636533626230343138663630323731626139393230383464313430
+61333438393337316239376435313337313437333931623238616133666138363235386533633437
+35356163363231656536353934643539643562343732626630383565623730626533313230656164
+35333735666135343364663233626163363930383262363266303265303638396239636361366534
+31333863333565356135613232393165353266343632633532343061663331633337343538376265
+39316630613439356262396634316361356436336634396337353339616536356336653930613966
+34656439653366363562636639346430623561303463356337363830373966366632303337663564
+35663632313265323365636238303364366230353039353561616636633664643233343430336237
+63373264643935616331616632633065366638363833306337633563653065363464343137623533
+36373231363739373335346464623533393336613634333636613937366136326464336332346166
+61376263623835646163353134643963663964373732313833346163323138633230393537636664
+30366234303334656130336630346130656237306161376566336534653630616439323764373665
+61383338326163336164353265326163646165623235626137623237306666333832306461613630
+66373331356465346261643466323662393661623433383265376666623932343861323139383531
+64633536373362643935633734366235396433333237306166646164363930613862613365303663
+38343833336137353634313362666665306666393635663633353934363832343739616331386130
+66336561633039326434313833303465366638303961626138333165623331386230616130626639
+34613962366230333065633761333335613636363533656461626632343631666563383738623330
+30333834346233653938633330663166616331376436356533366461336264643264336139343262
+35393665656230663232366133393037643536366234343537326631623332373131323739363638
+39653162646366316639313631393631666261623230313538613666393732626438393763646330
+36346661313131313630343432616365666633353762623261613039623331396330623939626132
+34626333386538326434356432623965666662663437646237373537326534653634346239653634
+31373038303639333037613637393862356263323066666630313262366633313932396465633337
+66653930303934616236323064613761353935613835356561313334323762633064306661346666
+37653262343865386236343634316336386630393739626437333065323433613531393738313432
+31376233353463373237653164386363633334366332356538343966663939656165323465333030
+39656532363363333432626638626438396539336461326338353732376235316133616666316261
+37353063343366376433653961333233306461303133376661303332386230346231383837396133
+37323137343066383966343535633363643233663530613566313330336232366638396165373631
+30626531363033313833303836366434613736396339643032663066333865306535323739666162
+64626133616433653864376662623464343131303938303237316264393765303035663833376464
+32663264383236303766323935306463643138396237373338653238633464616238306132633735
+31626538653262326533326266336633623532623935383266373533363466313033393235663538
+66653038646233303665343634383666343363383238326533366136363838303332323230316662
+35383235646638653539633961663036663933306463626335356631646662636230356261363261
+65633261353830373865636630353932323937666331353635373736376436333361613330366633
+30663939356165393132636131663966373433623063356265353131306532643066306630656363
+66636636353262633437663264613266613663656137386231306231646264363661613035343538
+37353633643065643236376537336238663137623735613038623766393231643131653436333262
+31626463646432613563393665346532386161366435396364663239386236616233356131323536
+33633936623762666534633862363466353736386137636363633733623366346337613365636439
+66663035313430386464623833646135333062313830396637323961386135363461326539623432
+32653865623530313637393561343465636430373162333162646631643235653931333830326266
+36376631316165343631326165623838306239623764363262376634663236393933343838376663
+39663834306165313330393739363133396436376437643232346336386531356638343063376465
+61613037623137306666383231376539656361326132396662613061376134376266633764336266
+64336334313335643635303632666431383637306334376462643630646339396435313830313363
+33383162316261663035393962306234613865613366353465373035656434366261383133653331
+63643235616362663663343330303765363263366130393837613939323264373937333162636639
+31643438666338646135663538343231643235646364623761653064633566656663383465626133
+31373935646266303565303539376162623132316438623565316537306337636630313861623937
+34313832636533623033616139373965303839356530353935643363613464356364343162336466
+66376130653162666661313139613530306666633432346639656466653364376435636461626362
+32653633303561346233643463373534653434323134353434373839373937626663336464303866
+33363264623038313835396231373132396163363662626264346461333539326365326165323066
+62333139383334333334353031616430323339623066363232313937323465356266323934313761
+66623835653961303830383030643537393130653935313265333062393034336562633535323263
+65616237373232336534393834653162363461336262653862666637326266663966356665363036
+35383437326465663635303664643236633435303862633965346133376536316233386333313634
+33643565326633386565653961646463383866646636303537643436623734393234633938333933
+65366164633165623333623362393639656661326332306538663738356364373734316563653038
+34646531616662386232613034366332656262343164333531353037363036646262623663666236
+38613238666136363431623664633863636365396236666532383930336636353031396232656435
+61346238643431653231623861373964383931336535363262373437353532393165316562386134
+36363263666135646237383666373833373737396330616163376439663736663937666161313831
+63663531656635663339306365656663636633343733636165386230376332616331313638386538
+32386466323232363533613334333333346161376430373436373961316564343061326164306138
+33616263666262323430303730626266396535626439623364376239346564323730323534323938
+33346364393033353865393864326361643734353234613563393138363334383536396535393166
+34623163616336653436393639313965353237633566313039303137326234383230323235363234
+37626161356166356365366164363863636563316332393638616535376466343537373966643839
+32613930643533336264626136626465303339376632323034386161663661376466616233633065
+66313739346162363838346663623266383130383736656334323430623463666439386532643630
+33666639613830386136363535363830333234653961663739343537306634616531616263623762
+64666230373830636238353062666330623061613663376638343763626264363130313464383661
+38326530333362616163363735323861376366333665623536383566653837306131623732373639
+31316661353332633630326162663738636562336666326637353764323431613666303038373532
+62343661336338306561356235396636343130633365303466613637633363613862663233633731
+66623530353132666261316637303763363830623734346262333633646238613131346564303734
+62336434353432326239333232383833633962313537626430663130393733623162626131656366
+64333535623138326239336165666562376663663334323036323539653734333835386331653438
+63353861666239396437346361306634613462386335376137333963333838616138633730393865
+62353539376136316564666136646639363635663736636439393462633165646632623664383663
+31613137306461616361323832393036323933626531363536336261356636303531633239333362
+32663134363263383039646162643539663737333861386437326337616362343963373532346238
+37346137363933623839373838353939386630303461346438666534616434333031373730393537
+30313134643963623564356266656430613430626238613266316335336265613132616562626261
+35386435313933626634616463616166646466363939313639646264346464363337656339323366
+36366665363739356564363232313762323565323134616134666337336534353464373637373130
+63613265366436313131356332316531633732356461383064383031613337343363646432373936
+33633339386632653032663837346130623636356464326637303338376132623734333932396232
+61333033386265356630316134383066343164613130666664643732643362666561346132656266
+31623633333039633837383264363937623435643061393935393762346430396335373864633634
+33336136353332663366313334353739303539633364663231636539333132303966383432376262
+61356563323232613433653262623663336634626532653465306638316633663564633862666666
+30366133616336326661626238653933383164336366333438626235636631336165386664343736
+62663961346664656333306435323833366632346366356238653731653937626333653630623334
+64326662346138386433333232643262333835326263343239353264373038613634356436396630
+38323931643361663238623766323930666130356339363564366661663033303831363138343737
+66633535326131396236653261303836613364306537633637323031663166316338323533323731
+30326235323066396663613531653061643661336631613835626266626436386662353465383065
+64396562343966303362636136616438353661626466636635323961613438646634336563636534
+38343566396530643961356434643933636235643561353232643062303232323437666261363061
+62636530396466303466653333633930376465366561376363316137323263333561343334383364
+39313863643062643766396564363137386231373136346138396162376264653538303464633161
+61663363623937356138356430666461623130323466623162653863393736326264393836336637
+34663931646566333535666664653237643732316663323230383239393763376266356135326438
+35656266353865623663373366373830613361373664346632363031356265313364623866643438
+61363866353934636337616239633330623734666138396166313864333939663563636138653930
+35653137363033326432373661613434313137623163356134613265393238346438306165313639
+36666662393165353565633531663536613037623230373063316639663632643139353235303462
+31393263656265656131613164363035343233626433656135353331613532363236616439363731
+62666432356363323937666435326638323437346136366131613636653430306131623966356263
+39303739306233303862636535633431363630393432613663633836396566653039383735303336
+62623331623034636363636661653236386337326666656532343737336262336462613762326531
+34303066303834386366636430343161653665343362363038396562626133636135656538306435
+36393364333066346238396362663664643236373532336263656233386663323663623137343462
+64386337333130316434663564613665666238623132343437656637653035373738313735366630
+66383639616166393265616434623463326437313530326130376339313662303836636664366232
+32366634633030333130316435616233396231663937343732313066373834326464623139363663
+31323931626364303230666162316436653065366137663631376265383063316534343736373261
+31613637316235386539343766323439653062633137663730343236343661346162653366656332
+32663932313063383561636266373766633535656131386133386135663863396261306530326632
+63653936626236316539613262386231616433393064323461626536363831666461316131383837
+30646266646266393666396362326238613231303335336532303836363264323233343534636635
+66313538643033343262373463363866346566353263303966323933383963363463393761383865
+64663932343830643531643466303438343161396133666463353762393737613036646166333265
+66376231613232666164663964636134653061633330383863373836306366393838393235656331
+35613231306263373230326634623262326333356263353961633836396531633431383163633361
+30356534666466653734333437383964346564346165326664633738653338313263633837316531
+36613034323433643839333264323864613033313137663131623265643364333664646235666232
+33393039313666323266643362323337316465306564303230646561303434666630616137633831
+34346439616634343337306636643733316464376631616266376437636439396337306637333432
+39306333363035393436316434656436353738303861633933376531383862316466373736323639
+35336137373866336631386436646231653366366435363932376434303063613961353261343661
+33383638393165336438376662306431333837356435626137356130323836396335636166306662
+36386161353739353637353861306666383966323339303262616239633930373633323937356632
+65383032613031666665623631613430666662656336663931646533636230303261646530623765
+64643939326435643539373564336531623236653731636636346361363064333963376566616530
+62326639663632666634326233363635383830643163373938646165656163643864336436373466
+36353832306632386230373832333234643638313238626333303963383962343265366137656136
+37333261343161633562346638323632616566646162633133663466346535656463393932386135
+62653332313066363965386335356430326539316366633537356364666230326237306236393563
+35323363633936353034323232353366373566666332323737653237323135646665626139393436
+65333762653536656161386532363765336538653763666236343166653933626666633130393033
+31643531646633623663313237353333313136663863663430306131316165663765653732663164
+36326531626365326330643064336230313466343731376437316563303339336333326636633066
+61386135626430616661313236623030316362373338643233326365646531633265626238383830
+65346132643537366537626132666165616138656139626132396639376230333262643766386363
+39383034663034326165643636613237623234613666333532383733623462303331326238636461
+34383139383466356139333934353837613964326538336463643832623062633034613762363061
+61346361656363366136353336326433326266336564316366393565626262303637316564356566
+39376661383763373436306238393666653561306538333638306233356139346634653363346164
+31303835383062376638626266303237323832623735653066353936376339633637333562333561
+36646462653834316131323166366661386161646538346464386232306239363030366363633663
+65306439616339626635326531636435356134376561303235393337373564373937623636643432
+61393535643038626562366331353831663338333838383066323632383633346564396566653330
+34386563393832313537623061666466366661333934613766366165366330353835323637643635
+38613363396663356564646132613536653033616337386566623662333832383938303138316662
+34303339323166383863363831636233323335313565393933636435396666313337663037323432
+63333139333165646262666339343736383966346133356138326437386334626461636530336432
+61356631366163366561303636333230643732316261376365386463333565623533663966336365
+39333365393766306536366231366435363030353263393534653534373064636361333532323735
+61313163323831653362356333386638343566356261353534303738613730373632363534666337
+62313339613138646361356431616236613435393233343732626263653332663265393934616134
+35313165613766643938393839373261633439396661623961353934373130623865353639633038
+34353631346433663131653965326337663561613330323562666336656237633163356562323931
+62393833663233333538383063303937386365306135343962623333663435663431396438666362
+61386266353838653532393233353939363738306634666537313761313835333864633764666262
+30333032623766633334383031636633636539336237613235376466356430663938653565626235
+64373537656566306136633630366130363630633462656330623633393735386630343437336436
+65343635366531646130616534623136636666323139326462306533653532643962656530336633
+35616537303932343539336638333730663639396330653761346136363431346536666138336462
+66396565613166623934316532383835316137303134363466306163356233356530323231666464
+30353933306530323734306564626234343864373964333264353366326265316333343330356532
+38363837646635633461653562303264353633343461633339376665616331613733666663353130
+65396363613731366234326466323738663563646166653237613364323734616465643764633537
+35373865353532383566363632366564353536643739663761303565333138383638653665663664
+65643366316461613630366437623736353739356538336237613431306363663234373265623962
+34653565373335653563356135313835643266356261623037336536613733323733363933376538
+36626134396563623733656534363331626262643339633932373035626134343531623634666463
+61623036313334616639633930393562663631653565656136666537393731333430663062643362
+63633663396562343965313261373965356163393538666466303661363531393266316462626166
+38616536653665366462383064373766396438616665346666376232653031323566313164383164
+36643231646439663637333165376439333432383532316661333766363136636236326338386537
+33306130353634346136356234363438383865313136393839663066333935623565333730613538
+63323831663866363831383930303434333936646564316435303931396362303534386335343330
+65383635346662626363626365666166636361633365643735303762393832316436646139303835
+63633733656361643233323332613632653837663262306661626438316262653931333061336366
+35353939353835333361623261613738383734656132613139393264393038373765343131333330
+37663962313566366463623437323965326365623437363038633661313461383634626661666236
+32633335323861643037383261393164393933353531636134323765353962633732396230636331
+32613865373739366530303538313566346434633933393330346637346136373036306666336164
+35373732346334353432616561623031663331346431383235306537386466623339356366663335
+36333733626433653465336431666530626665373564336339626163633131353330656437643638
+31616563616665343635356231633135663665326131636664373338323736393364353636613762
+66636135633766323866376235633535613735613465303239343036663438333331626431623435
+61323537386434323638666537643236623632626430666263376534643336613635663762643736
+30323237353265613062373265643562373637383337326264653639306263373865333262376665
+62646331373931373762303461366163393839633135393964313937616437323865653735383630
+32653936336534666565373437666130396265363561333635316461663766346336623865376133
+35373665303433326265623531613038636166643130616637653165376263643634376439613765
+35363031373630333966656466616235616337306335363132386335613462363664653634633864
+61303635653932353730663666386263633662633736313461643932386161313762663761313336
+62653665313033656537643936373465633932626166366430643763313030393838393039323230
+62633334383938343433306262393536653930653030393033306661666264313630643564333166
+35383237633932656331653030363434313534613637373465663264643061303538653666653861
+35373936643037333866636131373338363062663035323531626431633362663364396365353139
+66383737666437353764333231303662393630643933376161366430376530613365363830373534
+38376633333936626430393163323830346166643537326430616236393733653761363235356363
+35333131663032383861336262653936376565646662313965303265623763613330653461333835
+63613563323135633438383931343731656333303362316533376339376636623037376431336366
+61393236383364356162633062666265653534326363363862666539623761623065386537616563
+62666561316437303763376635346536666437373361386666643139643737663333323933613661
+38326566663932333930616435626133616531306461356466326437623235613233393434626563
+34373966633834373430386132353163366465626262353863353335323830393266393562393133
+65383632653438646435343333386261653066613663623232373564666465613136353039313036
+61646462626433646330396664363938376530376438646262343231393262383733636233636333
+35633862336566636439653464613564333162613836343636316334316665383164353131373431
+63623030306564346562346237333934616134346536303365396533626262333937396432393830
+38313763393463646437666137353835373735646365373934363936346564326362376565353133
+36653362333432326133393837316331666663663263396461363239306239363733633137396633
+38393865613431653337313665313762653635656531353465623436343132303064303564393066
+63616639353962366666616261393766643364333634346630616436376565313236316539633537
+66653239636561393433383639646462616433653166613130373134376535633937353366383230
+61613335663434333835653236343633633038346335333861356637353965396632393833646635
+36653034356234663831333764303338663464316362646339376338393236336161616263363538
+63356631613239326161343031643936623366643432663732346438333265666535623664396333
+62303239363339626566613439396234303536333333653433393666383635643235376165666234
+30336236393962666335353233666463346530323531316438373130303933383465316638646461
+62643066376666363236333231386237376466633932313836323163363061313333633434663763
+64323365353336333736363436376232653436633739613437343538633632356665656364616637
+62313666346436656564663335636635393632353430666236313863613464626434323939383538
+65386265343434303632313739353239323565333734656566356164643430613538333234383566
+37646431316363316139646435333732313339623666613738663039613239613738393565333330
+33376432373933656435303737653762666464363865633831373330393435633332636261336139
+34336236373535636165353262323966363164633135613534353661316364616637663465363864
+39306163346365643339643937396165666366663339336438373031613937636464383531613962
+34373433663533626665656364623634373335313033646165303764396563356235343033383138
+62326361353630393938643764616636313461633734646661386536356235656665393864386465
+37666262346561656436343036646330363664306135333464663265306165353039396665336664
+62346631366330653762646538323565613864383534636532633033643533323736373931643130
+32343435333333613734626234363132373734353035326232366264336161383631353133663230
+32636533333866343763336439373336356237303636376334333433376630353338333261333037
+31666537363666653238383939663464346662636133346561326335346163363061393830616237
+36643430626534653331653665316535303139343763663965363164636238366533303038653935
+32356432316633373137316237663331336463363431393033323635646564366639346230353363
+38346663363039363962323137383366303862356530353238656563306131643236626536656334
+38303462306562366532346163323061393437353063326539393466616439346564383036303235
+35633731393661323962633631373061303930323638326565636162316436646337383266626561
+32326430363031396530396238353862333133363731623736376239626561626165663337373261
+39353461343461643238646635633562653865323336366634613264616662323232653861663038
+64396330626633303031333334343335393039623135353266383561313231643433393963326637
+39313530636361373831306234383166346266656261663830636631333564356536323565336266
+38306561376366626236306633613564386166616630613032633163613837313462343662653261
+63353437663436303634633336636532646439636465663362346138313665336334313039613631
+65326135383831613531323265353831313562346161663265366434623236636635333038366536
+33646631663662393331323162343438626666366636613438383665633136326439376166373462
+33363864613136643461663436396362643066633437376631623031613366656238396165313832
+31313131653263666334393664343239306235373862313339373563643137393633343663613936
+61356564636238363136623031336638333566633766636362303938653531306131396665303033
+63353362636463636236643464343562383161343432383766396330623764393837613435396162
+31303162356437663932663964663239623764666366663061313535346438373334636263653531
+34643133356638653031373036343162653135663734623035353033633561366266623566383233
+36356434643538643430383532393762333535636639353361353763333363313131646264336332
+34373331343930633962623963666365306132356334646636626461316236343839383266363635
+65623434336239313330343437646333353362303232346638623161616133636636626236643465
+36303636363965363765656533386534633839346363363738386532386531326538643134363132
+66613235373362633166343565323766306335336365333439323764623964393263623236623832
+34346132383136303038363764333039626234616132386464666633663536656230666133363533
+38306665643361666539636666316432623430623939663636343164386438313765633031313534
+65393633323837326166343936326263343833646331326464376138633461613532303135393036
+65353830373065393038343039323937303634346665393135383639303162396565646232663736
+39376434646634353330383933303164653431373433346335666131386165343035303964626665
+35383035653631346638326637326235393833623264323030373238646335346332353362393230
+61616664613562383639306564376661306665396138613066326631616531623132633966633832
+65363637376264336635633132633332373634383864626564623966356464373864393832323738
+37616338646633326636323461376137663632376262363738303336616463326238333465343533
+31316132386530326539

ansible/group_vars/ntp_servers/vars

@@ -0,0 +1,18 @@
+---
+# file: group_vars/ntp_servers/vars
+#Ansible vars template for NTP servers.
+
+ntp_servers:
+  - 0.us.pool.ntp.org
+  - 1.us.pool.ntp.org
+
+allowed_networks:
+  - "192.168.1.0/24"
+  - "192.168.2.0/24"
+  - "192.168.3.0/24"
+  - "192.168.5.0/24"
+  - "192.168.9.0/24"
+  - "192.168.10.0/24"
+  - "192.168.250.0/24"
+  - "10.1.71.0/24"
+  - "10.1.82.0/24"

ansible/group_vars/proxmox/oidc.yml

@@ -0,0 +1,19 @@
+---
+# ansible/group_vars/proxmox/oidc.yml
+#
+# Proxmox OIDC configuration for Authentik integration.
+# Client credentials come from vault.yml.
+
+proxmox_oidc_realm_name: "authentik"
+proxmox_oidc_issuer_url: "https://authentik.local.mk-labs.cloud/application/o/proxmox/"
+proxmox_oidc_username_claim: "username"
+proxmox_oidc_scopes: "openid email profile"
+proxmox_oidc_autocreate: true
+proxmox_oidc_default_realm: false
+proxmox_oidc_comment: "Authentik SSO"
+
+# ACL entries - grant your Authentik user admin access
+proxmox_oidc_acl_entries:
+  - path: "/"
+    user: "rblundon@authentik"
+    role: "Administrator"

ansible/group_vars/proxmox/vault

@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+64613361376364346139313833613465663361336634326430393261366630306466363935613139
+3634363235343736643230623865386436333734663531310a343965396534336262356234623966
+39353332626662636666383935383530613139626439373664323063633063316264383331646533
+3366333837613731310a656462633638376432326365343135373863313665346566383933353630
+37303565323630633739396433323165326262363863386233343134636236646366633765616432
+33633165613239653762343935386637393437386431383961306436373765343736313634333933
+30376463646464303066613561613564353938306664373464333966383664383034616439343735
+38363966323366343465393530383736393364373361326234356365363163356632393834393464
+39393530356235383830323065636535383138353864373237333164323436623737383435313261
+64366362626232386438376131633533633162356432613835656465623762633464353936303236
+63353633633262633461353963653534663336396134373435303266386162393965343165303335
+65313436666334383965373837376664323861376162373834363439653539383231346634633737
+30626431373739633930313937643938343165383536373465613535366562313439396533643864
+36323032316131333962373732306334373939333363386564653465303261393337333466316130
+32326533353165393635393130396164636363623937313566343333386562616662383038613565
+35386638383365633362

ansible/host_vars/arcade/vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.111
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/astro-orbiter/vars.yml

@@ -0,0 +1,20 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/host_vars/astro_orbiter/vars.yml
+# HOST: astro-orbiter (10.1.71.130)
+# ROLE: llama.cpp LLM inference host — Ryzen 7 5800XT / RTX 3090 (ATX rebuild,
+#       2026-08-04). Superseded the prior AMD RX 5700 / Ollama config below;
+#       drive was transplanted into new hardware, not reinstalled.
+# ------------------------------------------------------------------------------
+
+ansible_host: 10.1.71.130
+ansible_user: jarvis
+ansible_ssh_private_key_file: ~/.ssh/id_jarvis
+ansible_become: true
+
+# LVM root expansion — xlarge template uses sda3 partition, standard VG/LV names
+common_expand_root_lvm: true
+common_root_pv: /dev/sda3
+common_root_vg: ubuntu-vg
+common_root_lv: ubuntu-lv
+

ansible/host_vars/backup/vars

@@ -0,0 +1,6 @@
+---
+# file: host_vars/backup/vars
+# mac_address: "98:b7:85:1e:c6:f1"
+ip_address: "10.1.71.9"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# primary_interface: "enp1s0f0"

ansible/host_vars/big-thunder-mountain/old_vars

@@ -0,0 +1,58 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.52
+vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/big-thunder-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.52
+vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/carousel-of-progress/vars.yml

@@ -0,0 +1,16 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/host_vars/astro_orbiter/vars.yml
+# HOST: astro-orbiter (10.1.71.130)
+# ROLE: Ollama inference host with AMD RX 5700 GPU passthrough
+# ------------------------------------------------------------------------------
+
+ansible_host: 10.1.71.131
+ansible_user: wed
+ansible_become: true
+
+# LVM root expansion — xlarge template uses sda3 partition, standard VG/LV names
+common_expand_root_lvm: true
+common_root_pv: /dev/sda3
+common_root_vg: ubuntu-vg
+common_root_lv: ubuntu-lv

ansible/host_vars/city-hall/vars

@@ -0,0 +1,48 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+
+vm_clone_source: "fedora-42-small"
+
+# Proxmox storage target.
+
+vm_storage: "mk-general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.21
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/docker01/vars

@@ -0,0 +1,11 @@
+---
+# file: host_vars/docker01/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+#mac_address: "BC:24:11:03:A9:7B"
+ip_address: 10.1.71.211
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+
+# Software
+#terraform_version: "1.11.3"

ansible/host_vars/guest-relations/vars

@@ -0,0 +1,12 @@
+---
+# file: host_vars/guest-relations/vars
+# guest-relations — Guest Relations
+# VM provisioned by Terraform (pre-pipeline bootstrap)
+
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.40
+
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: identity_provider
+app_name: authentik
+app_deployment: docker_compose

ansible/host_vars/haunted-mansion/old_vars

@@ -0,0 +1,60 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.61
+vm_mac_address: 'BC:24:11:C9:3A:13'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/haunted-mansion/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.61
+vm_mac_address: 'BC:24:11:C9:3A:13'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/infra01/vars

@@ -5,7 +5,7 @@
 # primary_interface: "enp1s0f0"
 # mac_address: "98:b7:85:1e:c6:f1"
 #ip_address: 10.1.71.51
-hostname: "infra01.{{ base_domain }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 
 # Software
 terraform_version: "1.11.3"

ansible/host_vars/lightning_lane/vars

@@ -0,0 +1,12 @@
+---
+# file: host_vars/lightning_lane/vars
+# lightning-lane — Traefik Reverse Proxy / Load Balancer
+# VM provisioned by Terraform (pre-pipeline bootstrap)
+
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.35
+
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: reverse_proxy
+app_name: traefik
+app_deployment: docker_compose

ansible/host_vars/main-street-station/main.yml

@@ -0,0 +1,16 @@
+---
+# Host-specific vars for main-street-station (JMRI headless server)
+# LCRR - Lake Country Railroad, Milwaukee Road Oct 1956, HO scale
+
+# JMRI profile ID — find with: ls ~/.jmri/profiles/ on the old box
+# Format: <name>.<8-char-hex>  e.g. LCRR.3d3f1dfc
+# TODO: fill in after restoring config from GitHub backup
+jmri_profile_id: ""
+
+# USB serial device for NCE command station
+# Verify after install: ls -la /dev/ttyUSB* /dev/ttyACM*
+jmri_serial_device: /dev/ttyUSB0
+
+# Path to JMRI config backup for restore task (leave empty to skip)
+# Point at a local checkout of the LCRR GitHub repo
+jmri_config_src: ""

ansible/host_vars/main-street-station/vars.yml

@@ -0,0 +1,10 @@
+---
+# main-street-station — JMRI / LCRR server
+jmri_profile_id: "Lake_Country_Railroad.3e8b1d4b"
+jmri_lcrr_repo: "ssh://git@gitea.mk-labs.cloud:2221/rblundon/LCRR.git"
+jmri_lcrr_branch: "clean-profile"
+jmri_leviton_email: "{{ leviton_email }}"
+jmri_leviton_password: "{{ leviton_password }}"
+jmri_ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnSM/9fO8rz/amqkyoGUzUKNNzzmtSXPwOCr1O9zKNO ansible"
+jmri_ssh_authorized_keys_extra:
+  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6HaK4Y21UwPRbAZ986L7I9QnUdyq53114+9kO8X4bL rblundon@laptop"

ansible/host_vars/matchbox/vars

@@ -0,0 +1,11 @@
+---
+# file: host_vars/matchbox/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+# mac_address: "98:b7:85:1e:c6:f1"
+ip_address: 10.1.71.7
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+
+# Software
+#terraform_version: "1.11.3"

ansible/host_vars/n8n/vars

@@ -0,0 +1,11 @@
+---
+# file: host_vars/matchbox/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+mac_address: "BC:24:11:1B:BB:92"
+ip_address: 10.1.71.81
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+
+# Software
+#terraform_version: "1.11.3"

ansible/host_vars/peter-pans-flight/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.62
+vm_mac_address: 'BC:24:11:AA:8F:3A'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/peter-pans-flight/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.62
+vm_mac_address: 'BC:24:11:AA:8F:3A'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/pve01/vars

@@ -0,0 +1,7 @@
+---
+# file: host_vars/pve01/vars
+# mac_address: "98:b7:85:1e:c6:f1"
+#ip_address: "10.1.71.51"
+ip_address: "10.10.21.51"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# primary_interface: "enp1s0f0"

ansible/host_vars/pve02/vars

@@ -0,0 +1,7 @@
+---
+# file: host_vars/pve02/vars
+# mac_address: "98:b7:85:1e:c6:f1"
+#ip_address: "10.1.71.52"
+ip_address: "10.10.21.52"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# primary_interface: "enp1s0f0"

ansible/host_vars/pve03/vars

@@ -0,0 +1,7 @@
+---
+# file: host_vars/pve03/vars
+# mac_address: "98:b7:85:1e:c6:f1"
+#ip_address: "10.1.71.53"
+ip_address: "10.10.21.53"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# primary_interface: "enp1s0f0"

ansible/host_vars/space-mountain/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.51
+vm_mac_address: 'BC:24:11:1A:E8:8C'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/space-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.51
+vm_mac_address: 'BC:24:11:1A:E8:8C'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/splash-mountain/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.53
+vm_mac_address: 'BC:24:11:84:D7:2F'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/splash-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.53
+vm_mac_address: 'BC:24:11:84:D7:2F'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/splash/vars

@@ -0,0 +1,100 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts creation via clone or create.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "small"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "tomorrowland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+# Comment out vm_mac_address if new MAC address should be generated
+
+ip_address: 10.1.71.99
+vm_mac_address: 'BC:24:11:97:C3:AA'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/sql01/vars

@@ -0,0 +1,11 @@
+---
+# file: host_vars/matchbox/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+mac_address: "BC:24:11:1C:95:1B"
+ip_address: 10.1.71.91
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+
+# Software
+#terraform_version: "1.11.3"

ansible/host_vars/sundial/vars

@@ -0,0 +1,50 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_clone_source: "fedora-42-small"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "fantasyland"
+proxmox_host_target: "fantasyland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.21
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/tiki-room/vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.23
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/turnstile/vars

@@ -0,0 +1,27 @@
+---
+# file: host_vars/turnstile/vars
+# turnstile — Smallstep step-ca SSH Certificate Authority
+# VM provisioned by Terraform (pre-pipeline bootstrap)
+
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.34
+
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: ssh_certificate_authority
+app_name: step-ca
+app_deployment: docker_compose
+
+# ─── step-ca Configuration ───────────────────────────────────────────────────
+stepca_hostname: turnstile.local.mk-labs.cloud
+stepca_dns_names: "turnstile.local.mk-labs.cloud,10.1.71.34"
+stepca_ssh_enabled: true
+stepca_listen_port: 9000
+
+# ─── OIDC Provisioner (Authentik) ────────────────────────────────────────────
+# Client ID and secret stored in vault
+stepca_oidc_provisioner_name: authentik
+stepca_oidc_configuration_endpoint: "https://authentik.local.mk-labs.cloud/application/o/step-ca/.well-known/openid-configuration"
+stepca_oidc_listen_address: ":10000"
+stepca_oidc_domains:
+  - "local.mk-labs.cloud"
+  - "protonmail.com"

ansible/host_vars/turnstile/vault

@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+30383930323363386234333433636465393263613336646464666365643730386430353864616334
+3865343031653162313736656437373666636136653263360a613961646133376262633164393535
+31363434633634303035663133316230633538363936303266373931313661346563333832653032
+6239376363646530620a303231363333363233623038326165316463383662656565626534396232
+62333133623530643932643430663166373930353733363866336533643233373261333130613635
+31633337376337663833613634666436383862386431636537373363343333323932363761653366
+61353166613162346436396138316561646165303566376366323462663861616364336539313138
+30386430373566353761383636626335393463376661356666303861353564313832346333396134
+30653861363866336331336164323130623230666237356165613934333239386536373664643065
+33643139346562346663313533643433353462363665323166313364373335366665373435643935
+65303863663864393238393732303065343364306264396333376233666233346664323334336532
+38373164383835663163363137643531303163396236623565666436363261393563343133333161
+36663934303633663062346161636333396135336135616136303664636562363862353764343562
+39643430396636313139336130656363306562363430346233313530663963366238326334623135
+62383632613061316262323038303333323739303137363334626637666663666263613132336433
+65346266393733633632

ansible/host_vars/vm_template/vars

@@ -0,0 +1,104 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts creation via clone or create.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "tomorrowland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+# Comment out vm_mac_address if new MAC address should be generated
+
+ip_address: 10.1.71.249
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+small:
+  cores: 2
+  memory: 2048
+  disk: 8
+
+medium:
+  cores: 2
+  memory: 4096
+  disk: 16
+
+large:
+  cores: 4
+  memory: 4096
+  disk: 32
+
+large-plus:
+  cores: 4
+  memory: 4096
+  disk: 48
+
+xlarge:
+  cores: 4
+  memory: 8192
+  disk: 64
+
+xlarge-plus:
+  cores: 4
+  memory: 8192
+  disk: 128

ansible/inventory.yml

@@ -0,0 +1,123 @@
+# file: inventory.yml
+proxmox:
+  hosts:
+    main-street-usa:
+      ansible_host: 10.1.71.11
+      ansible_user: wed
+      ansible_become: true
+    tomorrowland:
+    fantasyland:
+
+magic_kingdom:
+  hosts:
+    main-street-usa:
+    tomorrowland:
+    fantasyland:
+
+dns_server:
+  hosts:
+    monorail:
+
+ntp_servers:
+  hosts:
+    sundial:
+    
+load_balancers:
+  hosts:
+    lightning-lane:
+      ansible_become: true
+
+step_ca_server:
+  hosts:
+    turnstile:
+      ansible_become: true
+
+authentik_server:
+  hosts:
+    guest-relations:
+      ansible_become: true
+
+gitea_servers:
+  hosts:
+    mad-tea-party:
+      ansible_user: wed
+      ansible_become: true
+
+nextcloud_server:
+  hosts:
+    the-grid:
+      ansible_become: true
+
+semaphore_server:
+  hosts:
+    figment:
+      ansible_host: 10.1.71.37
+      ansible_user: wed
+      ansible_become: true
+
+n8n_server:
+  hosts:
+    tiki-room:
+
+astro_orbiter:
+  hosts:
+    astro-orbiter:
+
+hermes_server:
+  hosts:
+    carousel-of-progress:
+      ansible_host: 10.1.71.131
+      ansible_user: wed
+      ansible_become: true
+      ansible_ssh_private_key_file: ~/.ssh/ansible
+
+honcho_server:
+  hosts:
+    lincoln:
+      ansible_host: 10.1.71.132
+      ansible_user: wed
+      ansible_become: true
+
+jmri_server:
+  hosts:
+    main-street-station:
+      ansible_host: 192.168.10.40
+      ansible_user: wed
+      ansible_become: true
+
+papermc_server:
+# ansible-galaxy role install engonzal.papermc
+  hosts:
+    arcade:
+
+dev_servers:
+  hosts:
+    scrim:
+    backstage:
+      ansible_host: 10.1.71.133
+      ansible_user: wed
+      ansible_become: true
+
+# dhcp_server:
+#   hosts:
+#     matchbox:
+
+backup_servers:
+  hosts:
+    timekeeper:
+
+talos_control:
+  hosts:
+    city-hall:
+      ansible_become: true
+  vars:
+    talosctl_version: "v1.12.4"
+    talos_cluster_name: "fastpass"
+
+# matchbox_server:
+#   hosts:
+#     matchbox:
+
+terraform_server:
+  hosts:
+    infra01:

ansible/mk

@@ -0,0 +1,5 @@
+space-mountain
+splash-mountain
+big-thunder-mountain
+peter-pans-flight
+haunted-mansion

ansible/playbooks/add_dhcp_reservation.yml

@@ -0,0 +1,84 @@
+---
+- name: Bind VM MAC address to IP address on Ubiquiti
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Set VM MAC address (if defined in vars)
+      delegate_to: "localhost"
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ proxmox_user }}"
+        api_password: "{{ proxmox_password }}"
+        api_host: "{{ proxmox_host }}"
+        node: "{{ proxmox_clone_node }}"
+        vmid: "{{ vm_id }}"
+        net:
+          net0: "virtio={{ vm_mac_address }},bridge=vmbr0,firewall=1"
+        update: true
+        update_unsafe: true
+      when: vm_mac_address is defined
+
+    - name: Get VM MAC address from Proxmox (not defined in vars)
+      when: vm_mac_address is not defined
+      block:
+        - name: Retrieve information about specific VM by name and get current configuration
+          delegate_to: "localhost"
+          community.proxmox.proxmox_vm_info:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            name: "{{ inventory_hostname }}"
+            config: current
+          register: proxmox_vm_info
+
+        - name: Extract net0 information
+          ansible.builtin.set_fact:
+            vm_net0: "{{ proxmox_vm_info.proxmox_vms[0].config.net0 }}"
+
+        - name: Extract MAC address using regex
+          ansible.builtin.set_fact:
+            vm_mac_address: "{{ vm_net0 | regex_search('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}') }}"
+
+    - name: Assign VM MAC address to IP address on Ubiquiti with Terraform
+      when: vm_mac_address is defined
+      delegate_to: "{{ groups['terraform_server'][0] }}"
+      block:
+        - name: Create a directory if it does not exist
+          ansible.builtin.file:
+            path: "~/homelab/terraform/unifi-dhcp"
+            state: directory
+            mode: '0755'
+
+        - name: Create Unifi provider file from template
+          ansible.builtin.template:
+            src: templates/unifi_provider.tf.j2
+            dest: ~/homelab/terraform/unifi-dhcp/provider.tf
+            mode: '0644'
+
+        - name: Create Unifi user (host) file from template
+          ansible.builtin.template:
+            src: templates/unifi-user.tf.j2
+            dest: ~/homelab/terraform/unifi-dhcp/{{ inventory_hostname }}.tf
+            mode: '0644'
+
+        - name: Configure Unifi via Terraform
+          community.general.terraform:
+            project_path: ~/homelab/terraform/unifi-dhcp
+            state: present
+            force_init: true
+
+    # - name: Add line to hosts file
+    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
+    #   become: true
+    #   ansible.builtin.lineinfile:
+    #     path: /etc/dnsmasq.d/hosts.conf
+    #     regexp: "# {{ inventory_hostname }}$"
+    #     line: "dhcp-host={{ vm_mac_address | lower }},{{ ip_address }} # {{ inventory_hostname }}"
+    #     state: present
+    # # restart dnsmasq service
+    # - name: Restart service dnsmasq
+    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
+    #   become: true
+    #   ansible.builtin.service:
+    #     name: dnsmasq
+    #     state: restarted

ansible/playbooks/add_dns_entry.yml

@@ -0,0 +1,13 @@
+---
+# Replacement for add_technitium_dns_entry.yml
+# This playbook uses the modular task file approach
+
+- name: Add DNS entry using Technitium DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Include Technitium DNS entry task
+      ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+      vars:
+        host_name: "{{ inventory_hostname }}"

ansible/playbooks/add_service_route.yml

@@ -0,0 +1,95 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/add_service_route.yml
+# DESCRIPTION: Ensures all services in the Traefik dynamic config directory
+#              are routed and have DNS CNAME records on monorail.
+#
+#              1. Syncs boilerplates/traefik/dynamic/ to lightning-lane
+#              2. Scans the directory for service configs
+#              3. Extracts all hostnames from Host() rules (supports multi-host)
+#              4. Creates CNAME records for each hostname -> lightning-lane
+#
+# PREREQUISITES:
+#   - Service dynamic config YAML committed to boilerplates/traefik/dynamic/
+#   - vault_technitium_api_key defined in group_vars/all/vault
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/add_service_route.yml
+# ------------------------------------------------------------------------------
+
+- name: Sync Traefik routes and ensure DNS records
+  hosts: localhost
+  connection: local
+  gather_facts: false
+
+  vars:
+    base_domain: "local.mk-labs.cloud"
+    dns_server: "monorail"
+    traefik_host: "lightning-lane.local.mk-labs.cloud"
+    traefik_user: "wed"
+    traefik_dynamic_path: "/opt/docker/traefik/dynamic/"
+    dynamic_config_dir: "{{ playbook_dir }}/../../boilerplates/traefik/dynamic"
+
+    # Files in the dynamic directory that are NOT service routes
+    exclude_configs:
+      - default.yml
+
+  tasks:
+    # ── Step 1: Sync dynamic config to lightning-lane ──
+    - name: Sync Traefik dynamic configuration to lightning-lane
+      ansible.builtin.shell: >
+        rsync -av --delete
+        {{ dynamic_config_dir }}/
+        {{ traefik_user }}@{{ traefik_host }}:{{ traefik_dynamic_path }}
+      register: sync_result
+      changed_when: "'sending incremental file list' in sync_result.stdout"
+
+    # ── Step 2: Discover hostnames from Traefik router rules ──
+    - name: Find all dynamic config files
+      ansible.builtin.find:
+        paths: "{{ dynamic_config_dir }}"
+        patterns: "*.yml"
+      register: config_files
+
+    - name: Read config files
+      ansible.builtin.slurp:
+        src: "{{ item.path }}"
+      register: slurped_configs
+      loop: "{{ config_files.files }}"
+      when: item.path | basename not in exclude_configs
+
+    - name: Extract all hostnames from Host() rules
+      ansible.builtin.set_fact:
+        hostnames: >-
+          {% set hosts = [] -%}
+          {% for result in slurped_configs.results if result.content is defined -%}
+            {% set content = result.content | b64decode -%}
+            {% for match in content | regex_findall('Host\(`([^`]+)`\)') -%}
+              {% for h in match.split(' || ') -%}
+                {% set h = h | regex_replace('`', '') | trim -%}
+                {% if h.endswith('.local.mk-labs.cloud') and h not in hosts -%}
+                  {% set _ = hosts.append(h) -%}
+                {% endif -%}
+              {% endfor -%}
+            {% endfor -%}
+          {% endfor -%}
+          {{ hosts | unique | list }}
+
+    - name: Display hostnames to create
+      ansible.builtin.debug:
+        msg: "Hostnames found: {{ hostnames }}"
+
+    # ── Step 3: Create DNS CNAME records ──
+    - name: Create DNS CNAME record for each hostname
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        api_url: "http://{{ dns_server }}.{{ base_domain }}"
+        api_token: "{{ vault_technitium_api_key }}"
+        zone: "{{ base_domain }}"
+        name: "{{ item }}"
+        type: "CNAME"
+        cname: "lightning-lane.{{ base_domain }}"
+        ttl: 360
+        validate_certs: false
+      loop: "{{ hostnames }}"
+      loop_control:
+        label: "{{ item }}"

ansible/playbooks/add_technitium_dns_entry.yml.backup

@@ -0,0 +1,18 @@
+---
+- name: Add entry to Technitium DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: "Create DNS entry for {{ inventory_hostname }}"
+      delegate_to: localhost
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        api_url: "http://{{ dns_server }}.{{ base_domain }}"
+        api_token: "{{ vault_technitium_api_key }}"
+        zone: "{{ base_domain }}"
+        name: "{{ inventory_hostname }}.{{ base_domain }}"
+        type: "A"
+        ipAddress: "{{ ip_address }}"
+        ptr: true
+        ttl: 360
+#        validate_certs: false

ansible/playbooks/configure_proxmox_oidc.yml

@@ -0,0 +1,20 @@
+---
+# ansible/playbooks/configure_proxmox_oidc.yml
+#
+# Configures Proxmox OIDC authentication with Authentik.
+# Only targets one node since realm config is cluster-wide.
+#
+# Usage:
+#   cd ansible
+#   ansible-playbook -i inventory.yml playbooks/configure_proxmox_oidc.yml
+#
+# To also set up ACL entries for your user:
+#   ansible-playbook -i inventory.yml playbooks/configure_proxmox_oidc.yml \
+#     -e '{"proxmox_oidc_acl_entries": [{"path": "/", "user": "rblundon@authentik", "role": "Administrator"}]}'
+
+- name: Configure Proxmox Authentik OIDC
+  hosts: main-street-usa
+  become: true
+  roles:
+    - role: proxmox
+      tags: [proxmox-oidc]

ansible/playbooks/configure_unbound.yml

@@ -0,0 +1,37 @@
+---
+- name: Master playbook to install and configure unbound
+  hosts: unbound_servers
+  become: true
+
+  tasks:
+    - name: Permit traffic in default zone for dns service
+      ansible.posix.firewalld:
+        service: dns
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Create the directory
+      ansible.builtin.file:
+        path: /etc/systemd/resolved.conf.d
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Put `unbound.conf` in the correct place
+      ansible.builtin.copy:
+        src: ../roles/common/files/unbound.conf
+        dest: /etc/systemd/resolved.conf.d/unbound.conf
+        mode: '0644'
+        owner: root
+        group: root
+
+    - name: Restart service systemd-resolved
+      ansible.builtin.service:
+        name: systemd-resolved
+        state: restarted
+
+    - name: Install unbound via role
+      ansible.builtin.import_role:
+        name: Anthony25.unbound