fix: resolve talos config issues, Cloudflare v5 migration, and security cleanup
- Remove sensitive files from git tracking (kubeconfig, secrets.yaml.backup, talosconfig.backup) and update .gitignore - Fix installer version drift: v1.12.4 -> v1.12.6 across all talos configs - Fix grubUseUKICmdline + extraKernelArgs conflict on CP configs - Remove tailscale extension from stock installer CP configs (won't work) - Add nameservers to controlplane and per-node configs - Add time servers to all per-node worker configs - Fix HostnameConfig auto: stable in base templates - Clean up doc drift (README.md, CLAUDE.md) for worker count and storage - Remove all Longhorn references (worker configs, documentation) - Migrate Cloudflare provider v4 -> v5 with full resource refactoring: cloudflare_record -> cloudflare_dns_record, zone_settings_override -> zone_setting, block -> attribute syntax for rulesets, data, and tunnel configs - Fix firewall expression (not http.user_agent ne '' -> not exists)
This commit is contained in:
parent
9b73f436d8
commit
78d0ae179d
20 changed files with 461 additions and 498 deletions
17
CLAUDE.md
17
CLAUDE.md
|
|
@ -28,7 +28,7 @@ ansible-playbook playbook.yml --tags provision,bind9
|
|||
# - Storage: local-lvm (for BIND9 and general infrastructure VMs)
|
||||
# - Network: vmbr0
|
||||
#
|
||||
# Note: Talos nodes use a different template and Longhorn for persistent storage
|
||||
# Note: Talos nodes use a different template (Talos Linux) and do not use Longhorn
|
||||
```
|
||||
|
||||
### Ansible Operations
|
||||
|
|
@ -166,18 +166,15 @@ tofu plan
|
|||
- **Cluster Name**: home-cluster
|
||||
- **Kubernetes Version**: v1.35.0
|
||||
- **Control Plane Nodes**: 3 (10.0.15.1-3)
|
||||
- **Worker Nodes**: 3 (10.0.15.4-6)
|
||||
- **Worker Nodes**: 4 (10.0.15.4-7, incl. bare-metal talos4)
|
||||
- **API Endpoint**: https://10.0.15.1:6443
|
||||
- **Proxmox Cluster**: "home" (node1, node2, node3 at 10.0.15.101-103)
|
||||
- **VM Disks**: Proxmox Ceph for VM boot disks
|
||||
- **Persistent Storage**: Longhorn on passthrough NVMe drives (`/dev/sdb` on each worker, mounted at `/var/mnt/longhorn`)
|
||||
- Worker1: 2TB, Worker2: 2TB, Worker3: 1TB
|
||||
- `longhorn` StorageClass is the default
|
||||
- `longhorn-system` namespace requires privileged PodSecurity policy
|
||||
- **VM Disks**: local-lvm on each Proxmox node
|
||||
- **Persistent Storage**: TBD (Longhorn was removed — evaluating alternatives)
|
||||
- **CNI**: Flannel
|
||||
- **Talos Extensions** (workers only):
|
||||
- `iscsi-tools` v0.2.0 — required by Longhorn
|
||||
- `util-linux-tools` 2.41.2 — required by Longhorn
|
||||
- `iscsi-tools` v0.2.0
|
||||
- `util-linux-tools` 2.41.2
|
||||
- Installer image: `factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6`
|
||||
- Control plane nodes use the stock `ghcr.io/siderolabs/installer:v1.12.6`
|
||||
- **Deployment**: Managed via OpenTofu in `/tofu/`
|
||||
|
|
@ -237,7 +234,7 @@ tofu plan
|
|||
1. App repos contain their own k8s manifests in `./k8s/`
|
||||
2. ArgoCD `Application` in `home/cluster/argocd/apps/<name>.yaml` points at the repo
|
||||
3. Push the app repo → Argo auto-syncs (when `automated.selfHeal=true` is set)
|
||||
4. Use Longhorn for persistent volumes (default StorageClass)
|
||||
4. Use a CSI storage driver for persistent volumes (set default StorageClass)
|
||||
5. Use ClusterIP services + Cloudflare tunnel for external access
|
||||
|
||||
### Common Issues & Solutions
|
||||
|
|
|
|||
74
findings.md
74
findings.md
|
|
@ -81,17 +81,13 @@
|
|||
- **Issue**: CP configs specify `install.extensions` but use the **stock** installer image (`ghcr.io/siderolabs/installer`). Extensions require a **custom/factory** installer image (like the worker configs use: `factory.talos.dev/installer/<hash>`). The stock installer does NOT support extensions. Result: tailscale extension binary is never installed, `ExtensionServiceConfig` for tailscale silently fails.
|
||||
- **Fix**: Either switch CP nodes to use the factory installer image (bundling tailscale into the schematic), or remove the tailscale extension config from CP nodes.
|
||||
|
||||
### C-4: Longhorn disk configs missing on workers 2 and 3
|
||||
- **Files**: `talos/configs/talos-worker2.yaml` (lines 34-41, 89-92), `talos/configs/talos-worker3.yaml` (same)
|
||||
- **Severity**: 🟠 HIGH
|
||||
- **Issue**: Workers 2 and 3 have NVMe passthrough disks (`/dev/sdb`) for Longhorn per CLAUDE.md, but the `extraMounts` and `disks` sections are **commented out** in both configs. Worker1 (no NVMe) correctly has them disabled, but workers 2 and 3 appear to have been incorrectly commented out during the same fix pass. Longhorn effectively has no dedicated storage in the cluster.
|
||||
- **Fix**: Uncomment `extraMounts` and `disks` sections in `talos-worker2.yaml` and `talos-worker3.yaml`.
|
||||
|
||||
### C-5: All per-node worker configs lack `/dev/sdb` disk config
|
||||
### ~~C-4: Longhorn disk configs missing on workers 2 and 3~~ ✅ RESOLVED
|
||||
- **Files**: `talos/configs/talos-worker{1,2,3,4,5}.yaml`
|
||||
- **Severity**: 🟠 HIGH
|
||||
- **Issue**: ALL per-node worker configs have `extraMounts` and `disks` commented out. The base `worker.yaml` template has them active. Since per-node configs are what gets applied, no worker has the Longhorn bind mount configured. The base template and per-node configs have drifted apart.
|
||||
- **Fix**: Enable for workers 2-3 (have NVMe). Keep disabled for worker1 (no NVMe). Clarify for workers 4-5.
|
||||
- **Severity**: 🟠 HIGH → ✅
|
||||
- **Issue**: Longhorn has been removed from the cluster. All Longhorn disk configs (`extraMounts`, `disks`, installer image comments) removed from worker configs and documentation.
|
||||
|
||||
### ~~C-5: All per-node worker configs lack `/dev/sdb` disk config~~ ✅ RESOLVED
|
||||
- **Same as C-4** — all Longhorn disk references removed.
|
||||
|
||||
### C-6: Suspect firewall expression `(not http.user_agent ne "")`
|
||||
- **File**: `tofu/cloudflare.tf:437`
|
||||
|
|
@ -245,42 +241,56 @@
|
|||
| Severity | Count |
|
||||
|----------|-------|
|
||||
| 🔴 CRITICAL | 6 |
|
||||
| 🟠 HIGH | 6 |
|
||||
| 🟠 HIGH | 4 |
|
||||
| 🟡 MEDIUM | 11 |
|
||||
| 🔵 LOW | 10 |
|
||||
| **Total** | **33** |
|
||||
| **Total** | **31** |
|
||||
|
||||
**Top 5 priorities:**
|
||||
1. Remove sensitive files from git (kubeconfig, secrets backup, talosconfig backup, per-node configs with PKI) — S-1, S-2, S-3, S-6
|
||||
2. Rotate exposed Tailscale pre-auth keys — S-4
|
||||
3. Fix CP configs: either remove tailscale extension or switch to factory installer — C-3
|
||||
4. Fix `grubUseUKICmdline` + `extraKernelArgs` conflict on CPs — C-2
|
||||
5. Uncomment Longhorn disk config on workers 2-3 and resolve installer version drift — C-1, C-4, C-5
|
||||
5. Resolve installer version drift across Talos configs (v1.12.4 → v1.12.6) — C-1
|
||||
|
||||
---
|
||||
|
||||
## ✅ Fixes Applied (2026-06-04)
|
||||
|
||||
### S-5: State file removed from git tracking
|
||||
- Created `tofu/.gitignore` with `*.tfstate`, `*.tfstate.*`, `.terraform/`, `tfplan`, `.envrc`, `.claude/`
|
||||
- Ran `git rm --cached tofu/terraform.tfstate` — stops tracking but keeps local copy
|
||||
- Backup state files (`*tfstate*.backup`, `*tfstate.*.backup`) now covered by `*.tfstate.*` pattern
|
||||
### Security
|
||||
- **S-1, S-2, S-3**: Removed `talos/kubeconfig`, `talos/secrets.yaml.backup`, `talos/talosconfig.backup` from git tracking via `git rm --cached`
|
||||
- **S-5**: Created `tofu/.gitignore`, removed `tofu/terraform.tfstate` from tracking
|
||||
- Updated `talos/.gitignore` with `*.backup`, `kubeconfig`, `secrets.yaml.backup`, `talosconfig.backup`
|
||||
|
||||
### D-8: Porkbun provider upgraded to latest
|
||||
- **Before**: v1.3.1 | **After**: v1.3.3
|
||||
- Via `tofu init -upgrade` (within existing `~> 1.3` constraint)
|
||||
- Lock file updated accordingly
|
||||
### Talos Config Fixes (background task)
|
||||
- **C-1**: Installer version drift resolved (all configs → v1.12.6)
|
||||
- **C-2**: `grubUseUKICmdline` + `extraKernelArgs` conflict resolved on CPs
|
||||
- **C-3**: Tailscale extension removed from stock installer CP configs
|
||||
- **D-2/D-3**: Nameservers added to controlplane.yaml and per-node configs
|
||||
- **D-4**: HostnameConfig `auto: stable` removed from base templates
|
||||
- **D-5**: Time servers added to all per-node worker configs
|
||||
- **D-7**: README.md updated (worker count 4, local-lvm, versions corrected)
|
||||
- **E-5**: Orphaned worker4/5 configs documented
|
||||
- Root CLAUDE.md: Longhorn removed, worker count corrected, Ceph→local-lvm fixed
|
||||
|
||||
### D-8: Cloudflare provider upgraded to latest v4.x
|
||||
- **Before**: v4.52.5 | **After**: v4.52.7
|
||||
- Via `tofu init -upgrade` (within existing `~> 4.0` constraint)
|
||||
- Lock file updated accordingly
|
||||
### Longhorn Removal
|
||||
- `talos/worker.yaml`: Removed active `extraMounts` and `disks` blocks
|
||||
- `talos/configs/talos-worker*.yaml`: Removed commented-out Longhorn blocks
|
||||
- All documentation cleaned up (CLAUDE.md, README.md, root CLAUDE.md)
|
||||
|
||||
### E-1, E-2, E-3: Local backup files cleaned up
|
||||
- Removed `tofu/terraform.tfstate.backup`
|
||||
- Removed `tofu/terraform.tfstate.*.backup` (3 stale backups)
|
||||
- Removed `tofu/tfplan`
|
||||
- `.gitignore` prevents future accumulation
|
||||
### Provider Upgrades
|
||||
- **Porkbun**: v1.3.1 → v1.3.3 (via `tofu init -upgrade`)
|
||||
- **Cloudflare**: v4.52.5 → v5.19.1 (full v5 migration):
|
||||
- `main.tf`: Bumped constraint to `~> 5.0`
|
||||
- `cloudflare_zone`: Renamed `zone` → `name`, `account_id` → `account = { id = ... }`
|
||||
- `cloudflare_record` → `cloudflare_dns_record` (50+ resources + imports)
|
||||
- Replaced 4x `cloudflare_zone_settings_override` with 24x `cloudflare_zone_setting`
|
||||
- Converted ALL `cloudflare_ruleset` blocks → attribute syntax (`rules = [...]`)
|
||||
- Converted DNS `data {}` blocks → attribute syntax (`data = {}`)
|
||||
- Added `ttl = 1` to proxied records (required in v5)
|
||||
- Tunnel config blocks → attribute syntax (`config = { ingress = [...] }`)
|
||||
|
||||
### Notes
|
||||
- **Cloudflare v5.x** not yet migrated — requires splitting 4x `cloudflare_zone_settings_override` into ~16 individual `cloudflare_zone_setting` resources + renaming `zone` → `name` on `cloudflare_zone`. Non-trivial. Pending decision.
|
||||
### Other Fixes
|
||||
- **C-6**: Fixed suspect firewall expression `(not http.user_agent ne "")` → `(not http.request.user_agent exists)`
|
||||
- **E-1/2/3**: Created `tofu/.gitignore`, cleaned up backup files and tfplan
|
||||
- Root CLAUDE.md: Updated Talos notes (storage, worker count, Longhorn references)
|
||||
|
|
|
|||
7
talos/.gitignore
vendored
7
talos/.gitignore
vendored
|
|
@ -1,7 +1,14 @@
|
|||
# Talos secrets and sensitive files
|
||||
secrets.yaml
|
||||
secrets.yaml.backup
|
||||
talosconfig
|
||||
talosconfig.backup
|
||||
kubeconfig
|
||||
|
||||
# Per-node configs contain full cluster PKI — track with care
|
||||
# Consider externalizing secrets from these files
|
||||
|
||||
# Temporary files
|
||||
*.tmp
|
||||
*.bak
|
||||
*.backup
|
||||
|
|
|
|||
|
|
@ -254,16 +254,12 @@ kubectl get nodes
|
|||
ssh root@<proxmox-node> "qm start <VMID>"
|
||||
# Wait for DHCP, then apply config:
|
||||
talosctl --talosconfig talosconfig apply-config --nodes <IP> --file configs/<hostname>.yaml --insecure
|
||||
# Then upgrade to the factory image with extensions:
|
||||
# Then upgrade to the factory image with extensions (iscsi-tools, util-linux-tools):
|
||||
talosctl --talosconfig talosconfig --nodes <IP> upgrade --image factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6
|
||||
```
|
||||
**Critical VM settings**: `cpu: host` is required — without it, Talos boots but never gets a network address. Also set `balloon: 0`, `firewall=0` on NIC.
|
||||
|
||||
7. **Disk Dependencies Block Boot**: If a worker config references `/dev/sdb` for Longhorn but the Proxmox node has no passthrough NVMe disk, the `UserDiskConfigController` errors will prevent CRI and kubelet from starting. Comment out the `disks:` and `extraMounts:` sections for nodes without the extra disk.
|
||||
|
||||
8. **Node1 Has No NVMe**: node1 (10.0.15.101) only has a single 238GB SSD. No NVMe passthrough disk is available for Longhorn storage on talos-worker1.
|
||||
|
||||
9. **Bare-Metal Install Disk Enumeration**: On bare-metal nodes booted from a Talos USB, the USB enumerates as `/dev/sda` and the internal drive as `/dev/sdb`. Set `machine.install.disk: /dev/sdb` in the config so Talos installs to the internal drive. After install, when the USB is removed, the internal drive becomes `/dev/sda` in the running system — this is expected and does not require reconfiguration. Example: talos4 (HP t620 with 128GB SK hynix M.2 SATA) was installed this way.
|
||||
7. **Bare-Metal Install Disk Enumeration**: On bare-metal nodes booted from a Talos USB, the USB enumerates as `/dev/sda` and the internal drive as `/dev/sdb`. Set `machine.install.disk: /dev/sdb` in the config so Talos installs to the internal drive. After install, when the USB is removed, the internal drive becomes `/dev/sda` in the running system — this is expected and does not require reconfiguration. Example: talos4 (HP t620 with 128GB SK hynix M.2 SATA) was installed this way.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
|
|
@ -298,8 +294,6 @@ talosctl --talosconfig talosconfig service --nodes 10.0.15.1
|
|||
## Storage
|
||||
|
||||
- **VM boot disks**: local-lvm on each Proxmox node (no ceph storage available)
|
||||
- **Longhorn**: Workers 2 and 3 have passthrough NVMe disks (`/dev/sdb`) for Longhorn persistent storage. Worker 1 (node1) has no NVMe disk.
|
||||
- **Longhorn StorageClass**: `longhorn` (default)
|
||||
|
||||
## Maintenance
|
||||
|
||||
|
|
|
|||
|
|
@ -5,7 +5,8 @@
|
|||
- **Cluster Name**: home-cluster
|
||||
- **Kubernetes Version**: v1.35.0
|
||||
- **Control Plane Nodes**: 3 (10.0.15.1-3)
|
||||
- **Worker Nodes**: 3 (10.0.15.4-6)
|
||||
- **Worker Nodes**: 4 (10.0.15.4-7)
|
||||
- **Bare Metal Worker**: talos4 at 10.0.15.7 (HP t620)
|
||||
- **API Endpoint**: https://10.0.15.1:6443
|
||||
|
||||
## Node Details
|
||||
|
|
@ -18,6 +19,7 @@
|
|||
| talos-worker1 | Worker | 10.0.15.4 | node1 | 210 |
|
||||
| talos-worker2 | Worker | 10.0.15.5 | node2 | 211 |
|
||||
| talos-worker3 | Worker | 10.0.15.6 | node3 | 212 |
|
||||
| talos4 | Worker | 10.0.15.7 | bare-metal (HP t620) | — |
|
||||
|
||||
## Configuration Files
|
||||
|
||||
|
|
@ -44,7 +46,7 @@ talosctl --talosconfig talosconfig logs -f kubelet
|
|||
talosctl --talosconfig talosconfig service
|
||||
|
||||
# Upgrade Talos (example)
|
||||
talosctl --talosconfig talosconfig upgrade --image ghcr.io/siderolabs/installer:v1.9.5
|
||||
talosctl --talosconfig talosconfig upgrade --image ghcr.io/siderolabs/installer:v1.12.6
|
||||
```
|
||||
|
||||
### Kubectl Commands
|
||||
|
|
@ -64,18 +66,7 @@ kubectl cluster-info
|
|||
|
||||
## Storage Configuration
|
||||
|
||||
This cluster uses Proxmox Ceph storage for VM disks. For Kubernetes persistent storage, you'll need to deploy a storage solution:
|
||||
|
||||
### Option 1: Ceph CSI (Direct Proxmox Ceph)
|
||||
See CLAUDE.md for Ceph CSI setup instructions to use Proxmox Ceph directly.
|
||||
|
||||
### Option 2: Longhorn
|
||||
```bash
|
||||
kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.2/deploy/longhorn.yaml
|
||||
```
|
||||
|
||||
### Option 3: Rook-Ceph
|
||||
Deploy a separate Ceph cluster inside Kubernetes using Rook.
|
||||
VM boot disks are stored on local-lvm on each Proxmox node (no shared Ceph storage). For Kubernetes persistent storage, deploy a CSI provisioner (e.g. Rook-Ceph, OpenEBS, or cloud provider CSI).
|
||||
|
||||
## Networking
|
||||
|
||||
|
|
@ -109,7 +100,7 @@ talosctl --talosconfig talosconfig reset --nodes <NODE_IP>
|
|||
### Upgrading Kubernetes
|
||||
|
||||
```bash
|
||||
talosctl --talosconfig talosconfig upgrade-k8s --to 1.36.0
|
||||
talosctl --talosconfig talosconfig upgrade-k8s --to 1.35.0
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
|
@ -141,6 +132,7 @@ talosctl --talosconfig talosconfig reboot --nodes <NODE_IP>
|
|||
Important files to backup:
|
||||
- `secrets.yaml` - Required to add nodes or recover cluster
|
||||
- `talosconfig` - Required for talosctl access
|
||||
- Node configs in `configs/` directory
|
||||
- Kubeconfig is stored in `~/.kube/config`
|
||||
|
||||
Store these securely in a password manager or encrypted backup.
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -70,6 +70,10 @@ machine:
|
|||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
|
|
@ -77,13 +81,10 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sda # The disk used for installations.
|
||||
image: ghcr.io/siderolabs/installer:v1.12.4 # Allows for supplying the image used to perform the installation.
|
||||
extensions:
|
||||
- image: ghcr.io/siderolabs/tailscale:1.82.1
|
||||
image: ghcr.io/siderolabs/installer:v1.12.6 # Allows for supplying the image used to perform the installation.
|
||||
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||
extraKernelArgs:
|
||||
- console=tty0
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
|
|
@ -404,10 +405,3 @@ apiVersion: v1alpha1
|
|||
kind: HostnameConfig
|
||||
hostname: talos-cp1
|
||||
# hostname: controlplane1.example.org
|
||||
---
|
||||
apiVersion: v1alpha1
|
||||
kind: ExtensionServiceConfig
|
||||
name: tailscale # Name of the extension service.
|
||||
# The environment for the extension service.
|
||||
environment:
|
||||
- TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -70,6 +70,10 @@ machine:
|
|||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
|
|
@ -77,13 +81,10 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sda # The disk used for installations.
|
||||
image: ghcr.io/siderolabs/installer:v1.12.4 # Allows for supplying the image used to perform the installation.
|
||||
extensions:
|
||||
- image: ghcr.io/siderolabs/tailscale:1.82.1
|
||||
image: ghcr.io/siderolabs/installer:v1.12.6 # Allows for supplying the image used to perform the installation.
|
||||
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||
extraKernelArgs:
|
||||
- console=tty0
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
|
|
@ -404,10 +405,3 @@ apiVersion: v1alpha1
|
|||
kind: HostnameConfig
|
||||
hostname: talos-cp2
|
||||
# hostname: controlplane1.example.org
|
||||
---
|
||||
apiVersion: v1alpha1
|
||||
kind: ExtensionServiceConfig
|
||||
name: tailscale # Name of the extension service.
|
||||
# The environment for the extension service.
|
||||
environment:
|
||||
- TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -70,6 +70,10 @@ machine:
|
|||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
|
|
@ -77,13 +81,10 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sda # The disk used for installations.
|
||||
image: ghcr.io/siderolabs/installer:v1.12.4 # Allows for supplying the image used to perform the installation.
|
||||
extensions:
|
||||
- image: ghcr.io/siderolabs/tailscale:1.82.1
|
||||
image: ghcr.io/siderolabs/installer:v1.12.6 # Allows for supplying the image used to perform the installation.
|
||||
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||
extraKernelArgs:
|
||||
- console=tty0
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
|
|
@ -404,10 +405,3 @@ apiVersion: v1alpha1
|
|||
kind: HostnameConfig
|
||||
hostname: talos-cp3
|
||||
# hostname: controlplane1.example.org
|
||||
---
|
||||
apiVersion: v1alpha1
|
||||
kind: ExtensionServiceConfig
|
||||
name: tailscale # Name of the extension service.
|
||||
# The environment for the extension service.
|
||||
environment:
|
||||
- TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -31,14 +31,6 @@ machine:
|
|||
# extraArgs:
|
||||
# key: value
|
||||
|
||||
# extraMounts:
|
||||
# - destination: /var/mnt/longhorn
|
||||
# type: bind
|
||||
# source: /var/mnt/longhorn
|
||||
# options:
|
||||
# - bind
|
||||
# - rshared
|
||||
# - rw
|
||||
|
||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||
# extraConfig:
|
||||
|
|
@ -68,6 +60,10 @@ machine:
|
|||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
|
|
@ -75,21 +71,14 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sda # The disk used for installations.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.4 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions).
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
extraKernelArgs:
|
||||
- console=tty0
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
# size: 4GB # Disk size.
|
||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||
# Extra disks to configure (Longhorn storage).
|
||||
# disks:
|
||||
# - device: /dev/sdb
|
||||
# partitions:
|
||||
# - mountpoint: /var/mnt/longhorn
|
||||
registries: {}
|
||||
# Features describe individual Talos features that can be switched on or off.
|
||||
features:
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -31,14 +31,6 @@ machine:
|
|||
# extraArgs:
|
||||
# key: value
|
||||
|
||||
# extraMounts:
|
||||
# - destination: /var/mnt/longhorn
|
||||
# type: bind
|
||||
# source: /var/mnt/longhorn
|
||||
# options:
|
||||
# - bind
|
||||
# - rshared
|
||||
# - rw
|
||||
|
||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||
# extraConfig:
|
||||
|
|
@ -68,6 +60,10 @@ machine:
|
|||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
|
|
@ -75,21 +71,14 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sda # The disk used for installations.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.4 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions).
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
extraKernelArgs:
|
||||
- console=tty0
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
# size: 4GB # Disk size.
|
||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||
# Extra disks to configure (Longhorn storage).
|
||||
# disks:
|
||||
# - device: /dev/sdb
|
||||
# partitions:
|
||||
# - mountpoint: /var/mnt/longhorn
|
||||
registries: {}
|
||||
# Features describe individual Talos features that can be switched on or off.
|
||||
features:
|
||||
|
|
@ -439,9 +428,3 @@ apiVersion: v1alpha1
|
|||
kind: HostnameConfig
|
||||
hostname: talos-worker2
|
||||
# hostname: controlplane1.example.org
|
||||
---
|
||||
apiVersion: v1alpha1
|
||||
kind: ExtensionServiceConfig
|
||||
name: tailscale
|
||||
environment:
|
||||
- TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -31,14 +31,6 @@ machine:
|
|||
# extraArgs:
|
||||
# key: value
|
||||
|
||||
# extraMounts:
|
||||
# - destination: /var/mnt/longhorn
|
||||
# type: bind
|
||||
# source: /var/mnt/longhorn
|
||||
# options:
|
||||
# - bind
|
||||
# - rshared
|
||||
# - rw
|
||||
|
||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||
# extraConfig:
|
||||
|
|
@ -68,6 +60,10 @@ machine:
|
|||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
|
|
@ -75,21 +71,14 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sda # The disk used for installations.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.4 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions).
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
extraKernelArgs:
|
||||
- console=tty0
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
# size: 4GB # Disk size.
|
||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||
# Extra disks to configure (Longhorn storage).
|
||||
# disks:
|
||||
# - device: /dev/sdb
|
||||
# partitions:
|
||||
# - mountpoint: /var/mnt/longhorn
|
||||
registries: {}
|
||||
# Features describe individual Talos features that can be switched on or off.
|
||||
features:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
# Purpose: Bare-metal worker node (talos4, HP t620, 10.0.15.7)
|
||||
# Disk: /dev/sdb (USB boot, internal drive after install)
|
||||
# Installer: factory image with iscsi-tools + util-linux-tools extensions
|
||||
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||
debug: false # Enable verbose logging to the console.
|
||||
persist: true
|
||||
|
|
@ -20,7 +23,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -31,14 +34,6 @@ machine:
|
|||
# extraArgs:
|
||||
# key: value
|
||||
|
||||
# extraMounts:
|
||||
# - destination: /var/mnt/longhorn
|
||||
# type: bind
|
||||
# source: /var/mnt/longhorn
|
||||
# options:
|
||||
# - bind
|
||||
# - rshared
|
||||
# - rw
|
||||
|
||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||
# extraConfig:
|
||||
|
|
@ -68,6 +63,10 @@ machine:
|
|||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
|
|
@ -75,21 +74,14 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sdb # The disk used for installations.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions).
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
extraKernelArgs:
|
||||
- console=tty0
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
# size: 4GB # Disk size.
|
||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||
# Extra disks to configure (Longhorn storage).
|
||||
# disks:
|
||||
# - device: /dev/sdb
|
||||
# partitions:
|
||||
# - mountpoint: /var/mnt/longhorn
|
||||
registries: {}
|
||||
# Features describe individual Talos features that can be switched on or off.
|
||||
features:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
# Purpose: Future worker node (talos5, bare-metal, 10.0.15.8 planned)
|
||||
# Disk: /dev/nvme0n1 (NVMe internal drive)
|
||||
# Installer: factory image with iscsi-tools + util-linux-tools extensions
|
||||
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||
debug: false # Enable verbose logging to the console.
|
||||
persist: true
|
||||
|
|
@ -20,7 +23,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -31,14 +34,6 @@ machine:
|
|||
# extraArgs:
|
||||
# key: value
|
||||
|
||||
# extraMounts:
|
||||
# - destination: /var/mnt/longhorn
|
||||
# type: bind
|
||||
# source: /var/mnt/longhorn
|
||||
# options:
|
||||
# - bind
|
||||
# - rshared
|
||||
# - rw
|
||||
|
||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||
# extraConfig:
|
||||
|
|
@ -68,6 +63,10 @@ machine:
|
|||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
|
|
@ -75,21 +74,14 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/nvme0n1 # The disk used for installations.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions).
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
extraKernelArgs:
|
||||
- console=tty0
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
# size: 4GB # Disk size.
|
||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||
# Extra disks to configure (Longhorn storage).
|
||||
# disks:
|
||||
# - device: /dev/sdb
|
||||
# partitions:
|
||||
# - mountpoint: /var/mnt/longhorn
|
||||
registries: {}
|
||||
# Features describe individual Talos features that can be switched on or off.
|
||||
features:
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -69,7 +69,11 @@ machine:
|
|||
# - '!10.0.0.3/32'
|
||||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network: {}
|
||||
network:
|
||||
nameservers:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 1.1.1.1
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
# enabled: true # Enable the KubeSpan feature.
|
||||
|
|
@ -77,7 +81,7 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sda # The disk used for installations.
|
||||
image: ghcr.io/siderolabs/installer:v1.12.4 # Allows for supplying the image used to perform the installation.
|
||||
image: ghcr.io/siderolabs/installer:v1.12.6 # Allows for supplying the image used to perform the installation.
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||
|
||||
|
|
@ -392,7 +396,7 @@ cluster:
|
|||
---
|
||||
apiVersion: v1alpha1
|
||||
kind: HostnameConfig
|
||||
auto: stable # A method to automatically generate a hostname for the machine.
|
||||
# auto: stable # Commented out — per-node configs use static hostname instead.
|
||||
|
||||
# # A static hostname to set for the machine.
|
||||
# hostname: controlplane1
|
||||
|
|
|
|||
|
|
@ -1,19 +0,0 @@
|
|||
apiVersion: v1
|
||||
clusters:
|
||||
- cluster:
|
||||
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
server: https://10.0.15.1:6443
|
||||
name: home-cluster
|
||||
contexts:
|
||||
- context:
|
||||
cluster: home-cluster
|
||||
namespace: default
|
||||
user: admin@home-cluster
|
||||
name: admin@home-cluster
|
||||
current-context: admin@home-cluster
|
||||
kind: Config
|
||||
users:
|
||||
- name: admin@home-cluster
|
||||
user:
|
||||
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoVENDQVNxZ0F3SUJBZ0lRTGJBMXhGT0NPa2lkbmhnaCtkb3o5VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV6TVRJeE1Ua3hPRm9YRFRJM01ERXpNVEl4TVRreQpPRm93S1RFWE1CVUdBMVVFQ2hNT2MzbHpkR1Z0T20xaGMzUmxjbk14RGpBTUJnTlZCQU1UQldGa2JXbHVNRmt3CkV3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFa2pCaTRiMXl0aUd4cFpJcDVSQVhtYXlCZDU5SlhqWGsKWllRbWI4b0svL2dDeE4yaHFvUCt4dmM1dC9DVXdtTVZKQkFod2FuRnhHalA3TkplMGNYZ3BLTklNRVl3RGdZRApWUjBQQVFIL0JBUURBZ1dnTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01COEdBMVVkSXdRWU1CYUFGTXhoCnRrWDh2VGxLRjJCeExwalF4SWRkbjcybk1Bb0dDQ3FHU000OUJBTUNBMGtBTUVZQ0lRQ1NJdVZ0VTYzaWowRG0KSU5ML01QZEdjY2t6WTlDMURLUGw4bytObStjVmJRSWhBT2orQnB6NUo1ZThub2pNMXI2aHFnRWlpYjF6Y1ZpSwpuaXVPZjYrNFBPU0cKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVMeHprQzVIMHBLVkxHVU93RmpoaDBPeHdZWFN2R2lIRktIbmF1L09nZllvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa2pCaTRiMXl0aUd4cFpJcDVSQVhtYXlCZDU5SlhqWGtaWVFtYjhvSy8vZ0N4TjJocW9QKwp4dmM1dC9DVXdtTVZKQkFod2FuRnhHalA3TkplMGNYZ3BBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
cluster:
|
||||
id: ajFbAfx06GXDzj6aZKEZ7M47wpc_0y4n9f4_NjIpz-c=
|
||||
secret: eZtUgfkU6glNR7S7O6n5uQBHb/m0pkb3QD9OlSo9cDM=
|
||||
secrets:
|
||||
bootstraptoken: fkth11.nmhzlprifn9pe6jl
|
||||
secretboxencryptionsecret: 83iFqNeoP3fTSwstgBRWidjicy//f71Ui83VVcqI6So=
|
||||
trustdinfo:
|
||||
token: 6mvqo9.nn5sbv4fhyifbqjk
|
||||
certs:
|
||||
etcd:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmRENDQVNPZ0F3SUJBZ0lRRFV2eGpQbDViSFRSR05KN1VSQ0JzVEFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE1URTNNakF5T1ZvWERUTTJNREV3T1RFM01qQXlPVm93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpWSlhnSGRMbTJFCjFSNmJyZjJ2aG91blBndlpzeVlsZFA5TlMzT0FXaGk1dUczc2JBTi96ZnF1VEtpOUFjQXpuOWNnbHY5MkI3MXkKQXNtMktPcUJXYTJqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVOGpCellJc3RITjA2CjFNSDBsNjFRaXlibnFIa3dDZ1lJS29aSXpqMEVBd0lEUndBd1JBSWdWbDZ0SWw5MlN0YUtKWDhkVnpzKzJiWUgKQi9sTnlPbkx1eGNZTWsvL1lGTUNJQXZWT1ZMckQ4Q3hCMlgyMDREVVpOL0t6KzVZcHFtRy9yUTFiRnBDSkF1NwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVKaktuempHY1ViakNRekpkamF0cFNXUVlacnI2MHg4b1NNeEV3eUhkNUFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbFVsZUFkMHViWVRWSHB1dC9hK0dpNmMrQzltekppVjAvMDFMYzRCYUdMbTRiZXhzQTMvTgorcTVNcUwwQndET2YxeUNXLzNZSHZYSUN5YllvNm9GWnJRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
k8s:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpRENDQVMrZ0F3SUJBZ0lRSFp3TUhKd0ZyblVLTDMrNjltQ2JnVEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV4TVRFM01qQXlPVm9YRFRNMk1ERXdPVEUzTWpBeQpPVm93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCSWxHL0ppOWdEOTh2WEJKZjVWQ05VbkhuTGlIN1F5UWdMbHR0TFgrUElUeWFUaXVzSW5RRGMvUzZ4aysKTFVkSjhrN0t3d0NYUEZ0SDZTTWM0VE12MTZpallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVyRU5ZMllVN3pWb1hoZ1BCb2Rqa1Z2Q2czWWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnV2xxb0ZXTzYKa3RnNEt3NVBtUkhUeVNuUi90cmQzTmQyc0x6WHdCRmFZcUlDSUNobFpCWDBHRGpQTVFjM0xQcG1oR2xpMVpCQgpzWkdyY0M4VVpqSjNqR0t4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlQYklVSWtZWnRVaDI4Z2dqZERsbmp3bUVUWDJ0eEtpV2I2ek1xMTA2aDRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaVViOG1MMkFQM3k5Y0VsL2xVSTFTY2VjdUlmdERKQ0F1VzIwdGY0OGhQSnBPSzZ3aWRBTgp6OUxyR1Q0dFIwbnlUc3JEQUpjOFcwZnBJeHpoTXkvWHFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
k8saggregator:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFXZ0F3SUJBZ0lRREFKZDVPVGdJbnFnZ0NnMUUrNmFaVEFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhNVEUzTWpBeU9Wb1hEVE0yTURFd09URTNNakF5T1Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTi9oNms5MEMzT0VLOWlLY3daZEFvWFVXNDBXY0JFWnNEYnRxamMwWkI5cUxseHpLMkdYCnZZZHVsODJ4c1JiTjlXVjFoS085NjZCc2w5TXF2ZDAvOXJHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVpTGtETGhmcVQ5OUJ4VVBUVFBOa2tyUG1xRkV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloCkFQOXJxVHhXeEFWRXA2MElnNkgxSDJNaVpxc20waXlTSWFGNktHSDhGRDB5QWlCWkhWRml1SzFvKzZUWEt6QzkKSnNjait3emhuSTZWYUNQU2pEUUt3NGFrYkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpTYXNCall3ZDAzcjZxRUFJaXNCTU9lWm5Dd3BRcm54cnE5T1JNZnFkT01vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMytIcVQzUUxjNFFyMklwekJsMENoZFJialJad0VSbXdOdTJxTnpSa0gyb3VYSE1yWVplOQpoMjZYemJHeEZzMzFaWFdFbzczcm9HeVgweXE5M1QvMnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
k8sserviceaccount:
|
||||
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBOXRQbWRWMDFYTWNXenAzc3RXS3p3NHFDcW9kZDVjaXVQanF2MXQ5VkcxbHRQNEJTCmlVS3U3VERTS3R4Zm1qQ3pMLzVvVHVwMUVPbDRHckVOK0RZNDhvZjN1MU1VdDdjWE9lelF5SXBLaitDMUJyRTEKQ29pNTFOUHdXNGpUaHRPTExXUmRrU2doUCtPaDM0alpzelBvczVvS1E4aFJtK1hZNzRjbytPZ3lOL2NORXQzNQowa3h1aVEyUzZPam51Z0tIZk9zOFhRL2d0cDloSitUYW0zdkpTSHdOUFpOVkFHb3dYSmQrRU5PeEhMWjlLSDIrCmNOcmpNZGUvbmZza3lvV2h1NXZFZnQxTmV0ZkEwWXZSb1hzZERqdS82YXJ5NW92MWNoMDJYVENhc0tLN05RajAKT1Y2REVqZm5PTlNRRndXRUpTVzY4RVlWY1AxSCtoY3E4VkozODM3b0JyWVpUWUNFZllMaC8rNnpZY3RjSGdLTAo5VFhvdkxkTlZLaDlpZ0Q5NVlsT3lsTmpCVlVDNm45Q0RPQ3BZWDUzaXdiTGl1VFVsRUNwK3g0eCtrcVlPUFNDCmFrWVhwZXZ2R1F0STFUTDFLK2lDamNXUm9EaVZoblFWREhsV243R3pqeFNKMEJWd25ydFk3aWlXR1JmemxMTVUKQzUrVVY3TGxSaytwMFlDMG85dmczbXZQNkJRTm5NQUtETGc5MG5PSjVzZWFkR21DQVdyVnI2TjhhaDR2ZmpGdQprUkVVa29vcjZmYXlERmxpN1pQWGYzaXVLY0FiNXhXb3JoTXVvR0tzMUFRZHdLZFdUZi9janVKOVJYR2lLSXJ2ClJWQWQ4TW82MGhKd25SRElCK1M0cUNOWXlvYXQxd2x4NldCcjQyRUZ2ekFxdk41Z0thOVBQR09KOEJjQ0F3RUEKQVFLQ0FnQml4dXc4WFovRVVEdzFWWWZzRXVManh5T0JnUWkzczNiZm1uYlNJN0FZY05KQ2ptVDVYMEZIMUxqVwp4RGhTS1ZrY1JOQ1RmRXA3Q1NPeWN0YW5WWE8ydzJrRmd6c1FSbW82R1NaNGlyZEtHdC8zSEtXZ1lKVVZzZmRICmVsdEVZcFlaQlVoWWxkbXdpclUyRXJza2R3cVNEWHc4SWdkZXZ6M3dwWU5sRU84LzdGTkVFS2N3WEx3RGh2WWEKMVZJZTQzSTdNSnlJbFprVkhIVXlGT2pUUGxlUDlXMExEbEgvQjMveEhnTXFVcjFYUTBTVkZyVkd6cUlMU1U3Ngp0dzNES25WTjhnbFJ4OWlBNTZUWGR2L2VncmxlLzlST2U4WVhNejEzZkc5TUhlNVo3OVhCWktMdjduMi9wYldYCnphRVlSWEhidDl5MjJTVXRnWDd6ZTZBSTBUc0U0clIrY0RCZndwcm9ZSHpSRUdlb2t4a0JucHRSNG1YNkNyYm8KYUxZdTJiTWpzd0dCclE5VEJiTk9vNjVkOExRV3JlaGNFY0ZSbWxXN2JCT2M5N3FVbUIvakZGSXhQMUk5NjY5WgpveXpuZ2tzcHZISHZXR2NVTTRsMVkxYkhXNCtOUFpaUk9uOFc4dGJKT2hTNjZ2YTdFQ3pnb2QzRC9aSmFmdlViCkRjTlNCdVltZTZsUisvU1Z6SEcvOTROQVZJdmdPdVVxVWxqbmlpNnRtUFBqUEduNXlNTmZ4QUN4aEJlQmZJNCsKbitqc2V4UGtHamhrSjdPVDVKQjYxQWFId28wdjJ3Y212a0I1YkE3cEo3K0k4OUp1bE9VM3V2eXQ2OUQ2b1k0agpEQk00ZVVVd3ArZ3c1ZHVMYWpES2w0cno5SHNQQllPSUpDNE9uUE5wdXRlb2tzWWEyUUtDQVFFQS82YlpGYkI3CkZ2dGdxYkozV0ZEL1BjcjFwbnljakI4ZFZObVNBN0FhVHZaZll5THovbHlJM0VUQkJUbkhWUk9YVy9qa2VYcGcKa1FpRGRLbzlZS2g3Y1EwdTBwVnVDeGNOdXRkRmIwRkROMERvWjNuRlJlSkpEcmh2c2gyRDkvMGdaTmw2Tkg0dApPMUxWUDBGUStpeTZ5TGlUci9XelVZYVc1OHVNcmw2cFUxRStQTjJPQ1l4bnBmVk0vbFJQbHdJUFF5ZUYrc3krCkZibjBnVTArOEJHY0R6aDJZZldBZ1J4OUt5RStNcWtROVdIQzY2MXZkUGFPdm5ROTY3Y2xTRE5kU3FiRFRuU3EKSlExbVdLT0c3RzJXRGtDcmw0RElZU0tQQUZCeWowbGcxeCtjQ1JoN1hZOUtDVnZxMmFkcXJOZ1A4UHZmblFpdwpGcThuSWE1UnNhM3Y5UUtDQVFFQTl5bjVuNW5rQUd4Z2JlSEF4MnFMbWFBNHRvUGVHUkxHeUdCWU9Wa3RtSFN5Ck4rS2tvamw4ZmEyN0ppTVVNWHRONzhsSzdNM3lGQldSWENocUgvaURZYmtVZFNLUk4yTFJBRWtudTkxTWVVTWkKV1pmMVo5QzNpL2JlUmV4aEl0aGFNQkk2YldQeTMzTExYREdsZXlmTnp6N21nNFVOQm5relp6aUMwRjN0NUlMcgp5WG1VdDZxUjNPQlBIcUhDZXhTeERqQVk4ZDBXTjhQejk0YUJkNW1pelBEQ1FwYkFuTmZ4NFVGU0Z5N2hRRGVrCkFQUm5MY0tacXZibGJzT3JlUUo3TUJXV1h6U3VwYnUxL2krYTNwZWNwMTRmek9HMC9GaDh0c1JQTUtHNFNDcDYKQ2lOVm55T210MGRHaWxaOXV4emRVZVF6RXBSZk93YkF6UlNqYW95VVd3S0NBUUVBMDBLQWovRFh0dVVpT3ZsVQpzREcyeXN5R2RQN3lxc1FuaSsrRFB2THV1cVBUcld1NzcwMXVkMytGZGhrS0JONzhyQzhnTnRhUEtDcTkzdEd6CmlNV1J4SmxkUVAzbEF0c1pLSFl1VmNLN2xkUlllUEhpdUY1SGV4ZWtqYTdnV0RUZjZSYmlhckIrRmxEY0VicWEKL1RHclpLVkt2aFN2QzBiS08yQTByLzlmczQ4bWZFdWx6WFF1VHJGSDM3K3lTWnFWSEN4MEJnM2RZcnpaTldTdApCdHUyZDhsejRuMXFwTWJ6RklvVENQQTNLRitTSVFtZ1dpcEpTVTlydi9jSG93TjNLM0psWU5iOXAwTE1lYUVnCnBRM2wrMzhyalRZSjRHTWJndW4zMFRxVkFSQ0k4K2M4UXROZkhoN01FdkxMTDJ3WXVFNmJ1ZnZzNzhIcjkyUkMKOUM1RlpRS0NBUUVBb2pxaTVlY1VpRkthV0lVOUM2Y2JTaEtvSnVRVyswNGZ1NVhCVXFMK0VudEdIdmhjSno2awpQN213aFMreEtXbE5sbjRBOTcyVmp5azQ1OHgvRzh6NkwwSlQ4eTVsTW4xaHdWWkRCa1FTMWVVQ3Z0dkc4QVZHCjlFOXRSV2dKdWQxWUZRVmg1RHNlUnh3Sjd0R0hWSGFqMTh2cGNabjdHcXlpMkxWMjUxMC9zQ1ZlcmpkbkxjWi8KUndMVDY3OHc3Nmg5TGxyVGhLMGcwQ21HRUlud29KZnZDNlZiWEdtbXMwdnFMM2U0Y2c4TE9pTkxPblV3NUJBKwozTUNCaDFwWFNtNGVmVWt1RWY5NlFyNGFqbVNndWttNVFRRyt6Yk80SDRuVkVnRjRHT3VORVpFUDJXZW40M1I3CkVRRnZnNDJScVNjZy9ZZFRIbmJVcXVHYjJ3QVk0dTZ5MFFLQ0FRRUFpQm0zbkUxTGg2VFFtZjlZQVVnV1pNeVkKQWlVSHNFUnRTUGdCdWgrZzUxY1krMmp2ckEvbVZ3bG5PQlphWmoreU52Tk5ESktoWUk3TDlFb2krbTlZM1duUAp4OGFlRndhNFBRMzhUU09wM0hSYXhtcUd2Ylo0aktqcVVSc3R3b1B2UzkyK2JGZUxyaFArREh2dmhOMW41TDNkCjZtdFQycjVpSkZWWEc1RVZWMGpUdkVMUVBDT013c0NVL2hyOVdCY0hpeFdIdzBGOGdZaEo2VjJ6WjB2ZEhTUHYKMTNhUWFHZlh4M0o2NEN4dy9CWmJPaUdnYUNOOEtBKzJhYmhLY2M1UTR5L21QRUN1WXRlVHJPMFZURU9GOHczMgpta29SOUUxWHI2RnowK1Z1b0puKzBXSWNkN0l5dS8ybHZzWjVPc2ltMVRkUS9VaFAvVjlsMHpweGhOYlJUQT09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
|
||||
os:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJRFl1WkVJcC9ONEhLNG9RcndlcnlvZUVYNkt4WFFzWUcyeDRXV3ZxTVM4eAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
context: home-cluster
|
||||
contexts:
|
||||
home-cluster:
|
||||
endpoints:
|
||||
- 10.0.15.1
|
||||
- 10.0.15.2
|
||||
- 10.0.15.3
|
||||
nodes:
|
||||
- 10.0.15.1
|
||||
ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLRENCMjZBREFnRUNBaEJOcDFlRkxURkM3dlpLdzRxYk5hc0JNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TmpNME5UWmFGdzB5TnpBeE1UUXhOak0wTlRaYU1CTXhFVEFQQmdOVgpCQW9UQ0c5ek9tRmtiV2x1TUNvd0JRWURLMlZ3QXlFQWQ0WGFqeENScDFRZi9lZWJFRWxWa2pQS1BqZ3paZGJCCkRxUENBbGRCL1cyalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0QKQWpBZkJnTlZIU01FR0RBV2dCUlV0V1RId3M3ZmRvem0wdzgyVGFBK00xb0hTREFGQmdNclpYQURRUUJ4Ni9FdgpsUHFJTFRaNHhPN0ZOM2xWNHdCdngrekpLbGE4ODdkbUtRWk50NEZUbmpadFh1eWQ5VEhaVXdsOXozN3RBUG1ZCjFxZzAzUW5ZR1lyVEt5NEQKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSXpScjY5NGp0SnRDWjZFbmp6cWhSWGREdndpa0h2eGErNzlCZzN1cDZpUAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||
|
|
@ -20,7 +20,7 @@ machine:
|
|||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
disableManifestsDirectory: true # Disable static pod manifest directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
|
|
@ -31,15 +31,6 @@ machine:
|
|||
# extraArgs:
|
||||
# key: value
|
||||
|
||||
extraMounts:
|
||||
- destination: /var/mnt/longhorn
|
||||
type: bind
|
||||
source: /var/mnt/longhorn
|
||||
options:
|
||||
- bind
|
||||
- rshared
|
||||
- rw
|
||||
|
||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||
# extraConfig:
|
||||
# serverTLSBootstrap: true
|
||||
|
|
@ -79,7 +70,7 @@ machine:
|
|||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/sda # The disk used for installations.
|
||||
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.4 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn.
|
||||
image: ghcr.io/siderolabs/installer:v1.12.6 # Talos installer.
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
|
|
@ -87,11 +78,7 @@ machine:
|
|||
# size: 4GB # Disk size.
|
||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||
# Extra disks to configure (Longhorn storage).
|
||||
disks:
|
||||
- device: /dev/sdb
|
||||
partitions:
|
||||
- mountpoint: /var/mnt/longhorn
|
||||
disks: []
|
||||
registries: {}
|
||||
# Features describe individual Talos features that can be switched on or off.
|
||||
features:
|
||||
|
|
@ -432,7 +419,7 @@ cluster:
|
|||
---
|
||||
apiVersion: v1alpha1
|
||||
kind: HostnameConfig
|
||||
auto: stable # A method to automatically generate a hostname for the machine.
|
||||
# auto: stable # Commented out — per-node configs use static hostname instead.
|
||||
|
||||
# # A static hostname to set for the machine.
|
||||
# hostname: controlplane1
|
||||
|
|
|
|||
50
tofu/.terraform.lock.hcl
generated
50
tofu/.terraform.lock.hcl
generated
|
|
@ -2,38 +2,26 @@
|
|||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.opentofu.org/cloudflare/cloudflare" {
|
||||
version = "4.52.7"
|
||||
constraints = "~> 4.0"
|
||||
version = "5.19.1"
|
||||
constraints = "~> 5.0"
|
||||
hashes = [
|
||||
"h1:+O72J3QYiZtYmYYZM/Eh0f4NNfl1BvjX1eju43qTQsQ=",
|
||||
"h1:0oqjYIPXcXh7XiDiKI085cHDYQQ5mh8kDl9dmBtvtog=",
|
||||
"h1:4b4ESb87MGv5bnadgYe7sK5rEkKMZhbkQcwPubQTsR4=",
|
||||
"h1:6mTr3eA1Ddb348lLmJuyvn98z4KF+ejqaUEJ76D1rzQ=",
|
||||
"h1:9/3YH+9k9HqsvFtbmBf7SO2+xqZeZrXNKzLkjNuhUEA=",
|
||||
"h1:Jcq4tBWgyH4/2JsojNBSRaN0mcItVMchO+lynonrlqc=",
|
||||
"h1:Y4Vv/2RdP0Q+uxqhOxzOdKxuuEMjXPDcU0vPc5bCQzI=",
|
||||
"h1:a0gW8FBKsbP9Fi0HEDoy49WIbEWVHk9+BR4/iwuBdDQ=",
|
||||
"h1:gElv6iqJtg8OKN77gbw+MjrkrQmJHPkkMEi1J+0xkpU=",
|
||||
"h1:oslXUugD/NQ+duJgT4BhKQyfGbuFOANknMvR73fiOeM=",
|
||||
"h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=",
|
||||
"h1:u67GWw8GwD9NDlDzp9Y5VRnSQGcCrE8rSpkGPaBpDl0=",
|
||||
"h1:uUUa9dY0XQOycI8pxg16PFFtL0WCTi9uEJz8trTQ7pU=",
|
||||
"h1:y3rV8KF2q6GEMANNlf5EkKJurlfbKlIKpjGcdxoy7pQ=",
|
||||
"zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b",
|
||||
"zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e",
|
||||
"zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10",
|
||||
"zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285",
|
||||
"zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529",
|
||||
"zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
|
||||
"zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13",
|
||||
"zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d",
|
||||
"zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f",
|
||||
"zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d",
|
||||
"zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe",
|
||||
"zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455",
|
||||
"zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2",
|
||||
"zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b",
|
||||
"zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe",
|
||||
"h1:HkKPMZ/n+QiExkRUSLjGMTGnuIaph+k932LiTp7CKZM=",
|
||||
"h1:LicdZu3hugYpWuCAprg2EslbVP0zANnV9n9/2KiOnYc=",
|
||||
"h1:VvnqJUTXlbKrB/6X2K9dc7lE3CQj3KX055gr+bMyXsg=",
|
||||
"h1:XYVRvCG+auhkY1NnSe6pK7ClqKW5GX8BgUnMQwfC7mQ=",
|
||||
"h1:Xf1PHfUfK690caJYZvoudKKBppfleJ6RcqsEQWqKVCw=",
|
||||
"h1:i6pbudcLi1X2MVeN9IV3bDeiGWnWhn+v9dMrMzAN+l8=",
|
||||
"h1:mopYISyLkUVUwMjJbuPenxIUVDrna1/7ACB1hfMfciU=",
|
||||
"h1:xfoTAyKkR12F8nuVC96DwBA2Fva38o5BnYHLXZzmDP4=",
|
||||
"zh:0651618000db705564dab5a25322b9d76ea54b7dd78931ed3565497b559babeb",
|
||||
"zh:1a7847e9479fb6d21a65ef933ffae1416b1e4b44ca940c0d6c50fc4248cc4a0d",
|
||||
"zh:5597cee5854131045eb9f201ae3a70b59c51955d31a647d9616863c746d902cb",
|
||||
"zh:580786830d93e35b957754fd4c62d4681a3b19abc28b757e41acba26455663b1",
|
||||
"zh:83c4bdfb0e74fd50e56fff3c461d76c1c1ec61af3f679e4de1aa70b5ed05a09f",
|
||||
"zh:abb4d1052cee61d80f9cb51e5421e3c118312403afb7104b98bd7e310ac736ee",
|
||||
"zh:b0aeeb3d66ea4d719989875e778c477065ba941e3a76e9a8caacc3be08208dd9",
|
||||
"zh:e43b4b2dfcec1ce2115f5a5c86042d432deb49bee8eae103eb56d97ea02e2e3b",
|
||||
"zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
|
||||
]
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -200,8 +200,10 @@ import {
|
|||
resource "cloudflare_zone" "zones" {
|
||||
for_each = local.cloudflare_zones
|
||||
|
||||
account_id = local.cloudflare_account_id
|
||||
zone = each.key
|
||||
account = {
|
||||
id = local.cloudflare_account_id
|
||||
}
|
||||
name = each.key
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -210,11 +212,11 @@ resource "cloudflare_zone" "zones" {
|
|||
|
||||
import {
|
||||
for_each = local.cloudflare_records
|
||||
to = cloudflare_record.records[each.key]
|
||||
to = cloudflare_dns_record.records[each.key]
|
||||
id = "${local.cloudflare_zones[each.value.zone_key]}/${each.value.record_id}"
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "records" {
|
||||
resource "cloudflare_dns_record" "records" {
|
||||
for_each = local.cloudflare_records
|
||||
|
||||
zone_id = cloudflare_zone.zones[each.value.zone_key].id
|
||||
|
|
@ -231,16 +233,17 @@ resource "cloudflare_record" "records" {
|
|||
# DNS Records - aprs.me tunnel CNAME
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "aprs_me_tunnel" {
|
||||
resource "cloudflare_dns_record" "aprs_me_tunnel" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
type = "CNAME"
|
||||
name = "aprs.me"
|
||||
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
||||
proxied = true
|
||||
ttl = 1
|
||||
}
|
||||
|
||||
# aprs.me - Resend email (DKIM, SPF, DMARC, MX)
|
||||
resource "cloudflare_record" "aprs_me_dkim_resend" {
|
||||
resource "cloudflare_dns_record" "aprs_me_dkim_resend" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
type = "TXT"
|
||||
name = "resend._domainkey"
|
||||
|
|
@ -248,7 +251,7 @@ resource "cloudflare_record" "aprs_me_dkim_resend" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "aprs_me_mx_send" {
|
||||
resource "cloudflare_dns_record" "aprs_me_mx_send" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
type = "MX"
|
||||
name = "send"
|
||||
|
|
@ -257,7 +260,7 @@ resource "cloudflare_record" "aprs_me_mx_send" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "aprs_me_spf_send" {
|
||||
resource "cloudflare_dns_record" "aprs_me_spf_send" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
type = "TXT"
|
||||
name = "send"
|
||||
|
|
@ -265,7 +268,7 @@ resource "cloudflare_record" "aprs_me_spf_send" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "aprs_me_dmarc" {
|
||||
resource "cloudflare_dns_record" "aprs_me_dmarc" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
type = "TXT"
|
||||
name = "_dmarc"
|
||||
|
|
@ -273,7 +276,7 @@ resource "cloudflare_record" "aprs_me_dmarc" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "aprs_me_txt_yahoo_verification" {
|
||||
resource "cloudflare_dns_record" "aprs_me_txt_yahoo_verification" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
type = "TXT"
|
||||
name = "aprs.me"
|
||||
|
|
@ -281,7 +284,7 @@ resource "cloudflare_record" "aprs_me_txt_yahoo_verification" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "towerops_txt_yahoo_verification" {
|
||||
resource "cloudflare_dns_record" "towerops_txt_yahoo_verification" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
type = "TXT"
|
||||
name = "towerops.net"
|
||||
|
|
@ -289,12 +292,13 @@ resource "cloudflare_record" "towerops_txt_yahoo_verification" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "gridmap_org_tunnel" {
|
||||
resource "cloudflare_dns_record" "gridmap_org_tunnel" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
type = "CNAME"
|
||||
name = "gridmap.org"
|
||||
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
||||
proxied = true
|
||||
ttl = 1
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -314,7 +318,7 @@ locals {
|
|||
]...)
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "caa" {
|
||||
resource "cloudflare_dns_record" "caa" {
|
||||
for_each = local.caa_records
|
||||
|
||||
zone_id = cloudflare_zone.zones[each.value.zone].id
|
||||
|
|
@ -322,11 +326,11 @@ resource "cloudflare_record" "caa" {
|
|||
name = each.value.zone
|
||||
ttl = 86400
|
||||
|
||||
data {
|
||||
flags = "0"
|
||||
tag = "issue"
|
||||
value = each.value.ca
|
||||
}
|
||||
data = {
|
||||
flags = 0
|
||||
tag = "issue"
|
||||
value = each.value.ca
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -334,22 +338,22 @@ resource "cloudflare_record" "caa" {
|
|||
# =============================================================================
|
||||
|
||||
import {
|
||||
to = cloudflare_record.towerops_srv_autodiscover
|
||||
to = cloudflare_dns_record.towerops_srv_autodiscover
|
||||
id = "${local.cloudflare_zones["towerops.net"]}/26db78978535d1d630432970b9a4e279"
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "towerops_srv_autodiscover" {
|
||||
resource "cloudflare_dns_record" "towerops_srv_autodiscover" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
type = "SRV"
|
||||
name = "_autodiscover._tcp"
|
||||
ttl = 86400
|
||||
|
||||
data {
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.mcintire.me"
|
||||
}
|
||||
data = {
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.mcintire.me"
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -357,64 +361,140 @@ resource "cloudflare_record" "towerops_srv_autodiscover" {
|
|||
#
|
||||
# Zone security settings: TLS hardening and HSTS
|
||||
# =============================================================================
|
||||
resource "cloudflare_zone_settings_override" "aprs_me" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
|
||||
settings {
|
||||
min_tls_version = "1.2"
|
||||
always_use_https = "on"
|
||||
tls_1_3 = "zrt"
|
||||
zero_rtt = "on"
|
||||
ssl = "strict"
|
||||
|
||||
security_header {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
include_subdomains = true
|
||||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
}
|
||||
# aprs.me
|
||||
resource "cloudflare_zone_setting" "aprs_me_min_tls_version" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
setting_id = "min_tls_version"
|
||||
value = "1.2"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_settings_override" "towerops_net" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
|
||||
settings {
|
||||
min_tls_version = "1.2"
|
||||
always_use_https = "on"
|
||||
tls_1_3 = "zrt"
|
||||
zero_rtt = "on"
|
||||
ssl = "full"
|
||||
|
||||
security_header {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
include_subdomains = true
|
||||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
}
|
||||
resource "cloudflare_zone_setting" "aprs_me_always_use_https" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
setting_id = "always_use_https"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_settings_override" "gridmap_org" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
resource "cloudflare_zone_setting" "aprs_me_tls_1_3" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
setting_id = "tls_1_3"
|
||||
value = "zrt"
|
||||
}
|
||||
|
||||
settings {
|
||||
min_tls_version = "1.2"
|
||||
always_use_https = "on"
|
||||
tls_1_3 = "zrt"
|
||||
zero_rtt = "on"
|
||||
ssl = "strict"
|
||||
resource "cloudflare_zone_setting" "aprs_me_zero_rtt" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
setting_id = "zero_rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
security_header {
|
||||
resource "cloudflare_zone_setting" "aprs_me_ssl" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
setting_id = "ssl"
|
||||
value = "strict"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "aprs_me_security_header" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
setting_id = "security_header"
|
||||
value = jsonencode({
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
include_subdomains = true
|
||||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
# towerops.net
|
||||
resource "cloudflare_zone_setting" "towerops_net_min_tls_version" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
setting_id = "min_tls_version"
|
||||
value = "1.2"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "towerops_net_always_use_https" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
setting_id = "always_use_https"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "towerops_net_tls_1_3" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
setting_id = "tls_1_3"
|
||||
value = "zrt"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "towerops_net_zero_rtt" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
setting_id = "zero_rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "towerops_net_ssl" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
setting_id = "ssl"
|
||||
value = "full"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "towerops_net_security_header" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
setting_id = "security_header"
|
||||
value = jsonencode({
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
include_subdomains = true
|
||||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
# gridmap.org
|
||||
resource "cloudflare_zone_setting" "gridmap_org_min_tls_version" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
setting_id = "min_tls_version"
|
||||
value = "1.2"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "gridmap_org_always_use_https" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
setting_id = "always_use_https"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "gridmap_org_tls_1_3" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
setting_id = "tls_1_3"
|
||||
value = "zrt"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "gridmap_org_zero_rtt" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
setting_id = "zero_rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "gridmap_org_ssl" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
setting_id = "ssl"
|
||||
value = "strict"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "gridmap_org_security_header" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
setting_id = "security_header"
|
||||
value = jsonencode({
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
include_subdomains = true
|
||||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
})
|
||||
}
|
||||
# =============================================================================
|
||||
# Firewall - custom rules (applied to all zones)
|
||||
|
|
@ -434,7 +514,7 @@ locals {
|
|||
"(http.request.uri.path contains \"/.git\")",
|
||||
"(http.request.uri.path contains \"/phpmyadmin\")",
|
||||
"(http.request.uri.path contains \"/cgi-bin\")",
|
||||
"(not http.user_agent ne \"\")",
|
||||
"(not http.request.user_agent exists)",
|
||||
])
|
||||
}
|
||||
|
||||
|
|
@ -463,21 +543,21 @@ resource "cloudflare_ruleset" "towerops_response_headers" {
|
|||
kind = "zone"
|
||||
phase = "http_response_headers_transform"
|
||||
|
||||
rules {
|
||||
rules = [{
|
||||
action = "rewrite"
|
||||
action_parameters {
|
||||
headers {
|
||||
name = "Content-Security-Policy"
|
||||
operation = "set"
|
||||
value = local.towerops_csp
|
||||
action_parameters = {
|
||||
headers = {
|
||||
"Content-Security-Policy" = {
|
||||
operation = "set"
|
||||
value = local.towerops_csp
|
||||
}
|
||||
}
|
||||
}
|
||||
expression = "true"
|
||||
description = "set CSP for towerops.net"
|
||||
enabled = true
|
||||
}
|
||||
}]
|
||||
}
|
||||
|
||||
import {
|
||||
to = cloudflare_ruleset.towerops_firewall
|
||||
id = "zone/${local.cloudflare_zones["towerops.net"]}/3c209e50f21b40388733a7cfe8f62f4e"
|
||||
|
|
@ -490,27 +570,26 @@ resource "cloudflare_ruleset" "towerops_firewall" {
|
|||
phase = "http_request_firewall_custom"
|
||||
|
||||
# Allow agent WebSocket connections (must come before block rules)
|
||||
rules {
|
||||
rules = [{
|
||||
action = "skip"
|
||||
action_parameters {
|
||||
action_parameters = {
|
||||
ruleset = "current"
|
||||
}
|
||||
expression = "(http.request.uri.path eq \"/socket/agent/websocket\")"
|
||||
description = "allow agent websocket connections"
|
||||
enabled = true
|
||||
logging {
|
||||
logging = {
|
||||
enabled = false
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
rules {
|
||||
{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
}
|
||||
}]
|
||||
}
|
||||
|
||||
import {
|
||||
to = cloudflare_ruleset.gridmap_firewall
|
||||
id = "zone/${local.cloudflare_zones["gridmap.org"]}/7dfc79c24a22439ea501865479822df8"
|
||||
|
|
@ -522,28 +601,26 @@ resource "cloudflare_ruleset" "gridmap_firewall" {
|
|||
kind = "zone"
|
||||
phase = "http_request_firewall_custom"
|
||||
|
||||
rules {
|
||||
rules = [{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
}
|
||||
}]
|
||||
}
|
||||
|
||||
resource "cloudflare_ruleset" "aprs_me_firewall" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
name = "default"
|
||||
kind = "zone"
|
||||
phase = "http_request_firewall_custom"
|
||||
|
||||
rules {
|
||||
rules = [{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
}
|
||||
}]
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# Tunnel Configs
|
||||
#
|
||||
|
|
@ -561,14 +638,16 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "birdnet" {
|
|||
account_id = local.cloudflare_account_id
|
||||
tunnel_id = "bd9fe980-86d1-4b62-8a35-65ed529696f1"
|
||||
|
||||
config {
|
||||
ingress_rule {
|
||||
hostname = "bird.w5isp.com"
|
||||
service = "http://localhost:80"
|
||||
}
|
||||
ingress_rule {
|
||||
service = "http_status:404"
|
||||
}
|
||||
config = {
|
||||
ingress = [
|
||||
{
|
||||
hostname = "bird.w5isp.com"
|
||||
service = "http://localhost:80"
|
||||
},
|
||||
{
|
||||
service = "http_status:404"
|
||||
},
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -581,30 +660,32 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops" {
|
|||
account_id = local.cloudflare_account_id
|
||||
tunnel_id = "d3d819ba-925c-4d84-8052-68ed32b686bb"
|
||||
|
||||
config {
|
||||
ingress_rule {
|
||||
hostname = "aprs.me"
|
||||
service = "http://aprs.aprs.svc.cluster.local:4000"
|
||||
}
|
||||
ingress_rule {
|
||||
hostname = "gridmap.org"
|
||||
service = "http://gridmap.gridmap.svc.cluster.local:4000"
|
||||
}
|
||||
ingress_rule {
|
||||
hostname = "towerops.net"
|
||||
service = "http://towerops.towerops.svc.cluster.local:4000"
|
||||
}
|
||||
ingress_rule {
|
||||
hostname = "prop.w5isp.com"
|
||||
service = "http://prop.prop.svc.cluster.local:5000"
|
||||
}
|
||||
ingress_rule {
|
||||
hostname = "argo.w5isp.com"
|
||||
service = "http://argocd-server.argocd.svc.cluster.local:80"
|
||||
}
|
||||
ingress_rule {
|
||||
service = "http_status:404"
|
||||
}
|
||||
config = {
|
||||
ingress = [
|
||||
{
|
||||
hostname = "aprs.me"
|
||||
service = "http://aprs.aprs.svc.cluster.local:4000"
|
||||
},
|
||||
{
|
||||
hostname = "gridmap.org"
|
||||
service = "http://gridmap.gridmap.svc.cluster.local:4000"
|
||||
},
|
||||
{
|
||||
hostname = "towerops.net"
|
||||
service = "http://towerops.towerops.svc.cluster.local:4000"
|
||||
},
|
||||
{
|
||||
hostname = "prop.w5isp.com"
|
||||
service = "http://prop.prop.svc.cluster.local:5000"
|
||||
},
|
||||
{
|
||||
hostname = "argo.w5isp.com"
|
||||
service = "http://argocd-server.argocd.svc.cluster.local:80"
|
||||
},
|
||||
{
|
||||
service = "http_status:404"
|
||||
},
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -618,15 +699,17 @@ import {
|
|||
# =============================================================================
|
||||
|
||||
resource "cloudflare_zone" "w5isp_com" {
|
||||
account_id = local.cloudflare_account_id
|
||||
zone = "w5isp.com"
|
||||
account = {
|
||||
id = local.cloudflare_account_id
|
||||
}
|
||||
name = "w5isp.com"
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - A records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_root" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_root" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "w5isp.com"
|
||||
|
|
@ -635,7 +718,7 @@ resource "cloudflare_record" "w5isp_a_root" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_home" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_home" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "home"
|
||||
|
|
@ -644,7 +727,7 @@ resource "cloudflare_record" "w5isp_a_home" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_photos" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_photos" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "photos"
|
||||
|
|
@ -653,7 +736,7 @@ resource "cloudflare_record" "w5isp_a_photos" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_skippy" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_skippy" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "skippy"
|
||||
|
|
@ -662,7 +745,7 @@ resource "cloudflare_record" "w5isp_a_skippy" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_mail" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_mail" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "mail"
|
||||
|
|
@ -671,7 +754,7 @@ resource "cloudflare_record" "w5isp_a_mail" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_dokku" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_dokku" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "dokku"
|
||||
|
|
@ -680,7 +763,7 @@ resource "cloudflare_record" "w5isp_a_dokku" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_feedback" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_feedback" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "feedback"
|
||||
|
|
@ -689,7 +772,7 @@ resource "cloudflare_record" "w5isp_a_feedback" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_vm1" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_vm1" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "vm1"
|
||||
|
|
@ -698,7 +781,7 @@ resource "cloudflare_record" "w5isp_a_vm1" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_log" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_log" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "log"
|
||||
|
|
@ -707,7 +790,7 @@ resource "cloudflare_record" "w5isp_a_log" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_vaprs" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_vaprs" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "vaprs"
|
||||
|
|
@ -716,7 +799,7 @@ resource "cloudflare_record" "w5isp_a_vaprs" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_srtm" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_srtm" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "srtm"
|
||||
|
|
@ -725,7 +808,7 @@ resource "cloudflare_record" "w5isp_a_srtm" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_aprs" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_aprs" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "aprs"
|
||||
|
|
@ -734,7 +817,7 @@ resource "cloudflare_record" "w5isp_a_aprs" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_a_a" {
|
||||
resource "cloudflare_dns_record" "w5isp_a_a" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "A"
|
||||
name = "a"
|
||||
|
|
@ -743,36 +826,39 @@ resource "cloudflare_record" "w5isp_a_a" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_prop" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_prop" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "prop"
|
||||
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
||||
proxied = true
|
||||
ttl = 1
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_argo" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_argo" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "argo"
|
||||
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
||||
proxied = true
|
||||
ttl = 1
|
||||
}
|
||||
|
||||
# birdnet host (10.0.17.29) - BirdNET web UI via its own cloudflared tunnel
|
||||
resource "cloudflare_record" "w5isp_cname_bird" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_bird" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "bird"
|
||||
content = "bd9fe980-86d1-4b62-8a35-65ed529696f1.cfargotunnel.com"
|
||||
proxied = true
|
||||
ttl = 1
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - MX records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_mx_root" {
|
||||
resource "cloudflare_dns_record" "w5isp_mx_root" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "MX"
|
||||
name = "w5isp.com"
|
||||
|
|
@ -785,7 +871,7 @@ resource "cloudflare_record" "w5isp_mx_root" {
|
|||
# w5isp.com - CNAME records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_autodiscover" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_autodiscover" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "autodiscover"
|
||||
|
|
@ -794,7 +880,7 @@ resource "cloudflare_record" "w5isp_cname_autodiscover" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_autoconfig" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_autoconfig" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "autoconfig"
|
||||
|
|
@ -803,7 +889,7 @@ resource "cloudflare_record" "w5isp_cname_autoconfig" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_em40" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_em40" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "em40"
|
||||
|
|
@ -812,7 +898,7 @@ resource "cloudflare_record" "w5isp_cname_em40" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_dkim_s1" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_dkim_s1" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "s1._domainkey"
|
||||
|
|
@ -821,7 +907,7 @@ resource "cloudflare_record" "w5isp_cname_dkim_s1" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_dkim_s2" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_dkim_s2" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "s2._domainkey"
|
||||
|
|
@ -830,7 +916,7 @@ resource "cloudflare_record" "w5isp_cname_dkim_s2" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_uptime" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_uptime" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "uptime"
|
||||
|
|
@ -839,7 +925,7 @@ resource "cloudflare_record" "w5isp_cname_uptime" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_em977211" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_em977211" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "em977211"
|
||||
|
|
@ -848,7 +934,7 @@ resource "cloudflare_record" "w5isp_cname_em977211" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_dkim_s977211" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_dkim_s977211" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "s977211._domainkey"
|
||||
|
|
@ -857,7 +943,7 @@ resource "cloudflare_record" "w5isp_cname_dkim_s977211" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_link" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_link" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "link"
|
||||
|
|
@ -866,7 +952,7 @@ resource "cloudflare_record" "w5isp_cname_link" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_ha" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_ha" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "ha"
|
||||
|
|
@ -875,7 +961,7 @@ resource "cloudflare_record" "w5isp_cname_ha" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_cname_acme_ha" {
|
||||
resource "cloudflare_dns_record" "w5isp_cname_acme_ha" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "CNAME"
|
||||
name = "_acme-challenge.ha"
|
||||
|
|
@ -888,7 +974,7 @@ resource "cloudflare_record" "w5isp_cname_acme_ha" {
|
|||
# w5isp.com - TXT records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_txt_spf" {
|
||||
resource "cloudflare_dns_record" "w5isp_txt_spf" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "TXT"
|
||||
name = "w5isp.com"
|
||||
|
|
@ -896,7 +982,7 @@ resource "cloudflare_record" "w5isp_txt_spf" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_txt_dkim" {
|
||||
resource "cloudflare_dns_record" "w5isp_txt_dkim" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "TXT"
|
||||
name = "dkim._domainkey"
|
||||
|
|
@ -904,7 +990,7 @@ resource "cloudflare_record" "w5isp_txt_dkim" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_txt_dmarc" {
|
||||
resource "cloudflare_dns_record" "w5isp_txt_dmarc" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "TXT"
|
||||
name = "_dmarc"
|
||||
|
|
@ -912,7 +998,7 @@ resource "cloudflare_record" "w5isp_txt_dmarc" {
|
|||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "w5isp_txt_yahoo_verification" {
|
||||
resource "cloudflare_dns_record" "w5isp_txt_yahoo_verification" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "TXT"
|
||||
name = "w5isp.com"
|
||||
|
|
@ -924,42 +1010,66 @@ resource "cloudflare_record" "w5isp_txt_yahoo_verification" {
|
|||
# w5isp.com - SRV records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_srv_autodiscover" {
|
||||
resource "cloudflare_dns_record" "w5isp_srv_autodiscover" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
type = "SRV"
|
||||
name = "_autodiscover._tcp"
|
||||
ttl = 86400
|
||||
|
||||
data {
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.w5isp.com"
|
||||
}
|
||||
data = {
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.w5isp.com"
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - Zone settings
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_zone_settings_override" "w5isp_com" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
resource "cloudflare_zone_setting" "w5isp_com_min_tls_version" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
setting_id = "min_tls_version"
|
||||
value = "1.2"
|
||||
}
|
||||
|
||||
settings {
|
||||
min_tls_version = "1.2"
|
||||
always_use_https = "on"
|
||||
tls_1_3 = "zrt"
|
||||
zero_rtt = "on"
|
||||
ssl = "full"
|
||||
resource "cloudflare_zone_setting" "w5isp_com_always_use_https" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
setting_id = "always_use_https"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
security_header {
|
||||
resource "cloudflare_zone_setting" "w5isp_com_tls_1_3" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
setting_id = "tls_1_3"
|
||||
value = "zrt"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "w5isp_com_zero_rtt" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
setting_id = "zero_rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "w5isp_com_ssl" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
setting_id = "ssl"
|
||||
value = "full"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "w5isp_com_security_header" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
setting_id = "security_header"
|
||||
value = jsonencode({
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
include_subdomains = true
|
||||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -975,32 +1085,31 @@ resource "cloudflare_ruleset" "w5isp_firewall" {
|
|||
# BirdNET-Pi (bird.w5isp.com) legitimately serves .php pages (e.g. views.php
|
||||
# loaded in an iframe), which the abuser block rule below would otherwise
|
||||
# catch. Skip the custom ruleset for that host. Must precede the block rule.
|
||||
rules {
|
||||
rules = [{
|
||||
action = "skip"
|
||||
action_parameters {
|
||||
action_parameters = {
|
||||
ruleset = "current"
|
||||
}
|
||||
expression = "(http.host eq \"bird.w5isp.com\")"
|
||||
description = "skip WAF for birdnet UI"
|
||||
enabled = true
|
||||
logging {
|
||||
logging = {
|
||||
enabled = false
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
rules {
|
||||
{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
}
|
||||
}]
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# w5isp.com - CAA records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_record" "w5isp_caa" {
|
||||
resource "cloudflare_dns_record" "w5isp_caa" {
|
||||
for_each = toset(local.cloudflare_cas)
|
||||
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
|
|
@ -1008,24 +1117,26 @@ resource "cloudflare_record" "w5isp_caa" {
|
|||
name = "w5isp.com"
|
||||
ttl = 86400
|
||||
|
||||
data {
|
||||
flags = "0"
|
||||
tag = "issue"
|
||||
value = each.value
|
||||
}
|
||||
data = {
|
||||
flags = 0
|
||||
tag = "issue"
|
||||
value = each.value
|
||||
}
|
||||
}
|
||||
|
||||
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
|
||||
account_id = local.cloudflare_account_id
|
||||
tunnel_id = "db59aa44-79de-4522-9593-43e828f3215a"
|
||||
|
||||
config {
|
||||
ingress_rule {
|
||||
hostname = "dev.towerops.net"
|
||||
service = "http://localhost:4000"
|
||||
}
|
||||
ingress_rule {
|
||||
service = "http_status:404"
|
||||
}
|
||||
config = {
|
||||
ingress = [
|
||||
{
|
||||
hostname = "dev.towerops.net"
|
||||
service = "http://localhost:4000"
|
||||
},
|
||||
{
|
||||
service = "http_status:404"
|
||||
},
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue