From 78d0ae179d9cd1cd013b6940a8f7348e46ca3ef8 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Thu, 4 Jun 2026 14:58:09 -0500 Subject: [PATCH] fix: resolve talos config issues, Cloudflare v5 migration, and security cleanup - Remove sensitive files from git tracking (kubeconfig, secrets.yaml.backup, talosconfig.backup) and update .gitignore - Fix installer version drift: v1.12.4 -> v1.12.6 across all talos configs - Fix grubUseUKICmdline + extraKernelArgs conflict on CP configs - Remove tailscale extension from stock installer CP configs (won't work) - Add nameservers to controlplane and per-node configs - Add time servers to all per-node worker configs - Fix HostnameConfig auto: stable in base templates - Clean up doc drift (README.md, CLAUDE.md) for worker count and storage - Remove all Longhorn references (worker configs, documentation) - Migrate Cloudflare provider v4 -> v5 with full resource refactoring: cloudflare_record -> cloudflare_dns_record, zone_settings_override -> zone_setting, block -> attribute syntax for rulesets, data, and tunnel configs - Fix firewall expression (not http.user_agent ne '' -> not exists) --- CLAUDE.md | 17 +- findings.md | 74 +++-- talos/.gitignore | 7 + talos/CLAUDE.md | 10 +- talos/README.md | 22 +- talos/configs/talos-cp1.yaml | 20 +- talos/configs/talos-cp2.yaml | 20 +- talos/configs/talos-cp3.yaml | 20 +- talos/configs/talos-worker1.yaml | 23 +- talos/configs/talos-worker2.yaml | 29 +- talos/configs/talos-worker3.yaml | 23 +- talos/configs/talos-worker4.yaml | 26 +- talos/configs/talos-worker5.yaml | 26 +- talos/controlplane.yaml | 12 +- talos/kubeconfig | 19 -- talos/secrets.yaml.backup | 23 -- talos/talosconfig.backup | 12 - talos/worker.yaml | 21 +- tofu/.terraform.lock.hcl | 50 ++- tofu/cloudflare.tf | 505 +++++++++++++++++++------------ 20 files changed, 461 insertions(+), 498 deletions(-) delete mode 100644 talos/kubeconfig delete mode 100644 talos/secrets.yaml.backup delete mode 100644 talos/talosconfig.backup diff --git a/CLAUDE.md b/CLAUDE.md index 42cdb64..73e545f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -28,7 +28,7 @@ ansible-playbook playbook.yml --tags provision,bind9 # - Storage: local-lvm (for BIND9 and general infrastructure VMs) # - Network: vmbr0 # -# Note: Talos nodes use a different template and Longhorn for persistent storage +# Note: Talos nodes use a different template (Talos Linux) and do not use Longhorn ``` ### Ansible Operations @@ -166,18 +166,15 @@ tofu plan - **Cluster Name**: home-cluster - **Kubernetes Version**: v1.35.0 - **Control Plane Nodes**: 3 (10.0.15.1-3) -- **Worker Nodes**: 3 (10.0.15.4-6) +- **Worker Nodes**: 4 (10.0.15.4-7, incl. bare-metal talos4) - **API Endpoint**: https://10.0.15.1:6443 - **Proxmox Cluster**: "home" (node1, node2, node3 at 10.0.15.101-103) -- **VM Disks**: Proxmox Ceph for VM boot disks -- **Persistent Storage**: Longhorn on passthrough NVMe drives (`/dev/sdb` on each worker, mounted at `/var/mnt/longhorn`) - - Worker1: 2TB, Worker2: 2TB, Worker3: 1TB - - `longhorn` StorageClass is the default - - `longhorn-system` namespace requires privileged PodSecurity policy +- **VM Disks**: local-lvm on each Proxmox node +- **Persistent Storage**: TBD (Longhorn was removed β€” evaluating alternatives) - **CNI**: Flannel - **Talos Extensions** (workers only): - - `iscsi-tools` v0.2.0 β€” required by Longhorn - - `util-linux-tools` 2.41.2 β€” required by Longhorn + - `iscsi-tools` v0.2.0 + - `util-linux-tools` 2.41.2 - Installer image: `factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6` - Control plane nodes use the stock `ghcr.io/siderolabs/installer:v1.12.6` - **Deployment**: Managed via OpenTofu in `/tofu/` @@ -237,7 +234,7 @@ tofu plan 1. App repos contain their own k8s manifests in `./k8s/` 2. ArgoCD `Application` in `home/cluster/argocd/apps/.yaml` points at the repo 3. Push the app repo β†’ Argo auto-syncs (when `automated.selfHeal=true` is set) -4. Use Longhorn for persistent volumes (default StorageClass) +4. Use a CSI storage driver for persistent volumes (set default StorageClass) 5. Use ClusterIP services + Cloudflare tunnel for external access ### Common Issues & Solutions diff --git a/findings.md b/findings.md index 473d52b..cd46dd4 100644 --- a/findings.md +++ b/findings.md @@ -81,17 +81,13 @@ - **Issue**: CP configs specify `install.extensions` but use the **stock** installer image (`ghcr.io/siderolabs/installer`). Extensions require a **custom/factory** installer image (like the worker configs use: `factory.talos.dev/installer/`). The stock installer does NOT support extensions. Result: tailscale extension binary is never installed, `ExtensionServiceConfig` for tailscale silently fails. - **Fix**: Either switch CP nodes to use the factory installer image (bundling tailscale into the schematic), or remove the tailscale extension config from CP nodes. -### C-4: Longhorn disk configs missing on workers 2 and 3 -- **Files**: `talos/configs/talos-worker2.yaml` (lines 34-41, 89-92), `talos/configs/talos-worker3.yaml` (same) -- **Severity**: 🟠 HIGH -- **Issue**: Workers 2 and 3 have NVMe passthrough disks (`/dev/sdb`) for Longhorn per CLAUDE.md, but the `extraMounts` and `disks` sections are **commented out** in both configs. Worker1 (no NVMe) correctly has them disabled, but workers 2 and 3 appear to have been incorrectly commented out during the same fix pass. Longhorn effectively has no dedicated storage in the cluster. -- **Fix**: Uncomment `extraMounts` and `disks` sections in `talos-worker2.yaml` and `talos-worker3.yaml`. - -### C-5: All per-node worker configs lack `/dev/sdb` disk config +### ~~C-4: Longhorn disk configs missing on workers 2 and 3~~ βœ… RESOLVED - **Files**: `talos/configs/talos-worker{1,2,3,4,5}.yaml` -- **Severity**: 🟠 HIGH -- **Issue**: ALL per-node worker configs have `extraMounts` and `disks` commented out. The base `worker.yaml` template has them active. Since per-node configs are what gets applied, no worker has the Longhorn bind mount configured. The base template and per-node configs have drifted apart. -- **Fix**: Enable for workers 2-3 (have NVMe). Keep disabled for worker1 (no NVMe). Clarify for workers 4-5. +- **Severity**: 🟠 HIGH β†’ βœ… +- **Issue**: Longhorn has been removed from the cluster. All Longhorn disk configs (`extraMounts`, `disks`, installer image comments) removed from worker configs and documentation. + +### ~~C-5: All per-node worker configs lack `/dev/sdb` disk config~~ βœ… RESOLVED +- **Same as C-4** β€” all Longhorn disk references removed. ### C-6: Suspect firewall expression `(not http.user_agent ne "")` - **File**: `tofu/cloudflare.tf:437` @@ -245,42 +241,56 @@ | Severity | Count | |----------|-------| | πŸ”΄ CRITICAL | 6 | -| 🟠 HIGH | 6 | +| 🟠 HIGH | 4 | | 🟑 MEDIUM | 11 | | πŸ”΅ LOW | 10 | -| **Total** | **33** | +| **Total** | **31** | **Top 5 priorities:** 1. Remove sensitive files from git (kubeconfig, secrets backup, talosconfig backup, per-node configs with PKI) β€” S-1, S-2, S-3, S-6 2. Rotate exposed Tailscale pre-auth keys β€” S-4 3. Fix CP configs: either remove tailscale extension or switch to factory installer β€” C-3 4. Fix `grubUseUKICmdline` + `extraKernelArgs` conflict on CPs β€” C-2 -5. Uncomment Longhorn disk config on workers 2-3 and resolve installer version drift β€” C-1, C-4, C-5 +5. Resolve installer version drift across Talos configs (v1.12.4 β†’ v1.12.6) β€” C-1 --- ## βœ… Fixes Applied (2026-06-04) -### S-5: State file removed from git tracking -- Created `tofu/.gitignore` with `*.tfstate`, `*.tfstate.*`, `.terraform/`, `tfplan`, `.envrc`, `.claude/` -- Ran `git rm --cached tofu/terraform.tfstate` β€” stops tracking but keeps local copy -- Backup state files (`*tfstate*.backup`, `*tfstate.*.backup`) now covered by `*.tfstate.*` pattern +### Security +- **S-1, S-2, S-3**: Removed `talos/kubeconfig`, `talos/secrets.yaml.backup`, `talos/talosconfig.backup` from git tracking via `git rm --cached` +- **S-5**: Created `tofu/.gitignore`, removed `tofu/terraform.tfstate` from tracking +- Updated `talos/.gitignore` with `*.backup`, `kubeconfig`, `secrets.yaml.backup`, `talosconfig.backup` -### D-8: Porkbun provider upgraded to latest -- **Before**: v1.3.1 | **After**: v1.3.3 -- Via `tofu init -upgrade` (within existing `~> 1.3` constraint) -- Lock file updated accordingly +### Talos Config Fixes (background task) +- **C-1**: Installer version drift resolved (all configs β†’ v1.12.6) +- **C-2**: `grubUseUKICmdline` + `extraKernelArgs` conflict resolved on CPs +- **C-3**: Tailscale extension removed from stock installer CP configs +- **D-2/D-3**: Nameservers added to controlplane.yaml and per-node configs +- **D-4**: HostnameConfig `auto: stable` removed from base templates +- **D-5**: Time servers added to all per-node worker configs +- **D-7**: README.md updated (worker count 4, local-lvm, versions corrected) +- **E-5**: Orphaned worker4/5 configs documented +- Root CLAUDE.md: Longhorn removed, worker count corrected, Cephβ†’local-lvm fixed -### D-8: Cloudflare provider upgraded to latest v4.x -- **Before**: v4.52.5 | **After**: v4.52.7 -- Via `tofu init -upgrade` (within existing `~> 4.0` constraint) -- Lock file updated accordingly +### Longhorn Removal +- `talos/worker.yaml`: Removed active `extraMounts` and `disks` blocks +- `talos/configs/talos-worker*.yaml`: Removed commented-out Longhorn blocks +- All documentation cleaned up (CLAUDE.md, README.md, root CLAUDE.md) -### E-1, E-2, E-3: Local backup files cleaned up -- Removed `tofu/terraform.tfstate.backup` -- Removed `tofu/terraform.tfstate.*.backup` (3 stale backups) -- Removed `tofu/tfplan` -- `.gitignore` prevents future accumulation +### Provider Upgrades +- **Porkbun**: v1.3.1 β†’ v1.3.3 (via `tofu init -upgrade`) +- **Cloudflare**: v4.52.5 β†’ v5.19.1 (full v5 migration): + - `main.tf`: Bumped constraint to `~> 5.0` + - `cloudflare_zone`: Renamed `zone` β†’ `name`, `account_id` β†’ `account = { id = ... }` + - `cloudflare_record` β†’ `cloudflare_dns_record` (50+ resources + imports) + - Replaced 4x `cloudflare_zone_settings_override` with 24x `cloudflare_zone_setting` + - Converted ALL `cloudflare_ruleset` blocks β†’ attribute syntax (`rules = [...]`) + - Converted DNS `data {}` blocks β†’ attribute syntax (`data = {}`) + - Added `ttl = 1` to proxied records (required in v5) + - Tunnel config blocks β†’ attribute syntax (`config = { ingress = [...] }`) -### Notes -- **Cloudflare v5.x** not yet migrated β€” requires splitting 4x `cloudflare_zone_settings_override` into ~16 individual `cloudflare_zone_setting` resources + renaming `zone` β†’ `name` on `cloudflare_zone`. Non-trivial. Pending decision. +### Other Fixes +- **C-6**: Fixed suspect firewall expression `(not http.user_agent ne "")` β†’ `(not http.request.user_agent exists)` +- **E-1/2/3**: Created `tofu/.gitignore`, cleaned up backup files and tfplan +- Root CLAUDE.md: Updated Talos notes (storage, worker count, Longhorn references) diff --git a/talos/.gitignore b/talos/.gitignore index f6a6509..4488a57 100644 --- a/talos/.gitignore +++ b/talos/.gitignore @@ -1,7 +1,14 @@ # Talos secrets and sensitive files secrets.yaml +secrets.yaml.backup talosconfig +talosconfig.backup +kubeconfig + +# Per-node configs contain full cluster PKI β€” track with care +# Consider externalizing secrets from these files # Temporary files *.tmp *.bak +*.backup diff --git a/talos/CLAUDE.md b/talos/CLAUDE.md index c14fd9e..b1f1371 100644 --- a/talos/CLAUDE.md +++ b/talos/CLAUDE.md @@ -254,16 +254,12 @@ kubectl get nodes ssh root@ "qm start " # Wait for DHCP, then apply config: talosctl --talosconfig talosconfig apply-config --nodes --file configs/.yaml --insecure - # Then upgrade to the factory image with extensions: + # Then upgrade to the factory image with extensions (iscsi-tools, util-linux-tools): talosctl --talosconfig talosconfig --nodes upgrade --image factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 ``` **Critical VM settings**: `cpu: host` is required β€” without it, Talos boots but never gets a network address. Also set `balloon: 0`, `firewall=0` on NIC. -7. **Disk Dependencies Block Boot**: If a worker config references `/dev/sdb` for Longhorn but the Proxmox node has no passthrough NVMe disk, the `UserDiskConfigController` errors will prevent CRI and kubelet from starting. Comment out the `disks:` and `extraMounts:` sections for nodes without the extra disk. - -8. **Node1 Has No NVMe**: node1 (10.0.15.101) only has a single 238GB SSD. No NVMe passthrough disk is available for Longhorn storage on talos-worker1. - -9. **Bare-Metal Install Disk Enumeration**: On bare-metal nodes booted from a Talos USB, the USB enumerates as `/dev/sda` and the internal drive as `/dev/sdb`. Set `machine.install.disk: /dev/sdb` in the config so Talos installs to the internal drive. After install, when the USB is removed, the internal drive becomes `/dev/sda` in the running system β€” this is expected and does not require reconfiguration. Example: talos4 (HP t620 with 128GB SK hynix M.2 SATA) was installed this way. +7. **Bare-Metal Install Disk Enumeration**: On bare-metal nodes booted from a Talos USB, the USB enumerates as `/dev/sda` and the internal drive as `/dev/sdb`. Set `machine.install.disk: /dev/sdb` in the config so Talos installs to the internal drive. After install, when the USB is removed, the internal drive becomes `/dev/sda` in the running system β€” this is expected and does not require reconfiguration. Example: talos4 (HP t620 with 128GB SK hynix M.2 SATA) was installed this way. ## Troubleshooting @@ -298,8 +294,6 @@ talosctl --talosconfig talosconfig service --nodes 10.0.15.1 ## Storage - **VM boot disks**: local-lvm on each Proxmox node (no ceph storage available) -- **Longhorn**: Workers 2 and 3 have passthrough NVMe disks (`/dev/sdb`) for Longhorn persistent storage. Worker 1 (node1) has no NVMe disk. -- **Longhorn StorageClass**: `longhorn` (default) ## Maintenance diff --git a/talos/README.md b/talos/README.md index fe27474..7495079 100644 --- a/talos/README.md +++ b/talos/README.md @@ -5,7 +5,8 @@ - **Cluster Name**: home-cluster - **Kubernetes Version**: v1.35.0 - **Control Plane Nodes**: 3 (10.0.15.1-3) -- **Worker Nodes**: 3 (10.0.15.4-6) +- **Worker Nodes**: 4 (10.0.15.4-7) +- **Bare Metal Worker**: talos4 at 10.0.15.7 (HP t620) - **API Endpoint**: https://10.0.15.1:6443 ## Node Details @@ -18,6 +19,7 @@ | talos-worker1 | Worker | 10.0.15.4 | node1 | 210 | | talos-worker2 | Worker | 10.0.15.5 | node2 | 211 | | talos-worker3 | Worker | 10.0.15.6 | node3 | 212 | +| talos4 | Worker | 10.0.15.7 | bare-metal (HP t620) | β€” | ## Configuration Files @@ -44,7 +46,7 @@ talosctl --talosconfig talosconfig logs -f kubelet talosctl --talosconfig talosconfig service # Upgrade Talos (example) -talosctl --talosconfig talosconfig upgrade --image ghcr.io/siderolabs/installer:v1.9.5 +talosctl --talosconfig talosconfig upgrade --image ghcr.io/siderolabs/installer:v1.12.6 ``` ### Kubectl Commands @@ -64,18 +66,7 @@ kubectl cluster-info ## Storage Configuration -This cluster uses Proxmox Ceph storage for VM disks. For Kubernetes persistent storage, you'll need to deploy a storage solution: - -### Option 1: Ceph CSI (Direct Proxmox Ceph) -See CLAUDE.md for Ceph CSI setup instructions to use Proxmox Ceph directly. - -### Option 2: Longhorn -```bash -kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.2/deploy/longhorn.yaml -``` - -### Option 3: Rook-Ceph -Deploy a separate Ceph cluster inside Kubernetes using Rook. +VM boot disks are stored on local-lvm on each Proxmox node (no shared Ceph storage). For Kubernetes persistent storage, deploy a CSI provisioner (e.g. Rook-Ceph, OpenEBS, or cloud provider CSI). ## Networking @@ -109,7 +100,7 @@ talosctl --talosconfig talosconfig reset --nodes ### Upgrading Kubernetes ```bash -talosctl --talosconfig talosconfig upgrade-k8s --to 1.36.0 +talosctl --talosconfig talosconfig upgrade-k8s --to 1.35.0 ``` ## Troubleshooting @@ -141,6 +132,7 @@ talosctl --talosconfig talosconfig reboot --nodes Important files to backup: - `secrets.yaml` - Required to add nodes or recover cluster - `talosconfig` - Required for talosctl access +- Node configs in `configs/` directory - Kubeconfig is stored in `~/.kube/config` Store these securely in a password manager or encrypted backup. diff --git a/talos/configs/talos-cp1.yaml b/talos/configs/talos-cp1.yaml index d15e0b9..47e2570 100644 --- a/talos/configs/talos-cp1.yaml +++ b/talos/configs/talos-cp1.yaml @@ -20,7 +20,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -70,6 +70,10 @@ machine: # - fdc7::/16 # Provides machine specific network configuration options. network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: @@ -77,13 +81,10 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.12.4 # Allows for supplying the image used to perform the installation. - extensions: - - image: ghcr.io/siderolabs/tailscale:1.82.1 + image: ghcr.io/siderolabs/installer:v1.12.6 # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - extraKernelArgs: - - console=tty0 # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: @@ -404,10 +405,3 @@ apiVersion: v1alpha1 kind: HostnameConfig hostname: talos-cp1 # hostname: controlplane1.example.org ---- -apiVersion: v1alpha1 -kind: ExtensionServiceConfig -name: tailscale # Name of the extension service. -# The environment for the extension service. -environment: - - TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF diff --git a/talos/configs/talos-cp2.yaml b/talos/configs/talos-cp2.yaml index d50decf..a9313ff 100644 --- a/talos/configs/talos-cp2.yaml +++ b/talos/configs/talos-cp2.yaml @@ -20,7 +20,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -70,6 +70,10 @@ machine: # - fdc7::/16 # Provides machine specific network configuration options. network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: @@ -77,13 +81,10 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.12.4 # Allows for supplying the image used to perform the installation. - extensions: - - image: ghcr.io/siderolabs/tailscale:1.82.1 + image: ghcr.io/siderolabs/installer:v1.12.6 # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - extraKernelArgs: - - console=tty0 # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: @@ -404,10 +405,3 @@ apiVersion: v1alpha1 kind: HostnameConfig hostname: talos-cp2 # hostname: controlplane1.example.org ---- -apiVersion: v1alpha1 -kind: ExtensionServiceConfig -name: tailscale # Name of the extension service. -# The environment for the extension service. -environment: - - TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF diff --git a/talos/configs/talos-cp3.yaml b/talos/configs/talos-cp3.yaml index 3153d6e..acbe78b 100644 --- a/talos/configs/talos-cp3.yaml +++ b/talos/configs/talos-cp3.yaml @@ -20,7 +20,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -70,6 +70,10 @@ machine: # - fdc7::/16 # Provides machine specific network configuration options. network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: @@ -77,13 +81,10 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.12.4 # Allows for supplying the image used to perform the installation. - extensions: - - image: ghcr.io/siderolabs/tailscale:1.82.1 + image: ghcr.io/siderolabs/installer:v1.12.6 # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - extraKernelArgs: - - console=tty0 # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: @@ -404,10 +405,3 @@ apiVersion: v1alpha1 kind: HostnameConfig hostname: talos-cp3 # hostname: controlplane1.example.org ---- -apiVersion: v1alpha1 -kind: ExtensionServiceConfig -name: tailscale # Name of the extension service. -# The environment for the extension service. -environment: - - TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF diff --git a/talos/configs/talos-worker1.yaml b/talos/configs/talos-worker1.yaml index bd7e6f4..7e1ad71 100644 --- a/talos/configs/talos-worker1.yaml +++ b/talos/configs/talos-worker1.yaml @@ -20,7 +20,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -31,14 +31,6 @@ machine: # extraArgs: # key: value - # extraMounts: - # - destination: /var/mnt/longhorn - # type: bind - # source: /var/mnt/longhorn - # options: - # - bind - # - rshared - # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: @@ -68,6 +60,10 @@ machine: # - fdc7::/16 # Provides machine specific network configuration options. network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: @@ -75,21 +71,14 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.4 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn. + image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). wipe: false # Indicates if the installation disk should be wiped at installation time. - extraKernelArgs: - - console=tty0 # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Extra disks to configure (Longhorn storage). - # disks: - # - device: /dev/sdb - # partitions: - # - mountpoint: /var/mnt/longhorn registries: {} # Features describe individual Talos features that can be switched on or off. features: diff --git a/talos/configs/talos-worker2.yaml b/talos/configs/talos-worker2.yaml index d914b23..996d739 100644 --- a/talos/configs/talos-worker2.yaml +++ b/talos/configs/talos-worker2.yaml @@ -20,7 +20,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -31,14 +31,6 @@ machine: # extraArgs: # key: value - # extraMounts: - # - destination: /var/mnt/longhorn - # type: bind - # source: /var/mnt/longhorn - # options: - # - bind - # - rshared - # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: @@ -68,6 +60,10 @@ machine: # - fdc7::/16 # Provides machine specific network configuration options. network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: @@ -75,21 +71,14 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.4 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn. + image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). wipe: false # Indicates if the installation disk should be wiped at installation time. - extraKernelArgs: - - console=tty0 # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Extra disks to configure (Longhorn storage). - # disks: - # - device: /dev/sdb - # partitions: - # - mountpoint: /var/mnt/longhorn registries: {} # Features describe individual Talos features that can be switched on or off. features: @@ -439,9 +428,3 @@ apiVersion: v1alpha1 kind: HostnameConfig hostname: talos-worker2 # hostname: controlplane1.example.org ---- -apiVersion: v1alpha1 -kind: ExtensionServiceConfig -name: tailscale -environment: - - TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF diff --git a/talos/configs/talos-worker3.yaml b/talos/configs/talos-worker3.yaml index ab2013c..fd12a10 100644 --- a/talos/configs/talos-worker3.yaml +++ b/talos/configs/talos-worker3.yaml @@ -20,7 +20,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -31,14 +31,6 @@ machine: # extraArgs: # key: value - # extraMounts: - # - destination: /var/mnt/longhorn - # type: bind - # source: /var/mnt/longhorn - # options: - # - bind - # - rshared - # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: @@ -68,6 +60,10 @@ machine: # - fdc7::/16 # Provides machine specific network configuration options. network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: @@ -75,21 +71,14 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.4 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn. + image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). wipe: false # Indicates if the installation disk should be wiped at installation time. - extraKernelArgs: - - console=tty0 # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Extra disks to configure (Longhorn storage). - # disks: - # - device: /dev/sdb - # partitions: - # - mountpoint: /var/mnt/longhorn registries: {} # Features describe individual Talos features that can be switched on or off. features: diff --git a/talos/configs/talos-worker4.yaml b/talos/configs/talos-worker4.yaml index ba5f2f0..77a92af 100644 --- a/talos/configs/talos-worker4.yaml +++ b/talos/configs/talos-worker4.yaml @@ -1,3 +1,6 @@ +# Purpose: Bare-metal worker node (talos4, HP t620, 10.0.15.7) +# Disk: /dev/sdb (USB boot, internal drive after install) +# Installer: factory image with iscsi-tools + util-linux-tools extensions version: v1alpha1 # Indicates the schema used to decode the contents. debug: false # Enable verbose logging to the console. persist: true @@ -20,7 +23,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -31,14 +34,6 @@ machine: # extraArgs: # key: value - # extraMounts: - # - destination: /var/mnt/longhorn - # type: bind - # source: /var/mnt/longhorn - # options: - # - bind - # - rshared - # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: @@ -68,6 +63,10 @@ machine: # - fdc7::/16 # Provides machine specific network configuration options. network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: @@ -75,21 +74,14 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sdb # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn. + image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). wipe: false # Indicates if the installation disk should be wiped at installation time. - extraKernelArgs: - - console=tty0 # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Extra disks to configure (Longhorn storage). - # disks: - # - device: /dev/sdb - # partitions: - # - mountpoint: /var/mnt/longhorn registries: {} # Features describe individual Talos features that can be switched on or off. features: diff --git a/talos/configs/talos-worker5.yaml b/talos/configs/talos-worker5.yaml index b33abca..ed86e78 100644 --- a/talos/configs/talos-worker5.yaml +++ b/talos/configs/talos-worker5.yaml @@ -1,3 +1,6 @@ +# Purpose: Future worker node (talos5, bare-metal, 10.0.15.8 planned) +# Disk: /dev/nvme0n1 (NVMe internal drive) +# Installer: factory image with iscsi-tools + util-linux-tools extensions version: v1alpha1 # Indicates the schema used to decode the contents. debug: false # Enable verbose logging to the console. persist: true @@ -20,7 +23,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -31,14 +34,6 @@ machine: # extraArgs: # key: value - # extraMounts: - # - destination: /var/mnt/longhorn - # type: bind - # source: /var/mnt/longhorn - # options: - # - bind - # - rshared - # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: @@ -68,6 +63,10 @@ machine: # - fdc7::/16 # Provides machine specific network configuration options. network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: @@ -75,21 +74,14 @@ machine: # Used to provide instructions for installations. install: disk: /dev/nvme0n1 # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn. + image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). wipe: false # Indicates if the installation disk should be wiped at installation time. - extraKernelArgs: - - console=tty0 # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Extra disks to configure (Longhorn storage). - # disks: - # - device: /dev/sdb - # partitions: - # - mountpoint: /var/mnt/longhorn registries: {} # Features describe individual Talos features that can be switched on or off. features: diff --git a/talos/controlplane.yaml b/talos/controlplane.yaml index b7ecfec..07f181c 100644 --- a/talos/controlplane.yaml +++ b/talos/controlplane.yaml @@ -20,7 +20,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -69,7 +69,11 @@ machine: # - '!10.0.0.3/32' # - fdc7::/16 # Provides machine specific network configuration options. - network: {} + network: + nameservers: + - 9.9.9.9 + - 149.112.112.112 + - 1.1.1.1 # # Configures KubeSpan feature. # kubespan: # enabled: true # Enable the KubeSpan feature. @@ -77,7 +81,7 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.12.4 # Allows for supplying the image used to perform the installation. + image: ghcr.io/siderolabs/installer:v1.12.6 # Allows for supplying the image used to perform the installation. wipe: false # Indicates if the installation disk should be wiped at installation time. grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. @@ -392,7 +396,7 @@ cluster: --- apiVersion: v1alpha1 kind: HostnameConfig -auto: stable # A method to automatically generate a hostname for the machine. +# auto: stable # Commented out β€” per-node configs use static hostname instead. # # A static hostname to set for the machine. # hostname: controlplane1 diff --git a/talos/kubeconfig b/talos/kubeconfig deleted file mode 100644 index 920162e..0000000 --- a/talos/kubeconfig +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://10.0.15.1:6443 - name: home-cluster -contexts: -- context: - cluster: home-cluster - namespace: default - user: admin@home-cluster - name: admin@home-cluster -current-context: admin@home-cluster -kind: Config -users: -- name: admin@home-cluster - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoVENDQVNxZ0F3SUJBZ0lRTGJBMXhGT0NPa2lkbmhnaCtkb3o5VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV6TVRJeE1Ua3hPRm9YRFRJM01ERXpNVEl4TVRreQpPRm93S1RFWE1CVUdBMVVFQ2hNT2MzbHpkR1Z0T20xaGMzUmxjbk14RGpBTUJnTlZCQU1UQldGa2JXbHVNRmt3CkV3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFa2pCaTRiMXl0aUd4cFpJcDVSQVhtYXlCZDU5SlhqWGsKWllRbWI4b0svL2dDeE4yaHFvUCt4dmM1dC9DVXdtTVZKQkFod2FuRnhHalA3TkplMGNYZ3BLTklNRVl3RGdZRApWUjBQQVFIL0JBUURBZ1dnTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01COEdBMVVkSXdRWU1CYUFGTXhoCnRrWDh2VGxLRjJCeExwalF4SWRkbjcybk1Bb0dDQ3FHU000OUJBTUNBMGtBTUVZQ0lRQ1NJdVZ0VTYzaWowRG0KSU5ML01QZEdjY2t6WTlDMURLUGw4bytObStjVmJRSWhBT2orQnB6NUo1ZThub2pNMXI2aHFnRWlpYjF6Y1ZpSwpuaXVPZjYrNFBPU0cKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVMeHprQzVIMHBLVkxHVU93RmpoaDBPeHdZWFN2R2lIRktIbmF1L09nZllvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa2pCaTRiMXl0aUd4cFpJcDVSQVhtYXlCZDU5SlhqWGtaWVFtYjhvSy8vZ0N4TjJocW9QKwp4dmM1dC9DVXdtTVZKQkFod2FuRnhHalA3TkplMGNYZ3BBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/talos/secrets.yaml.backup b/talos/secrets.yaml.backup deleted file mode 100644 index d42ab85..0000000 --- a/talos/secrets.yaml.backup +++ /dev/null @@ -1,23 +0,0 @@ -cluster: - id: ajFbAfx06GXDzj6aZKEZ7M47wpc_0y4n9f4_NjIpz-c= - secret: eZtUgfkU6glNR7S7O6n5uQBHb/m0pkb3QD9OlSo9cDM= -secrets: - bootstraptoken: fkth11.nmhzlprifn9pe6jl - secretboxencryptionsecret: 83iFqNeoP3fTSwstgBRWidjicy//f71Ui83VVcqI6So= -trustdinfo: - token: 6mvqo9.nn5sbv4fhyifbqjk -certs: - etcd: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmRENDQVNPZ0F3SUJBZ0lRRFV2eGpQbDViSFRSR05KN1VSQ0JzVEFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE1URTNNakF5T1ZvWERUTTJNREV3T1RFM01qQXlPVm93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpWSlhnSGRMbTJFCjFSNmJyZjJ2aG91blBndlpzeVlsZFA5TlMzT0FXaGk1dUczc2JBTi96ZnF1VEtpOUFjQXpuOWNnbHY5MkI3MXkKQXNtMktPcUJXYTJqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVOGpCellJc3RITjA2CjFNSDBsNjFRaXlibnFIa3dDZ1lJS29aSXpqMEVBd0lEUndBd1JBSWdWbDZ0SWw5MlN0YUtKWDhkVnpzKzJiWUgKQi9sTnlPbkx1eGNZTWsvL1lGTUNJQXZWT1ZMckQ4Q3hCMlgyMDREVVpOL0t6KzVZcHFtRy9yUTFiRnBDSkF1NwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVKaktuempHY1ViakNRekpkamF0cFNXUVlacnI2MHg4b1NNeEV3eUhkNUFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbFVsZUFkMHViWVRWSHB1dC9hK0dpNmMrQzltekppVjAvMDFMYzRCYUdMbTRiZXhzQTMvTgorcTVNcUwwQndET2YxeUNXLzNZSHZYSUN5YllvNm9GWnJRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - k8s: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpRENDQVMrZ0F3SUJBZ0lRSFp3TUhKd0ZyblVLTDMrNjltQ2JnVEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV4TVRFM01qQXlPVm9YRFRNMk1ERXdPVEUzTWpBeQpPVm93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCSWxHL0ppOWdEOTh2WEJKZjVWQ05VbkhuTGlIN1F5UWdMbHR0TFgrUElUeWFUaXVzSW5RRGMvUzZ4aysKTFVkSjhrN0t3d0NYUEZ0SDZTTWM0VE12MTZpallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVyRU5ZMllVN3pWb1hoZ1BCb2Rqa1Z2Q2czWWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnV2xxb0ZXTzYKa3RnNEt3NVBtUkhUeVNuUi90cmQzTmQyc0x6WHdCRmFZcUlDSUNobFpCWDBHRGpQTVFjM0xQcG1oR2xpMVpCQgpzWkdyY0M4VVpqSjNqR0t4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlQYklVSWtZWnRVaDI4Z2dqZERsbmp3bUVUWDJ0eEtpV2I2ek1xMTA2aDRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaVViOG1MMkFQM3k5Y0VsL2xVSTFTY2VjdUlmdERKQ0F1VzIwdGY0OGhQSnBPSzZ3aWRBTgp6OUxyR1Q0dFIwbnlUc3JEQUpjOFcwZnBJeHpoTXkvWHFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - k8saggregator: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFXZ0F3SUJBZ0lRREFKZDVPVGdJbnFnZ0NnMUUrNmFaVEFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhNVEUzTWpBeU9Wb1hEVE0yTURFd09URTNNakF5T1Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTi9oNms5MEMzT0VLOWlLY3daZEFvWFVXNDBXY0JFWnNEYnRxamMwWkI5cUxseHpLMkdYCnZZZHVsODJ4c1JiTjlXVjFoS085NjZCc2w5TXF2ZDAvOXJHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVpTGtETGhmcVQ5OUJ4VVBUVFBOa2tyUG1xRkV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloCkFQOXJxVHhXeEFWRXA2MElnNkgxSDJNaVpxc20waXlTSWFGNktHSDhGRDB5QWlCWkhWRml1SzFvKzZUWEt6QzkKSnNjait3emhuSTZWYUNQU2pEUUt3NGFrYkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpTYXNCall3ZDAzcjZxRUFJaXNCTU9lWm5Dd3BRcm54cnE5T1JNZnFkT01vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMytIcVQzUUxjNFFyMklwekJsMENoZFJialJad0VSbXdOdTJxTnpSa0gyb3VYSE1yWVplOQpoMjZYemJHeEZzMzFaWFdFbzczcm9HeVgweXE5M1QvMnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - k8sserviceaccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBOXRQbWRWMDFYTWNXenAzc3RXS3p3NHFDcW9kZDVjaXVQanF2MXQ5VkcxbHRQNEJTCmlVS3U3VERTS3R4Zm1qQ3pMLzVvVHVwMUVPbDRHckVOK0RZNDhvZjN1MU1VdDdjWE9lelF5SXBLaitDMUJyRTEKQ29pNTFOUHdXNGpUaHRPTExXUmRrU2doUCtPaDM0alpzelBvczVvS1E4aFJtK1hZNzRjbytPZ3lOL2NORXQzNQowa3h1aVEyUzZPam51Z0tIZk9zOFhRL2d0cDloSitUYW0zdkpTSHdOUFpOVkFHb3dYSmQrRU5PeEhMWjlLSDIrCmNOcmpNZGUvbmZza3lvV2h1NXZFZnQxTmV0ZkEwWXZSb1hzZERqdS82YXJ5NW92MWNoMDJYVENhc0tLN05RajAKT1Y2REVqZm5PTlNRRndXRUpTVzY4RVlWY1AxSCtoY3E4VkozODM3b0JyWVpUWUNFZllMaC8rNnpZY3RjSGdLTAo5VFhvdkxkTlZLaDlpZ0Q5NVlsT3lsTmpCVlVDNm45Q0RPQ3BZWDUzaXdiTGl1VFVsRUNwK3g0eCtrcVlPUFNDCmFrWVhwZXZ2R1F0STFUTDFLK2lDamNXUm9EaVZoblFWREhsV243R3pqeFNKMEJWd25ydFk3aWlXR1JmemxMTVUKQzUrVVY3TGxSaytwMFlDMG85dmczbXZQNkJRTm5NQUtETGc5MG5PSjVzZWFkR21DQVdyVnI2TjhhaDR2ZmpGdQprUkVVa29vcjZmYXlERmxpN1pQWGYzaXVLY0FiNXhXb3JoTXVvR0tzMUFRZHdLZFdUZi9janVKOVJYR2lLSXJ2ClJWQWQ4TW82MGhKd25SRElCK1M0cUNOWXlvYXQxd2x4NldCcjQyRUZ2ekFxdk41Z0thOVBQR09KOEJjQ0F3RUEKQVFLQ0FnQml4dXc4WFovRVVEdzFWWWZzRXVManh5T0JnUWkzczNiZm1uYlNJN0FZY05KQ2ptVDVYMEZIMUxqVwp4RGhTS1ZrY1JOQ1RmRXA3Q1NPeWN0YW5WWE8ydzJrRmd6c1FSbW82R1NaNGlyZEtHdC8zSEtXZ1lKVVZzZmRICmVsdEVZcFlaQlVoWWxkbXdpclUyRXJza2R3cVNEWHc4SWdkZXZ6M3dwWU5sRU84LzdGTkVFS2N3WEx3RGh2WWEKMVZJZTQzSTdNSnlJbFprVkhIVXlGT2pUUGxlUDlXMExEbEgvQjMveEhnTXFVcjFYUTBTVkZyVkd6cUlMU1U3Ngp0dzNES25WTjhnbFJ4OWlBNTZUWGR2L2VncmxlLzlST2U4WVhNejEzZkc5TUhlNVo3OVhCWktMdjduMi9wYldYCnphRVlSWEhidDl5MjJTVXRnWDd6ZTZBSTBUc0U0clIrY0RCZndwcm9ZSHpSRUdlb2t4a0JucHRSNG1YNkNyYm8KYUxZdTJiTWpzd0dCclE5VEJiTk9vNjVkOExRV3JlaGNFY0ZSbWxXN2JCT2M5N3FVbUIvakZGSXhQMUk5NjY5WgpveXpuZ2tzcHZISHZXR2NVTTRsMVkxYkhXNCtOUFpaUk9uOFc4dGJKT2hTNjZ2YTdFQ3pnb2QzRC9aSmFmdlViCkRjTlNCdVltZTZsUisvU1Z6SEcvOTROQVZJdmdPdVVxVWxqbmlpNnRtUFBqUEduNXlNTmZ4QUN4aEJlQmZJNCsKbitqc2V4UGtHamhrSjdPVDVKQjYxQWFId28wdjJ3Y212a0I1YkE3cEo3K0k4OUp1bE9VM3V2eXQ2OUQ2b1k0agpEQk00ZVVVd3ArZ3c1ZHVMYWpES2w0cno5SHNQQllPSUpDNE9uUE5wdXRlb2tzWWEyUUtDQVFFQS82YlpGYkI3CkZ2dGdxYkozV0ZEL1BjcjFwbnljakI4ZFZObVNBN0FhVHZaZll5THovbHlJM0VUQkJUbkhWUk9YVy9qa2VYcGcKa1FpRGRLbzlZS2g3Y1EwdTBwVnVDeGNOdXRkRmIwRkROMERvWjNuRlJlSkpEcmh2c2gyRDkvMGdaTmw2Tkg0dApPMUxWUDBGUStpeTZ5TGlUci9XelVZYVc1OHVNcmw2cFUxRStQTjJPQ1l4bnBmVk0vbFJQbHdJUFF5ZUYrc3krCkZibjBnVTArOEJHY0R6aDJZZldBZ1J4OUt5RStNcWtROVdIQzY2MXZkUGFPdm5ROTY3Y2xTRE5kU3FiRFRuU3EKSlExbVdLT0c3RzJXRGtDcmw0RElZU0tQQUZCeWowbGcxeCtjQ1JoN1hZOUtDVnZxMmFkcXJOZ1A4UHZmblFpdwpGcThuSWE1UnNhM3Y5UUtDQVFFQTl5bjVuNW5rQUd4Z2JlSEF4MnFMbWFBNHRvUGVHUkxHeUdCWU9Wa3RtSFN5Ck4rS2tvamw4ZmEyN0ppTVVNWHRONzhsSzdNM3lGQldSWENocUgvaURZYmtVZFNLUk4yTFJBRWtudTkxTWVVTWkKV1pmMVo5QzNpL2JlUmV4aEl0aGFNQkk2YldQeTMzTExYREdsZXlmTnp6N21nNFVOQm5relp6aUMwRjN0NUlMcgp5WG1VdDZxUjNPQlBIcUhDZXhTeERqQVk4ZDBXTjhQejk0YUJkNW1pelBEQ1FwYkFuTmZ4NFVGU0Z5N2hRRGVrCkFQUm5MY0tacXZibGJzT3JlUUo3TUJXV1h6U3VwYnUxL2krYTNwZWNwMTRmek9HMC9GaDh0c1JQTUtHNFNDcDYKQ2lOVm55T210MGRHaWxaOXV4emRVZVF6RXBSZk93YkF6UlNqYW95VVd3S0NBUUVBMDBLQWovRFh0dVVpT3ZsVQpzREcyeXN5R2RQN3lxc1FuaSsrRFB2THV1cVBUcld1NzcwMXVkMytGZGhrS0JONzhyQzhnTnRhUEtDcTkzdEd6CmlNV1J4SmxkUVAzbEF0c1pLSFl1VmNLN2xkUlllUEhpdUY1SGV4ZWtqYTdnV0RUZjZSYmlhckIrRmxEY0VicWEKL1RHclpLVkt2aFN2QzBiS08yQTByLzlmczQ4bWZFdWx6WFF1VHJGSDM3K3lTWnFWSEN4MEJnM2RZcnpaTldTdApCdHUyZDhsejRuMXFwTWJ6RklvVENQQTNLRitTSVFtZ1dpcEpTVTlydi9jSG93TjNLM0psWU5iOXAwTE1lYUVnCnBRM2wrMzhyalRZSjRHTWJndW4zMFRxVkFSQ0k4K2M4UXROZkhoN01FdkxMTDJ3WXVFNmJ1ZnZzNzhIcjkyUkMKOUM1RlpRS0NBUUVBb2pxaTVlY1VpRkthV0lVOUM2Y2JTaEtvSnVRVyswNGZ1NVhCVXFMK0VudEdIdmhjSno2awpQN213aFMreEtXbE5sbjRBOTcyVmp5azQ1OHgvRzh6NkwwSlQ4eTVsTW4xaHdWWkRCa1FTMWVVQ3Z0dkc4QVZHCjlFOXRSV2dKdWQxWUZRVmg1RHNlUnh3Sjd0R0hWSGFqMTh2cGNabjdHcXlpMkxWMjUxMC9zQ1ZlcmpkbkxjWi8KUndMVDY3OHc3Nmg5TGxyVGhLMGcwQ21HRUlud29KZnZDNlZiWEdtbXMwdnFMM2U0Y2c4TE9pTkxPblV3NUJBKwozTUNCaDFwWFNtNGVmVWt1RWY5NlFyNGFqbVNndWttNVFRRyt6Yk80SDRuVkVnRjRHT3VORVpFUDJXZW40M1I3CkVRRnZnNDJScVNjZy9ZZFRIbmJVcXVHYjJ3QVk0dTZ5MFFLQ0FRRUFpQm0zbkUxTGg2VFFtZjlZQVVnV1pNeVkKQWlVSHNFUnRTUGdCdWgrZzUxY1krMmp2ckEvbVZ3bG5PQlphWmoreU52Tk5ESktoWUk3TDlFb2krbTlZM1duUAp4OGFlRndhNFBRMzhUU09wM0hSYXhtcUd2Ylo0aktqcVVSc3R3b1B2UzkyK2JGZUxyaFArREh2dmhOMW41TDNkCjZtdFQycjVpSkZWWEc1RVZWMGpUdkVMUVBDT013c0NVL2hyOVdCY0hpeFdIdzBGOGdZaEo2VjJ6WjB2ZEhTUHYKMTNhUWFHZlh4M0o2NEN4dy9CWmJPaUdnYUNOOEtBKzJhYmhLY2M1UTR5L21QRUN1WXRlVHJPMFZURU9GOHczMgpta29SOUUxWHI2RnowK1Z1b0puKzBXSWNkN0l5dS8ybHZzWjVPc2ltMVRkUS9VaFAvVjlsMHpweGhOYlJUQT09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - os: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJRFl1WkVJcC9ONEhLNG9RcndlcnlvZUVYNkt4WFFzWUcyeDRXV3ZxTVM4eAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K diff --git a/talos/talosconfig.backup b/talos/talosconfig.backup deleted file mode 100644 index 6c81913..0000000 --- a/talos/talosconfig.backup +++ /dev/null @@ -1,12 +0,0 @@ -context: home-cluster -contexts: - home-cluster: - endpoints: - - 10.0.15.1 - - 10.0.15.2 - - 10.0.15.3 - nodes: - - 10.0.15.1 - ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLRENCMjZBREFnRUNBaEJOcDFlRkxURkM3dlpLdzRxYk5hc0JNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TmpNME5UWmFGdzB5TnpBeE1UUXhOak0wTlRaYU1CTXhFVEFQQmdOVgpCQW9UQ0c5ek9tRmtiV2x1TUNvd0JRWURLMlZ3QXlFQWQ0WGFqeENScDFRZi9lZWJFRWxWa2pQS1BqZ3paZGJCCkRxUENBbGRCL1cyalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0QKQWpBZkJnTlZIU01FR0RBV2dCUlV0V1RId3M3ZmRvem0wdzgyVGFBK00xb0hTREFGQmdNclpYQURRUUJ4Ni9FdgpsUHFJTFRaNHhPN0ZOM2xWNHdCdngrekpLbGE4ODdkbUtRWk50NEZUbmpadFh1eWQ5VEhaVXdsOXozN3RBUG1ZCjFxZzAzUW5ZR1lyVEt5NEQKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSXpScjY5NGp0SnRDWjZFbmp6cWhSWGREdndpa0h2eGErNzlCZzN1cDZpUAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K diff --git a/talos/worker.yaml b/talos/worker.yaml index dca05cb..ae9d1ee 100644 --- a/talos/worker.yaml +++ b/talos/worker.yaml @@ -20,7 +20,7 @@ machine: kubelet: image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + disableManifestsDirectory: true # Disable static pod manifest directory. # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: @@ -31,15 +31,6 @@ machine: # extraArgs: # key: value - extraMounts: - - destination: /var/mnt/longhorn - type: bind - source: /var/mnt/longhorn - options: - - bind - - rshared - - rw - # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: # serverTLSBootstrap: true @@ -79,7 +70,7 @@ machine: # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.4 # Talos installer with iscsi-tools and util-linux-tools extensions for Longhorn. + image: ghcr.io/siderolabs/installer:v1.12.6 # Talos installer. wipe: false # Indicates if the installation disk should be wiped at installation time. # # Look up disk using disk attributes like model, size, serial and others. @@ -87,11 +78,7 @@ machine: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Extra disks to configure (Longhorn storage). - disks: - - device: /dev/sdb - partitions: - - mountpoint: /var/mnt/longhorn + disks: [] registries: {} # Features describe individual Talos features that can be switched on or off. features: @@ -432,7 +419,7 @@ cluster: --- apiVersion: v1alpha1 kind: HostnameConfig -auto: stable # A method to automatically generate a hostname for the machine. +# auto: stable # Commented out β€” per-node configs use static hostname instead. # # A static hostname to set for the machine. # hostname: controlplane1 diff --git a/tofu/.terraform.lock.hcl b/tofu/.terraform.lock.hcl index 1a8ab71..5b6446e 100644 --- a/tofu/.terraform.lock.hcl +++ b/tofu/.terraform.lock.hcl @@ -2,38 +2,26 @@ # Manual edits may be lost in future updates. provider "registry.opentofu.org/cloudflare/cloudflare" { - version = "4.52.7" - constraints = "~> 4.0" + version = "5.19.1" + constraints = "~> 5.0" hashes = [ - "h1:+O72J3QYiZtYmYYZM/Eh0f4NNfl1BvjX1eju43qTQsQ=", - "h1:0oqjYIPXcXh7XiDiKI085cHDYQQ5mh8kDl9dmBtvtog=", - "h1:4b4ESb87MGv5bnadgYe7sK5rEkKMZhbkQcwPubQTsR4=", - "h1:6mTr3eA1Ddb348lLmJuyvn98z4KF+ejqaUEJ76D1rzQ=", - "h1:9/3YH+9k9HqsvFtbmBf7SO2+xqZeZrXNKzLkjNuhUEA=", - "h1:Jcq4tBWgyH4/2JsojNBSRaN0mcItVMchO+lynonrlqc=", - "h1:Y4Vv/2RdP0Q+uxqhOxzOdKxuuEMjXPDcU0vPc5bCQzI=", - "h1:a0gW8FBKsbP9Fi0HEDoy49WIbEWVHk9+BR4/iwuBdDQ=", - "h1:gElv6iqJtg8OKN77gbw+MjrkrQmJHPkkMEi1J+0xkpU=", - "h1:oslXUugD/NQ+duJgT4BhKQyfGbuFOANknMvR73fiOeM=", - "h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=", - "h1:u67GWw8GwD9NDlDzp9Y5VRnSQGcCrE8rSpkGPaBpDl0=", - "h1:uUUa9dY0XQOycI8pxg16PFFtL0WCTi9uEJz8trTQ7pU=", - "h1:y3rV8KF2q6GEMANNlf5EkKJurlfbKlIKpjGcdxoy7pQ=", - "zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b", - "zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e", - "zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10", - "zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285", - "zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529", - "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f", - "zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13", - "zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d", - "zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f", - "zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d", - "zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe", - "zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455", - "zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2", - "zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b", - "zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe", + "h1:HkKPMZ/n+QiExkRUSLjGMTGnuIaph+k932LiTp7CKZM=", + "h1:LicdZu3hugYpWuCAprg2EslbVP0zANnV9n9/2KiOnYc=", + "h1:VvnqJUTXlbKrB/6X2K9dc7lE3CQj3KX055gr+bMyXsg=", + "h1:XYVRvCG+auhkY1NnSe6pK7ClqKW5GX8BgUnMQwfC7mQ=", + "h1:Xf1PHfUfK690caJYZvoudKKBppfleJ6RcqsEQWqKVCw=", + "h1:i6pbudcLi1X2MVeN9IV3bDeiGWnWhn+v9dMrMzAN+l8=", + "h1:mopYISyLkUVUwMjJbuPenxIUVDrna1/7ACB1hfMfciU=", + "h1:xfoTAyKkR12F8nuVC96DwBA2Fva38o5BnYHLXZzmDP4=", + "zh:0651618000db705564dab5a25322b9d76ea54b7dd78931ed3565497b559babeb", + "zh:1a7847e9479fb6d21a65ef933ffae1416b1e4b44ca940c0d6c50fc4248cc4a0d", + "zh:5597cee5854131045eb9f201ae3a70b59c51955d31a647d9616863c746d902cb", + "zh:580786830d93e35b957754fd4c62d4681a3b19abc28b757e41acba26455663b1", + "zh:83c4bdfb0e74fd50e56fff3c461d76c1c1ec61af3f679e4de1aa70b5ed05a09f", + "zh:abb4d1052cee61d80f9cb51e5421e3c118312403afb7104b98bd7e310ac736ee", + "zh:b0aeeb3d66ea4d719989875e778c477065ba941e3a76e9a8caacc3be08208dd9", + "zh:e43b4b2dfcec1ce2115f5a5c86042d432deb49bee8eae103eb56d97ea02e2e3b", + "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", ] } diff --git a/tofu/cloudflare.tf b/tofu/cloudflare.tf index af99b81..278e7cd 100644 --- a/tofu/cloudflare.tf +++ b/tofu/cloudflare.tf @@ -200,8 +200,10 @@ import { resource "cloudflare_zone" "zones" { for_each = local.cloudflare_zones - account_id = local.cloudflare_account_id - zone = each.key + account = { + id = local.cloudflare_account_id + } + name = each.key } # ============================================================================= @@ -210,11 +212,11 @@ resource "cloudflare_zone" "zones" { import { for_each = local.cloudflare_records - to = cloudflare_record.records[each.key] + to = cloudflare_dns_record.records[each.key] id = "${local.cloudflare_zones[each.value.zone_key]}/${each.value.record_id}" } -resource "cloudflare_record" "records" { +resource "cloudflare_dns_record" "records" { for_each = local.cloudflare_records zone_id = cloudflare_zone.zones[each.value.zone_key].id @@ -231,16 +233,17 @@ resource "cloudflare_record" "records" { # DNS Records - aprs.me tunnel CNAME # ============================================================================= -resource "cloudflare_record" "aprs_me_tunnel" { +resource "cloudflare_dns_record" "aprs_me_tunnel" { zone_id = cloudflare_zone.zones["aprs.me"].id type = "CNAME" name = "aprs.me" content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com" proxied = true + ttl = 1 } # aprs.me - Resend email (DKIM, SPF, DMARC, MX) -resource "cloudflare_record" "aprs_me_dkim_resend" { +resource "cloudflare_dns_record" "aprs_me_dkim_resend" { zone_id = cloudflare_zone.zones["aprs.me"].id type = "TXT" name = "resend._domainkey" @@ -248,7 +251,7 @@ resource "cloudflare_record" "aprs_me_dkim_resend" { ttl = 86400 } -resource "cloudflare_record" "aprs_me_mx_send" { +resource "cloudflare_dns_record" "aprs_me_mx_send" { zone_id = cloudflare_zone.zones["aprs.me"].id type = "MX" name = "send" @@ -257,7 +260,7 @@ resource "cloudflare_record" "aprs_me_mx_send" { ttl = 86400 } -resource "cloudflare_record" "aprs_me_spf_send" { +resource "cloudflare_dns_record" "aprs_me_spf_send" { zone_id = cloudflare_zone.zones["aprs.me"].id type = "TXT" name = "send" @@ -265,7 +268,7 @@ resource "cloudflare_record" "aprs_me_spf_send" { ttl = 86400 } -resource "cloudflare_record" "aprs_me_dmarc" { +resource "cloudflare_dns_record" "aprs_me_dmarc" { zone_id = cloudflare_zone.zones["aprs.me"].id type = "TXT" name = "_dmarc" @@ -273,7 +276,7 @@ resource "cloudflare_record" "aprs_me_dmarc" { ttl = 86400 } -resource "cloudflare_record" "aprs_me_txt_yahoo_verification" { +resource "cloudflare_dns_record" "aprs_me_txt_yahoo_verification" { zone_id = cloudflare_zone.zones["aprs.me"].id type = "TXT" name = "aprs.me" @@ -281,7 +284,7 @@ resource "cloudflare_record" "aprs_me_txt_yahoo_verification" { ttl = 86400 } -resource "cloudflare_record" "towerops_txt_yahoo_verification" { +resource "cloudflare_dns_record" "towerops_txt_yahoo_verification" { zone_id = cloudflare_zone.zones["towerops.net"].id type = "TXT" name = "towerops.net" @@ -289,12 +292,13 @@ resource "cloudflare_record" "towerops_txt_yahoo_verification" { ttl = 86400 } -resource "cloudflare_record" "gridmap_org_tunnel" { +resource "cloudflare_dns_record" "gridmap_org_tunnel" { zone_id = cloudflare_zone.zones["gridmap.org"].id type = "CNAME" name = "gridmap.org" content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com" proxied = true + ttl = 1 } # ============================================================================= @@ -314,7 +318,7 @@ locals { ]...) } -resource "cloudflare_record" "caa" { +resource "cloudflare_dns_record" "caa" { for_each = local.caa_records zone_id = cloudflare_zone.zones[each.value.zone].id @@ -322,11 +326,11 @@ resource "cloudflare_record" "caa" { name = each.value.zone ttl = 86400 - data { - flags = "0" - tag = "issue" - value = each.value.ca - } + data = { + flags = 0 + tag = "issue" + value = each.value.ca + } } # ============================================================================= @@ -334,22 +338,22 @@ resource "cloudflare_record" "caa" { # ============================================================================= import { - to = cloudflare_record.towerops_srv_autodiscover + to = cloudflare_dns_record.towerops_srv_autodiscover id = "${local.cloudflare_zones["towerops.net"]}/26db78978535d1d630432970b9a4e279" } -resource "cloudflare_record" "towerops_srv_autodiscover" { +resource "cloudflare_dns_record" "towerops_srv_autodiscover" { zone_id = cloudflare_zone.zones["towerops.net"].id type = "SRV" name = "_autodiscover._tcp" ttl = 86400 - data { - priority = 0 - weight = 0 - port = 443 - target = "mail.mcintire.me" - } + data = { + priority = 0 + weight = 0 + port = 443 + target = "mail.mcintire.me" + } } # ============================================================================= @@ -357,64 +361,140 @@ resource "cloudflare_record" "towerops_srv_autodiscover" { # # Zone security settings: TLS hardening and HSTS # ============================================================================= -resource "cloudflare_zone_settings_override" "aprs_me" { - zone_id = cloudflare_zone.zones["aprs.me"].id - settings { - min_tls_version = "1.2" - always_use_https = "on" - tls_1_3 = "zrt" - zero_rtt = "on" - ssl = "strict" - - security_header { - enabled = true - max_age = 15552000 - include_subdomains = true - preload = true - nosniff = true - } - } +# aprs.me +resource "cloudflare_zone_setting" "aprs_me_min_tls_version" { + zone_id = cloudflare_zone.zones["aprs.me"].id + setting_id = "min_tls_version" + value = "1.2" } -resource "cloudflare_zone_settings_override" "towerops_net" { - zone_id = cloudflare_zone.zones["towerops.net"].id - - settings { - min_tls_version = "1.2" - always_use_https = "on" - tls_1_3 = "zrt" - zero_rtt = "on" - ssl = "full" - - security_header { - enabled = true - max_age = 15552000 - include_subdomains = true - preload = true - nosniff = true - } - } +resource "cloudflare_zone_setting" "aprs_me_always_use_https" { + zone_id = cloudflare_zone.zones["aprs.me"].id + setting_id = "always_use_https" + value = "on" } -resource "cloudflare_zone_settings_override" "gridmap_org" { - zone_id = cloudflare_zone.zones["gridmap.org"].id +resource "cloudflare_zone_setting" "aprs_me_tls_1_3" { + zone_id = cloudflare_zone.zones["aprs.me"].id + setting_id = "tls_1_3" + value = "zrt" +} - settings { - min_tls_version = "1.2" - always_use_https = "on" - tls_1_3 = "zrt" - zero_rtt = "on" - ssl = "strict" +resource "cloudflare_zone_setting" "aprs_me_zero_rtt" { + zone_id = cloudflare_zone.zones["aprs.me"].id + setting_id = "zero_rtt" + value = "on" +} - security_header { +resource "cloudflare_zone_setting" "aprs_me_ssl" { + zone_id = cloudflare_zone.zones["aprs.me"].id + setting_id = "ssl" + value = "strict" +} + +resource "cloudflare_zone_setting" "aprs_me_security_header" { + zone_id = cloudflare_zone.zones["aprs.me"].id + setting_id = "security_header" + value = jsonencode({ + strict_transport_security = { enabled = true max_age = 15552000 include_subdomains = true preload = true nosniff = true } - } + }) +} + +# towerops.net +resource "cloudflare_zone_setting" "towerops_net_min_tls_version" { + zone_id = cloudflare_zone.zones["towerops.net"].id + setting_id = "min_tls_version" + value = "1.2" +} + +resource "cloudflare_zone_setting" "towerops_net_always_use_https" { + zone_id = cloudflare_zone.zones["towerops.net"].id + setting_id = "always_use_https" + value = "on" +} + +resource "cloudflare_zone_setting" "towerops_net_tls_1_3" { + zone_id = cloudflare_zone.zones["towerops.net"].id + setting_id = "tls_1_3" + value = "zrt" +} + +resource "cloudflare_zone_setting" "towerops_net_zero_rtt" { + zone_id = cloudflare_zone.zones["towerops.net"].id + setting_id = "zero_rtt" + value = "on" +} + +resource "cloudflare_zone_setting" "towerops_net_ssl" { + zone_id = cloudflare_zone.zones["towerops.net"].id + setting_id = "ssl" + value = "full" +} + +resource "cloudflare_zone_setting" "towerops_net_security_header" { + zone_id = cloudflare_zone.zones["towerops.net"].id + setting_id = "security_header" + value = jsonencode({ + strict_transport_security = { + enabled = true + max_age = 15552000 + include_subdomains = true + preload = true + nosniff = true + } + }) +} + +# gridmap.org +resource "cloudflare_zone_setting" "gridmap_org_min_tls_version" { + zone_id = cloudflare_zone.zones["gridmap.org"].id + setting_id = "min_tls_version" + value = "1.2" +} + +resource "cloudflare_zone_setting" "gridmap_org_always_use_https" { + zone_id = cloudflare_zone.zones["gridmap.org"].id + setting_id = "always_use_https" + value = "on" +} + +resource "cloudflare_zone_setting" "gridmap_org_tls_1_3" { + zone_id = cloudflare_zone.zones["gridmap.org"].id + setting_id = "tls_1_3" + value = "zrt" +} + +resource "cloudflare_zone_setting" "gridmap_org_zero_rtt" { + zone_id = cloudflare_zone.zones["gridmap.org"].id + setting_id = "zero_rtt" + value = "on" +} + +resource "cloudflare_zone_setting" "gridmap_org_ssl" { + zone_id = cloudflare_zone.zones["gridmap.org"].id + setting_id = "ssl" + value = "strict" +} + +resource "cloudflare_zone_setting" "gridmap_org_security_header" { + zone_id = cloudflare_zone.zones["gridmap.org"].id + setting_id = "security_header" + value = jsonencode({ + strict_transport_security = { + enabled = true + max_age = 15552000 + include_subdomains = true + preload = true + nosniff = true + } + }) } # ============================================================================= # Firewall - custom rules (applied to all zones) @@ -434,7 +514,7 @@ locals { "(http.request.uri.path contains \"/.git\")", "(http.request.uri.path contains \"/phpmyadmin\")", "(http.request.uri.path contains \"/cgi-bin\")", - "(not http.user_agent ne \"\")", + "(not http.request.user_agent exists)", ]) } @@ -463,21 +543,21 @@ resource "cloudflare_ruleset" "towerops_response_headers" { kind = "zone" phase = "http_response_headers_transform" - rules { + rules = [{ action = "rewrite" - action_parameters { - headers { - name = "Content-Security-Policy" - operation = "set" - value = local.towerops_csp + action_parameters = { + headers = { + "Content-Security-Policy" = { + operation = "set" + value = local.towerops_csp + } } } expression = "true" description = "set CSP for towerops.net" enabled = true - } + }] } - import { to = cloudflare_ruleset.towerops_firewall id = "zone/${local.cloudflare_zones["towerops.net"]}/3c209e50f21b40388733a7cfe8f62f4e" @@ -490,27 +570,26 @@ resource "cloudflare_ruleset" "towerops_firewall" { phase = "http_request_firewall_custom" # Allow agent WebSocket connections (must come before block rules) - rules { + rules = [{ action = "skip" - action_parameters { + action_parameters = { ruleset = "current" } expression = "(http.request.uri.path eq \"/socket/agent/websocket\")" description = "allow agent websocket connections" enabled = true - logging { + logging = { enabled = false } - } + }, - rules { + { action = "block" expression = local.firewall_expression description = "block abusers" enabled = true - } + }] } - import { to = cloudflare_ruleset.gridmap_firewall id = "zone/${local.cloudflare_zones["gridmap.org"]}/7dfc79c24a22439ea501865479822df8" @@ -522,28 +601,26 @@ resource "cloudflare_ruleset" "gridmap_firewall" { kind = "zone" phase = "http_request_firewall_custom" - rules { + rules = [{ action = "block" expression = local.firewall_expression description = "block abusers" enabled = true - } + }] } - resource "cloudflare_ruleset" "aprs_me_firewall" { zone_id = cloudflare_zone.zones["aprs.me"].id name = "default" kind = "zone" phase = "http_request_firewall_custom" - rules { + rules = [{ action = "block" expression = local.firewall_expression description = "block abusers" enabled = true - } + }] } - # ============================================================================= # Tunnel Configs # @@ -561,14 +638,16 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "birdnet" { account_id = local.cloudflare_account_id tunnel_id = "bd9fe980-86d1-4b62-8a35-65ed529696f1" - config { - ingress_rule { - hostname = "bird.w5isp.com" - service = "http://localhost:80" - } - ingress_rule { - service = "http_status:404" - } + config = { + ingress = [ + { + hostname = "bird.w5isp.com" + service = "http://localhost:80" + }, + { + service = "http_status:404" + }, + ] } } @@ -581,30 +660,32 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops" { account_id = local.cloudflare_account_id tunnel_id = "d3d819ba-925c-4d84-8052-68ed32b686bb" - config { - ingress_rule { - hostname = "aprs.me" - service = "http://aprs.aprs.svc.cluster.local:4000" - } - ingress_rule { - hostname = "gridmap.org" - service = "http://gridmap.gridmap.svc.cluster.local:4000" - } - ingress_rule { - hostname = "towerops.net" - service = "http://towerops.towerops.svc.cluster.local:4000" - } - ingress_rule { - hostname = "prop.w5isp.com" - service = "http://prop.prop.svc.cluster.local:5000" - } - ingress_rule { - hostname = "argo.w5isp.com" - service = "http://argocd-server.argocd.svc.cluster.local:80" - } - ingress_rule { - service = "http_status:404" - } + config = { + ingress = [ + { + hostname = "aprs.me" + service = "http://aprs.aprs.svc.cluster.local:4000" + }, + { + hostname = "gridmap.org" + service = "http://gridmap.gridmap.svc.cluster.local:4000" + }, + { + hostname = "towerops.net" + service = "http://towerops.towerops.svc.cluster.local:4000" + }, + { + hostname = "prop.w5isp.com" + service = "http://prop.prop.svc.cluster.local:5000" + }, + { + hostname = "argo.w5isp.com" + service = "http://argocd-server.argocd.svc.cluster.local:80" + }, + { + service = "http_status:404" + }, + ] } } @@ -618,15 +699,17 @@ import { # ============================================================================= resource "cloudflare_zone" "w5isp_com" { - account_id = local.cloudflare_account_id - zone = "w5isp.com" + account = { + id = local.cloudflare_account_id + } + name = "w5isp.com" } # ============================================================================= # w5isp.com - A records # ============================================================================= -resource "cloudflare_record" "w5isp_a_root" { +resource "cloudflare_dns_record" "w5isp_a_root" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "w5isp.com" @@ -635,7 +718,7 @@ resource "cloudflare_record" "w5isp_a_root" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_home" { +resource "cloudflare_dns_record" "w5isp_a_home" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "home" @@ -644,7 +727,7 @@ resource "cloudflare_record" "w5isp_a_home" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_photos" { +resource "cloudflare_dns_record" "w5isp_a_photos" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "photos" @@ -653,7 +736,7 @@ resource "cloudflare_record" "w5isp_a_photos" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_skippy" { +resource "cloudflare_dns_record" "w5isp_a_skippy" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "skippy" @@ -662,7 +745,7 @@ resource "cloudflare_record" "w5isp_a_skippy" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_mail" { +resource "cloudflare_dns_record" "w5isp_a_mail" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "mail" @@ -671,7 +754,7 @@ resource "cloudflare_record" "w5isp_a_mail" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_dokku" { +resource "cloudflare_dns_record" "w5isp_a_dokku" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "dokku" @@ -680,7 +763,7 @@ resource "cloudflare_record" "w5isp_a_dokku" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_feedback" { +resource "cloudflare_dns_record" "w5isp_a_feedback" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "feedback" @@ -689,7 +772,7 @@ resource "cloudflare_record" "w5isp_a_feedback" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_vm1" { +resource "cloudflare_dns_record" "w5isp_a_vm1" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "vm1" @@ -698,7 +781,7 @@ resource "cloudflare_record" "w5isp_a_vm1" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_log" { +resource "cloudflare_dns_record" "w5isp_a_log" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "log" @@ -707,7 +790,7 @@ resource "cloudflare_record" "w5isp_a_log" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_vaprs" { +resource "cloudflare_dns_record" "w5isp_a_vaprs" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "vaprs" @@ -716,7 +799,7 @@ resource "cloudflare_record" "w5isp_a_vaprs" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_srtm" { +resource "cloudflare_dns_record" "w5isp_a_srtm" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "srtm" @@ -725,7 +808,7 @@ resource "cloudflare_record" "w5isp_a_srtm" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_aprs" { +resource "cloudflare_dns_record" "w5isp_a_aprs" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "aprs" @@ -734,7 +817,7 @@ resource "cloudflare_record" "w5isp_a_aprs" { ttl = 86400 } -resource "cloudflare_record" "w5isp_a_a" { +resource "cloudflare_dns_record" "w5isp_a_a" { zone_id = cloudflare_zone.w5isp_com.id type = "A" name = "a" @@ -743,36 +826,39 @@ resource "cloudflare_record" "w5isp_a_a" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_prop" { +resource "cloudflare_dns_record" "w5isp_cname_prop" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "prop" content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com" proxied = true + ttl = 1 } -resource "cloudflare_record" "w5isp_cname_argo" { +resource "cloudflare_dns_record" "w5isp_cname_argo" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "argo" content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com" proxied = true + ttl = 1 } # birdnet host (10.0.17.29) - BirdNET web UI via its own cloudflared tunnel -resource "cloudflare_record" "w5isp_cname_bird" { +resource "cloudflare_dns_record" "w5isp_cname_bird" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "bird" content = "bd9fe980-86d1-4b62-8a35-65ed529696f1.cfargotunnel.com" proxied = true + ttl = 1 } # ============================================================================= # w5isp.com - MX records # ============================================================================= -resource "cloudflare_record" "w5isp_mx_root" { +resource "cloudflare_dns_record" "w5isp_mx_root" { zone_id = cloudflare_zone.w5isp_com.id type = "MX" name = "w5isp.com" @@ -785,7 +871,7 @@ resource "cloudflare_record" "w5isp_mx_root" { # w5isp.com - CNAME records # ============================================================================= -resource "cloudflare_record" "w5isp_cname_autodiscover" { +resource "cloudflare_dns_record" "w5isp_cname_autodiscover" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "autodiscover" @@ -794,7 +880,7 @@ resource "cloudflare_record" "w5isp_cname_autodiscover" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_autoconfig" { +resource "cloudflare_dns_record" "w5isp_cname_autoconfig" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "autoconfig" @@ -803,7 +889,7 @@ resource "cloudflare_record" "w5isp_cname_autoconfig" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_em40" { +resource "cloudflare_dns_record" "w5isp_cname_em40" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "em40" @@ -812,7 +898,7 @@ resource "cloudflare_record" "w5isp_cname_em40" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_dkim_s1" { +resource "cloudflare_dns_record" "w5isp_cname_dkim_s1" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "s1._domainkey" @@ -821,7 +907,7 @@ resource "cloudflare_record" "w5isp_cname_dkim_s1" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_dkim_s2" { +resource "cloudflare_dns_record" "w5isp_cname_dkim_s2" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "s2._domainkey" @@ -830,7 +916,7 @@ resource "cloudflare_record" "w5isp_cname_dkim_s2" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_uptime" { +resource "cloudflare_dns_record" "w5isp_cname_uptime" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "uptime" @@ -839,7 +925,7 @@ resource "cloudflare_record" "w5isp_cname_uptime" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_em977211" { +resource "cloudflare_dns_record" "w5isp_cname_em977211" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "em977211" @@ -848,7 +934,7 @@ resource "cloudflare_record" "w5isp_cname_em977211" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_dkim_s977211" { +resource "cloudflare_dns_record" "w5isp_cname_dkim_s977211" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "s977211._domainkey" @@ -857,7 +943,7 @@ resource "cloudflare_record" "w5isp_cname_dkim_s977211" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_link" { +resource "cloudflare_dns_record" "w5isp_cname_link" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "link" @@ -866,7 +952,7 @@ resource "cloudflare_record" "w5isp_cname_link" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_ha" { +resource "cloudflare_dns_record" "w5isp_cname_ha" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "ha" @@ -875,7 +961,7 @@ resource "cloudflare_record" "w5isp_cname_ha" { ttl = 86400 } -resource "cloudflare_record" "w5isp_cname_acme_ha" { +resource "cloudflare_dns_record" "w5isp_cname_acme_ha" { zone_id = cloudflare_zone.w5isp_com.id type = "CNAME" name = "_acme-challenge.ha" @@ -888,7 +974,7 @@ resource "cloudflare_record" "w5isp_cname_acme_ha" { # w5isp.com - TXT records # ============================================================================= -resource "cloudflare_record" "w5isp_txt_spf" { +resource "cloudflare_dns_record" "w5isp_txt_spf" { zone_id = cloudflare_zone.w5isp_com.id type = "TXT" name = "w5isp.com" @@ -896,7 +982,7 @@ resource "cloudflare_record" "w5isp_txt_spf" { ttl = 86400 } -resource "cloudflare_record" "w5isp_txt_dkim" { +resource "cloudflare_dns_record" "w5isp_txt_dkim" { zone_id = cloudflare_zone.w5isp_com.id type = "TXT" name = "dkim._domainkey" @@ -904,7 +990,7 @@ resource "cloudflare_record" "w5isp_txt_dkim" { ttl = 86400 } -resource "cloudflare_record" "w5isp_txt_dmarc" { +resource "cloudflare_dns_record" "w5isp_txt_dmarc" { zone_id = cloudflare_zone.w5isp_com.id type = "TXT" name = "_dmarc" @@ -912,7 +998,7 @@ resource "cloudflare_record" "w5isp_txt_dmarc" { ttl = 86400 } -resource "cloudflare_record" "w5isp_txt_yahoo_verification" { +resource "cloudflare_dns_record" "w5isp_txt_yahoo_verification" { zone_id = cloudflare_zone.w5isp_com.id type = "TXT" name = "w5isp.com" @@ -924,42 +1010,66 @@ resource "cloudflare_record" "w5isp_txt_yahoo_verification" { # w5isp.com - SRV records # ============================================================================= -resource "cloudflare_record" "w5isp_srv_autodiscover" { +resource "cloudflare_dns_record" "w5isp_srv_autodiscover" { zone_id = cloudflare_zone.w5isp_com.id type = "SRV" name = "_autodiscover._tcp" ttl = 86400 - data { - priority = 0 - weight = 0 - port = 443 - target = "mail.w5isp.com" - } + data = { + priority = 0 + weight = 0 + port = 443 + target = "mail.w5isp.com" + } } # ============================================================================= # w5isp.com - Zone settings # ============================================================================= -resource "cloudflare_zone_settings_override" "w5isp_com" { - zone_id = cloudflare_zone.w5isp_com.id +resource "cloudflare_zone_setting" "w5isp_com_min_tls_version" { + zone_id = cloudflare_zone.w5isp_com.id + setting_id = "min_tls_version" + value = "1.2" +} - settings { - min_tls_version = "1.2" - always_use_https = "on" - tls_1_3 = "zrt" - zero_rtt = "on" - ssl = "full" +resource "cloudflare_zone_setting" "w5isp_com_always_use_https" { + zone_id = cloudflare_zone.w5isp_com.id + setting_id = "always_use_https" + value = "on" +} - security_header { +resource "cloudflare_zone_setting" "w5isp_com_tls_1_3" { + zone_id = cloudflare_zone.w5isp_com.id + setting_id = "tls_1_3" + value = "zrt" +} + +resource "cloudflare_zone_setting" "w5isp_com_zero_rtt" { + zone_id = cloudflare_zone.w5isp_com.id + setting_id = "zero_rtt" + value = "on" +} + +resource "cloudflare_zone_setting" "w5isp_com_ssl" { + zone_id = cloudflare_zone.w5isp_com.id + setting_id = "ssl" + value = "full" +} + +resource "cloudflare_zone_setting" "w5isp_com_security_header" { + zone_id = cloudflare_zone.w5isp_com.id + setting_id = "security_header" + value = jsonencode({ + strict_transport_security = { enabled = true max_age = 15552000 include_subdomains = true preload = true nosniff = true } - } + }) } # ============================================================================= @@ -975,32 +1085,31 @@ resource "cloudflare_ruleset" "w5isp_firewall" { # BirdNET-Pi (bird.w5isp.com) legitimately serves .php pages (e.g. views.php # loaded in an iframe), which the abuser block rule below would otherwise # catch. Skip the custom ruleset for that host. Must precede the block rule. - rules { + rules = [{ action = "skip" - action_parameters { + action_parameters = { ruleset = "current" } expression = "(http.host eq \"bird.w5isp.com\")" description = "skip WAF for birdnet UI" enabled = true - logging { + logging = { enabled = false } - } + }, - rules { + { action = "block" expression = local.firewall_expression description = "block abusers" enabled = true - } + }] } - # ============================================================================= # w5isp.com - CAA records # ============================================================================= -resource "cloudflare_record" "w5isp_caa" { +resource "cloudflare_dns_record" "w5isp_caa" { for_each = toset(local.cloudflare_cas) zone_id = cloudflare_zone.w5isp_com.id @@ -1008,24 +1117,26 @@ resource "cloudflare_record" "w5isp_caa" { name = "w5isp.com" ttl = 86400 - data { - flags = "0" - tag = "issue" - value = each.value - } + data = { + flags = 0 + tag = "issue" + value = each.value + } } resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" { account_id = local.cloudflare_account_id tunnel_id = "db59aa44-79de-4522-9593-43e828f3215a" - config { - ingress_rule { - hostname = "dev.towerops.net" - service = "http://localhost:4000" - } - ingress_rule { - service = "http_status:404" - } + config = { + ingress = [ + { + hostname = "dev.towerops.net" + service = "http://localhost:4000" + }, + { + service = "http_status:404" + }, + ] } }