graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update

Browse source
This commit is contained in:
Graham McIntire 2026-01-30 17:27:52 -06:00
parent b951c77015
commit a1e787093e
No known key found for this signature in database
100 changed files with 6904 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

242
CLAUDE.sync-conflict-20260129-151421-ZJZJYMM.md Normal file
View file

@ -0,0 +1,242 @@
# CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
## Repository Overview
This is a multi-environment infrastructure-as-code repository managing:
- **Ansible**: Configuration management for servers across multiple environments (VNTX, home, app servers)
- **Terraform**: DNS infrastructure management across DNSimple, Porkbun, and PowerDNS
- **Home Lab**: Server configurations with Tailscale integration
## Common Commands
### Proxmox VM Provisioning
BIND9 and future infrastructure VMs are provisioned using the main Ansible playbook:
```bash
cd ansible
source .envrc # Load Proxmox credentials from .envrc
# Provision and configure BIND9 nameserver at 204.110.191.222
ansible-playbook playbook.yml --tags provision,bind9
# VM settings (aligned with terraform/variables.tf):
# - Node: vm2-380 (var.proxmox_host)
# - Template: debian-13-cloudinit (VMID 9000)
# - Storage: local-lvm (for BIND9 and general infrastructure VMs)
# - Network: vmbr0
#
# Note: Talos K3s nodes use different template and Longhorn for persistent storage
```
### Ansible Operations
```bash
# Run main playbook
cd ansible && ./run.sh
# Bootstrap new host
make bootstrap-init HOSTNAME=hostname ANSIBLE_HOST=ip_address
# Run specific playbook
ansible-playbook general.yml
# Run with specific tags
ansible-playbook -t caddy general.yml
# Gather facts from all hosts
make facts
```
### Terraform Operations
**IMPORTANT**: Use OpenTofu (tofu) instead of terraform for all operations.
```bash
cd terraform
tofu init
tofu plan
tofu apply
# Format terraform files before committing
tofu fmt
```
### Kubernetes Operations (K3s cluster at 204.110.191.2)
```bash
# Set kubeconfig
export KUBECONFIG=/Users/graham/dev/infra/home/ansible/kubeconfig
# Deploy APRS.me application
cd home/cluster/aprs
./deploy.sh
# Check deployment status
kubectl get pods -n aprs
kubectl get svc -n aprs
```
### Talos Operations
```bash
# Apply configuration to nodes (from cluster directory)
talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml
# Check node status
talosctl --talosconfig=./talosconfig -e 10.0.101.21 get nodes
# Bootstrap cluster (only needed once)
talosctl --talosconfig=./talosconfig -e 10.0.101.21 bootstrap
# Get kubeconfig
talosctl --talosconfig=./talosconfig -e 10.0.101.21 kubeconfig
```
## Architecture
### Directory Structure
- `ansible/` - Ansible playbooks and roles for server configuration
- `roles/` - Reusable roles (base, caddy, docker, resolvers, etc.)
- `group_vars/` - Group-specific variables
- `host_vars/` - Host-specific variables
- Main playbooks: `playbook.yml`, `general.yml`, `bootstrap.yml`
- `home/terraform/` - DNS infrastructure management
- Manages domains: w5isp.com, vntx.net/org, manero.org, mcintire.me, gridmap.org
- Providers: DNSimple, Porkbun, PowerDNS (reverse DNS)
- `home/` - Home lab configurations
- `cluster/` - Kubernetes application deployments
- `aprs/` - APRS.me deployment with PostgreSQL/PostGIS and Redis
- `wavelog/` - Wavelog amateur radio logging application
- `terraform/` - DNS infrastructure management
### Key Infrastructure Services
**Monitoring**: Icinga2 with MariaDB backend
**DNS**: Unbound resolvers, PowerDNS for reverse zones
**VPN**: Tailscale integration across environments
**Web Proxy**: Caddy for reverse proxy and SSL termination
### Security Notes
- Ansible user (UID 10001) with passwordless sudo
- SSH keys fetched from GitHub for authentication
- Tailscale requires `TAILSCALE_KEY` environment variable
- Terraform credentials should use environment variables (TF_VAR_*)
## Development Workflow
### Adding New Hosts
1. Add host to `ansible/hosts` inventory
2. Create host_vars file if needed
3. Run bootstrap: `make bootstrap-init HOSTNAME=x ANSIBLE_HOST=y`
4. Apply configuration: `ansible-playbook -l hostname general.yml`
### DNS Changes
1. Edit appropriate `home/terraform/dns_*.tf` file
2. Run `tofu fmt` to format
3. Review with `tofu plan`
4. Apply with `tofu apply`
## Testing
### Ansible
```bash
# Syntax check
ansible-playbook --syntax-check playbook.yml
# Dry run
ansible-playbook --check playbook.yml
# Test on specific host
ansible-playbook -l hostname playbook.yml
```
### Terraform
```bash
tofu validate
tofu plan
```
## Recent Infrastructure Updates
### K3s Cluster at 204.110.191.2
- **Purpose**: Home lab Kubernetes cluster
- **Node1 IPs**:
- Public: 204.110.191.2
- Tailscale: 100.102.235.20
- Internal: 10.0.101.21
- **API Access**: Currently only available on 10.0.101.21:6443 (not on Tailscale)
- **Context**: Use `kubectl config use-context homelab` to access
- **Storage**: Longhorn for persistent volumes
- **Applications**:
- **APRS.me**: Amateur radio APRS tracking application (https://aprs.me)
- PostgreSQL 17 with PostGIS (100GB Longhorn PVC)
- Redis for caching
- 2-replica StatefulSet for high availability
- Erlang clustering enabled
- LoadBalancer service assigned: 10.0.101.32
- **Note**: ghcr.io/aprsme/aprs.me:latest requires authentication
- Deploy with: `cd home/cluster/aprs && ./deploy.sh`
- **Wavelog**: Amateur radio logging application (https://log.w5isp.com)
- MariaDB 11 database (10GB storage)
- 20GB storage for configs, backups, uploads, QSL cards
- PHP application with custom limits (50MB uploads, 256MB memory)
- Deploy with: `cd home/cluster/wavelog && ./deploy.sh`
### New Server: w5isp.w5isp.com (204.110.191.200)
- **Purpose**: Single-node server running Debian 13
- **Features**:
- Web services with automatic SSL
- Single public IP handles all services
### DNS Configuration
- **Photos**: photos.w5isp.com → 204.110.191.212 (Caddy) → 100.107.11.77:2283
- **Mailcow**: mcintire.me mail records → mail.w5isp.com (sync.w5isp.com at 204.110.191.216)
- Full mail setup with MX, SPF, DKIM, DMARC records
- Autodiscover/Autoconfig for mail clients
- Backup MX: mail.nsnw.ca (priority 20)
- **Note**: sync.w5isp.com is the Mailcow server (not using Caddy proxy)
## Code Guidelines
### Communication Practices
- Do not ever reply with "you're right". Just fix the issue
- Never say you're right, just accept it and move on
### Notes for Claude
- As you learn new things, keep claude.md updated
## Clusters
- k3s cluster at 204.110.191.2
## Application Deployment Patterns
### Standard App Deployment Process
1. **Check for existing manifests** in `/home/cluster/[app-name]/`
2. **Set namespace security policy**: `kubectl label namespace [app] pod-security.kubernetes.io/enforce=privileged --overwrite`
3. **Use ClusterIP services** (internal only) with Traefik for external access
4. **Deploy via existing deploy.sh** scripts when available
5. **Use Longhorn storage** for persistent volumes
6. **Configure Traefik IngressRoute** for SSL and routing
### Deployed Applications
- **APRS.me**: https://aprs.me (PostgreSQL + Redis, 2-replica StatefulSet)
- **Node-RED**: https://nodered.w5isp.com (automation platform)
- **n8n**: https://n8n.w5isp.com (workflow automation, PostgreSQL backend)
- **Wavelog**: https://log.w5isp.com (amateur radio logging, MariaDB backend)
### Common Issues & Solutions
- **PodSecurity violations**: Set namespace to privileged security policy
- **Database connectivity**: Use short service names (`postgres` not `postgres.namespace.svc.cluster.local`)
- **Init container permissions**: Required for volume ownership fixes
- **SSL certificates**: cert-manager with Let's Encrypt, handled automatically via Traefik
- **Service DNS**: Services accessible via `service-name` within same namespace
### Traefik Configuration
- **Host-based routing**: Multiple apps on same IP (204.110.191.2)
- **Automatic SSL**: cert-manager integration with Let's Encrypt
- **HTTP to HTTPS redirect**: Configured in IngressRoute manifests
- **ClusterIP backend**: All apps use ClusterIP, Traefik provides external access

16
ansible/group_vars/bind9_servers/aprs.me.sync-conflict-20260129-152638-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,16 @@
---
# aprs.me DNS zone configuration
aprs_me_zone:
name: aprs.me
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
hosts:
- name: '@'
ip: 204.110.191.195
- name: www
ip: 204.110.191.195
other_name_servers:
- aprs.me. IN CAA 0 issue "letsencrypt.org"

37
ansible/group_vars/bind9_servers/main.sync-conflict-20260129-152606-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,37 @@
---
# BIND9 Configuration for ns1.as393837.net
# This server will be the primary authoritative nameserver
bind_allow_query: ["any"]
bind_listen_ipv4: ["any"]
bind_recursion: false
bind_zone_dir: /var/cache/bind
bind_zone_master_server_ip: "{{ public_ip }}"
# DNSSEC settings (dnssec-enable removed in BIND 9.16+)
bind_dnssec_validation: auto
# Secondaries that should receive NOTIFY
bind_also_notify:
- 204.87.183.53 # ns2
- 172.245.56.83 # vm1.w5isp.com
bind_allow_transfer:
- 23.128.97.53 # ns-global.kjsl.com
- 204.87.183.53 # ns2
- 172.245.56.83 # vm1.w5isp.com
# Zone definitions are loaded from individual files in zones/ directory
bind_zones:
- "{{ w5isp_com_zone }}"
- "{{ aprs_me_zone }}"
- "{{ mcintire_me_zone }}"
- "{{ manero_org_zone }}"
- "{{ ntxarms_com_zone }}"
- "{{ towerops_net_zone }}"
- "{{ vntx_net_zone }}"
- "{{ vntx_org_zone }}"
- "{{ reverse_188_zone }}"
- "{{ reverse_189_zone }}"
- "{{ reverse_190_zone }}"
- "{{ reverse_191_zone }}"

31
ansible/group_vars/bind9_servers/manero.org.sync-conflict-20260129-154743-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,31 @@
---
# manero.org DNS zone configuration
manero_org_zone:
name: manero.org
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
hosts:
- name: '@'
ip: 185.199.108.153
- name: '@'
ip: 185.199.109.153
- name: '@'
ip: 185.199.110.153
- name: '@'
ip: 185.199.111.153
- name: irc
ip: 149.28.242.178
- name: us
ip: 149.28.242.178
- name: ca
ip: 167.114.209.151
- name: tankfox
ip: 137.184.202.89
ipv6_hosts:
- name: us
ipv6: 2001:19f0:6401:19e6:5400:5ff:fe45:5701
other_name_servers:
- 404.manero.org. IN CNAME 404.al.

30
ansible/group_vars/bind9_servers/mcintire.me.sync-conflict-20260129-161634-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,30 @@
---
# mcintire.me DNS zone configuration
mcintire_me_zone:
name: mcintire.me
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
mail_servers:
- name: mail
preference: 10
- name: mail.nsnw.ca.
preference: 20
hosts:
- name: mail
ip: 204.110.191.5
- name: photos
ip: 204.110.191.8
other_name_servers:
- autodiscover.mcintire.me. IN CNAME mail.w5isp.com.
- autoconfig.mcintire.me. IN CNAME mail.w5isp.com.
- _autodiscover._tcp.mcintire.me. IN SRV 0 0 443 mail.w5isp.com.
text:
- name: '@'
text: '"v=spf1 mx a ip4:204.110.191.5 ~all"'
- name: _dmarc
text: '"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"'
- name: dkim._domainkey
text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"'

25
ansible/group_vars/bind9_servers/ntxarms.com.sync-conflict-20260129-143855-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,25 @@
---
# ntxarms.com DNS zone configuration
ntxarms_com_zone:
name: ntxarms.com
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
mail_servers:
- name: in1-smtp.messagingengine.com.
preference: 10
- name: in2-smtp.messagingengine.com.
preference: 20
hosts:
- name: '@'
ip: 75.2.60.5
other_name_servers:
- www.ntxarms.com. IN CNAME ntxarms.netlify.app.
- fm1._domainkey.ntxarms.com. IN CNAME fm1.ntxarms.com.dkim.fmhosted.com.
- fm2._domainkey.ntxarms.com. IN CNAME fm2.ntxarms.com.dkim.fmhosted.com.
- fm3._domainkey.ntxarms.com. IN CNAME fm3.ntxarms.com.dkim.fmhosted.com.
text:
- name: '@'
text: '"v=spf1 include:spf.messagingengine.com ?all"'

268
ansible/group_vars/bind9_servers/reverse_188.sync-conflict-20260129-150906-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,268 @@
---
# 188.110.204.in-addr.arpa reverse DNS zone
# Mapping 204.110.188.0-255 -> *.188.client.vntx.net
reverse_188_zone:
name: 188.110.204.in-addr.arpa
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
other_name_servers:
- 0.188.110.204.in-addr.arpa. IN PTR 0.188.client.vntx.net.
- 1.188.110.204.in-addr.arpa. IN PTR 1.188.client.vntx.net.
- 2.188.110.204.in-addr.arpa. IN PTR 2.188.client.vntx.net.
- 3.188.110.204.in-addr.arpa. IN PTR 3.188.client.vntx.net.
- 4.188.110.204.in-addr.arpa. IN PTR 4.188.client.vntx.net.
- 5.188.110.204.in-addr.arpa. IN PTR 5.188.client.vntx.net.
- 6.188.110.204.in-addr.arpa. IN PTR 6.188.client.vntx.net.
- 7.188.110.204.in-addr.arpa. IN PTR 7.188.client.vntx.net.
- 8.188.110.204.in-addr.arpa. IN PTR 8.188.client.vntx.net.
- 9.188.110.204.in-addr.arpa. IN PTR 9.188.client.vntx.net.
- 10.188.110.204.in-addr.arpa. IN PTR 10.188.client.vntx.net.
- 11.188.110.204.in-addr.arpa. IN PTR 11.188.client.vntx.net.
- 12.188.110.204.in-addr.arpa. IN PTR 12.188.client.vntx.net.
- 13.188.110.204.in-addr.arpa. IN PTR 13.188.client.vntx.net.
- 14.188.110.204.in-addr.arpa. IN PTR 14.188.client.vntx.net.
- 15.188.110.204.in-addr.arpa. IN PTR 15.188.client.vntx.net.
- 16.188.110.204.in-addr.arpa. IN PTR 16.188.client.vntx.net.
- 17.188.110.204.in-addr.arpa. IN PTR 17.188.client.vntx.net.
- 18.188.110.204.in-addr.arpa. IN PTR 18.188.client.vntx.net.
- 19.188.110.204.in-addr.arpa. IN PTR 19.188.client.vntx.net.
- 20.188.110.204.in-addr.arpa. IN PTR 20.188.client.vntx.net.
- 21.188.110.204.in-addr.arpa. IN PTR 21.188.client.vntx.net.
- 22.188.110.204.in-addr.arpa. IN PTR 22.188.client.vntx.net.
- 23.188.110.204.in-addr.arpa. IN PTR 23.188.client.vntx.net.
- 24.188.110.204.in-addr.arpa. IN PTR 24.188.client.vntx.net.
- 25.188.110.204.in-addr.arpa. IN PTR 25.188.client.vntx.net.
- 26.188.110.204.in-addr.arpa. IN PTR 26.188.client.vntx.net.
- 27.188.110.204.in-addr.arpa. IN PTR 27.188.client.vntx.net.
- 28.188.110.204.in-addr.arpa. IN PTR 28.188.client.vntx.net.
- 29.188.110.204.in-addr.arpa. IN PTR 29.188.client.vntx.net.
- 30.188.110.204.in-addr.arpa. IN PTR 30.188.client.vntx.net.
- 31.188.110.204.in-addr.arpa. IN PTR 31.188.client.vntx.net.
- 32.188.110.204.in-addr.arpa. IN PTR 32.188.client.vntx.net.
- 33.188.110.204.in-addr.arpa. IN PTR 33.188.client.vntx.net.
- 34.188.110.204.in-addr.arpa. IN PTR 34.188.client.vntx.net.
- 35.188.110.204.in-addr.arpa. IN PTR 35.188.client.vntx.net.
- 36.188.110.204.in-addr.arpa. IN PTR 36.188.client.vntx.net.
- 37.188.110.204.in-addr.arpa. IN PTR 37.188.client.vntx.net.
- 38.188.110.204.in-addr.arpa. IN PTR 38.188.client.vntx.net.
- 39.188.110.204.in-addr.arpa. IN PTR 39.188.client.vntx.net.
- 40.188.110.204.in-addr.arpa. IN PTR 40.188.client.vntx.net.
- 41.188.110.204.in-addr.arpa. IN PTR 41.188.client.vntx.net.
- 42.188.110.204.in-addr.arpa. IN PTR 42.188.client.vntx.net.
- 43.188.110.204.in-addr.arpa. IN PTR 43.188.client.vntx.net.
- 44.188.110.204.in-addr.arpa. IN PTR 44.188.client.vntx.net.
- 45.188.110.204.in-addr.arpa. IN PTR 45.188.client.vntx.net.
- 46.188.110.204.in-addr.arpa. IN PTR 46.188.client.vntx.net.
- 47.188.110.204.in-addr.arpa. IN PTR 47.188.client.vntx.net.
- 48.188.110.204.in-addr.arpa. IN PTR 48.188.client.vntx.net.
- 49.188.110.204.in-addr.arpa. IN PTR 49.188.client.vntx.net.
- 50.188.110.204.in-addr.arpa. IN PTR 50.188.client.vntx.net.
- 51.188.110.204.in-addr.arpa. IN PTR 51.188.client.vntx.net.
- 52.188.110.204.in-addr.arpa. IN PTR 52.188.client.vntx.net.
- 53.188.110.204.in-addr.arpa. IN PTR 53.188.client.vntx.net.
- 54.188.110.204.in-addr.arpa. IN PTR 54.188.client.vntx.net.
- 55.188.110.204.in-addr.arpa. IN PTR 55.188.client.vntx.net.
- 56.188.110.204.in-addr.arpa. IN PTR 56.188.client.vntx.net.
- 57.188.110.204.in-addr.arpa. IN PTR 57.188.client.vntx.net.
- 58.188.110.204.in-addr.arpa. IN PTR 58.188.client.vntx.net.
- 59.188.110.204.in-addr.arpa. IN PTR 59.188.client.vntx.net.
- 60.188.110.204.in-addr.arpa. IN PTR 60.188.client.vntx.net.
- 61.188.110.204.in-addr.arpa. IN PTR 61.188.client.vntx.net.
- 62.188.110.204.in-addr.arpa. IN PTR 62.188.client.vntx.net.
- 63.188.110.204.in-addr.arpa. IN PTR 63.188.client.vntx.net.
- 64.188.110.204.in-addr.arpa. IN PTR 64.188.client.vntx.net.
- 65.188.110.204.in-addr.arpa. IN PTR 65.188.client.vntx.net.
- 66.188.110.204.in-addr.arpa. IN PTR 66.188.client.vntx.net.
- 67.188.110.204.in-addr.arpa. IN PTR 67.188.client.vntx.net.
- 68.188.110.204.in-addr.arpa. IN PTR 68.188.client.vntx.net.
- 69.188.110.204.in-addr.arpa. IN PTR 69.188.client.vntx.net.
- 70.188.110.204.in-addr.arpa. IN PTR 70.188.client.vntx.net.
- 71.188.110.204.in-addr.arpa. IN PTR 71.188.client.vntx.net.
- 72.188.110.204.in-addr.arpa. IN PTR 72.188.client.vntx.net.
- 73.188.110.204.in-addr.arpa. IN PTR 73.188.client.vntx.net.
- 74.188.110.204.in-addr.arpa. IN PTR 74.188.client.vntx.net.
- 75.188.110.204.in-addr.arpa. IN PTR 75.188.client.vntx.net.
- 76.188.110.204.in-addr.arpa. IN PTR 76.188.client.vntx.net.
- 77.188.110.204.in-addr.arpa. IN PTR 77.188.client.vntx.net.
- 78.188.110.204.in-addr.arpa. IN PTR 78.188.client.vntx.net.
- 79.188.110.204.in-addr.arpa. IN PTR 79.188.client.vntx.net.
- 80.188.110.204.in-addr.arpa. IN PTR 80.188.client.vntx.net.
- 81.188.110.204.in-addr.arpa. IN PTR 81.188.client.vntx.net.
- 82.188.110.204.in-addr.arpa. IN PTR 82.188.client.vntx.net.
- 83.188.110.204.in-addr.arpa. IN PTR 83.188.client.vntx.net.
- 84.188.110.204.in-addr.arpa. IN PTR 84.188.client.vntx.net.
- 85.188.110.204.in-addr.arpa. IN PTR 85.188.client.vntx.net.
- 86.188.110.204.in-addr.arpa. IN PTR 86.188.client.vntx.net.
- 87.188.110.204.in-addr.arpa. IN PTR 87.188.client.vntx.net.
- 88.188.110.204.in-addr.arpa. IN PTR 88.188.client.vntx.net.
- 89.188.110.204.in-addr.arpa. IN PTR 89.188.client.vntx.net.
- 90.188.110.204.in-addr.arpa. IN PTR 90.188.client.vntx.net.
- 91.188.110.204.in-addr.arpa. IN PTR 91.188.client.vntx.net.
- 92.188.110.204.in-addr.arpa. IN PTR 92.188.client.vntx.net.
- 93.188.110.204.in-addr.arpa. IN PTR 93.188.client.vntx.net.
- 94.188.110.204.in-addr.arpa. IN PTR 94.188.client.vntx.net.
- 95.188.110.204.in-addr.arpa. IN PTR 95.188.client.vntx.net.
- 96.188.110.204.in-addr.arpa. IN PTR 96.188.client.vntx.net.
- 97.188.110.204.in-addr.arpa. IN PTR 97.188.client.vntx.net.
- 98.188.110.204.in-addr.arpa. IN PTR 98.188.client.vntx.net.
- 99.188.110.204.in-addr.arpa. IN PTR 99.188.client.vntx.net.
- 100.188.110.204.in-addr.arpa. IN PTR 100.188.client.vntx.net.
- 101.188.110.204.in-addr.arpa. IN PTR 101.188.client.vntx.net.
- 102.188.110.204.in-addr.arpa. IN PTR 102.188.client.vntx.net.
- 103.188.110.204.in-addr.arpa. IN PTR 103.188.client.vntx.net.
- 104.188.110.204.in-addr.arpa. IN PTR 104.188.client.vntx.net.
- 105.188.110.204.in-addr.arpa. IN PTR 105.188.client.vntx.net.
- 106.188.110.204.in-addr.arpa. IN PTR 106.188.client.vntx.net.
- 107.188.110.204.in-addr.arpa. IN PTR 107.188.client.vntx.net.
- 108.188.110.204.in-addr.arpa. IN PTR 108.188.client.vntx.net.
- 109.188.110.204.in-addr.arpa. IN PTR 109.188.client.vntx.net.
- 110.188.110.204.in-addr.arpa. IN PTR 110.188.client.vntx.net.
- 111.188.110.204.in-addr.arpa. IN PTR 111.188.client.vntx.net.
- 112.188.110.204.in-addr.arpa. IN PTR 112.188.client.vntx.net.
- 113.188.110.204.in-addr.arpa. IN PTR 113.188.client.vntx.net.
- 114.188.110.204.in-addr.arpa. IN PTR 114.188.client.vntx.net.
- 115.188.110.204.in-addr.arpa. IN PTR 115.188.client.vntx.net.
- 116.188.110.204.in-addr.arpa. IN PTR 116.188.client.vntx.net.
- 117.188.110.204.in-addr.arpa. IN PTR 117.188.client.vntx.net.
- 118.188.110.204.in-addr.arpa. IN PTR 118.188.client.vntx.net.
- 119.188.110.204.in-addr.arpa. IN PTR 119.188.client.vntx.net.
- 120.188.110.204.in-addr.arpa. IN PTR 120.188.client.vntx.net.
- 121.188.110.204.in-addr.arpa. IN PTR 121.188.client.vntx.net.
- 122.188.110.204.in-addr.arpa. IN PTR 122.188.client.vntx.net.
- 123.188.110.204.in-addr.arpa. IN PTR 123.188.client.vntx.net.
- 124.188.110.204.in-addr.arpa. IN PTR 124.188.client.vntx.net.
- 125.188.110.204.in-addr.arpa. IN PTR 125.188.client.vntx.net.
- 126.188.110.204.in-addr.arpa. IN PTR 126.188.client.vntx.net.
- 127.188.110.204.in-addr.arpa. IN PTR 127.188.client.vntx.net.
- 128.188.110.204.in-addr.arpa. IN PTR 128.188.client.vntx.net.
- 129.188.110.204.in-addr.arpa. IN PTR 129.188.client.vntx.net.
- 130.188.110.204.in-addr.arpa. IN PTR 130.188.client.vntx.net.
- 131.188.110.204.in-addr.arpa. IN PTR 131.188.client.vntx.net.
- 132.188.110.204.in-addr.arpa. IN PTR 132.188.client.vntx.net.
- 133.188.110.204.in-addr.arpa. IN PTR 133.188.client.vntx.net.
- 134.188.110.204.in-addr.arpa. IN PTR 134.188.client.vntx.net.
- 135.188.110.204.in-addr.arpa. IN PTR 135.188.client.vntx.net.
- 136.188.110.204.in-addr.arpa. IN PTR 136.188.client.vntx.net.
- 137.188.110.204.in-addr.arpa. IN PTR 137.188.client.vntx.net.
- 138.188.110.204.in-addr.arpa. IN PTR 138.188.client.vntx.net.
- 139.188.110.204.in-addr.arpa. IN PTR 139.188.client.vntx.net.
- 140.188.110.204.in-addr.arpa. IN PTR 140.188.client.vntx.net.
- 141.188.110.204.in-addr.arpa. IN PTR 141.188.client.vntx.net.
- 142.188.110.204.in-addr.arpa. IN PTR 142.188.client.vntx.net.
- 143.188.110.204.in-addr.arpa. IN PTR 143.188.client.vntx.net.
- 144.188.110.204.in-addr.arpa. IN PTR 144.188.client.vntx.net.
- 145.188.110.204.in-addr.arpa. IN PTR 145.188.client.vntx.net.
- 146.188.110.204.in-addr.arpa. IN PTR 146.188.client.vntx.net.
- 147.188.110.204.in-addr.arpa. IN PTR 147.188.client.vntx.net.
- 148.188.110.204.in-addr.arpa. IN PTR 148.188.client.vntx.net.
- 149.188.110.204.in-addr.arpa. IN PTR 149.188.client.vntx.net.
- 150.188.110.204.in-addr.arpa. IN PTR 150.188.client.vntx.net.
- 151.188.110.204.in-addr.arpa. IN PTR 151.188.client.vntx.net.
- 152.188.110.204.in-addr.arpa. IN PTR 152.188.client.vntx.net.
- 153.188.110.204.in-addr.arpa. IN PTR 153.188.client.vntx.net.
- 154.188.110.204.in-addr.arpa. IN PTR 154.188.client.vntx.net.
- 155.188.110.204.in-addr.arpa. IN PTR 155.188.client.vntx.net.
- 156.188.110.204.in-addr.arpa. IN PTR 156.188.client.vntx.net.
- 157.188.110.204.in-addr.arpa. IN PTR 157.188.client.vntx.net.
- 158.188.110.204.in-addr.arpa. IN PTR 158.188.client.vntx.net.
- 159.188.110.204.in-addr.arpa. IN PTR 159.188.client.vntx.net.
- 160.188.110.204.in-addr.arpa. IN PTR 160.188.client.vntx.net.
- 161.188.110.204.in-addr.arpa. IN PTR 161.188.client.vntx.net.
- 162.188.110.204.in-addr.arpa. IN PTR 162.188.client.vntx.net.
- 163.188.110.204.in-addr.arpa. IN PTR 163.188.client.vntx.net.
- 164.188.110.204.in-addr.arpa. IN PTR 164.188.client.vntx.net.
- 165.188.110.204.in-addr.arpa. IN PTR 165.188.client.vntx.net.
- 166.188.110.204.in-addr.arpa. IN PTR 166.188.client.vntx.net.
- 167.188.110.204.in-addr.arpa. IN PTR 167.188.client.vntx.net.
- 168.188.110.204.in-addr.arpa. IN PTR 168.188.client.vntx.net.
- 169.188.110.204.in-addr.arpa. IN PTR 169.188.client.vntx.net.
- 170.188.110.204.in-addr.arpa. IN PTR 170.188.client.vntx.net.
- 171.188.110.204.in-addr.arpa. IN PTR 171.188.client.vntx.net.
- 172.188.110.204.in-addr.arpa. IN PTR 172.188.client.vntx.net.
- 173.188.110.204.in-addr.arpa. IN PTR 173.188.client.vntx.net.
- 174.188.110.204.in-addr.arpa. IN PTR 174.188.client.vntx.net.
- 175.188.110.204.in-addr.arpa. IN PTR 175.188.client.vntx.net.
- 176.188.110.204.in-addr.arpa. IN PTR 176.188.client.vntx.net.
- 177.188.110.204.in-addr.arpa. IN PTR 177.188.client.vntx.net.
- 178.188.110.204.in-addr.arpa. IN PTR 178.188.client.vntx.net.
- 179.188.110.204.in-addr.arpa. IN PTR 179.188.client.vntx.net.
- 180.188.110.204.in-addr.arpa. IN PTR 180.188.client.vntx.net.
- 181.188.110.204.in-addr.arpa. IN PTR 181.188.client.vntx.net.
- 182.188.110.204.in-addr.arpa. IN PTR 182.188.client.vntx.net.
- 183.188.110.204.in-addr.arpa. IN PTR 183.188.client.vntx.net.
- 184.188.110.204.in-addr.arpa. IN PTR 184.188.client.vntx.net.
- 185.188.110.204.in-addr.arpa. IN PTR 185.188.client.vntx.net.
- 186.188.110.204.in-addr.arpa. IN PTR 186.188.client.vntx.net.
- 187.188.110.204.in-addr.arpa. IN PTR 187.188.client.vntx.net.
- 188.188.110.204.in-addr.arpa. IN PTR 188.188.client.vntx.net.
- 189.188.110.204.in-addr.arpa. IN PTR 189.188.client.vntx.net.
- 190.188.110.204.in-addr.arpa. IN PTR 190.188.client.vntx.net.
- 191.188.110.204.in-addr.arpa. IN PTR 191.188.client.vntx.net.
- 192.188.110.204.in-addr.arpa. IN PTR 192.188.client.vntx.net.
- 193.188.110.204.in-addr.arpa. IN PTR 193.188.client.vntx.net.
- 194.188.110.204.in-addr.arpa. IN PTR 194.188.client.vntx.net.
- 195.188.110.204.in-addr.arpa. IN PTR 195.188.client.vntx.net.
- 196.188.110.204.in-addr.arpa. IN PTR 196.188.client.vntx.net.
- 197.188.110.204.in-addr.arpa. IN PTR 197.188.client.vntx.net.
- 198.188.110.204.in-addr.arpa. IN PTR 198.188.client.vntx.net.
- 199.188.110.204.in-addr.arpa. IN PTR 199.188.client.vntx.net.
- 200.188.110.204.in-addr.arpa. IN PTR 200.188.client.vntx.net.
- 201.188.110.204.in-addr.arpa. IN PTR 201.188.client.vntx.net.
- 202.188.110.204.in-addr.arpa. IN PTR 202.188.client.vntx.net.
- 203.188.110.204.in-addr.arpa. IN PTR 203.188.client.vntx.net.
- 204.188.110.204.in-addr.arpa. IN PTR 204.188.client.vntx.net.
- 205.188.110.204.in-addr.arpa. IN PTR 205.188.client.vntx.net.
- 206.188.110.204.in-addr.arpa. IN PTR 206.188.client.vntx.net.
- 207.188.110.204.in-addr.arpa. IN PTR 207.188.client.vntx.net.
- 208.188.110.204.in-addr.arpa. IN PTR 208.188.client.vntx.net.
- 209.188.110.204.in-addr.arpa. IN PTR 209.188.client.vntx.net.
- 210.188.110.204.in-addr.arpa. IN PTR 210.188.client.vntx.net.
- 211.188.110.204.in-addr.arpa. IN PTR 211.188.client.vntx.net.
- 212.188.110.204.in-addr.arpa. IN PTR 212.188.client.vntx.net.
- 213.188.110.204.in-addr.arpa. IN PTR 213.188.client.vntx.net.
- 214.188.110.204.in-addr.arpa. IN PTR 214.188.client.vntx.net.
- 215.188.110.204.in-addr.arpa. IN PTR 215.188.client.vntx.net.
- 216.188.110.204.in-addr.arpa. IN PTR 216.188.client.vntx.net.
- 217.188.110.204.in-addr.arpa. IN PTR 217.188.client.vntx.net.
- 218.188.110.204.in-addr.arpa. IN PTR 218.188.client.vntx.net.
- 219.188.110.204.in-addr.arpa. IN PTR 219.188.client.vntx.net.
- 220.188.110.204.in-addr.arpa. IN PTR 220.188.client.vntx.net.
- 221.188.110.204.in-addr.arpa. IN PTR 221.188.client.vntx.net.
- 222.188.110.204.in-addr.arpa. IN PTR 222.188.client.vntx.net.
- 223.188.110.204.in-addr.arpa. IN PTR 223.188.client.vntx.net.
- 224.188.110.204.in-addr.arpa. IN PTR 224.188.client.vntx.net.
- 225.188.110.204.in-addr.arpa. IN PTR 225.188.client.vntx.net.
- 226.188.110.204.in-addr.arpa. IN PTR 226.188.client.vntx.net.
- 227.188.110.204.in-addr.arpa. IN PTR 227.188.client.vntx.net.
- 228.188.110.204.in-addr.arpa. IN PTR 228.188.client.vntx.net.
- 229.188.110.204.in-addr.arpa. IN PTR 229.188.client.vntx.net.
- 230.188.110.204.in-addr.arpa. IN PTR 230.188.client.vntx.net.
- 231.188.110.204.in-addr.arpa. IN PTR 231.188.client.vntx.net.
- 232.188.110.204.in-addr.arpa. IN PTR 232.188.client.vntx.net.
- 233.188.110.204.in-addr.arpa. IN PTR 233.188.client.vntx.net.
- 234.188.110.204.in-addr.arpa. IN PTR 234.188.client.vntx.net.
- 235.188.110.204.in-addr.arpa. IN PTR 235.188.client.vntx.net.
- 236.188.110.204.in-addr.arpa. IN PTR 236.188.client.vntx.net.
- 237.188.110.204.in-addr.arpa. IN PTR 237.188.client.vntx.net.
- 238.188.110.204.in-addr.arpa. IN PTR 238.188.client.vntx.net.
- 239.188.110.204.in-addr.arpa. IN PTR 239.188.client.vntx.net.
- 240.188.110.204.in-addr.arpa. IN PTR 240.188.client.vntx.net.
- 241.188.110.204.in-addr.arpa. IN PTR 241.188.client.vntx.net.
- 242.188.110.204.in-addr.arpa. IN PTR 242.188.client.vntx.net.
- 243.188.110.204.in-addr.arpa. IN PTR 243.188.client.vntx.net.
- 244.188.110.204.in-addr.arpa. IN PTR 244.188.client.vntx.net.
- 245.188.110.204.in-addr.arpa. IN PTR 245.188.client.vntx.net.
- 246.188.110.204.in-addr.arpa. IN PTR 246.188.client.vntx.net.
- 247.188.110.204.in-addr.arpa. IN PTR 247.188.client.vntx.net.
- 248.188.110.204.in-addr.arpa. IN PTR 248.188.client.vntx.net.
- 249.188.110.204.in-addr.arpa. IN PTR 249.188.client.vntx.net.
- 250.188.110.204.in-addr.arpa. IN PTR 250.188.client.vntx.net.
- 251.188.110.204.in-addr.arpa. IN PTR 251.188.client.vntx.net.
- 252.188.110.204.in-addr.arpa. IN PTR 252.188.client.vntx.net.
- 253.188.110.204.in-addr.arpa. IN PTR 253.188.client.vntx.net.
- 254.188.110.204.in-addr.arpa. IN PTR 254.188.client.vntx.net.
- 255.188.110.204.in-addr.arpa. IN PTR 255.188.client.vntx.net.

268
ansible/group_vars/bind9_servers/reverse_189.sync-conflict-20260129-143542-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,268 @@
---
# 189.110.204.in-addr.arpa reverse DNS zone
# Mapping 204.110.189.0-255 -> *.189.client.vntx.net
reverse_189_zone:
name: 189.110.204.in-addr.arpa
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
other_name_servers:
- 0.189.110.204.in-addr.arpa. IN PTR 0.189.client.vntx.net.
- 1.189.110.204.in-addr.arpa. IN PTR 1.189.client.vntx.net.
- 2.189.110.204.in-addr.arpa. IN PTR 2.189.client.vntx.net.
- 3.189.110.204.in-addr.arpa. IN PTR 3.189.client.vntx.net.
- 4.189.110.204.in-addr.arpa. IN PTR 4.189.client.vntx.net.
- 5.189.110.204.in-addr.arpa. IN PTR 5.189.client.vntx.net.
- 6.189.110.204.in-addr.arpa. IN PTR 6.189.client.vntx.net.
- 7.189.110.204.in-addr.arpa. IN PTR 7.189.client.vntx.net.
- 8.189.110.204.in-addr.arpa. IN PTR 8.189.client.vntx.net.
- 9.189.110.204.in-addr.arpa. IN PTR 9.189.client.vntx.net.
- 10.189.110.204.in-addr.arpa. IN PTR 10.189.client.vntx.net.
- 11.189.110.204.in-addr.arpa. IN PTR 11.189.client.vntx.net.
- 12.189.110.204.in-addr.arpa. IN PTR 12.189.client.vntx.net.
- 13.189.110.204.in-addr.arpa. IN PTR 13.189.client.vntx.net.
- 14.189.110.204.in-addr.arpa. IN PTR 14.189.client.vntx.net.
- 15.189.110.204.in-addr.arpa. IN PTR 15.189.client.vntx.net.
- 16.189.110.204.in-addr.arpa. IN PTR 16.189.client.vntx.net.
- 17.189.110.204.in-addr.arpa. IN PTR 17.189.client.vntx.net.
- 18.189.110.204.in-addr.arpa. IN PTR 18.189.client.vntx.net.
- 19.189.110.204.in-addr.arpa. IN PTR 19.189.client.vntx.net.
- 20.189.110.204.in-addr.arpa. IN PTR 20.189.client.vntx.net.
- 21.189.110.204.in-addr.arpa. IN PTR 21.189.client.vntx.net.
- 22.189.110.204.in-addr.arpa. IN PTR 22.189.client.vntx.net.
- 23.189.110.204.in-addr.arpa. IN PTR 23.189.client.vntx.net.
- 24.189.110.204.in-addr.arpa. IN PTR 24.189.client.vntx.net.
- 25.189.110.204.in-addr.arpa. IN PTR 25.189.client.vntx.net.
- 26.189.110.204.in-addr.arpa. IN PTR 26.189.client.vntx.net.
- 27.189.110.204.in-addr.arpa. IN PTR 27.189.client.vntx.net.
- 28.189.110.204.in-addr.arpa. IN PTR 28.189.client.vntx.net.
- 29.189.110.204.in-addr.arpa. IN PTR 29.189.client.vntx.net.
- 30.189.110.204.in-addr.arpa. IN PTR 30.189.client.vntx.net.
- 31.189.110.204.in-addr.arpa. IN PTR 31.189.client.vntx.net.
- 32.189.110.204.in-addr.arpa. IN PTR 32.189.client.vntx.net.
- 33.189.110.204.in-addr.arpa. IN PTR 33.189.client.vntx.net.
- 34.189.110.204.in-addr.arpa. IN PTR 34.189.client.vntx.net.
- 35.189.110.204.in-addr.arpa. IN PTR 35.189.client.vntx.net.
- 36.189.110.204.in-addr.arpa. IN PTR 36.189.client.vntx.net.
- 37.189.110.204.in-addr.arpa. IN PTR 37.189.client.vntx.net.
- 38.189.110.204.in-addr.arpa. IN PTR 38.189.client.vntx.net.
- 39.189.110.204.in-addr.arpa. IN PTR 39.189.client.vntx.net.
- 40.189.110.204.in-addr.arpa. IN PTR 40.189.client.vntx.net.
- 41.189.110.204.in-addr.arpa. IN PTR 41.189.client.vntx.net.
- 42.189.110.204.in-addr.arpa. IN PTR 42.189.client.vntx.net.
- 43.189.110.204.in-addr.arpa. IN PTR 43.189.client.vntx.net.
- 44.189.110.204.in-addr.arpa. IN PTR 44.189.client.vntx.net.
- 45.189.110.204.in-addr.arpa. IN PTR 45.189.client.vntx.net.
- 46.189.110.204.in-addr.arpa. IN PTR 46.189.client.vntx.net.
- 47.189.110.204.in-addr.arpa. IN PTR 47.189.client.vntx.net.
- 48.189.110.204.in-addr.arpa. IN PTR 48.189.client.vntx.net.
- 49.189.110.204.in-addr.arpa. IN PTR 49.189.client.vntx.net.
- 50.189.110.204.in-addr.arpa. IN PTR 50.189.client.vntx.net.
- 51.189.110.204.in-addr.arpa. IN PTR 51.189.client.vntx.net.
- 52.189.110.204.in-addr.arpa. IN PTR 52.189.client.vntx.net.
- 53.189.110.204.in-addr.arpa. IN PTR 53.189.client.vntx.net.
- 54.189.110.204.in-addr.arpa. IN PTR 54.189.client.vntx.net.
- 55.189.110.204.in-addr.arpa. IN PTR 55.189.client.vntx.net.
- 56.189.110.204.in-addr.arpa. IN PTR 56.189.client.vntx.net.
- 57.189.110.204.in-addr.arpa. IN PTR 57.189.client.vntx.net.
- 58.189.110.204.in-addr.arpa. IN PTR 58.189.client.vntx.net.
- 59.189.110.204.in-addr.arpa. IN PTR 59.189.client.vntx.net.
- 60.189.110.204.in-addr.arpa. IN PTR 60.189.client.vntx.net.
- 61.189.110.204.in-addr.arpa. IN PTR 61.189.client.vntx.net.
- 62.189.110.204.in-addr.arpa. IN PTR 62.189.client.vntx.net.
- 63.189.110.204.in-addr.arpa. IN PTR 63.189.client.vntx.net.
- 64.189.110.204.in-addr.arpa. IN PTR 64.189.client.vntx.net.
- 65.189.110.204.in-addr.arpa. IN PTR 65.189.client.vntx.net.
- 66.189.110.204.in-addr.arpa. IN PTR 66.189.client.vntx.net.
- 67.189.110.204.in-addr.arpa. IN PTR 67.189.client.vntx.net.
- 68.189.110.204.in-addr.arpa. IN PTR 68.189.client.vntx.net.
- 69.189.110.204.in-addr.arpa. IN PTR 69.189.client.vntx.net.
- 70.189.110.204.in-addr.arpa. IN PTR 70.189.client.vntx.net.
- 71.189.110.204.in-addr.arpa. IN PTR 71.189.client.vntx.net.
- 72.189.110.204.in-addr.arpa. IN PTR 72.189.client.vntx.net.
- 73.189.110.204.in-addr.arpa. IN PTR 73.189.client.vntx.net.
- 74.189.110.204.in-addr.arpa. IN PTR 74.189.client.vntx.net.
- 75.189.110.204.in-addr.arpa. IN PTR 75.189.client.vntx.net.
- 76.189.110.204.in-addr.arpa. IN PTR 76.189.client.vntx.net.
- 77.189.110.204.in-addr.arpa. IN PTR 77.189.client.vntx.net.
- 78.189.110.204.in-addr.arpa. IN PTR 78.189.client.vntx.net.
- 79.189.110.204.in-addr.arpa. IN PTR 79.189.client.vntx.net.
- 80.189.110.204.in-addr.arpa. IN PTR 80.189.client.vntx.net.
- 81.189.110.204.in-addr.arpa. IN PTR 81.189.client.vntx.net.
- 82.189.110.204.in-addr.arpa. IN PTR 82.189.client.vntx.net.
- 83.189.110.204.in-addr.arpa. IN PTR 83.189.client.vntx.net.
- 84.189.110.204.in-addr.arpa. IN PTR 84.189.client.vntx.net.
- 85.189.110.204.in-addr.arpa. IN PTR 85.189.client.vntx.net.
- 86.189.110.204.in-addr.arpa. IN PTR 86.189.client.vntx.net.
- 87.189.110.204.in-addr.arpa. IN PTR 87.189.client.vntx.net.
- 88.189.110.204.in-addr.arpa. IN PTR 88.189.client.vntx.net.
- 89.189.110.204.in-addr.arpa. IN PTR 89.189.client.vntx.net.
- 90.189.110.204.in-addr.arpa. IN PTR 90.189.client.vntx.net.
- 91.189.110.204.in-addr.arpa. IN PTR 91.189.client.vntx.net.
- 92.189.110.204.in-addr.arpa. IN PTR 92.189.client.vntx.net.
- 93.189.110.204.in-addr.arpa. IN PTR 93.189.client.vntx.net.
- 94.189.110.204.in-addr.arpa. IN PTR 94.189.client.vntx.net.
- 95.189.110.204.in-addr.arpa. IN PTR 95.189.client.vntx.net.
- 96.189.110.204.in-addr.arpa. IN PTR 96.189.client.vntx.net.
- 97.189.110.204.in-addr.arpa. IN PTR 97.189.client.vntx.net.
- 98.189.110.204.in-addr.arpa. IN PTR 98.189.client.vntx.net.
- 99.189.110.204.in-addr.arpa. IN PTR 99.189.client.vntx.net.
- 100.189.110.204.in-addr.arpa. IN PTR 100.189.client.vntx.net.
- 101.189.110.204.in-addr.arpa. IN PTR 101.189.client.vntx.net.
- 102.189.110.204.in-addr.arpa. IN PTR 102.189.client.vntx.net.
- 103.189.110.204.in-addr.arpa. IN PTR 103.189.client.vntx.net.
- 104.189.110.204.in-addr.arpa. IN PTR 104.189.client.vntx.net.
- 105.189.110.204.in-addr.arpa. IN PTR 105.189.client.vntx.net.
- 106.189.110.204.in-addr.arpa. IN PTR 106.189.client.vntx.net.
- 107.189.110.204.in-addr.arpa. IN PTR 107.189.client.vntx.net.
- 108.189.110.204.in-addr.arpa. IN PTR 108.189.client.vntx.net.
- 109.189.110.204.in-addr.arpa. IN PTR 109.189.client.vntx.net.
- 110.189.110.204.in-addr.arpa. IN PTR 110.189.client.vntx.net.
- 111.189.110.204.in-addr.arpa. IN PTR 111.189.client.vntx.net.
- 112.189.110.204.in-addr.arpa. IN PTR 112.189.client.vntx.net.
- 113.189.110.204.in-addr.arpa. IN PTR 113.189.client.vntx.net.
- 114.189.110.204.in-addr.arpa. IN PTR 114.189.client.vntx.net.
- 115.189.110.204.in-addr.arpa. IN PTR 115.189.client.vntx.net.
- 116.189.110.204.in-addr.arpa. IN PTR 116.189.client.vntx.net.
- 117.189.110.204.in-addr.arpa. IN PTR 117.189.client.vntx.net.
- 118.189.110.204.in-addr.arpa. IN PTR 118.189.client.vntx.net.
- 119.189.110.204.in-addr.arpa. IN PTR 119.189.client.vntx.net.
- 120.189.110.204.in-addr.arpa. IN PTR 120.189.client.vntx.net.
- 121.189.110.204.in-addr.arpa. IN PTR 121.189.client.vntx.net.
- 122.189.110.204.in-addr.arpa. IN PTR 122.189.client.vntx.net.
- 123.189.110.204.in-addr.arpa. IN PTR 123.189.client.vntx.net.
- 124.189.110.204.in-addr.arpa. IN PTR 124.189.client.vntx.net.
- 125.189.110.204.in-addr.arpa. IN PTR 125.189.client.vntx.net.
- 126.189.110.204.in-addr.arpa. IN PTR 126.189.client.vntx.net.
- 127.189.110.204.in-addr.arpa. IN PTR 127.189.client.vntx.net.
- 128.189.110.204.in-addr.arpa. IN PTR 128.189.client.vntx.net.
- 129.189.110.204.in-addr.arpa. IN PTR 129.189.client.vntx.net.
- 130.189.110.204.in-addr.arpa. IN PTR 130.189.client.vntx.net.
- 131.189.110.204.in-addr.arpa. IN PTR 131.189.client.vntx.net.
- 132.189.110.204.in-addr.arpa. IN PTR 132.189.client.vntx.net.
- 133.189.110.204.in-addr.arpa. IN PTR 133.189.client.vntx.net.
- 134.189.110.204.in-addr.arpa. IN PTR 134.189.client.vntx.net.
- 135.189.110.204.in-addr.arpa. IN PTR 135.189.client.vntx.net.
- 136.189.110.204.in-addr.arpa. IN PTR 136.189.client.vntx.net.
- 137.189.110.204.in-addr.arpa. IN PTR 137.189.client.vntx.net.
- 138.189.110.204.in-addr.arpa. IN PTR 138.189.client.vntx.net.
- 139.189.110.204.in-addr.arpa. IN PTR 139.189.client.vntx.net.
- 140.189.110.204.in-addr.arpa. IN PTR 140.189.client.vntx.net.
- 141.189.110.204.in-addr.arpa. IN PTR 141.189.client.vntx.net.
- 142.189.110.204.in-addr.arpa. IN PTR 142.189.client.vntx.net.
- 143.189.110.204.in-addr.arpa. IN PTR 143.189.client.vntx.net.
- 144.189.110.204.in-addr.arpa. IN PTR 144.189.client.vntx.net.
- 145.189.110.204.in-addr.arpa. IN PTR 145.189.client.vntx.net.
- 146.189.110.204.in-addr.arpa. IN PTR 146.189.client.vntx.net.
- 147.189.110.204.in-addr.arpa. IN PTR 147.189.client.vntx.net.
- 148.189.110.204.in-addr.arpa. IN PTR 148.189.client.vntx.net.
- 149.189.110.204.in-addr.arpa. IN PTR 149.189.client.vntx.net.
- 150.189.110.204.in-addr.arpa. IN PTR 150.189.client.vntx.net.
- 151.189.110.204.in-addr.arpa. IN PTR 151.189.client.vntx.net.
- 152.189.110.204.in-addr.arpa. IN PTR 152.189.client.vntx.net.
- 153.189.110.204.in-addr.arpa. IN PTR 153.189.client.vntx.net.
- 154.189.110.204.in-addr.arpa. IN PTR 154.189.client.vntx.net.
- 155.189.110.204.in-addr.arpa. IN PTR 155.189.client.vntx.net.
- 156.189.110.204.in-addr.arpa. IN PTR 156.189.client.vntx.net.
- 157.189.110.204.in-addr.arpa. IN PTR 157.189.client.vntx.net.
- 158.189.110.204.in-addr.arpa. IN PTR 158.189.client.vntx.net.
- 159.189.110.204.in-addr.arpa. IN PTR 159.189.client.vntx.net.
- 160.189.110.204.in-addr.arpa. IN PTR 160.189.client.vntx.net.
- 161.189.110.204.in-addr.arpa. IN PTR 161.189.client.vntx.net.
- 162.189.110.204.in-addr.arpa. IN PTR 162.189.client.vntx.net.
- 163.189.110.204.in-addr.arpa. IN PTR 163.189.client.vntx.net.
- 164.189.110.204.in-addr.arpa. IN PTR 164.189.client.vntx.net.
- 165.189.110.204.in-addr.arpa. IN PTR 165.189.client.vntx.net.
- 166.189.110.204.in-addr.arpa. IN PTR 166.189.client.vntx.net.
- 167.189.110.204.in-addr.arpa. IN PTR 167.189.client.vntx.net.
- 168.189.110.204.in-addr.arpa. IN PTR 168.189.client.vntx.net.
- 169.189.110.204.in-addr.arpa. IN PTR 169.189.client.vntx.net.
- 170.189.110.204.in-addr.arpa. IN PTR 170.189.client.vntx.net.
- 171.189.110.204.in-addr.arpa. IN PTR 171.189.client.vntx.net.
- 172.189.110.204.in-addr.arpa. IN PTR 172.189.client.vntx.net.
- 173.189.110.204.in-addr.arpa. IN PTR 173.189.client.vntx.net.
- 174.189.110.204.in-addr.arpa. IN PTR 174.189.client.vntx.net.
- 175.189.110.204.in-addr.arpa. IN PTR 175.189.client.vntx.net.
- 176.189.110.204.in-addr.arpa. IN PTR 176.189.client.vntx.net.
- 177.189.110.204.in-addr.arpa. IN PTR 177.189.client.vntx.net.
- 178.189.110.204.in-addr.arpa. IN PTR 178.189.client.vntx.net.
- 179.189.110.204.in-addr.arpa. IN PTR 179.189.client.vntx.net.
- 180.189.110.204.in-addr.arpa. IN PTR 180.189.client.vntx.net.
- 181.189.110.204.in-addr.arpa. IN PTR 181.189.client.vntx.net.
- 182.189.110.204.in-addr.arpa. IN PTR 182.189.client.vntx.net.
- 183.189.110.204.in-addr.arpa. IN PTR 183.189.client.vntx.net.
- 184.189.110.204.in-addr.arpa. IN PTR 184.189.client.vntx.net.
- 185.189.110.204.in-addr.arpa. IN PTR 185.189.client.vntx.net.
- 186.189.110.204.in-addr.arpa. IN PTR 186.189.client.vntx.net.
- 187.189.110.204.in-addr.arpa. IN PTR 187.189.client.vntx.net.
- 188.189.110.204.in-addr.arpa. IN PTR 188.189.client.vntx.net.
- 189.189.110.204.in-addr.arpa. IN PTR 189.189.client.vntx.net.
- 190.189.110.204.in-addr.arpa. IN PTR 190.189.client.vntx.net.
- 191.189.110.204.in-addr.arpa. IN PTR 191.189.client.vntx.net.
- 192.189.110.204.in-addr.arpa. IN PTR 192.189.client.vntx.net.
- 193.189.110.204.in-addr.arpa. IN PTR 193.189.client.vntx.net.
- 194.189.110.204.in-addr.arpa. IN PTR 194.189.client.vntx.net.
- 195.189.110.204.in-addr.arpa. IN PTR 195.189.client.vntx.net.
- 196.189.110.204.in-addr.arpa. IN PTR 196.189.client.vntx.net.
- 197.189.110.204.in-addr.arpa. IN PTR 197.189.client.vntx.net.
- 198.189.110.204.in-addr.arpa. IN PTR 198.189.client.vntx.net.
- 199.189.110.204.in-addr.arpa. IN PTR 199.189.client.vntx.net.
- 200.189.110.204.in-addr.arpa. IN PTR 200.189.client.vntx.net.
- 201.189.110.204.in-addr.arpa. IN PTR 201.189.client.vntx.net.
- 202.189.110.204.in-addr.arpa. IN PTR 202.189.client.vntx.net.
- 203.189.110.204.in-addr.arpa. IN PTR 203.189.client.vntx.net.
- 204.189.110.204.in-addr.arpa. IN PTR 204.189.client.vntx.net.
- 205.189.110.204.in-addr.arpa. IN PTR 205.189.client.vntx.net.
- 206.189.110.204.in-addr.arpa. IN PTR 206.189.client.vntx.net.
- 207.189.110.204.in-addr.arpa. IN PTR 207.189.client.vntx.net.
- 208.189.110.204.in-addr.arpa. IN PTR 208.189.client.vntx.net.
- 209.189.110.204.in-addr.arpa. IN PTR 209.189.client.vntx.net.
- 210.189.110.204.in-addr.arpa. IN PTR 210.189.client.vntx.net.
- 211.189.110.204.in-addr.arpa. IN PTR 211.189.client.vntx.net.
- 212.189.110.204.in-addr.arpa. IN PTR 212.189.client.vntx.net.
- 213.189.110.204.in-addr.arpa. IN PTR 213.189.client.vntx.net.
- 214.189.110.204.in-addr.arpa. IN PTR 214.189.client.vntx.net.
- 215.189.110.204.in-addr.arpa. IN PTR 215.189.client.vntx.net.
- 216.189.110.204.in-addr.arpa. IN PTR 216.189.client.vntx.net.
- 217.189.110.204.in-addr.arpa. IN PTR 217.189.client.vntx.net.
- 218.189.110.204.in-addr.arpa. IN PTR 218.189.client.vntx.net.
- 219.189.110.204.in-addr.arpa. IN PTR 219.189.client.vntx.net.
- 220.189.110.204.in-addr.arpa. IN PTR 220.189.client.vntx.net.
- 221.189.110.204.in-addr.arpa. IN PTR 221.189.client.vntx.net.
- 222.189.110.204.in-addr.arpa. IN PTR 222.189.client.vntx.net.
- 223.189.110.204.in-addr.arpa. IN PTR 223.189.client.vntx.net.
- 224.189.110.204.in-addr.arpa. IN PTR 224.189.client.vntx.net.
- 225.189.110.204.in-addr.arpa. IN PTR 225.189.client.vntx.net.
- 226.189.110.204.in-addr.arpa. IN PTR 226.189.client.vntx.net.
- 227.189.110.204.in-addr.arpa. IN PTR 227.189.client.vntx.net.
- 228.189.110.204.in-addr.arpa. IN PTR 228.189.client.vntx.net.
- 229.189.110.204.in-addr.arpa. IN PTR 229.189.client.vntx.net.
- 230.189.110.204.in-addr.arpa. IN PTR 230.189.client.vntx.net.
- 231.189.110.204.in-addr.arpa. IN PTR 231.189.client.vntx.net.
- 232.189.110.204.in-addr.arpa. IN PTR 232.189.client.vntx.net.
- 233.189.110.204.in-addr.arpa. IN PTR 233.189.client.vntx.net.
- 234.189.110.204.in-addr.arpa. IN PTR 234.189.client.vntx.net.
- 235.189.110.204.in-addr.arpa. IN PTR 235.189.client.vntx.net.
- 236.189.110.204.in-addr.arpa. IN PTR 236.189.client.vntx.net.
- 237.189.110.204.in-addr.arpa. IN PTR 237.189.client.vntx.net.
- 238.189.110.204.in-addr.arpa. IN PTR 238.189.client.vntx.net.
- 239.189.110.204.in-addr.arpa. IN PTR 239.189.client.vntx.net.
- 240.189.110.204.in-addr.arpa. IN PTR 240.189.client.vntx.net.
- 241.189.110.204.in-addr.arpa. IN PTR 241.189.client.vntx.net.
- 242.189.110.204.in-addr.arpa. IN PTR 242.189.client.vntx.net.
- 243.189.110.204.in-addr.arpa. IN PTR 243.189.client.vntx.net.
- 244.189.110.204.in-addr.arpa. IN PTR 244.189.client.vntx.net.
- 245.189.110.204.in-addr.arpa. IN PTR 245.189.client.vntx.net.
- 246.189.110.204.in-addr.arpa. IN PTR 246.189.client.vntx.net.
- 247.189.110.204.in-addr.arpa. IN PTR 247.189.client.vntx.net.
- 248.189.110.204.in-addr.arpa. IN PTR 248.189.client.vntx.net.
- 249.189.110.204.in-addr.arpa. IN PTR 249.189.client.vntx.net.
- 250.189.110.204.in-addr.arpa. IN PTR 250.189.client.vntx.net.
- 251.189.110.204.in-addr.arpa. IN PTR 251.189.client.vntx.net.
- 252.189.110.204.in-addr.arpa. IN PTR 252.189.client.vntx.net.
- 253.189.110.204.in-addr.arpa. IN PTR 253.189.client.vntx.net.
- 254.189.110.204.in-addr.arpa. IN PTR 254.189.client.vntx.net.
- 255.189.110.204.in-addr.arpa. IN PTR 255.189.client.vntx.net.

266
ansible/group_vars/bind9_servers/reverse_190.sync-conflict-20260129-151531-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,266 @@
---
# 190.110.204.in-addr.arpa reverse DNS zone
# Mapping 204.110.190.0-255 -> *.190.client.vntx.net (excludes 119, 168)
reverse_190_zone:
name: 190.110.204.in-addr.arpa
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
other_name_servers:
- 0.190.110.204.in-addr.arpa. IN PTR 0.190.client.vntx.net.
- 1.190.110.204.in-addr.arpa. IN PTR 1.190.client.vntx.net.
- 2.190.110.204.in-addr.arpa. IN PTR 2.190.client.vntx.net.
- 3.190.110.204.in-addr.arpa. IN PTR 3.190.client.vntx.net.
- 4.190.110.204.in-addr.arpa. IN PTR 4.190.client.vntx.net.
- 5.190.110.204.in-addr.arpa. IN PTR 5.190.client.vntx.net.
- 6.190.110.204.in-addr.arpa. IN PTR 6.190.client.vntx.net.
- 7.190.110.204.in-addr.arpa. IN PTR 7.190.client.vntx.net.
- 8.190.110.204.in-addr.arpa. IN PTR 8.190.client.vntx.net.
- 9.190.110.204.in-addr.arpa. IN PTR 9.190.client.vntx.net.
- 10.190.110.204.in-addr.arpa. IN PTR 10.190.client.vntx.net.
- 11.190.110.204.in-addr.arpa. IN PTR 11.190.client.vntx.net.
- 12.190.110.204.in-addr.arpa. IN PTR 12.190.client.vntx.net.
- 13.190.110.204.in-addr.arpa. IN PTR 13.190.client.vntx.net.
- 14.190.110.204.in-addr.arpa. IN PTR 14.190.client.vntx.net.
- 15.190.110.204.in-addr.arpa. IN PTR 15.190.client.vntx.net.
- 16.190.110.204.in-addr.arpa. IN PTR 16.190.client.vntx.net.
- 17.190.110.204.in-addr.arpa. IN PTR 17.190.client.vntx.net.
- 18.190.110.204.in-addr.arpa. IN PTR 18.190.client.vntx.net.
- 19.190.110.204.in-addr.arpa. IN PTR 19.190.client.vntx.net.
- 20.190.110.204.in-addr.arpa. IN PTR 20.190.client.vntx.net.
- 21.190.110.204.in-addr.arpa. IN PTR 21.190.client.vntx.net.
- 22.190.110.204.in-addr.arpa. IN PTR 22.190.client.vntx.net.
- 23.190.110.204.in-addr.arpa. IN PTR 23.190.client.vntx.net.
- 24.190.110.204.in-addr.arpa. IN PTR 24.190.client.vntx.net.
- 25.190.110.204.in-addr.arpa. IN PTR 25.190.client.vntx.net.
- 26.190.110.204.in-addr.arpa. IN PTR 26.190.client.vntx.net.
- 27.190.110.204.in-addr.arpa. IN PTR 27.190.client.vntx.net.
- 28.190.110.204.in-addr.arpa. IN PTR 28.190.client.vntx.net.
- 29.190.110.204.in-addr.arpa. IN PTR 29.190.client.vntx.net.
- 30.190.110.204.in-addr.arpa. IN PTR 30.190.client.vntx.net.
- 31.190.110.204.in-addr.arpa. IN PTR 31.190.client.vntx.net.
- 32.190.110.204.in-addr.arpa. IN PTR 32.190.client.vntx.net.
- 33.190.110.204.in-addr.arpa. IN PTR 33.190.client.vntx.net.
- 34.190.110.204.in-addr.arpa. IN PTR 34.190.client.vntx.net.
- 35.190.110.204.in-addr.arpa. IN PTR 35.190.client.vntx.net.
- 36.190.110.204.in-addr.arpa. IN PTR 36.190.client.vntx.net.
- 37.190.110.204.in-addr.arpa. IN PTR 37.190.client.vntx.net.
- 38.190.110.204.in-addr.arpa. IN PTR 38.190.client.vntx.net.
- 39.190.110.204.in-addr.arpa. IN PTR 39.190.client.vntx.net.
- 40.190.110.204.in-addr.arpa. IN PTR 40.190.client.vntx.net.
- 41.190.110.204.in-addr.arpa. IN PTR 41.190.client.vntx.net.
- 42.190.110.204.in-addr.arpa. IN PTR 42.190.client.vntx.net.
- 43.190.110.204.in-addr.arpa. IN PTR 43.190.client.vntx.net.
- 44.190.110.204.in-addr.arpa. IN PTR 44.190.client.vntx.net.
- 45.190.110.204.in-addr.arpa. IN PTR 45.190.client.vntx.net.
- 46.190.110.204.in-addr.arpa. IN PTR 46.190.client.vntx.net.
- 47.190.110.204.in-addr.arpa. IN PTR 47.190.client.vntx.net.
- 48.190.110.204.in-addr.arpa. IN PTR 48.190.client.vntx.net.
- 49.190.110.204.in-addr.arpa. IN PTR 49.190.client.vntx.net.
- 50.190.110.204.in-addr.arpa. IN PTR 50.190.client.vntx.net.
- 51.190.110.204.in-addr.arpa. IN PTR 51.190.client.vntx.net.
- 52.190.110.204.in-addr.arpa. IN PTR 52.190.client.vntx.net.
- 53.190.110.204.in-addr.arpa. IN PTR 53.190.client.vntx.net.
- 54.190.110.204.in-addr.arpa. IN PTR 54.190.client.vntx.net.
- 55.190.110.204.in-addr.arpa. IN PTR 55.190.client.vntx.net.
- 56.190.110.204.in-addr.arpa. IN PTR 56.190.client.vntx.net.
- 57.190.110.204.in-addr.arpa. IN PTR 57.190.client.vntx.net.
- 58.190.110.204.in-addr.arpa. IN PTR 58.190.client.vntx.net.
- 59.190.110.204.in-addr.arpa. IN PTR 59.190.client.vntx.net.
- 60.190.110.204.in-addr.arpa. IN PTR 60.190.client.vntx.net.
- 61.190.110.204.in-addr.arpa. IN PTR 61.190.client.vntx.net.
- 62.190.110.204.in-addr.arpa. IN PTR 62.190.client.vntx.net.
- 63.190.110.204.in-addr.arpa. IN PTR 63.190.client.vntx.net.
- 64.190.110.204.in-addr.arpa. IN PTR 64.190.client.vntx.net.
- 65.190.110.204.in-addr.arpa. IN PTR 65.190.client.vntx.net.
- 66.190.110.204.in-addr.arpa. IN PTR 66.190.client.vntx.net.
- 67.190.110.204.in-addr.arpa. IN PTR 67.190.client.vntx.net.
- 68.190.110.204.in-addr.arpa. IN PTR 68.190.client.vntx.net.
- 69.190.110.204.in-addr.arpa. IN PTR 69.190.client.vntx.net.
- 70.190.110.204.in-addr.arpa. IN PTR 70.190.client.vntx.net.
- 71.190.110.204.in-addr.arpa. IN PTR 71.190.client.vntx.net.
- 72.190.110.204.in-addr.arpa. IN PTR 72.190.client.vntx.net.
- 73.190.110.204.in-addr.arpa. IN PTR 73.190.client.vntx.net.
- 74.190.110.204.in-addr.arpa. IN PTR 74.190.client.vntx.net.
- 75.190.110.204.in-addr.arpa. IN PTR 75.190.client.vntx.net.
- 76.190.110.204.in-addr.arpa. IN PTR 76.190.client.vntx.net.
- 77.190.110.204.in-addr.arpa. IN PTR 77.190.client.vntx.net.
- 78.190.110.204.in-addr.arpa. IN PTR 78.190.client.vntx.net.
- 79.190.110.204.in-addr.arpa. IN PTR 79.190.client.vntx.net.
- 80.190.110.204.in-addr.arpa. IN PTR 80.190.client.vntx.net.
- 81.190.110.204.in-addr.arpa. IN PTR 81.190.client.vntx.net.
- 82.190.110.204.in-addr.arpa. IN PTR 82.190.client.vntx.net.
- 83.190.110.204.in-addr.arpa. IN PTR 83.190.client.vntx.net.
- 84.190.110.204.in-addr.arpa. IN PTR 84.190.client.vntx.net.
- 85.190.110.204.in-addr.arpa. IN PTR 85.190.client.vntx.net.
- 86.190.110.204.in-addr.arpa. IN PTR 86.190.client.vntx.net.
- 87.190.110.204.in-addr.arpa. IN PTR 87.190.client.vntx.net.
- 88.190.110.204.in-addr.arpa. IN PTR 88.190.client.vntx.net.
- 89.190.110.204.in-addr.arpa. IN PTR 89.190.client.vntx.net.
- 90.190.110.204.in-addr.arpa. IN PTR 90.190.client.vntx.net.
- 91.190.110.204.in-addr.arpa. IN PTR 91.190.client.vntx.net.
- 92.190.110.204.in-addr.arpa. IN PTR 92.190.client.vntx.net.
- 93.190.110.204.in-addr.arpa. IN PTR 93.190.client.vntx.net.
- 94.190.110.204.in-addr.arpa. IN PTR 94.190.client.vntx.net.
- 95.190.110.204.in-addr.arpa. IN PTR 95.190.client.vntx.net.
- 96.190.110.204.in-addr.arpa. IN PTR 96.190.client.vntx.net.
- 97.190.110.204.in-addr.arpa. IN PTR 97.190.client.vntx.net.
- 98.190.110.204.in-addr.arpa. IN PTR 98.190.client.vntx.net.
- 99.190.110.204.in-addr.arpa. IN PTR 99.190.client.vntx.net.
- 100.190.110.204.in-addr.arpa. IN PTR 100.190.client.vntx.net.
- 101.190.110.204.in-addr.arpa. IN PTR 101.190.client.vntx.net.
- 102.190.110.204.in-addr.arpa. IN PTR 102.190.client.vntx.net.
- 103.190.110.204.in-addr.arpa. IN PTR 103.190.client.vntx.net.
- 104.190.110.204.in-addr.arpa. IN PTR 104.190.client.vntx.net.
- 105.190.110.204.in-addr.arpa. IN PTR 105.190.client.vntx.net.
- 106.190.110.204.in-addr.arpa. IN PTR 106.190.client.vntx.net.
- 107.190.110.204.in-addr.arpa. IN PTR 107.190.client.vntx.net.
- 108.190.110.204.in-addr.arpa. IN PTR 108.190.client.vntx.net.
- 109.190.110.204.in-addr.arpa. IN PTR 109.190.client.vntx.net.
- 110.190.110.204.in-addr.arpa. IN PTR 110.190.client.vntx.net.
- 111.190.110.204.in-addr.arpa. IN PTR 111.190.client.vntx.net.
- 112.190.110.204.in-addr.arpa. IN PTR 112.190.client.vntx.net.
- 113.190.110.204.in-addr.arpa. IN PTR 113.190.client.vntx.net.
- 114.190.110.204.in-addr.arpa. IN PTR 114.190.client.vntx.net.
- 115.190.110.204.in-addr.arpa. IN PTR 115.190.client.vntx.net.
- 116.190.110.204.in-addr.arpa. IN PTR 116.190.client.vntx.net.
- 117.190.110.204.in-addr.arpa. IN PTR 117.190.client.vntx.net.
- 118.190.110.204.in-addr.arpa. IN PTR 118.190.client.vntx.net.
- 120.190.110.204.in-addr.arpa. IN PTR 120.190.client.vntx.net.
- 121.190.110.204.in-addr.arpa. IN PTR 121.190.client.vntx.net.
- 122.190.110.204.in-addr.arpa. IN PTR 122.190.client.vntx.net.
- 123.190.110.204.in-addr.arpa. IN PTR 123.190.client.vntx.net.
- 124.190.110.204.in-addr.arpa. IN PTR 124.190.client.vntx.net.
- 125.190.110.204.in-addr.arpa. IN PTR 125.190.client.vntx.net.
- 126.190.110.204.in-addr.arpa. IN PTR 126.190.client.vntx.net.
- 127.190.110.204.in-addr.arpa. IN PTR 127.190.client.vntx.net.
- 128.190.110.204.in-addr.arpa. IN PTR 128.190.client.vntx.net.
- 129.190.110.204.in-addr.arpa. IN PTR 129.190.client.vntx.net.
- 130.190.110.204.in-addr.arpa. IN PTR 130.190.client.vntx.net.
- 131.190.110.204.in-addr.arpa. IN PTR 131.190.client.vntx.net.
- 132.190.110.204.in-addr.arpa. IN PTR 132.190.client.vntx.net.
- 133.190.110.204.in-addr.arpa. IN PTR 133.190.client.vntx.net.
- 134.190.110.204.in-addr.arpa. IN PTR 134.190.client.vntx.net.
- 135.190.110.204.in-addr.arpa. IN PTR 135.190.client.vntx.net.
- 136.190.110.204.in-addr.arpa. IN PTR 136.190.client.vntx.net.
- 137.190.110.204.in-addr.arpa. IN PTR 137.190.client.vntx.net.
- 138.190.110.204.in-addr.arpa. IN PTR 138.190.client.vntx.net.
- 139.190.110.204.in-addr.arpa. IN PTR 139.190.client.vntx.net.
- 140.190.110.204.in-addr.arpa. IN PTR 140.190.client.vntx.net.
- 141.190.110.204.in-addr.arpa. IN PTR 141.190.client.vntx.net.
- 142.190.110.204.in-addr.arpa. IN PTR 142.190.client.vntx.net.
- 143.190.110.204.in-addr.arpa. IN PTR 143.190.client.vntx.net.
- 144.190.110.204.in-addr.arpa. IN PTR 144.190.client.vntx.net.
- 145.190.110.204.in-addr.arpa. IN PTR 145.190.client.vntx.net.
- 146.190.110.204.in-addr.arpa. IN PTR 146.190.client.vntx.net.
- 147.190.110.204.in-addr.arpa. IN PTR 147.190.client.vntx.net.
- 148.190.110.204.in-addr.arpa. IN PTR 148.190.client.vntx.net.
- 149.190.110.204.in-addr.arpa. IN PTR 149.190.client.vntx.net.
- 150.190.110.204.in-addr.arpa. IN PTR 150.190.client.vntx.net.
- 151.190.110.204.in-addr.arpa. IN PTR 151.190.client.vntx.net.
- 152.190.110.204.in-addr.arpa. IN PTR 152.190.client.vntx.net.
- 153.190.110.204.in-addr.arpa. IN PTR 153.190.client.vntx.net.
- 154.190.110.204.in-addr.arpa. IN PTR 154.190.client.vntx.net.
- 155.190.110.204.in-addr.arpa. IN PTR 155.190.client.vntx.net.
- 156.190.110.204.in-addr.arpa. IN PTR 156.190.client.vntx.net.
- 157.190.110.204.in-addr.arpa. IN PTR 157.190.client.vntx.net.
- 158.190.110.204.in-addr.arpa. IN PTR 158.190.client.vntx.net.
- 159.190.110.204.in-addr.arpa. IN PTR 159.190.client.vntx.net.
- 160.190.110.204.in-addr.arpa. IN PTR 160.190.client.vntx.net.
- 161.190.110.204.in-addr.arpa. IN PTR 161.190.client.vntx.net.
- 162.190.110.204.in-addr.arpa. IN PTR 162.190.client.vntx.net.
- 163.190.110.204.in-addr.arpa. IN PTR 163.190.client.vntx.net.
- 164.190.110.204.in-addr.arpa. IN PTR 164.190.client.vntx.net.
- 165.190.110.204.in-addr.arpa. IN PTR 165.190.client.vntx.net.
- 166.190.110.204.in-addr.arpa. IN PTR 166.190.client.vntx.net.
- 167.190.110.204.in-addr.arpa. IN PTR 167.190.client.vntx.net.
- 169.190.110.204.in-addr.arpa. IN PTR 169.190.client.vntx.net.
- 170.190.110.204.in-addr.arpa. IN PTR 170.190.client.vntx.net.
- 171.190.110.204.in-addr.arpa. IN PTR 171.190.client.vntx.net.
- 172.190.110.204.in-addr.arpa. IN PTR 172.190.client.vntx.net.
- 173.190.110.204.in-addr.arpa. IN PTR 173.190.client.vntx.net.
- 174.190.110.204.in-addr.arpa. IN PTR 174.190.client.vntx.net.
- 175.190.110.204.in-addr.arpa. IN PTR 175.190.client.vntx.net.
- 176.190.110.204.in-addr.arpa. IN PTR 176.190.client.vntx.net.
- 177.190.110.204.in-addr.arpa. IN PTR 177.190.client.vntx.net.
- 178.190.110.204.in-addr.arpa. IN PTR 178.190.client.vntx.net.
- 179.190.110.204.in-addr.arpa. IN PTR 179.190.client.vntx.net.
- 180.190.110.204.in-addr.arpa. IN PTR 180.190.client.vntx.net.
- 181.190.110.204.in-addr.arpa. IN PTR 181.190.client.vntx.net.
- 182.190.110.204.in-addr.arpa. IN PTR 182.190.client.vntx.net.
- 183.190.110.204.in-addr.arpa. IN PTR 183.190.client.vntx.net.
- 184.190.110.204.in-addr.arpa. IN PTR 184.190.client.vntx.net.
- 185.190.110.204.in-addr.arpa. IN PTR 185.190.client.vntx.net.
- 186.190.110.204.in-addr.arpa. IN PTR 186.190.client.vntx.net.
- 187.190.110.204.in-addr.arpa. IN PTR 187.190.client.vntx.net.
- 188.190.110.204.in-addr.arpa. IN PTR 188.190.client.vntx.net.
- 189.190.110.204.in-addr.arpa. IN PTR 189.190.client.vntx.net.
- 190.190.110.204.in-addr.arpa. IN PTR 190.190.client.vntx.net.
- 191.190.110.204.in-addr.arpa. IN PTR 191.190.client.vntx.net.
- 192.190.110.204.in-addr.arpa. IN PTR 192.190.client.vntx.net.
- 193.190.110.204.in-addr.arpa. IN PTR 193.190.client.vntx.net.
- 194.190.110.204.in-addr.arpa. IN PTR 194.190.client.vntx.net.
- 195.190.110.204.in-addr.arpa. IN PTR 195.190.client.vntx.net.
- 196.190.110.204.in-addr.arpa. IN PTR 196.190.client.vntx.net.
- 197.190.110.204.in-addr.arpa. IN PTR 197.190.client.vntx.net.
- 198.190.110.204.in-addr.arpa. IN PTR 198.190.client.vntx.net.
- 199.190.110.204.in-addr.arpa. IN PTR 199.190.client.vntx.net.
- 200.190.110.204.in-addr.arpa. IN PTR 200.190.client.vntx.net.
- 201.190.110.204.in-addr.arpa. IN PTR 201.190.client.vntx.net.
- 202.190.110.204.in-addr.arpa. IN PTR 202.190.client.vntx.net.
- 203.190.110.204.in-addr.arpa. IN PTR 203.190.client.vntx.net.
- 204.190.110.204.in-addr.arpa. IN PTR 204.190.client.vntx.net.
- 205.190.110.204.in-addr.arpa. IN PTR 205.190.client.vntx.net.
- 206.190.110.204.in-addr.arpa. IN PTR 206.190.client.vntx.net.
- 207.190.110.204.in-addr.arpa. IN PTR 207.190.client.vntx.net.
- 208.190.110.204.in-addr.arpa. IN PTR 208.190.client.vntx.net.
- 209.190.110.204.in-addr.arpa. IN PTR 209.190.client.vntx.net.
- 210.190.110.204.in-addr.arpa. IN PTR 210.190.client.vntx.net.
- 211.190.110.204.in-addr.arpa. IN PTR 211.190.client.vntx.net.
- 212.190.110.204.in-addr.arpa. IN PTR 212.190.client.vntx.net.
- 213.190.110.204.in-addr.arpa. IN PTR 213.190.client.vntx.net.
- 214.190.110.204.in-addr.arpa. IN PTR 214.190.client.vntx.net.
- 215.190.110.204.in-addr.arpa. IN PTR 215.190.client.vntx.net.
- 216.190.110.204.in-addr.arpa. IN PTR 216.190.client.vntx.net.
- 217.190.110.204.in-addr.arpa. IN PTR 217.190.client.vntx.net.
- 218.190.110.204.in-addr.arpa. IN PTR 218.190.client.vntx.net.
- 219.190.110.204.in-addr.arpa. IN PTR 219.190.client.vntx.net.
- 220.190.110.204.in-addr.arpa. IN PTR 220.190.client.vntx.net.
- 221.190.110.204.in-addr.arpa. IN PTR 221.190.client.vntx.net.
- 222.190.110.204.in-addr.arpa. IN PTR 222.190.client.vntx.net.
- 223.190.110.204.in-addr.arpa. IN PTR 223.190.client.vntx.net.
- 224.190.110.204.in-addr.arpa. IN PTR 224.190.client.vntx.net.
- 225.190.110.204.in-addr.arpa. IN PTR 225.190.client.vntx.net.
- 226.190.110.204.in-addr.arpa. IN PTR 226.190.client.vntx.net.
- 227.190.110.204.in-addr.arpa. IN PTR 227.190.client.vntx.net.
- 228.190.110.204.in-addr.arpa. IN PTR 228.190.client.vntx.net.
- 229.190.110.204.in-addr.arpa. IN PTR 229.190.client.vntx.net.
- 230.190.110.204.in-addr.arpa. IN PTR 230.190.client.vntx.net.
- 231.190.110.204.in-addr.arpa. IN PTR 231.190.client.vntx.net.
- 232.190.110.204.in-addr.arpa. IN PTR 232.190.client.vntx.net.
- 233.190.110.204.in-addr.arpa. IN PTR 233.190.client.vntx.net.
- 234.190.110.204.in-addr.arpa. IN PTR 234.190.client.vntx.net.
- 235.190.110.204.in-addr.arpa. IN PTR 235.190.client.vntx.net.
- 236.190.110.204.in-addr.arpa. IN PTR 236.190.client.vntx.net.
- 237.190.110.204.in-addr.arpa. IN PTR 237.190.client.vntx.net.
- 238.190.110.204.in-addr.arpa. IN PTR 238.190.client.vntx.net.
- 239.190.110.204.in-addr.arpa. IN PTR 239.190.client.vntx.net.
- 240.190.110.204.in-addr.arpa. IN PTR 240.190.client.vntx.net.
- 241.190.110.204.in-addr.arpa. IN PTR 241.190.client.vntx.net.
- 242.190.110.204.in-addr.arpa. IN PTR 242.190.client.vntx.net.
- 243.190.110.204.in-addr.arpa. IN PTR 243.190.client.vntx.net.
- 244.190.110.204.in-addr.arpa. IN PTR 244.190.client.vntx.net.
- 245.190.110.204.in-addr.arpa. IN PTR 245.190.client.vntx.net.
- 246.190.110.204.in-addr.arpa. IN PTR 246.190.client.vntx.net.
- 247.190.110.204.in-addr.arpa. IN PTR 247.190.client.vntx.net.
- 248.190.110.204.in-addr.arpa. IN PTR 248.190.client.vntx.net.
- 249.190.110.204.in-addr.arpa. IN PTR 249.190.client.vntx.net.
- 250.190.110.204.in-addr.arpa. IN PTR 250.190.client.vntx.net.
- 251.190.110.204.in-addr.arpa. IN PTR 251.190.client.vntx.net.
- 252.190.110.204.in-addr.arpa. IN PTR 252.190.client.vntx.net.
- 253.190.110.204.in-addr.arpa. IN PTR 253.190.client.vntx.net.
- 254.190.110.204.in-addr.arpa. IN PTR 254.190.client.vntx.net.
- 255.190.110.204.in-addr.arpa. IN PTR 255.190.client.vntx.net.

269
ansible/group_vars/bind9_servers/reverse_191.sync-conflict-20260129-142816-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,269 @@
---
# 191.110.204.in-addr.arpa reverse DNS zone
# Mapping 204.110.191.0-255 -> *.191.client.vntx.net
# Exception: 204.110.191.5 -> mail.mcintire.me
reverse_191_zone:
name: 191.110.204.in-addr.arpa
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
other_name_servers:
- 0.191.110.204.in-addr.arpa. IN PTR 0.191.client.vntx.net.
- 1.191.110.204.in-addr.arpa. IN PTR 1.191.client.vntx.net.
- 2.191.110.204.in-addr.arpa. IN PTR 2.191.client.vntx.net.
- 3.191.110.204.in-addr.arpa. IN PTR 3.191.client.vntx.net.
- 4.191.110.204.in-addr.arpa. IN PTR 4.191.client.vntx.net.
- 5.191.110.204.in-addr.arpa. IN PTR mail.mcintire.me.
- 6.191.110.204.in-addr.arpa. IN PTR 6.191.client.vntx.net.
- 7.191.110.204.in-addr.arpa. IN PTR 7.191.client.vntx.net.
- 8.191.110.204.in-addr.arpa. IN PTR 8.191.client.vntx.net.
- 9.191.110.204.in-addr.arpa. IN PTR 9.191.client.vntx.net.
- 10.191.110.204.in-addr.arpa. IN PTR 10.191.client.vntx.net.
- 11.191.110.204.in-addr.arpa. IN PTR 11.191.client.vntx.net.
- 12.191.110.204.in-addr.arpa. IN PTR 12.191.client.vntx.net.
- 13.191.110.204.in-addr.arpa. IN PTR 13.191.client.vntx.net.
- 14.191.110.204.in-addr.arpa. IN PTR 14.191.client.vntx.net.
- 15.191.110.204.in-addr.arpa. IN PTR 15.191.client.vntx.net.
- 16.191.110.204.in-addr.arpa. IN PTR 16.191.client.vntx.net.
- 17.191.110.204.in-addr.arpa. IN PTR 17.191.client.vntx.net.
- 18.191.110.204.in-addr.arpa. IN PTR 18.191.client.vntx.net.
- 19.191.110.204.in-addr.arpa. IN PTR 19.191.client.vntx.net.
- 20.191.110.204.in-addr.arpa. IN PTR 20.191.client.vntx.net.
- 21.191.110.204.in-addr.arpa. IN PTR 21.191.client.vntx.net.
- 22.191.110.204.in-addr.arpa. IN PTR 22.191.client.vntx.net.
- 23.191.110.204.in-addr.arpa. IN PTR 23.191.client.vntx.net.
- 24.191.110.204.in-addr.arpa. IN PTR 24.191.client.vntx.net.
- 25.191.110.204.in-addr.arpa. IN PTR 25.191.client.vntx.net.
- 26.191.110.204.in-addr.arpa. IN PTR 26.191.client.vntx.net.
- 27.191.110.204.in-addr.arpa. IN PTR 27.191.client.vntx.net.
- 28.191.110.204.in-addr.arpa. IN PTR 28.191.client.vntx.net.
- 29.191.110.204.in-addr.arpa. IN PTR 29.191.client.vntx.net.
- 30.191.110.204.in-addr.arpa. IN PTR 30.191.client.vntx.net.
- 31.191.110.204.in-addr.arpa. IN PTR 31.191.client.vntx.net.
- 32.191.110.204.in-addr.arpa. IN PTR 32.191.client.vntx.net.
- 33.191.110.204.in-addr.arpa. IN PTR 33.191.client.vntx.net.
- 34.191.110.204.in-addr.arpa. IN PTR 34.191.client.vntx.net.
- 35.191.110.204.in-addr.arpa. IN PTR 35.191.client.vntx.net.
- 36.191.110.204.in-addr.arpa. IN PTR 36.191.client.vntx.net.
- 37.191.110.204.in-addr.arpa. IN PTR 37.191.client.vntx.net.
- 38.191.110.204.in-addr.arpa. IN PTR 38.191.client.vntx.net.
- 39.191.110.204.in-addr.arpa. IN PTR 39.191.client.vntx.net.
- 40.191.110.204.in-addr.arpa. IN PTR 40.191.client.vntx.net.
- 41.191.110.204.in-addr.arpa. IN PTR 41.191.client.vntx.net.
- 42.191.110.204.in-addr.arpa. IN PTR 42.191.client.vntx.net.
- 43.191.110.204.in-addr.arpa. IN PTR 43.191.client.vntx.net.
- 44.191.110.204.in-addr.arpa. IN PTR 44.191.client.vntx.net.
- 45.191.110.204.in-addr.arpa. IN PTR 45.191.client.vntx.net.
- 46.191.110.204.in-addr.arpa. IN PTR 46.191.client.vntx.net.
- 47.191.110.204.in-addr.arpa. IN PTR 47.191.client.vntx.net.
- 48.191.110.204.in-addr.arpa. IN PTR 48.191.client.vntx.net.
- 49.191.110.204.in-addr.arpa. IN PTR 49.191.client.vntx.net.
- 50.191.110.204.in-addr.arpa. IN PTR 50.191.client.vntx.net.
- 51.191.110.204.in-addr.arpa. IN PTR 51.191.client.vntx.net.
- 52.191.110.204.in-addr.arpa. IN PTR 52.191.client.vntx.net.
- 53.191.110.204.in-addr.arpa. IN PTR 53.191.client.vntx.net.
- 54.191.110.204.in-addr.arpa. IN PTR 54.191.client.vntx.net.
- 55.191.110.204.in-addr.arpa. IN PTR 55.191.client.vntx.net.
- 56.191.110.204.in-addr.arpa. IN PTR 56.191.client.vntx.net.
- 57.191.110.204.in-addr.arpa. IN PTR 57.191.client.vntx.net.
- 58.191.110.204.in-addr.arpa. IN PTR 58.191.client.vntx.net.
- 59.191.110.204.in-addr.arpa. IN PTR 59.191.client.vntx.net.
- 60.191.110.204.in-addr.arpa. IN PTR 60.191.client.vntx.net.
- 61.191.110.204.in-addr.arpa. IN PTR 61.191.client.vntx.net.
- 62.191.110.204.in-addr.arpa. IN PTR 62.191.client.vntx.net.
- 63.191.110.204.in-addr.arpa. IN PTR 63.191.client.vntx.net.
- 64.191.110.204.in-addr.arpa. IN PTR 64.191.client.vntx.net.
- 65.191.110.204.in-addr.arpa. IN PTR 65.191.client.vntx.net.
- 66.191.110.204.in-addr.arpa. IN PTR 66.191.client.vntx.net.
- 67.191.110.204.in-addr.arpa. IN PTR 67.191.client.vntx.net.
- 68.191.110.204.in-addr.arpa. IN PTR 68.191.client.vntx.net.
- 69.191.110.204.in-addr.arpa. IN PTR 69.191.client.vntx.net.
- 70.191.110.204.in-addr.arpa. IN PTR 70.191.client.vntx.net.
- 71.191.110.204.in-addr.arpa. IN PTR 71.191.client.vntx.net.
- 72.191.110.204.in-addr.arpa. IN PTR 72.191.client.vntx.net.
- 73.191.110.204.in-addr.arpa. IN PTR 73.191.client.vntx.net.
- 74.191.110.204.in-addr.arpa. IN PTR 74.191.client.vntx.net.
- 75.191.110.204.in-addr.arpa. IN PTR 75.191.client.vntx.net.
- 76.191.110.204.in-addr.arpa. IN PTR 76.191.client.vntx.net.
- 77.191.110.204.in-addr.arpa. IN PTR 77.191.client.vntx.net.
- 78.191.110.204.in-addr.arpa. IN PTR 78.191.client.vntx.net.
- 79.191.110.204.in-addr.arpa. IN PTR 79.191.client.vntx.net.
- 80.191.110.204.in-addr.arpa. IN PTR 80.191.client.vntx.net.
- 81.191.110.204.in-addr.arpa. IN PTR 81.191.client.vntx.net.
- 82.191.110.204.in-addr.arpa. IN PTR 82.191.client.vntx.net.
- 83.191.110.204.in-addr.arpa. IN PTR 83.191.client.vntx.net.
- 84.191.110.204.in-addr.arpa. IN PTR 84.191.client.vntx.net.
- 85.191.110.204.in-addr.arpa. IN PTR 85.191.client.vntx.net.
- 86.191.110.204.in-addr.arpa. IN PTR 86.191.client.vntx.net.
- 87.191.110.204.in-addr.arpa. IN PTR 87.191.client.vntx.net.
- 88.191.110.204.in-addr.arpa. IN PTR 88.191.client.vntx.net.
- 89.191.110.204.in-addr.arpa. IN PTR 89.191.client.vntx.net.
- 90.191.110.204.in-addr.arpa. IN PTR 90.191.client.vntx.net.
- 91.191.110.204.in-addr.arpa. IN PTR 91.191.client.vntx.net.
- 92.191.110.204.in-addr.arpa. IN PTR 92.191.client.vntx.net.
- 93.191.110.204.in-addr.arpa. IN PTR 93.191.client.vntx.net.
- 94.191.110.204.in-addr.arpa. IN PTR 94.191.client.vntx.net.
- 95.191.110.204.in-addr.arpa. IN PTR 95.191.client.vntx.net.
- 96.191.110.204.in-addr.arpa. IN PTR 96.191.client.vntx.net.
- 97.191.110.204.in-addr.arpa. IN PTR 97.191.client.vntx.net.
- 98.191.110.204.in-addr.arpa. IN PTR 98.191.client.vntx.net.
- 99.191.110.204.in-addr.arpa. IN PTR 99.191.client.vntx.net.
- 100.191.110.204.in-addr.arpa. IN PTR 100.191.client.vntx.net.
- 101.191.110.204.in-addr.arpa. IN PTR 101.191.client.vntx.net.
- 102.191.110.204.in-addr.arpa. IN PTR 102.191.client.vntx.net.
- 103.191.110.204.in-addr.arpa. IN PTR 103.191.client.vntx.net.
- 104.191.110.204.in-addr.arpa. IN PTR 104.191.client.vntx.net.
- 105.191.110.204.in-addr.arpa. IN PTR 105.191.client.vntx.net.
- 106.191.110.204.in-addr.arpa. IN PTR 106.191.client.vntx.net.
- 107.191.110.204.in-addr.arpa. IN PTR 107.191.client.vntx.net.
- 108.191.110.204.in-addr.arpa. IN PTR 108.191.client.vntx.net.
- 109.191.110.204.in-addr.arpa. IN PTR 109.191.client.vntx.net.
- 110.191.110.204.in-addr.arpa. IN PTR 110.191.client.vntx.net.
- 111.191.110.204.in-addr.arpa. IN PTR 111.191.client.vntx.net.
- 112.191.110.204.in-addr.arpa. IN PTR 112.191.client.vntx.net.
- 113.191.110.204.in-addr.arpa. IN PTR 113.191.client.vntx.net.
- 114.191.110.204.in-addr.arpa. IN PTR 114.191.client.vntx.net.
- 115.191.110.204.in-addr.arpa. IN PTR 115.191.client.vntx.net.
- 116.191.110.204.in-addr.arpa. IN PTR 116.191.client.vntx.net.
- 117.191.110.204.in-addr.arpa. IN PTR 117.191.client.vntx.net.
- 118.191.110.204.in-addr.arpa. IN PTR 118.191.client.vntx.net.
- 119.191.110.204.in-addr.arpa. IN PTR 119.191.client.vntx.net.
- 120.191.110.204.in-addr.arpa. IN PTR 120.191.client.vntx.net.
- 121.191.110.204.in-addr.arpa. IN PTR 121.191.client.vntx.net.
- 122.191.110.204.in-addr.arpa. IN PTR 122.191.client.vntx.net.
- 123.191.110.204.in-addr.arpa. IN PTR 123.191.client.vntx.net.
- 124.191.110.204.in-addr.arpa. IN PTR 124.191.client.vntx.net.
- 125.191.110.204.in-addr.arpa. IN PTR 125.191.client.vntx.net.
- 126.191.110.204.in-addr.arpa. IN PTR 126.191.client.vntx.net.
- 127.191.110.204.in-addr.arpa. IN PTR 127.191.client.vntx.net.
- 128.191.110.204.in-addr.arpa. IN PTR 128.191.client.vntx.net.
- 129.191.110.204.in-addr.arpa. IN PTR 129.191.client.vntx.net.
- 130.191.110.204.in-addr.arpa. IN PTR 130.191.client.vntx.net.
- 131.191.110.204.in-addr.arpa. IN PTR 131.191.client.vntx.net.
- 132.191.110.204.in-addr.arpa. IN PTR 132.191.client.vntx.net.
- 133.191.110.204.in-addr.arpa. IN PTR 133.191.client.vntx.net.
- 134.191.110.204.in-addr.arpa. IN PTR 134.191.client.vntx.net.
- 135.191.110.204.in-addr.arpa. IN PTR 135.191.client.vntx.net.
- 136.191.110.204.in-addr.arpa. IN PTR 136.191.client.vntx.net.
- 137.191.110.204.in-addr.arpa. IN PTR 137.191.client.vntx.net.
- 138.191.110.204.in-addr.arpa. IN PTR 138.191.client.vntx.net.
- 139.191.110.204.in-addr.arpa. IN PTR 139.191.client.vntx.net.
- 140.191.110.204.in-addr.arpa. IN PTR 140.191.client.vntx.net.
- 141.191.110.204.in-addr.arpa. IN PTR 141.191.client.vntx.net.
- 142.191.110.204.in-addr.arpa. IN PTR 142.191.client.vntx.net.
- 143.191.110.204.in-addr.arpa. IN PTR 143.191.client.vntx.net.
- 144.191.110.204.in-addr.arpa. IN PTR 144.191.client.vntx.net.
- 145.191.110.204.in-addr.arpa. IN PTR 145.191.client.vntx.net.
- 146.191.110.204.in-addr.arpa. IN PTR 146.191.client.vntx.net.
- 147.191.110.204.in-addr.arpa. IN PTR 147.191.client.vntx.net.
- 148.191.110.204.in-addr.arpa. IN PTR 148.191.client.vntx.net.
- 149.191.110.204.in-addr.arpa. IN PTR 149.191.client.vntx.net.
- 150.191.110.204.in-addr.arpa. IN PTR 150.191.client.vntx.net.
- 151.191.110.204.in-addr.arpa. IN PTR 151.191.client.vntx.net.
- 152.191.110.204.in-addr.arpa. IN PTR 152.191.client.vntx.net.
- 153.191.110.204.in-addr.arpa. IN PTR 153.191.client.vntx.net.
- 154.191.110.204.in-addr.arpa. IN PTR 154.191.client.vntx.net.
- 155.191.110.204.in-addr.arpa. IN PTR 155.191.client.vntx.net.
- 156.191.110.204.in-addr.arpa. IN PTR 156.191.client.vntx.net.
- 157.191.110.204.in-addr.arpa. IN PTR 157.191.client.vntx.net.
- 158.191.110.204.in-addr.arpa. IN PTR 158.191.client.vntx.net.
- 159.191.110.204.in-addr.arpa. IN PTR 159.191.client.vntx.net.
- 160.191.110.204.in-addr.arpa. IN PTR 160.191.client.vntx.net.
- 161.191.110.204.in-addr.arpa. IN PTR 161.191.client.vntx.net.
- 162.191.110.204.in-addr.arpa. IN PTR 162.191.client.vntx.net.
- 163.191.110.204.in-addr.arpa. IN PTR 163.191.client.vntx.net.
- 164.191.110.204.in-addr.arpa. IN PTR 164.191.client.vntx.net.
- 165.191.110.204.in-addr.arpa. IN PTR 165.191.client.vntx.net.
- 166.191.110.204.in-addr.arpa. IN PTR 166.191.client.vntx.net.
- 167.191.110.204.in-addr.arpa. IN PTR 167.191.client.vntx.net.
- 168.191.110.204.in-addr.arpa. IN PTR 168.191.client.vntx.net.
- 169.191.110.204.in-addr.arpa. IN PTR 169.191.client.vntx.net.
- 170.191.110.204.in-addr.arpa. IN PTR 170.191.client.vntx.net.
- 171.191.110.204.in-addr.arpa. IN PTR 171.191.client.vntx.net.
- 172.191.110.204.in-addr.arpa. IN PTR 172.191.client.vntx.net.
- 173.191.110.204.in-addr.arpa. IN PTR 173.191.client.vntx.net.
- 174.191.110.204.in-addr.arpa. IN PTR 174.191.client.vntx.net.
- 175.191.110.204.in-addr.arpa. IN PTR 175.191.client.vntx.net.
- 176.191.110.204.in-addr.arpa. IN PTR 176.191.client.vntx.net.
- 177.191.110.204.in-addr.arpa. IN PTR 177.191.client.vntx.net.
- 178.191.110.204.in-addr.arpa. IN PTR 178.191.client.vntx.net.
- 179.191.110.204.in-addr.arpa. IN PTR 179.191.client.vntx.net.
- 180.191.110.204.in-addr.arpa. IN PTR 180.191.client.vntx.net.
- 181.191.110.204.in-addr.arpa. IN PTR 181.191.client.vntx.net.
- 182.191.110.204.in-addr.arpa. IN PTR 182.191.client.vntx.net.
- 183.191.110.204.in-addr.arpa. IN PTR 183.191.client.vntx.net.
- 184.191.110.204.in-addr.arpa. IN PTR 184.191.client.vntx.net.
- 185.191.110.204.in-addr.arpa. IN PTR 185.191.client.vntx.net.
- 186.191.110.204.in-addr.arpa. IN PTR 186.191.client.vntx.net.
- 187.191.110.204.in-addr.arpa. IN PTR 187.191.client.vntx.net.
- 188.191.110.204.in-addr.arpa. IN PTR 188.191.client.vntx.net.
- 189.191.110.204.in-addr.arpa. IN PTR 189.191.client.vntx.net.
- 190.191.110.204.in-addr.arpa. IN PTR 190.191.client.vntx.net.
- 191.191.110.204.in-addr.arpa. IN PTR 191.191.client.vntx.net.
- 192.191.110.204.in-addr.arpa. IN PTR 192.191.client.vntx.net.
- 193.191.110.204.in-addr.arpa. IN PTR 193.191.client.vntx.net.
- 194.191.110.204.in-addr.arpa. IN PTR 194.191.client.vntx.net.
- 195.191.110.204.in-addr.arpa. IN PTR 195.191.client.vntx.net.
- 196.191.110.204.in-addr.arpa. IN PTR 196.191.client.vntx.net.
- 197.191.110.204.in-addr.arpa. IN PTR 197.191.client.vntx.net.
- 198.191.110.204.in-addr.arpa. IN PTR 198.191.client.vntx.net.
- 199.191.110.204.in-addr.arpa. IN PTR 199.191.client.vntx.net.
- 200.191.110.204.in-addr.arpa. IN PTR 200.191.client.vntx.net.
- 201.191.110.204.in-addr.arpa. IN PTR 201.191.client.vntx.net.
- 202.191.110.204.in-addr.arpa. IN PTR 202.191.client.vntx.net.
- 203.191.110.204.in-addr.arpa. IN PTR 203.191.client.vntx.net.
- 204.191.110.204.in-addr.arpa. IN PTR 204.191.client.vntx.net.
- 205.191.110.204.in-addr.arpa. IN PTR 205.191.client.vntx.net.
- 206.191.110.204.in-addr.arpa. IN PTR 206.191.client.vntx.net.
- 207.191.110.204.in-addr.arpa. IN PTR 207.191.client.vntx.net.
- 208.191.110.204.in-addr.arpa. IN PTR 208.191.client.vntx.net.
- 209.191.110.204.in-addr.arpa. IN PTR 209.191.client.vntx.net.
- 210.191.110.204.in-addr.arpa. IN PTR 210.191.client.vntx.net.
- 211.191.110.204.in-addr.arpa. IN PTR 211.191.client.vntx.net.
- 212.191.110.204.in-addr.arpa. IN PTR 212.191.client.vntx.net.
- 213.191.110.204.in-addr.arpa. IN PTR 213.191.client.vntx.net.
- 214.191.110.204.in-addr.arpa. IN PTR 214.191.client.vntx.net.
- 215.191.110.204.in-addr.arpa. IN PTR 215.191.client.vntx.net.
- 216.191.110.204.in-addr.arpa. IN PTR 216.191.client.vntx.net.
- 217.191.110.204.in-addr.arpa. IN PTR 217.191.client.vntx.net.
- 218.191.110.204.in-addr.arpa. IN PTR 218.191.client.vntx.net.
- 219.191.110.204.in-addr.arpa. IN PTR 219.191.client.vntx.net.
- 220.191.110.204.in-addr.arpa. IN PTR 220.191.client.vntx.net.
- 221.191.110.204.in-addr.arpa. IN PTR 221.191.client.vntx.net.
- 222.191.110.204.in-addr.arpa. IN PTR 222.191.client.vntx.net.
- 223.191.110.204.in-addr.arpa. IN PTR 223.191.client.vntx.net.
- 224.191.110.204.in-addr.arpa. IN PTR 224.191.client.vntx.net.
- 225.191.110.204.in-addr.arpa. IN PTR 225.191.client.vntx.net.
- 226.191.110.204.in-addr.arpa. IN PTR 226.191.client.vntx.net.
- 227.191.110.204.in-addr.arpa. IN PTR 227.191.client.vntx.net.
- 228.191.110.204.in-addr.arpa. IN PTR 228.191.client.vntx.net.
- 229.191.110.204.in-addr.arpa. IN PTR 229.191.client.vntx.net.
- 230.191.110.204.in-addr.arpa. IN PTR 230.191.client.vntx.net.
- 231.191.110.204.in-addr.arpa. IN PTR 231.191.client.vntx.net.
- 232.191.110.204.in-addr.arpa. IN PTR 232.191.client.vntx.net.
- 233.191.110.204.in-addr.arpa. IN PTR 233.191.client.vntx.net.
- 234.191.110.204.in-addr.arpa. IN PTR 234.191.client.vntx.net.
- 235.191.110.204.in-addr.arpa. IN PTR 235.191.client.vntx.net.
- 236.191.110.204.in-addr.arpa. IN PTR 236.191.client.vntx.net.
- 237.191.110.204.in-addr.arpa. IN PTR 237.191.client.vntx.net.
- 238.191.110.204.in-addr.arpa. IN PTR 238.191.client.vntx.net.
- 239.191.110.204.in-addr.arpa. IN PTR 239.191.client.vntx.net.
- 240.191.110.204.in-addr.arpa. IN PTR 240.191.client.vntx.net.
- 241.191.110.204.in-addr.arpa. IN PTR 241.191.client.vntx.net.
- 242.191.110.204.in-addr.arpa. IN PTR 242.191.client.vntx.net.
- 243.191.110.204.in-addr.arpa. IN PTR 243.191.client.vntx.net.
- 244.191.110.204.in-addr.arpa. IN PTR 244.191.client.vntx.net.
- 245.191.110.204.in-addr.arpa. IN PTR 245.191.client.vntx.net.
- 246.191.110.204.in-addr.arpa. IN PTR 246.191.client.vntx.net.
- 247.191.110.204.in-addr.arpa. IN PTR 247.191.client.vntx.net.
- 248.191.110.204.in-addr.arpa. IN PTR 248.191.client.vntx.net.
- 249.191.110.204.in-addr.arpa. IN PTR 249.191.client.vntx.net.
- 250.191.110.204.in-addr.arpa. IN PTR 250.191.client.vntx.net.
- 251.191.110.204.in-addr.arpa. IN PTR 251.191.client.vntx.net.
- 252.191.110.204.in-addr.arpa. IN PTR 252.191.client.vntx.net.
- 253.191.110.204.in-addr.arpa. IN PTR 253.191.client.vntx.net.
- 254.191.110.204.in-addr.arpa. IN PTR 254.191.client.vntx.net.
- 255.191.110.204.in-addr.arpa. IN PTR 255.191.client.vntx.net.

37
ansible/group_vars/bind9_servers/towerops.net.sync-conflict-20260129-142452-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,37 @@
---
# towerops.net DNS zone configuration
towerops_net_zone:
name: towerops.net
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
mail_servers:
- name: mail.mcintire.me.
preference: 10
- name: mail.nsnw.ca.
preference: 20
hosts:
- name: '@'
ip: 204.110.191.195
other_name_servers:
- autodiscover.towerops.net. IN CNAME mail.mcintire.me.
- autoconfig.towerops.net. IN CNAME mail.mcintire.me.
- _autodiscover._tcp.towerops.net. IN SRV 0 0 443 mail.mcintire.me.
- 4uwsaywjpmk35j36pfiz4vr37dyy4v7z._domainkey.towerops.net. IN CNAME 4uwsaywjpmk35j36pfiz4vr37dyy4v7z.dkim.amazonses.com.
- l7lbifvot6nv3wwho5rs35xzqzzinz5f._domainkey.towerops.net. IN CNAME l7lbifvot6nv3wwho5rs35xzqzzinz5f.dkim.amazonses.com.
- 2skkb53ep3vfbkdstfmm2elfthurggid._domainkey.towerops.net. IN CNAME 2skkb53ep3vfbkdstfmm2elfthurggid.dkim.amazonses.com.
- mail.towerops.net. IN MX 10 feedback-smtp.us-east-1.amazonses.com.
- em6505.towerops.net. IN CNAME u177982.wl233.sendgrid.net.
- s1._domainkey.towerops.net. IN CNAME s1.domainkey.u177982.wl233.sendgrid.net.
- s2._domainkey.towerops.net. IN CNAME s2.domainkey.u177982.wl233.sendgrid.net.
text:
- name: '@'
text: '"v=spf1 mx a ip4:204.110.191.5 ~all"'
- name: mail
text: '"v=spf1 include:amazonses.com ~all"'
- name: _dmarc
text: '"v=DMARC1; p=none;"'
- name: dkim._domainkey
text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFm6nd0L7/nAO4m0MPxdjwRAup5C90DPSPa0TQBDT8S2WvASyQUPV8xSbICGMj6FjZYNd5ph/0VK47gDulxQgNQT96IVf2ooTfkvY/80bAyEdtJbpjEUzQnX5YBi/pJigQx2EeCdaojUZumeIdlFlzeb8QQIEtQhVnyc1Xc/Z8ljPMW1H9DXLSDINjV6UTaXX+PZ7jgpRKgU+RnJNcqTAkhhKQ4bMcRfOam/lF6wPOWte1A7ir08TdE8O67ioqygkr/ivAp7xvV4vGOkY6buLLE+c3exY+my2qTCZgJyUMAhkZzYqzGo1csfHH8x+O2XN/k8Z5jPhq8LSvl9XkllKwIDAQAB"'

94
ansible/group_vars/bind9_servers/vntx.net.sync-conflict-20260129-153457-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,94 @@
---
# vntx.net DNS zone configuration
# NOTE: This zone includes 1,016 dynamically generated client records (*.188.client, *.189.client, *.190.client, *.191.client)
# These records map IPs 204.110.188.1-254, 204.110.189.1-254, 204.110.190.1-254, 204.110.191.1-254
# Consider keeping these in Terraform or generating them programmatically via a template
vntx_net_zone:
name: vntx.net
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
mail_servers:
- name: vntx-net.mail.protection.outlook.com.
preference: 0
hosts:
- name: '@'
ip: 198.185.159.144
- name: climax
ip: 204.110.188.62
- name: core
ip: 10.254.254.253
- name: culleoka
ip: 204.110.188.158
- name: edge
ip: 204.110.191.190
- name: librenms
ip: 204.110.191.227
- name: logs
ip: 204.110.191.229
- name: monitor
ip: 204.110.191.241
- name: netbox
ip: 204.110.191.243
- name: newhope
ip: 204.110.188.190
- name: ns1
ip: 204.110.191.249
- name: ns2
ip: 204.110.191.239
- name: preseem
ip: 204.110.191.225
- name: resolver-01
ip: 204.110.191.240
- name: resolver-02
ip: 204.110.191.250
- name: resolver1
ip: 204.110.191.240
- name: resolver2
ip: 204.110.191.250
- name: unimus
ip: 204.110.191.238
- name: verona
ip: 204.110.188.254
- name: routers
ip: 155.138.241.157
- name: vpn
ip: 204.110.191.247
- name: radius
ip: 204.110.191.248
- name: speedtest
ip: 204.110.191.228
- name: aprs
ip: 204.110.191.232
- name: g2
ip: 204.110.191.221
- name: net
ip: 104.238.146.79
- name: uisp
ip: 204.110.191.224
- name: dns
ip: 204.110.191.193
text:
- name: '@'
text: '"v=spf1 include:spf.protection.outlook.com include:mailgun.org -all"'
- name: _twilio
text: '"twilio-domain-verification=12bf63d61b86412618bdb4ab6c2b287a"'
- name: _dmarc
text: '"v=DMARC1; p=none"'
- name: _updown
text: '"updown-page=p/34yuc"'
- name: _github-challenge-vntx
text: '"34ea2705e4"'
- name: _github-pages-challenge-gmcintire
text: '"d125f4244edd0120ee0fa073d3acf1"'
- name: krs._domainkey.mg
text: '"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHbWtJ5uPGEOPmJrT36WBXKxVL0b4fqjIM4n6oXK4zaUucqYp7jeoKG+FTO5XEjyja7hsP9WahntUrVb8WI5V6Cj0CznesMrM7oQRntcyuy8mSD1zilmZe4q2Kc65gj2MRrkg3tkJfogXHNz2rxmquNu/DxsFLeQP8a2E5tYXVFwIDAQAB"'
- name: pic._domainkey.mg
text: '"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdv4ZUjhb9l0Nt1aEJMnH/TVNdVn9CEKkb8+RX3qBPMFGmJWrJ3BIFwOSTUBiPeCgd2vc4zOOv7iQhEgNTlIVNT/V1sY70Myo5t+tJCuJQT/G4h5D1u7LZB6YEOKTgd5wF5AoW/nLvKVEPyKl5mThB9KmIGqF5FMm9C9FWP8m6SQIDAQAB"'
- name: s1._domainkey.mg
text: '"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI3w7b9bBNcWzSH8DspZbRNp+9G9pHbCfmHmr3r2JqXh+F8bFlCK6gJqEQW7SIJgYMmSJ5GlYyy4A3VxJJFcWLZb3dxMoWkGjrJ3gEUNQGmG6rnJ7eXJxKb5J2mGgEfQgCgkWXPFRmJhKXPWoZP3RqU2vJZ3t7vJxWHmv0bQPHKQIDAQAB"'
- name: s2._domainkey.mg
text: '"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDc3JXQvGMBl3cW+3N2OPLJwlP4cMvPp9yOQM9X1TLxJWX7Hd7m6rJ1Xf2T3PGP9ZDPfJGXh+PfGPYVJYP2JXGPfP9HPfP3GPfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHQIDAQAB"'

10
ansible/group_vars/bind9_servers/vntx.org.sync-conflict-20260129-161402-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,10 @@
---
# vntx.org DNS zone configuration
vntx_org_zone:
name: vntx.org
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
hosts: []

46
ansible/group_vars/bind9_servers/w5isp.com.sync-conflict-20260129-153130-ZJZJYMM.yml Normal file
View file

@ -0,0 +1,46 @@
---
# w5isp.com DNS zone configuration
w5isp_com_zone:
name: w5isp.com
type: master
create_reverse_zones: false
name_servers:
- ns1.as393837.net.
- ns-global.kjsl.com.
mail_servers:
- name: mail
preference: 10
hosts:
- name: "@"
ip: 204.110.191.5
- name: home
ip: 204.110.191.1
- name: photos
ip: 204.110.191.8
- name: skippy
ip: 204.110.191.8
- name: mail
ip: 204.110.191.5
- name: dokku
ip: 204.110.191.218
- name: "vm1"
ip: 172.245.56.83
- name: "pangolin"
ip: 172.245.56.83
- name: "*"
ip: 172.245.56.83
other_name_servers:
- ha.w5isp.com. IN CNAME q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa.
- autodiscover.w5isp.com. IN CNAME mail.w5isp.com.
- autoconfig.w5isp.com. IN CNAME mail.w5isp.com.
- em40.w5isp.com. IN CNAME u177982.wl233.sendgrid.net.
- s1._domainkey.w5isp.com. IN CNAME s1.domainkey.u177982.wl233.sendgrid.net.
- s2._domainkey.w5isp.com. IN CNAME s2.domainkey.u177982.wl233.sendgrid.net.
- _autodiscover._tcp.w5isp.com. IN SRV 0 0 443 mail.w5isp.com.
text:
- name: "@"
text: '"v=spf1 mx a ip4:204.110.191.5 ~all"'
- name: dkim._domainkey
text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB"'
- name: _dmarc
text: '"v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1"'

31
ansible/hosts.sync-conflict-20260129-160647-ZJZJYMM Normal file
View file

@ -0,0 +1,31 @@
[vntx_servers]
#logs.vntx.net
radius.vntx.net
vpn.vntx.net
netbox.vntx.net
#ntp.vntx.net
unimus.vntx.net
[monitoring_servers]
monitor.vntx.net
[home_servers]
skippy.w5isp.com
mail.mcintire.me ansible_host=204.110.191.5
dokku.w5isp.com
camper
[caddy_servers]
skippy.w5isp.com
#[syncthing_servers]
#sync.w5isp.com
[bind9_servers]
ns1.as393837.net ansible_host=204.110.191.222
vm1.w5isp.com ansible_host=172.245.56.83
[dns_servers:children]
bind9_servers
[postgresql_servers]

0
ansible/playbook.yml Executable file → Normal file
View file

0
ansible/roles/almalinux/tasks/main.yml Executable file → Normal file
View file

0
ansible/roles/general/files/etc/update-motd.d/20-banner Executable file → Normal file
View file

0
ansible/roles/ns/handlers/main.yml Executable file → Normal file
View file

0
ansible/roles/ns/tasks/main.yml Executable file → Normal file
View file

53
ansible/roles/ns/templates/zone.sync-conflict-20260129-150118-ZJZJYMM.j2 Normal file
View file

@ -0,0 +1,53 @@
$ORIGIN {{ item.name }}.
$TTL 3600
; SOA Record
@ IN SOA {{ item.name_servers[0] }} hostmaster.{{ item.name }}. (
{{ ansible_date_time.epoch }} ; Serial
10800 ; Refresh
3600 ; Retry
604800 ; Expire
3600 ) ; Negative Cache TTL
; Name Servers
{% for ns in item.name_servers %}
@ IN NS {{ ns }}
{% endfor %}
; MX Records
{% if item.mail_servers is defined %}
{% for mx in item.mail_servers %}
@ IN MX {{ mx.preference }} {{ mx.name }}
{% endfor %}
{% endif %}
; A Records
{% if item.hosts is defined %}
{% for host in item.hosts %}
{{ host.name }} IN A {{ host.ip }}
{% endfor %}
{% endif %}
; TXT Records
{% if item.text is defined %}
{% for txt in item.text %}
{% set txt_value = txt.text.strip('"') %}
{% if txt_value | length > 255 %}
{{ txt.name }} IN TXT ( "{{ txt_value[:255] }}"
{% set remaining = txt_value[255:] %}
{% for i in range(0, remaining | length, 255) %}
"{{ remaining[i:i+255] }}"{% if not loop.last %} {% endif %}
{% endfor %} )
{% else %}
{{ txt.name }} IN TXT "{{ txt_value }}"
{% endif %}
{% endfor %}
{% endif %}
; Other Records (CNAME, SRV, etc.)
{% if item.other_name_servers is defined %}
{% for record in item.other_name_servers %}
{{ record }}
{% endfor %}
{% endif %}

0
ansible/roles/ubuntu/tasks/main.yml Executable file → Normal file
View file

0
ansible/scripts/fix-deprecated-imports.sh Executable file → Normal file
View file

0
ansible/update_dns.sh Executable file → Normal file
View file

74
home/cluster/add-node3-to-etcd.sh Normal file
View file

@ -0,0 +1,74 @@
#!/bin/bash
# Script to properly join node3 to existing K3s etcd cluster
# Run this script ON node3
set -e
echo "=== Adding node3 to existing K3s etcd cluster ==="
# Step 1: Stop K3s and clean up
echo "Stopping K3s and cleaning up..."
sudo systemctl stop k3s || true
sudo systemctl stop k3s-agent || true
# Remove server data to prevent conflicts
echo "Cleaning up previous server data..."
sudo rm -rf /var/lib/rancher/k3s/server
# Step 2: Get the token from an existing server
echo ""
echo "You need to get the cluster token from node1 or node2."
echo "On node1 or node2, run:"
echo " sudo cat /var/lib/rancher/k3s/server/token"
echo ""
read -p "Enter the K3s cluster token: " K3S_TOKEN
# Step 3: Create proper K3s configuration for joining existing cluster
echo "Creating K3s configuration..."
sudo mkdir -p /etc/rancher/k3s
# Important: We need to specify this is joining an existing cluster
cat << EOF | sudo tee /etc/rancher/k3s/config.yaml
# Join existing cluster - do not initialize new one
server: "https://10.0.101.21:6443"
token: "${K3S_TOKEN}"
# Additional configuration
tls-san:
- "10.0.101.23"
- "node3"
node-ip: "10.0.101.23"
EOF
# Step 4: Uninstall K3s agent if it exists
if [ -f /usr/local/bin/k3s-agent-uninstall.sh ]; then
echo "Uninstalling K3s agent..."
sudo /usr/local/bin/k3s-agent-uninstall.sh
fi
# Step 5: Install K3s as server joining the existing cluster
echo "Installing K3s as server (joining existing cluster)..."
curl -sfL https://get.k3s.io | sh -s - server \
--server https://10.0.101.21:6443 \
--token "${K3S_TOKEN}"
# Step 6: Wait for services to start
echo "Waiting for K3s to start..."
sleep 20
# Step 7: Check status
echo "Checking K3s status..."
sudo systemctl status k3s --no-pager || true
sudo journalctl -u k3s -n 50 --no-pager
echo ""
echo "=== Setup complete ==="
echo "If you see errors about etcd already being initialized, that's expected."
echo "Check from your local machine with:"
echo " kubectl get nodes"
echo ""
echo "The node should now show roles: control-plane,etcd,master"
echo ""
echo "To check etcd cluster members from node1:"
echo " sudo k3s etcdctl member list"

57
home/cluster/aprs/README.md Normal file
View file

@ -0,0 +1,57 @@
# APRS.me Deployment
APRS.me amateur radio tracking application deployed on k3s cluster at 204.110.191.2.
## Architecture
- **Application**: 2-replica StatefulSet with Erlang clustering
- **Database**: PostgreSQL 17 with PostGIS extension (100GB Longhorn storage)
- **Cache**: Redis for job queuing and caching
- **Ingress**: Traefik with cert-manager for SSL (Let's Encrypt)
- **Access**: https://aprs.me (DNS points to 204.110.191.3)
## Prerequisites
1. GitHub container registry access for `ghcr.io/aprsme/aprs.me:latest`
- Create a GitHub personal access token with `read:packages` scope
- Run: `./create-image-pull-secret.sh <username> <token>`
## Deployment
```bash
# Deploy everything
./deploy.sh
# Check status
kubectl get pods -n aprs
kubectl get certificate -n aprs
kubectl get ingressroute -n aprs
```
## Files
- `namespace.yaml` - APRS namespace
- `postgres-secret-secure.yaml` - PostgreSQL credentials (secured)
- `postgres-deployment.yaml` - PostgreSQL 17 with PostGIS StatefulSet
- `redis.yaml` - Redis cache deployment
- `aprs-secret-secure.yaml` - Application secrets (secured)
- `aprs-configmap.yaml` - APRS configuration (callsign, server, etc.)
- `aprs-rbac.yaml` - Service account and permissions for clustering
- `aprs-statefulset-with-pullsecret.yaml` - APRS application StatefulSet
- `aprs-ingressroute.yaml` - Traefik ingress with SSL certificate
- `create-image-pull-secret.sh` - Helper to create GitHub image pull secret
- `deploy.sh` - Deployment script
## Configuration
- **APRS Callsign**: W5ISP-2
- **APRS Server**: dallas.aprs2.net:10152
- **Filter**: r/33/-96/1000000000000
- **Passcode**: 15748
- **LoadBalancer IP**: 10.0.101.32 (internal)
- **Public Access**: https://aprs.me via Traefik at 204.110.191.3
## Secrets
All passwords have been generated securely and stored in `*-secure.yaml` files.
Do not commit these files to version control.

20
home/cluster/aprs/aprs-configmap.yaml Normal file
View file

@ -0,0 +1,20 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: aprs-config
namespace: aprs
data:
# APRS-IS Connection Configuration
APRS_CALLSIGN: "W5ISP-1"
APRS_SERVER: "204.110.191.232"
APRS_PORT: "10152"
APRS_FILTER: "r/33/-96/1000000000000"
APRS_PASSCODE: "15748"
# Application Configuration
PACKET_RETENTION_DAYS: "7"
CLUSTER_ENABLED: "true"
PHX_SERVER: "true"
PORT: "4000"
POOL_SIZE: "10"

70
home/cluster/aprs/aprs-ingressroute.yaml Normal file
View file

@ -0,0 +1,70 @@
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: aprs-me-cert
namespace: aprs
spec:
secretName: aprs-me-tls
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
dnsNames:
- aprs.me
- www.aprs.me
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: real-ip
namespace: aprs
spec:
headers:
customRequestHeaders:
X-Forwarded-Proto: "https"
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: aprs-https
namespace: aprs
spec:
entryPoints:
- websecure
routes:
- match: Host(`aprs.me`) || Host(`www.aprs.me`)
kind: Rule
middlewares:
- name: real-ip
services:
- name: aprs
port: 80
tls:
secretName: aprs-me-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: aprs-http
namespace: aprs
spec:
entryPoints:
- web
routes:
- match: Host(`aprs.me`) || Host(`www.aprs.me`)
kind: Rule
services:
- name: aprs
port: 80
middlewares:
- name: redirect-to-https
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: redirect-to-https
namespace: aprs
spec:
redirectScheme:
scheme: https
permanent: true

30
home/cluster/aprs/aprs-rbac.yaml Normal file
View file

@ -0,0 +1,30 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: aprs
namespace: aprs
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: aprs-endpoints-reader
namespace: aprs
rules:
- apiGroups: [""]
resources: ["endpoints", "pods"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: aprs-endpoints-reader
namespace: aprs
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: aprs-endpoints-reader
subjects:
- kind: ServiceAccount
name: aprs
namespace: aprs

13
home/cluster/aprs/aprs-secret-secure.yaml Normal file
View file

@ -0,0 +1,13 @@
---
apiVersion: v1
kind: Secret
metadata:
name: aprs-secret
namespace: aprs
type: Opaque
stringData:
DATABASE_URL: "postgres://aprs:17fZZOsYeeBCf0GN8olKaKrYCsUca25V@postgres-aprs:5432/aprsdb"
REDIS_URL: "redis://redis:6379"
SECRET_KEY_BASE: "sz31WoKApm6ud9Aik5DPRnKDQ7fd7w7GaisbPY6spkybhfU0IiuwuQbp5hxrpQzWiZnAn6045RQlhXENgrOQ"
ERLANG_COOKIE: "3LOiBOvsjdCdJGFd2m2jmLYjh44"
PHX_HOST: "aprs.me"

127
home/cluster/aprs/aprs-statefulset-with-pullsecret.yaml Normal file
View file

@ -0,0 +1,127 @@
---
apiVersion: v1
kind: Service
metadata:
name: aprs-headless
namespace: aprs
spec:
clusterIP: None
selector:
app: aprs
ports:
- name: epmd
port: 4369
targetPort: 4369
---
apiVersion: v1
kind: Service
metadata:
name: aprs
namespace: aprs
spec:
type: ClusterIP
selector:
app: aprs
ports:
- name: http
port: 80
targetPort: 4000
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: aprs
namespace: aprs
spec:
serviceName: aprs-headless
replicas: 2
selector:
matchLabels:
app: aprs
template:
metadata:
labels:
app: aprs
spec:
serviceAccountName: aprs
imagePullSecrets:
- name: ghcr-secret
initContainers:
- name: migrate
image: ghcr.io/aprsme/aprs.me:latest
command: ["/app/bin/migrate"]
envFrom:
- configMapRef:
name: aprs-config
- secretRef:
name: aprs-secret
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
containers:
- name: aprs
image: ghcr.io/aprsme/aprs.me:latest
ports:
- containerPort: 4000
name: http
- containerPort: 4369
name: epmd
envFrom:
- configMapRef:
name: aprs-config
- secretRef:
name: aprs-secret
env:
- name: POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: RELEASE_NAME
value: "aprsme@$(POD_NAME).aprs-headless.aprs.svc.cluster.local"
livenessProbe:
httpGet:
path: /
port: 4000
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /
port: 4000
initialDelaySeconds: 10
periodSeconds: 5
resources:
requests:
memory: "512Mi"
cpu: "250m"
limits:
memory: "1Gi"
cpu: "500m"
volumeMounts:
- name: tmp-volume
mountPath: /tmp
- name: app-volume
mountPath: /app/tmp
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
volumes:
- name: tmp-volume
emptyDir: {}
- name: app-volume
emptyDir: {}

25
home/cluster/aprs/create-image-pull-secret.sh Normal file
View file

@ -0,0 +1,25 @@
#!/bin/bash
# Create a GitHub personal access token with read:packages scope
# Then run this script with your GitHub username and token
if [ "$#" -ne 2 ]; then
echo "Usage: $0 <github-username> <github-token>"
echo "Create a token at: https://github.com/settings/tokens/new"
echo "Required scope: read:packages"
exit 1
fi
GITHUB_USER=$1
GITHUB_TOKEN=$2
kubectl create secret docker-registry ghcr-secret \
--docker-server=ghcr.io \
--docker-username=$GITHUB_USER \
--docker-password=$GITHUB_TOKEN \
--namespace=aprs
echo "Secret created! Now update the StatefulSet to use it:"
echo "Add this to the pod spec:"
echo " imagePullSecrets:"
echo " - name: ghcr-secret"

44
home/cluster/aprs/deploy.sh Normal file
View file

@ -0,0 +1,44 @@
#!/bin/bash
set -e
echo "Deploying APRS.me to cluster at 204.110.191.2"
# Use homelab context
kubectl config use-context admin@home
# Create namespace
echo "Creating namespace..."
kubectl apply -f namespace.yaml --validate=false
# Deploy PostgreSQL with PostGIS
echo "Deploying PostgreSQL 17 with PostGIS..."
kubectl apply -f postgres-secret-secure.yaml --validate=false
kubectl apply -f postgres-deployment.yaml --validate=false
# Wait for PostgreSQL to be ready
echo "Waiting for PostgreSQL to be ready..."
kubectl wait --for=condition=ready pod -l app=postgres-aprs -n aprs --timeout=300s
# Deploy APRS.me
echo "Deploying APRS.me application..."
kubectl apply -f aprs-secret-secure.yaml --validate=false
kubectl apply -f aprs-configmap.yaml --validate=false
kubectl apply -f aprs-rbac.yaml --validate=false
kubectl apply -f aprs-statefulset-with-pullsecret.yaml --validate=false
# Deploy Traefik ingress
echo "Deploying Traefik ingress..."
kubectl apply -f aprs-ingressroute.yaml --validate=false
echo "Deployment complete!"
echo ""
echo "To check status:"
echo "kubectl get pods -n aprs"
echo ""
echo "To get the LoadBalancer IP:"
echo "kubectl get svc aprs -n aprs"
echo ""
echo "Remember to:"
echo "1. Create GitHub image pull secret: ./create-image-pull-secret.sh <username> <token>"
echo "2. Access the application at: https://aprs.me"
echo "3. DNS points to 204.110.191.2 (Traefik ingress)"

18
home/cluster/aprs/install-postgis-manual.sh Normal file
View file

@ -0,0 +1,18 @@
#!/bin/bash
# Manual commands to install PostGIS on the PostgreSQL LXC container
echo "Run these commands on the Proxmox host:"
echo ""
echo "# 1. Update package list in the container"
echo "pct exec 300 -- apt-get update"
echo ""
echo "# 2. Install PostGIS for PostgreSQL 15"
echo "pct exec 300 -- apt-get install -y postgresql-15-postgis-3"
echo ""
echo "# 3. Enable PostGIS extension in the APRS database"
echo "pct exec 300 -- sudo -u postgres psql -d aprs -c 'CREATE EXTENSION IF NOT EXISTS postgis;'"
echo ""
echo "# 4. Verify installation"
echo "pct exec 300 -- sudo -u postgres psql -d aprs -c 'SELECT PostGIS_Version();'"
echo ""
echo "After running these commands, the APRS migrations should work."

5
home/cluster/aprs/namespace.yaml Normal file
View file

@ -0,0 +1,5 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: aprs

74
home/cluster/aprs/postgres-deployment-normal.yaml Normal file
View file

@ -0,0 +1,74 @@
---
apiVersion: v1
kind: Service
metadata:
name: postgres-aprs
namespace: aprs
spec:
selector:
app: postgres-aprs
ports:
- port: 5432
targetPort: 5432
clusterIP: None
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: postgres-aprs
namespace: aprs
spec:
serviceName: postgres-aprs
replicas: 1
selector:
matchLabels:
app: postgres-aprs
template:
metadata:
labels:
app: postgres-aprs
spec:
terminationGracePeriodSeconds: 600 # 10 minutes to shutdown gracefully
containers:
- name: postgres
image: postgis/postgis:17-3.4
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: postgres-aprs-secret
env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts:
- name: postgres-storage
mountPath: /var/lib/postgresql/data
livenessProbe:
exec:
command:
- /bin/sh
- -c
- pg_isready -U $POSTGRES_USER -d $POSTGRES_DB
initialDelaySeconds: 300 # 5 minutes to start
periodSeconds: 30 # Check every 30s
timeoutSeconds: 10 # 10s timeout for probe
failureThreshold: 20 # Allow 20 failures (10 minutes)
readinessProbe:
exec:
command:
- /bin/sh
- -c
- pg_isready -U $POSTGRES_USER -d $POSTGRES_DB
initialDelaySeconds: 300 # 5 minutes to start
periodSeconds: 30 # Check every 30s
timeoutSeconds: 10 # 10s timeout for probe
failureThreshold: 20 # Allow 20 failures (10 minutes)
volumeClaimTemplates:
- metadata:
name: postgres-storage
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 100Gi

55
home/cluster/aprs/postgres-deployment-repair.yaml Normal file
View file

@ -0,0 +1,55 @@
---
apiVersion: v1
kind: Service
metadata:
name: postgres-aprs
namespace: aprs
spec:
selector:
app: postgres-aprs
ports:
- port: 5432
targetPort: 5432
clusterIP: None
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: postgres-aprs
namespace: aprs
spec:
serviceName: postgres-aprs
replicas: 1
selector:
matchLabels:
app: postgres-aprs
template:
metadata:
labels:
app: postgres-aprs
spec:
terminationGracePeriodSeconds: 3600 # 1 hour to shutdown gracefully
containers:
- name: postgres
image: postgis/postgis:17-3.4
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: postgres-aprs-secret
env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts:
- name: postgres-storage
mountPath: /var/lib/postgresql/data
# NO HEALTH CHECKS - Pod will run indefinitely even if unhealthy
volumeClaimTemplates:
- metadata:
name: postgres-storage
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 100Gi

87
home/cluster/aprs/postgres-deployment.yaml Normal file
View file

@ -0,0 +1,87 @@
---
apiVersion: v1
kind: Service
metadata:
name: postgres-aprs
namespace: aprs
spec:
selector:
app: postgres-aprs
ports:
- port: 5432
targetPort: 5432
type: ClusterIP
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: postgres-aprs
namespace: aprs
spec:
serviceName: postgres-aprs
replicas: 1
selector:
matchLabels:
app: postgres-aprs
template:
metadata:
labels:
app: postgres-aprs
spec:
terminationGracePeriodSeconds: 600 # 10 minutes to shutdown gracefully
securityContext:
fsGroup: 999
fsGroupChangePolicy: OnRootMismatch
containers:
- name: postgres
image: postgis/postgis:17-3.4
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: postgres-aprs-secret
env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts:
- name: postgres-storage
mountPath: /var/lib/postgresql/data
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 999
runAsGroup: 999
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
livenessProbe:
exec:
command:
- /bin/sh
- -c
- pg_isready -U $POSTGRES_USER -d $POSTGRES_DB
initialDelaySeconds: 60 # 1 minute to start
periodSeconds: 30 # Check every 30s
timeoutSeconds: 10 # 10s timeout for probe
failureThreshold: 3 # Allow 3 failures
readinessProbe:
exec:
command:
- /bin/sh
- -c
- pg_isready -U $POSTGRES_USER -d $POSTGRES_DB
initialDelaySeconds: 30 # 30 seconds to start
periodSeconds: 10 # Check every 10s
timeoutSeconds: 5 # 5s timeout for probe
failureThreshold: 3 # Allow 3 failures
volumeClaimTemplates:
- metadata:
name: postgres-storage
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 256Gi

10
home/cluster/aprs/postgres-normal-mode.sh Normal file
View file

@ -0,0 +1,10 @@
#!/bin/bash
# Restore normal mode for PostgreSQL (with health checks)
echo "Restoring PostgreSQL normal mode (with health checks)..."
export KUBECONFIG=/Users/graham/dev/infra/home/ansible/kubeconfig
kubectl apply -f postgres-deployment-normal.yaml
echo "PostgreSQL is now in normal mode with health checks enabled"
echo "Monitor with: kubectl logs -n aprs postgres-aprs-0 -f"

11
home/cluster/aprs/postgres-repair-mode.sh Normal file
View file

@ -0,0 +1,11 @@
#!/bin/bash
# Enable repair mode for PostgreSQL (no health checks)
echo "Enabling PostgreSQL repair mode (no health checks)..."
export KUBECONFIG=/Users/graham/dev/infra/home/ansible/kubeconfig
kubectl apply -f postgres-deployment-repair.yaml
echo "PostgreSQL is now in repair mode - it will run indefinitely without health checks"
echo "Monitor with: kubectl logs -n aprs postgres-aprs-0 -f"
echo "To restore normal mode, run: ./postgres-normal-mode.sh"

14
home/cluster/aprs/postgres-secret-secure.yaml Normal file
View file

@ -0,0 +1,14 @@
---
apiVersion: v1
kind: Secret
metadata:
name: postgres-aprs-secret
namespace: aprs
type: Opaque
stringData:
POSTGRES_DB: aprsdb
POSTGRES_USER: aprs
POSTGRES_PASSWORD: "17fZZOsYeeBCf0GN8olKaKrYCsUca25V"
POSTGRES_REPLICATION_MODE: master
POSTGRES_REPLICATION_USER: replicator
POSTGRES_REPLICATION_PASSWORD: "qVXVmSA3HOVgn6zLY3TrhvUHxmPUMhc0"

559
home/cluster/controlplane.yaml Normal file
View file

@ -0,0 +1,559 @@
version: v1alpha1 # Indicates the schema used to decode the contents.
debug: false # Enable verbose logging to the console.
persist: true
# Provides machine specific configuration options.
machine:
type: controlplane # Defines the role of the machine within the cluster.
token: l1ubxp.d942qc3plno7pxlw # The `token` is used by a machine to join the PKI of the cluster.
# The root certificate authority of the PKI.
ca:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSFNWZnhiOWpZWnVaQWVvUFlBYmVxSU1hK1RYT3o3bzZwaSt0cXY1Mk1mbgotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
# Extra certificate subject alternative names for the machine's certificate.
certSANs: []
# # Uncomment this to enable SANs.
# - 10.0.0.10
# - 172.16.0.10
# - 192.168.0.10
# Used to provide additional options to the kubelet.
kubelet:
image: ghcr.io/siderolabs/kubelet:v1.34.0 # The `image` field is an optional reference to an alternative kubelet image.
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
# Extra mounts for Longhorn storage
extraMounts:
- destination: /var/mnt/longhorn
type: bind
source: /var/mnt/longhorn
options:
- bind
- rshared
- rw
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
# clusterDNS:
# - 10.96.0.10
# - 169.254.2.53
# # The `extraArgs` field is used to provide additional flags to the kubelet.
# extraArgs:
# key: value
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
# extraMounts:
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
# type: bind # Type specifies the mount kind.
# source: /var/lib/example # Source specifies the source path of the mount.
# # Options are fstab style mount options.
# options:
# - bind
# - rshared
# - rw
# # The `extraConfig` field is used to provide kubelet configuration overrides.
# extraConfig:
# serverTLSBootstrap: true
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
# credentialProviderConfig:
# apiVersion: kubelet.config.k8s.io/v1
# kind: CredentialProviderConfig
# providers:
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
# defaultCacheDuration: 12h
# matchImages:
# - '*.dkr.ecr.*.amazonaws.com'
# - '*.dkr.ecr.*.amazonaws.com.cn'
# - '*.dkr.ecr-fips.*.amazonaws.com'
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
# name: ecr-credential-provider
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
# nodeIP:
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
# validSubnets:
# - 10.0.0.0/8
# - '!10.0.0.3/32'
# - fdc7::/16
# Provides machine specific network configuration options.
network: {}
# # `interfaces` is used to define the network interface configuration.
# interfaces:
# - interface: enp0s1 # The interface name.
# # Assigns static IP addresses to the interface.
# addresses:
# - 192.168.2.0/24
# # A list of routes associated with the interface.
# routes:
# - network: 0.0.0.0/0 # The route's network (destination).
# gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
# metric: 1024 # The optional metric for the route.
# mtu: 1500 # The interface's MTU.
#
# # # Picks a network device using the selector.
# # # select a device with bus prefix 00:*.
# # deviceSelector:
# # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
# # deviceSelector:
# # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
# # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
# # deviceSelector:
# # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
# # # Bond specific options.
# # bond:
# # # The interfaces that make up the bond.
# # interfaces:
# # - enp2s0
# # - enp2s1
# # # Picks a network device using the selector.
# # deviceSelectors:
# # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
# # mode: 802.3ad # A bond option.
# # lacpRate: fast # A bond option.
# # # Bridge specific options.
# # bridge:
# # # The interfaces that make up the bridge.
# # interfaces:
# # - enxda4042ca9a51
# # - enxae2a6774c259
# # # Enable STP on this bridge.
# # stp:
# # enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
# # # Configure this device as a bridge port.
# # bridgePort:
# # master: br0 # The name of the bridge master interface
# # # Indicates if DHCP should be used to configure the interface.
# # dhcp: true
# # # DHCP specific options.
# # dhcpOptions:
# # routeMetric: 1024 # The priority of all routes received via DHCP.
# # # Wireguard specific configuration.
# # # wireguard server example
# # wireguard:
# # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # listenPort: 51111 # Specifies a device's listening port.
# # # Specifies a list of peer configurations to apply to a device.
# # peers:
# # - publicKey: ABCDEF... # Specifies the public key of this peer.
# # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# # allowedIPs:
# # - 192.168.1.0/24
# # # wireguard peer example
# # wireguard:
# # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # # Specifies a list of peer configurations to apply to a device.
# # peers:
# # - publicKey: ABCDEF... # Specifies the public key of this peer.
# # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
# # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# # allowedIPs:
# # - 192.168.1.0/24
# # # Virtual (shared) IP address configuration.
# # # layer2 vip example
# # vip:
# # ip: 172.16.199.55 # Specifies the IP address to be used.
# # Used to statically set the nameservers for the machine.
# nameservers:
# - 8.8.8.8
# - 1.1.1.1
# # Used to statically set arbitrary search domains.
# searchDomains:
# - example.org
# - example.com
# # Allows for extra entries to be added to the `/etc/hosts` file
# extraHostEntries:
# - ip: 192.168.1.100 # The IP of the host.
# # The host alias.
# aliases:
# - example
# - example.domain.tld
# # Configures KubeSpan feature.
# kubespan:
# enabled: true # Enable the KubeSpan feature.
# Used to provide instructions for installations.
install:
disk: /dev/nvme0n1 # The disk used for installations.
image: ghcr.io/siderolabs/installer:v1.11.1 # Allows for supplying the image used to perform the installation.
wipe: false # Indicates if the installation disk should be wiped at installation time.
# # Look up disk using disk attributes like model, size, serial and others.
# diskSelector:
# size: 4GB # Disk size.
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
# # Allows for supplying extra kernel args via the bootloader.
# extraKernelArgs:
# - talos.platform=metal
# - reboot=k
# Used to configure the machine's container image registry mirrors.
registries: {}
# # Specifies mirror configuration for each registry host namespace.
# mirrors:
# ghcr.io:
# # List of endpoints (URLs) for registry mirrors to use.
# endpoints:
# - https://registry.insecure
# - https://ghcr.io/v2/
# # Specifies TLS & auth configuration for HTTPS image registries.
# config:
# registry.insecure:
# # The TLS configuration for the registry.
# tls:
# insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
#
# # # Enable mutual TLS authentication with the registry.
# # clientIdentity:
# # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
# # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
#
# # # The auth configuration for this registry.
# # auth:
# # username: username # Optional registry authentication.
# # password: password # Optional registry authentication.
# Features describe individual Talos features that can be switched on or off.
features:
rbac: true # Enable role-based access control (RBAC).
stableHostname: true # Enable stable default hostname.
apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid.
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
# KubePrism - local proxy/load balancer on defined port that will distribute
kubePrism:
enabled: true # Enable KubePrism support - will start local load balancing proxy.
port: 7445 # KubePrism port.
# Configures host DNS caching resolver.
hostDNS:
enabled: true # Enable host DNS caching resolver.
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
# # Configure Talos API access from Kubernetes pods.
# kubernetesTalosAPIAccess:
# enabled: true # Enable Talos API access from Kubernetes pods.
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
# allowedRoles:
# - os:reader
# # The list of Kubernetes namespaces Talos API access is available from.
# allowedKubernetesNamespaces:
# - kube-system
# Configures the node labels for the machine.
nodeLabels:
node.kubernetes.io/exclude-from-external-load-balancers: ""
# # Provides machine specific control plane configuration options.
# # ControlPlane definition example.
# controlPlane:
# # Controller manager machine specific configuration options.
# controllerManager:
# disabled: false # Disable kube-controller-manager on the node.
# # Scheduler machine specific configuration options.
# scheduler:
# disabled: true # Disable kube-scheduler on the node.
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
# # nginx static pod.
# pods:
# - apiVersion: v1
# kind: pod
# metadata:
# name: nginx
# spec:
# containers:
# - image: nginx
# name: nginx
# # Allows the addition of user specified files.
# # MachineFiles usage example.
# files:
# - content: '...' # The contents of the file.
# permissions: 0o666 # The file's permissions in octal.
# path: /tmp/file.txt # The path of the file.
# op: append # The operation to use
# # The `env` field allows for the addition of environment variables.
# # Environment variables definition examples.
# env:
# GRPC_GO_LOG_SEVERITY_LEVEL: info
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
# https_proxy: http://SERVER:PORT/
# env:
# GRPC_GO_LOG_SEVERITY_LEVEL: error
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
# env:
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
# # Used to configure the machine's time settings.
# # Example configuration for cloudflare ntp server.
# time:
# disabled: false # Indicates if the time service is disabled for the machine.
# # description: |
# servers:
# - time.cloudflare.com
# bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
# # Used to configure the machine's sysctls.
# # MachineSysctls usage example.
# sysctls:
# kernel.domainname: talos.dev
# net.ipv4.ip_forward: "0"
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
# # Used to configure the machine's sysfs.
# # MachineSysfs usage example.
# sysfs:
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
# # Configures the udev system.
# udev:
# # List of udev rules to apply to the udev system
# rules:
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
# # Configures the logging system.
# logging:
# # Logging destination.
# destinations:
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
# format: json_lines # Logs format.
# # Configures the kernel.
# kernel:
# # Kernel modules to load.
# modules:
# - name: brtfs # Module name.
# # Configures the seccomp profiles for the machine.
# seccompProfiles:
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
# # The `value` field is used to provide the seccomp profile.
# value:
# defaultAction: SCMP_ACT_LOG
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
# # override default open file limit
# baseRuntimeSpecOverrides:
# process:
# rlimits:
# - hard: 1024
# soft: 1024
# type: RLIMIT_NOFILE
# # Configures the node annotations for the machine.
# # node annotations example.
# nodeAnnotations:
# customer.io/rack: r13a25
# # Configures the node taints for the machine. Effect is optional.
# # node taints example.
# nodeTaints:
# exampleTaint: exampleTaintValue:NoSchedule
# Provides cluster specific configuration options.
cluster:
id: eaZ-ULVPPORjVzp1Y4XpAOn4X8_UQTHwuGMLfNGZKgM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
secret: 0CQQzq2WnliOSsobOhMsAARA77nM8Phz6XiADm+IfzI= # Shared secret of cluster (base64 encoded random 32 bytes).
# Provides control plane specific configuration options.
controlPlane:
endpoint: https://10.0.101.21:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
clusterName: home # Configures the cluster's name.
# Provides cluster specific network configuration options.
network:
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
- 10.244.0.0/16
# The service subnet CIDR.
serviceSubnets:
- 10.96.0.0/12
# # The CNI used.
# cni:
# name: custom # Name of CNI to use.
# # URLs containing manifests to apply for the CNI.
# urls:
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
token: ehxond.kiubhs6w8x46jo2r # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
secretboxEncryptionSecret: JqgvvHbtZe38JaE26u/q0XZMjAX0ilWNGywpYUh44RI= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
# The base64 encoded root certificate authority used by Kubernetes.
ca:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQVBlNFgzZjZEUjBMbU00dzI2TXZ6V2N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV3TVRneE5qQXhNVGhhRncwek5URXdNVFl4TmpBeApNVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVNIZWpBdWVwdjRXelpxTDkvSzNLdDdkSm1EaCtxWXI3Y2Q1QzB3S0J5RTYyZnRtRjg3TktJc3R1WU8KYkdWb1BjQ0QyVzU3YVVEdGl5dVVmWlJUdDczcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGSXZuSlh1eVZVVWtFZVlxQy8rU2ZDUUwyQ2tpTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUVZcmRtSkYKaVVoM2xIaWlSSzJCamF6N3hyUjkvM2lDblZ2bm5meWlnbVNDQWlFQS9CSW9PWWJ2WmU5K2J0emo2b0tlaGRQcwo3R2Y3TTJYK0xhMlRQc3pMemswPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpWb29Icy9Lb3VEektMR0Q4Y0dHMTVIYVk2dGttTkJnUzNSWUtmYmV3ejlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaDNvd0xucWIrRnMyYWkvZnl0eXJlM1NaZzRmcW1LKzNIZVF0TUNnY2hPdG43WmhmT3pTaQpMTGJtRG14bGFEM0FnOWx1ZTJsQTdZc3JsSDJVVTdlOTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
aggregatorCA:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYakNDQVFXZ0F3SUJBZ0lRWXZJOHVYbG5USDRqOURxeGh4YzdDekFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMU1UQXhPREUyTURFeE9Gb1hEVE0xTVRBeE5qRTJNREV4T0Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCRVFmUjVBWHBrNE1OSTk4ZlJQd3p4bmxVbkUwYTBCc2J6N1lDZjFCYzZYalh3OWxEckRICjJsTGt5RlhxK2FoTnZaUloyZWlZTkVQT2Jvak51WnV3R2JHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVhdnoza2JMaFFJNFdvRXVvcDdGUVk0QXdsTlF3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnCkg0b3BCbmppclN5R1pvTjBTbGtsRG96MlllUERtR09qSytXcmNsRmxnUDhDSUZLSmpSdXBFa3U2R1haNExneXIKQ3NMMWdXbkNzMklPS2FRbzlIOUhrb0NuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUs3MTlkZDZMZ0JidFFjZkdmNHZQVkVCWWFLWElseFM1enQ1NStZbFEzOTlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFUkI5SGtCZW1UZ3cwajN4OUUvRFBHZVZTY1RSclFHeHZQdGdKL1VGenBlTmZEMlVPc01mYQpVdVRJVmVyNXFFMjlsRm5aNkpnMFE4NXVpTTI1bTdBWnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
# The base64 encoded private key for service account token generation.
serviceAccount:
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBeTNXQnIxcFBpSTdHTkNuV05kelgxTWIvMkwwclNFVWZ6dEZUM3pzbnI3ZjZGbUV0CmJpVEt3ampOZG53NlNaR0dZamhob1ZuK1piNS9HS2dhem9jempNNjBDWHBpSG5ETnB1aGF0bnp0ZWVVZjJmQUoKMFJaTitoTWRJM3ZMcmhBUHlldWhxRXlYYlBFTm5rVmhvbkhrdGtxZCt5dXByNzJjd0p0bkxqZTcxRXJuOFlCZgpFQ1NtNDJiOFE2L2pWbGJjdkdFYzFkSWlGRG9iRkNDU0QrSzg4bklPckxWemU0YVRwZTdNU3NZUTVLb0JQdTJNCmJqNG85QjI5ajFvWVpJZjV6akgxdlNCb1AzejNKQ1kvOTJhSnFYaS9adHA5b1FWa2NCZjRqVjdSVVYrbklVWjIKOW8yVTU5OExnRWZjRFNXbEdlMDBOZkh6SzduSXN6Y1UwNjJsNmV1VVJLNitMcytWK1RIRG1xdHVJSHQzTm1pNQphdU5QZlEwYTRRQ0M3bHdTY0VITFpNVVdrd0oxR2QyQzg4Y0I0M1p5K2lnckhFenIwUHU3czNLcjFxTlBDN3gvCkpEY0M4T2UzY0p6MWp2K3RjZlZWYnQ0NVp2dHB0aUhkNkhTaDR4NmxvZTRGWUdFbE5JREJld2V3WkgrakM0RWQKdTZUdDg4WEpNbm5FMnYzR3FqVWloNExMUitqREdJcE5FN0tlNUc4a0dkK1ZXNUdRaHJVdWZIWlY2YjB0Zi81dgpETHJ6d0V2OCtUa1paT3h3Lyt5RDVXZ2RRYkQ5c3ZGQUJEdk9XOGhvTm1ySUg1Q2dKcmtOcERjWHRTcUR0UUJuCkNJWmxIUGpvT1F2djZZZEhhamFSTFZFR3A5M0EwR3VJR0Q0ZlJsS0U2SnlpNlpHTCtsWDdmK2owY0tNQ0F3RUEKQVFLQ0FnQVRpNzVoc2pOaDB4V0hmVjF1MzBCODJJRkx1U0NuV0x5dGliNmMrM25jajdnZTNrY1hCY0hVMXRBbQpTZGp2cUdOWW5FSUUxamh5WGRLbjg3NWZpTzJTNFdpNllGOTh2U21FbDEzZm1qRFdQUVRLVXgwZVVSNDhvQWwwCmx6Z0NDTmo3ZFArYXc0RG9ubC9JakxITWdWU1BqcXVPcmFzbmp2ZTRLVFhJWXVKUWlzR3RtYitJTlgweTYzbmcKcHMwWVJrLythUFgwTkxQQmJiT2NRMlRFMGV1RS95QVp4M1RJc1MwT0M5cmtkQks3WlBtcHFmaUx2cjBBZHJyMwpRcGlGVCtyWHZFVDNYbDJsZThQaVhTcFlBaW5IZGlvdEgyQmlUN3BPYW44ZVZiV1dNN0pDcUJwVnBWUmcwalN3CnBqYWxyTEFueFhuMmxML2Z1NEZrZGk0eUI4U2dnR2xsbGVxUnQyUG12QUl0S21ZeDVhL2w4cWJqYXRDZkJaeWwKcVROTkRxTnNoZHBKK1FaVGhsekdFVHdDSCs3aTd4MXZjYVdxV3I4dFZSbjZKdmg3S3krUHZvZVFEa3lDSUhSMgptN041VlBBS09QZnp5aFVZampIcnhlK1FlV0I3UTBMM3Ezdm4xMkxGbGZFeTh1UllxUm5UaU9DaytOMFB6WDJ3ClJvYUg1VG0yOW9IblRTRy92T1FWWEE5UmkzMmdFUGcyaFBleHR0Z1hKeDlWYXZIaHl3eDYvb0t3YitDbERkaHAKOTE0bHV2dkI4bk5BTHVIMWRvK244djhmeEYyVXJhL0ZOcklQNDlSdlZCK055VFFqbGkwNndEbHM4bW4wQTJocAowU0pZTW5HdGo1SDVxQXJDS20xcGY3Z1JJVm56M053YlVqME9HSm5ad1BPbWt6OW1nUUtDQVFFQTFsR2lha3BWCnNXd0gydWIxb3JIdU5iWmNOc1cxRW4rRzNTdXEzWmc0NkwvUmpXSHp1R1FuSWg1VGlER0tVTmNacG1zeE5pb1QKeTZHMmpmNThPZVdLVnNaa2tLYXlKT3BkNlE5a2l1Y1dzOERwYitsU2Z5L2VDdlg5VzBhcDArdEo0SjdGdEloWQpTdTFZT3NIRVVqSCthMGJmWnlVRFlWT2tENXRWTW43YnQyNlhQNXE4cEg3OTVQdUhCRkpQZHlaYllXcEc2U0V6CmZ6Q2N2NWh6SWo4NGV0T2lPWCsrdUNkcDhkQ284YWw4dnNEOTJ3Rk1DMzJYYmxiL0NtT2VmK1lieEVWOU1nVVUKeTZaaStMWHhMQzZYekE5RE1WMnUwV3ZDUVdUaXBDcmJXbHN4WUR0a3YwSUNZQnhSa2lmSEMxMzRSK0d5ckJiRgpDcEJlMXY0UkZ5eVkyd0tDQVFFQTh3Y3dIcmFMOGdXV1EwN0ZzN0xwNXJKa1ZvTTlaQUN1QzYyeUtHaFhDZWtaClNSMm9OcVdNM1dZMVZqV2dSazhha0pXckRtdmp1eURKNkxtcS9Db1M1a2h6Mm8xY3NGTWJ2UUdKOHhIWDZmVUcKWGFZa3Z2WHBGdzkwSlhCR1pYanVVS1BhcVQzS2VWTDdlTXI3TFkySzhNMkNNVGpqZHoyVDZ2bzhGeTM5ZnVEWgpYOTBiUU5FaUQxV2dldzRPU0lRWjNPdndXbU9lM0UzSGd0SmE0ZkVYaGhTbzg0dDhHTituYU9uMmdrOHJ5cjE0Ck9GVkcra3pkb21jQjNOQ1RJZFJkZS93NHk5SVFEMHBPb0M5SlN6MHJReGtBWXpKemt0MGVVaXRNUWpGU1NuS1EKblJxSUZLM0pZdng5QTVtSWNHOGU3R01mUEtZbTVrczA2c1BnWTVkTjJRS0NBUUVBMWpVcnJ5N3k3VzA3Z0tnOQpOTXJBZTBEMGMrNHhwL1o4ZGt5eDc5KzRhYkZuSWZlWUlHRkIxOUVWemxjdGx0VVhGd1dtWHl1NU0xdERXakxVCk9RM2FzaGFDNXkwbGVzNGc1Tk4wdTN4emJXQlFNWUd6NmRtUEJjZU4zaEFIcC85UWpNaEVkTWVkNysyL3RLSjgKdFdhd2tzcDRlZUE5dTZaY29SaXhFOUpGaXRabko3UmgvY3ZMdW5WSUlxS2VPRW5ISmR1U1dtckx6TUZxdWZrRwpnbUZMOHovWnNieWpnKzRvN3YrT0RGUkprV0xWbDNKNWJqYXVCeU8rcjhTWDQ5KzdPdlgxUnV4Yk41enE2UWo0CnJ4ODJxMGRKOG1wZlU0TnYyZXFhdUZqNWV4c1FnODE1U2N3UkViemNMc2ZCSXZSZU5vSTRFZGFFUktXOWxRYkYKVUROTDV3S0NBUUJrd2M4bWZLSnF0ZnhGYll3ejQzSnNEZnZoamtuT2d5V2xlOThJTjdJV1Rza0g4ajdDWVVLVQpyQUppK3BxM2E2WmsyVmh4QXpRSWFpQ3Ixd1pYdzQzUVlhdCtxZXNLdzNvVmsyVEJITjI2aHJhYjd2ei9HdThICmU0VzQyK0tqd1U1MHFtcEdqbks2ZURnQUxZK1RwRUk5Y2NhUFo3bU92ejNyUnRIUS9tVkJ6RER6T0xWSzJ5blcKMTdaUUxsU25wZlVmRGNhNWd1SGpEbkF3QWN4aUxsV0ZabDFoazZ2Z21DRk5NdXJidmIwM01mUjh6b1k5MGM1MQp2V1VkU25BbHIya090VlJLMUkySitWRzl3YjBPYjQ3WEk2OXdjUU5QbVZNdjEvbW0yOUgxUWFoSktpM08vUG9vCml1dTlxVkxTNG84Y2pEL3dJaWF3aGUrcmdZZ3ZZaFNKQW9JQkFRQ1doNkphNmwvNGovamJIVjRPOENxdWI3cUwKZ05iam1rU3Zua3JNYTRWS1l4ZWs0UWNsdVNzaUNOaFBjZVY3MGpQemdZQWNBV3ZNTVZTTG1uVFRGbU9XYlJ1MwpMeHZyMXBqc0Z4M2RlSHhKUFVZNGJub0Y0ZnZyclRKNVh4MHM2dzh1Z0ZNVWFGSno3THB2TFJhWEw0eHpjUTd1CmRTY2ZkRkw1aGZxVmZ3RDFQdXlFK2ZHb1ltb081Z21XblA1QW1GRERFa2dsTHlHOEhER3FERC9XYXNMbGdhZm8KZDVEejJPcm9HdGdzeElSajM5Q2ZZcm1jclllNDhXdXdSR2dJcmM4dURLZlR3a2RmTlpGTVdMcUlZdHM0Z1M0NwpQeFh2c3VoS1BhTWovaFhGanhzdWlROTFxdDRUbWw3TnFtNjM4cFEyeDFYb0lldmdRUXBTN2dVSW1vc1AKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
# API server specific configuration options.
apiServer:
image: registry.k8s.io/kube-apiserver:v1.34.0 # The container image used in the API server manifest.
# Extra certificate subject alternative names for the API server's certificate.
certSANs:
- 10.0.101.21
disablePodSecurityPolicy: true # Disable PodSecurityPolicy in the API server and default manifests.
# Configure the API server admission plugins.
admissionControl:
- name: PodSecurity # Name is the name of the admission controller.
# Configuration is an embedded configuration object to be used as the plugin's
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
defaults:
audit: restricted
audit-version: latest
enforce: baseline
enforce-version: latest
warn: restricted
warn-version: latest
exemptions:
namespaces:
- kube-system
runtimeClasses: []
usernames: []
kind: PodSecurityConfiguration
# Configure the API server audit policy.
auditPolicy:
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
# authorizationConfig:
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
# name: webhook # Name is used to describe the authorizer.
# # webhook is the configuration for the webhook authorizer.
# webhook:
# connectionInfo:
# type: InClusterConfig
# failurePolicy: Deny
# matchConditionSubjectAccessReviewVersion: v1
# matchConditions:
# - expression: has(request.resourceAttributes)
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
# subjectAccessReviewVersion: v1
# timeout: 3s
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
# name: in-cluster-authorizer # Name is used to describe the authorizer.
# # webhook is the configuration for the webhook authorizer.
# webhook:
# connectionInfo:
# type: InClusterConfig
# failurePolicy: NoOpinion
# matchConditionSubjectAccessReviewVersion: v1
# subjectAccessReviewVersion: v1
# timeout: 3s
# Controller manager server specific configuration options.
controllerManager:
image: registry.k8s.io/kube-controller-manager:v1.34.0 # The container image used in the controller manager manifest.
# Kube-proxy server-specific configuration options
proxy:
image: registry.k8s.io/kube-proxy:v1.34.0 # The container image used in the kube-proxy manifest.
# # Disable kube-proxy deployment on cluster bootstrap.
# disabled: false
# Scheduler server specific configuration options.
scheduler:
image: registry.k8s.io/kube-scheduler:v1.34.0 # The container image used in the scheduler manifest.
# Configures cluster member discovery.
discovery:
enabled: true # Enable the cluster membership discovery feature.
# Configure registries used for cluster member discovery.
registries:
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
kubernetes:
disabled: true # Disable Kubernetes discovery registry.
# Service registry is using an external service to push and pull information about cluster members.
service: {}
# # External service endpoint.
# endpoint: https://discovery.talos.dev/
# Etcd specific configuration options.
etcd:
# The `ca` is the root certificate authority of the PKI.
ca:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmekNDQVNTZ0F3SUJBZ0lSQVBPYnhxSEJhTEcrRWlEblFYbFF1amt3Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TlRFd01UZ3hOakF4TVRoYUZ3MHpOVEV3TVRZeE5qQXhNVGhhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFUcG43ZDFHMjdJCk9lZzJLQ3E3bzhQWFV0Vm1yY0tSQkFMc2c2OXZoczdFZUU2aEkzSUdPcTNYcWpTdVAxbGJicVVlZWlNNTRDU1kKYXNTK0tvaUtjUmlubzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpKZUhoZ0xsRWxxCno0L0l6WG51bGtUTU5hQVJNQW9HQ0NxR1NNNDlCQU1DQTBrQU1FWUNJUURwZ1BRdTlpWDdoU05JbFJKek9JNDEKZ2pjZXNLQmo2T2d6dFE2M0dGa2ZuQUloQU9NaS9RYTRYc2FwOVFxSXJvd0tUaU9mZ25IS1YxeUZDVExqS29lRQpSTTdYCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtPNi9KcjFrT2l0a08wbVllTnB6L3d5QjNmYUVWUWN2RmZETndXUHIxZGRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFNlorM2RSdHV5RG5vTmlncXU2UEQxMUxWWnEzQ2tRUUM3SU92YjRiT3hIaE9vU055QmpxdAoxNm8wcmo5WlcyNmxIbm9qT2VBa21HckV2aXFJaW5FWXB3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
# # The container image used to create the etcd service.
# image: gcr.io/etcd-development/etcd:v3.6.4
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
# advertisedSubnets:
# - 10.0.0.0/8
# A list of urls that point to additional manifests.
extraManifests: []
# - https://www.example.com/manifest1.yaml
# - https://www.example.com/manifest2.yaml
# A list of inline Kubernetes manifests.
inlineManifests: []
# - name: namespace-ci # Name of the manifest.
# contents: |- # Manifest contents as a string.
# apiVersion: v1
# kind: Namespace
# metadata:
# name: ci
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
# # Decryption secret example (do not use in production!).
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
# # Core DNS specific configuration options.
# coreDNS:
# image: registry.k8s.io/coredns/coredns:v1.12.3 # The `image` field is an override to the default coredns image.
# # External cloud provider configuration.
# externalCloudProvider:
# enabled: true # Enable external cloud provider.
# # A list of urls that point to additional manifests for an external cloud provider.
# manifests:
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
# # A map of key value pairs that will be added while fetching the extraManifests.
# extraManifestHeaders:
# Token: "1234567"
# X-ExtraInfo: info
# # Settings for admin kubeconfig generation.
# adminKubeconfig:
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
# # Allows running workload on control-plane nodes.
allowSchedulingOnControlPlanes: true

335
home/cluster/deploy.md Normal file
View file

@ -0,0 +1,335 @@
# Cluster Deployment Guide
This document tracks the commands and process for provisioning the k3s cluster with Talos.
## Initial Talos Setup
Fresh Talos cluster has been set up. Document deployment commands below as they are executed.
## Deployment Commands Log
### Latest APRS Deployment (2025-10-18)
```bash
# Generate kubeconfig from Talos
talosctl --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 kubeconfig
# Force re-deploy APRS.me with new GitHub pull token
cd /Users/graham/dev/infra/home/cluster/aprs
./deploy.sh
# Check pod status
kubectl get pods -n aprs -o wide
# Force restart of APRS StatefulSet to pull new image with GitHub token
kubectl delete pod aprs-0 -n aprs
kubectl rollout restart statefulset/aprs -n aprs
# Check persistent volume claim status
kubectl get pvc -n aprs
kubectl get storageclass
# Check cluster nodes
kubectl get nodes -o wide
```
**Status**: Image pull now working with GitHub token, but PostgreSQL stuck due to missing storage class
### Storage Configuration (2025-10-18)
```bash
# Initially tried Longhorn but had iscsi-tools issues in Talos
kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.2/deploy/longhorn.yaml
kubectl label namespace longhorn-system pod-security.kubernetes.io/enforce=privileged --overwrite
kubectl rollout restart ds/longhorn-manager -n longhorn-system
# Installed local-path-provisioner as alternative
kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.28/deploy/local-path-storage.yaml
kubectl label namespace local-path-storage pod-security.kubernetes.io/enforce=privileged --overwrite
kubectl rollout restart deployment/local-path-provisioner -n local-path-storage
# Updated PostgreSQL to use local-path with 256GB storage
# Modified postgres-deployment.yaml: storageClassName: local-path, storage: 256Gi
kubectl delete pvc postgres-storage-postgres-aprs-0 -n aprs
kubectl delete statefulset postgres-aprs -n aprs
kubectl apply -f /Users/graham/dev/infra/home/cluster/aprs/postgres-deployment.yaml
# Verify storage configuration
kubectl get pvc -n aprs
kubectl get storageclass
```
**Status**: PostgreSQL with PostGIS now configured with 256GB local-path storage, APRS.me deploying with GitHub token
### Longhorn Storage Final Configuration (2025-10-18)
```bash
# Updated controlplane.yaml to add kubelet extraMounts for Longhorn
# Added:
# extraMounts:
# - destination: /var/mnt/longhorn
# type: bind
# source: /var/mnt/longhorn
# options: [bind, rshared, rw]
# Applied updated configuration to both nodes
talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml
talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.22 --nodes 10.0.101.22 --file controlplane.yaml --config-patch @node2.patch.yaml --config-patch @tailscale.patch.yaml
# Generated custom Talos image with iscsi-tools extension
curl -X POST --data-binary @schematic.yaml https://factory.talos.dev/schematics
# Returned schematic ID: 077514df2c1b6436460bc60faabc976687b16193b8a1290fda4366c69024fec2
# Upgraded both nodes with custom image including iscsi-tools
talosctl upgrade --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --image factory.talos.dev/metal-installer/708747e350d604ae9e57227d8dcf274091453ddb1097b765d4ea8884f1992c1f:v1.11.3 --preserve --force
talosctl upgrade --talosconfig=./talosconfig -e 10.0.101.22 --nodes 10.0.101.22 --image factory.talos.dev/metal-installer/708747e350d604ae9e57227d8dcf274091453ddb1097b765d4ea8884f1992c1f:v1.11.3 --preserve --force
# Reinstalled Longhorn after node upgrade
kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.2/deploy/longhorn.yaml
kubectl label namespace longhorn-system pod-security.kubernetes.io/enforce=privileged --overwrite
# Configured PostgreSQL to use Longhorn storage with 256GB
# Modified postgres-deployment.yaml: storageClassName: longhorn, storage: 256Gi
kubectl delete pvc postgres-storage-postgres-aprs-0 -n aprs
kubectl delete statefulset postgres-aprs -n aprs
kubectl apply -f /Users/graham/dev/infra/home/cluster/aprs/postgres-deployment.yaml
# Verify Longhorn storage
kubectl get storageclass
kubectl get nodes.longhorn.io -n longhorn-system
kubectl get pvc -n aprs
```
**Status**: Longhorn storage successfully configured on both nodes, PostgreSQL with PostGIS using 256GB Longhorn storage
### APRS.me Application Deployment Success (2025-10-19)
```bash
# Fixed PostgreSQL service to use ClusterIP instead of headless service
# Modified postgres-deployment.yaml: type: ClusterIP
kubectl delete svc postgres-aprs -n aprs
kubectl apply -f /Users/graham/dev/infra/home/cluster/aprs/postgres-deployment.yaml
# Fixed PostgreSQL permissions with fsGroup
# Added to postgres-deployment.yaml:
# securityContext:
# fsGroup: 999
# fsGroupChangePolicy: OnRootMismatch
# Shortened PostgreSQL readiness probe delays
# Updated readiness probe: initialDelaySeconds: 30, periodSeconds: 10, failureThreshold: 3
# Fixed APRS container permissions
# Removed strict runAsUser constraints from aprs-statefulset-with-pullsecret.yaml
# Added writable volumes for tmp directories
# Set APRS namespace to privileged pod security
kubectl label namespace aprs pod-security.kubernetes.io/enforce=privileged --overwrite
# Final deployment verification
kubectl get pods -n aprs
kubectl get svc -n aprs
kubectl logs aprs-0 -n aprs -c aprs
```
**Status**: ✅ APRS.me application fully deployed and operational
- PostgreSQL 17 with PostGIS running on 256GB Longhorn storage
- Redis cache operational
- APRS.me web application responding on port 4000
- APRS-IS packet receiver active and processing
- Multi-replica deployment with Erlang clustering
- All services healthy and ready
### MetalLB LoadBalancer Configuration (2025-10-19)
```bash
# Install MetalLB for LoadBalancer services
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.14.8/config/manifests/metallb-native.yaml
kubectl wait --for=condition=ready pod -l app=metallb -n metallb-system --timeout=60s
# Create MetalLB configuration with public IP
cat > /Users/graham/dev/infra/home/cluster/metallb-config.yaml << 'EOF'
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
name: public-ip-pool
namespace: metallb-system
spec:
addresses:
- 204.110.191.2/32
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
name: public-ip-advertisement
namespace: metallb-system
spec:
ipAddressPools:
- public-ip-pool
EOF
# Apply MetalLB configuration
kubectl apply -f /Users/graham/dev/infra/home/cluster/metallb-config.yaml
```
**Status**: ✅ LoadBalancer services now working with MetalLB
- Traefik assigned external IP 204.110.191.2
- HTTPS access to aprs.me working correctly
- HTTP redirects to HTTPS automatically
### Attempted APRS Deployment
```bash
# Attempted to deploy APRS application
cd /Users/graham/dev/infra/home/cluster/aprs
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" ./deploy.sh
```
**Issue**: Kubernetes API at 10.0.101.21:6443 not accessible - connection timeout.
**Current Context**: admin@home
**Status**: Deployment blocked - need cluster connectivity
### Network Configuration Fix
```bash
# Fixed node1.patch.yaml to remove conflicting default route from VLAN 10
# VLAN 10 now only has IP assignment, main interface handles routing
```
**Issue**: Dual default routes caused connectivity loss
**Fix**: Removed default route from VLAN 9 configuration to prevent dual route conflicts
### Security Context Fixes for PodSecurity Policy
```bash
# Fixed PostgreSQL deployment security context
kubectl apply -f postgres-deployment.yaml
# Fixed Redis deployment security context
kubectl apply -f redis.yaml
# Fixed APRS StatefulSet security context (migrate + aprs containers)
kubectl apply -f aprs-statefulset-with-pullsecret.yaml
```
### Node1 Public IP Configuration
```bash
# Updated node1.patch.yaml with public IP 204.110.191.2/27
# Gateway: 204.110.191.30 on VLAN 9
# Applied node1 configuration with public IP
talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml
```
### Cert-Manager Deployment
```bash
# Check if cert-manager is installed
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl get pods -n cert-manager
# Install cert-manager v1.16.1
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml
# Wait for cert-manager to be ready
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=cert-manager -n cert-manager --timeout=300s
# Deploy Let's Encrypt ClusterIssuer (had webhook timeout issues)
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl delete validatingwebhookconfiguration cert-manager-webhook
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f cert-manager/letsencrypt-prod.yaml
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml
```
### Traefik Deployment
```bash
# Create traefik namespace
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl create namespace traefik-system
# Install Traefik via Helm with LoadBalancer
helm repo update
helm install traefik traefik/traefik --namespace traefik-system --set service.type=LoadBalancer
# Wait for Traefik to be ready
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=traefik -n traefik-system --timeout=300s
# Deploy APRS IngressRoute and Certificate (temporarily removed webhook)
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl delete validatingwebhookconfiguration cert-manager-webhook
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f aprs/aprs-ingressroute.yaml
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml
```
### Longhorn Storage Deployment
```bash
# Install Longhorn v1.7.1
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.1/deploy/longhorn.yaml
# Set privileged security policy for Longhorn namespace (required for hostPath volumes)
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl label namespace longhorn-system pod-security.kubernetes.io/enforce=privileged
# Restart DaemonSet to apply new security policy
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl rollout restart ds/longhorn-manager -n longhorn-system
# Note: Longhorn may take several minutes to fully initialize and create storage class
```
### DNS Configuration Update
```bash
# Updated aprs.me DNS records to point to new cluster IP
# File: home/terraform/dns_aprs_me_cloudflare.tf
# Changed from 204.110.191.3 to 204.110.191.2
# Verify DNS changes (records already applied correctly)
tofu -chdir=/Users/graham/dev/infra/home/terraform plan -target=cloudflare_record.aprs_me_root -target=cloudflare_record.aprs_me_www
tofu -chdir=/Users/graham/dev/infra/home/terraform state show cloudflare_record.aprs_me_root
# Confirmed: Both aprs.me and www.aprs.me point to 204.110.191.2
```
### Node-RED Deployment (2025-10-19)
```bash
# Added 204.110.191.3 to node1 configuration
talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml
# Deployed nginx proxy for multiple services on 204.110.191.3:8080/8443
cd /Users/graham/dev/infra/home/cluster/nginx-proxy
./deploy.sh
# Deployed Node-RED to cluster
cd /Users/graham/dev/infra/home/cluster/nodered
./deploy.sh
# Updated DNS for nodered.w5isp.com to point to 204.110.191.3
tofu -chdir=/Users/graham/dev/infra/home/terraform apply -target=dnsimple_zone_record.w5isp_nodered -auto-approve
```
**Status**: ✅ Node-RED deployed and accessible
- Traefik handles routing and SSL termination via host-based routing
- APRS: https://aprs.me (204.110.191.2 via Traefik)
- Node-RED: https://nodered.w5isp.com (204.110.191.2 via Traefik)
- Both services use ClusterIP (internal only)
- Uses Longhorn for persistent storage
## Key Configuration Files
- `controlplane.yaml` - Talos control plane configuration
- `worker.yaml` - Talos worker node configuration
- `node1.patch.yaml`, `node2.patch.yaml`, `node3.patch.yaml` - Node-specific patches
- `talosconfig` - Talos client configuration
## Notes
- Cluster uses Talos Linux as the operating system
- Applications deployed via kubectl with manifests in subdirectories
- Each application has its own deploy.sh script for easy deployment
## Reproduction Steps
1. Apply Talos configurations to nodes
2. Bootstrap cluster
3. Deploy applications as needed
_Detailed steps will be added as deployment progresses._

43
home/cluster/k3s-upgrade/plan.yaml Normal file
View file

@ -0,0 +1,43 @@
# Server plan
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: server-plan
namespace: system-upgrade
spec:
concurrency: 1
cordon: true
nodeSelector:
matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: In
values:
- "true"
serviceAccountName: system-upgrade
upgrade:
image: rancher/k3s-upgrade
channel: https://update.k3s.io/v1-release/channels/stable
---
# Agent plan
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: agent-plan
namespace: system-upgrade
spec:
concurrency: 1
cordon: true
nodeSelector:
matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: DoesNotExist
prepare:
args:
- prepare
- server-plan
image: rancher/k3s-upgrade
serviceAccountName: system-upgrade
upgrade:
image: rancher/k3s-upgrade
channel: https://update.k3s.io/v1-release/channels/stable

8
home/cluster/longhorn-uservolume.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: v1alpha1
kind: UserVolumeConfig
name: longhorn
provisioning:
diskSelector:
match: disk.transport == "nvme"
grow: false
maxSize: 1700GB

130
home/cluster/mariadb/mariadb-deployment.yaml Normal file
View file

@ -0,0 +1,130 @@
apiVersion: v1
kind: Secret
metadata:
name: mariadb-secret
namespace: data
type: Opaque
stringData:
root-password: "TxN9RnbTQw9GarJg5mDvsuW2bFSYot7L"
replication-password: "nXhalxeheXryAy8R6qTJWhCw4P1CtUXu"
---
apiVersion: v1
kind: ConfigMap
metadata:
name: mariadb-config
namespace: data
data:
my.cnf: |
[mysqld]
bind-address = 0.0.0.0
default_storage_engine = InnoDB
binlog_format = ROW
innodb_autoinc_lock_mode = 2
innodb_flush_log_at_trx_commit = 0
query_cache_size = 0
query_cache_type = 0
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mariadb-data
namespace: data
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 20Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: mariadb
namespace: data
labels:
app: mariadb
spec:
replicas: 1
selector:
matchLabels:
app: mariadb
template:
metadata:
labels:
app: mariadb
spec:
containers:
- name: mariadb
image: mariadb:11
ports:
- containerPort: 3306
name: mysql
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: mariadb-secret
key: root-password
- name: MYSQL_DATABASE
value: "forgejo"
- name: MYSQL_USER
value: "forgejo"
- name: MYSQL_PASSWORD
value: "nJWD2Iv44Y2j4eQSFupjq9fBKX3rI6pg"
volumeMounts:
- name: data
mountPath: /var/lib/mysql
- name: config
mountPath: /etc/mysql/conf.d
resources:
requests:
memory: "512Mi"
cpu: "250m"
limits:
memory: "2Gi"
cpu: "1000m"
livenessProbe:
exec:
command:
- /bin/bash
- -c
- "mariadb-admin ping -h localhost -u root -p$MYSQL_ROOT_PASSWORD"
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
readinessProbe:
exec:
command:
- /bin/bash
- -c
- "mariadb-admin ping -h localhost -u root -p$MYSQL_ROOT_PASSWORD"
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
volumes:
- name: data
persistentVolumeClaim:
claimName: mariadb-data
- name: config
configMap:
name: mariadb-config
---
apiVersion: v1
kind: Service
metadata:
name: mariadb
namespace: data
labels:
app: mariadb
spec:
type: ClusterIP
ports:
- port: 3306
targetPort: 3306
protocol: TCP
name: mysql
selector:
app: mariadb

18
home/cluster/metallb-config.yaml Normal file
View file

@ -0,0 +1,18 @@
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
name: public-ip-pool
namespace: metallb-system
spec:
addresses:
- 204.110.191.2/32
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
name: public-ip-advertisement
namespace: metallb-system
spec:
ipAddressPools:
- public-ip-pool

177
home/cluster/mikrotik-ha-setup.md Normal file
View file

@ -0,0 +1,177 @@
# High Availability Setup with MikroTik
## Overview
Using MikroTik's built-in features to ensure K3s cluster remains accessible when node1 is down.
## Option 1: MikroTik Load Balancing with PCC (Per Connection Classifier)
### On MikroTik Router:
```mikrotik
# 1. Create address list for K3s nodes
/ip firewall address-list
add address=10.0.101.21 list=k3s-nodes comment="node1"
add address=10.0.101.22 list=k3s-nodes comment="node2"
add address=10.0.101.23 list=k3s-nodes comment="node3"
# 2. Create NAT rules for incoming traffic to distribute to nodes
# For HTTP/HTTPS traffic (ports 80, 443)
/ip firewall nat
add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \
dst-port=80 to-addresses=10.0.101.21-10.0.101.23 to-ports=80 \
comment="K3s HTTP load balance"
add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \
dst-port=443 to-addresses=10.0.101.21-10.0.101.23 to-ports=443 \
comment="K3s HTTPS load balance"
# 3. Add connection marking for load balancing
/ip firewall mangle
add chain=prerouting action=mark-connection new-connection-mark=k3s-conn-1 \
dst-address=204.110.191.2 dst-port=80,443 protocol=tcp \
per-connection-classifier=both-addresses:3/0
add chain=prerouting action=mark-connection new-connection-mark=k3s-conn-2 \
dst-address=204.110.191.2 dst-port=80,443 protocol=tcp \
per-connection-classifier=both-addresses:3/1
add chain=prerouting action=mark-connection new-connection-mark=k3s-conn-3 \
dst-address=204.110.191.2 dst-port=80,443 protocol=tcp \
per-connection-classifier=both-addresses:3/2
```
## Option 2: MikroTik with VRRP (Virtual Router Redundancy Protocol)
### Prerequisites:
- Assign additional IPs to each node for VRRP
- Configure MikroTik to route to VRRP virtual IP
### On Each K3s Node:
```bash
# Install keepalived
sudo apt-get update && sudo apt-get install -y keepalived
# Create keepalived configuration
sudo tee /etc/keepalived/keepalived.conf << EOF
vrrp_instance VI_1 {
state BACKUP # All nodes start as BACKUP
interface eth0 # Your network interface
virtual_router_id 51 # Same on all nodes
priority $(hostname | grep -o '[0-9]*')0 # node1=10, node2=20, node3=30
advert_int 1
authentication {
auth_type PASS
auth_pass k3scluster
}
virtual_ipaddress {
10.0.101.100/24 # Virtual IP for cluster
}
}
EOF
# Start keepalived
sudo systemctl enable --now keepalived
```
### On MikroTik:
```mikrotik
# Route public IP traffic to VRRP virtual IP
/ip firewall nat
add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \
dst-port=80,443 to-addresses=10.0.101.100 \
comment="K3s VRRP Virtual IP"
```
## Option 3: MikroTik Netwatch with Failover (Simplest)
This monitors nodes and updates NAT dynamically:
```mikrotik
# 1. Create scripts for failover
/system script
add name="k3s-use-node1" source={
/ip firewall nat set [find comment="K3s HTTP"] to-addresses=10.0.101.21
/ip firewall nat set [find comment="K3s HTTPS"] to-addresses=10.0.101.21
:log info "K3s traffic switched to node1"
}
add name="k3s-use-node2" source={
/ip firewall nat set [find comment="K3s HTTP"] to-addresses=10.0.101.22
/ip firewall nat set [find comment="K3s HTTPS"] to-addresses=10.0.101.22
:log info "K3s traffic switched to node2"
}
add name="k3s-use-node3" source={
/ip firewall nat set [find comment="K3s HTTP"] to-addresses=10.0.101.23
/ip firewall nat set [find comment="K3s HTTPS"] to-addresses=10.0.101.23
:log info "K3s traffic switched to node3"
}
# 2. Create initial NAT rules
/ip firewall nat
add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \
dst-port=80 to-addresses=10.0.101.21 to-ports=80 comment="K3s HTTP"
add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \
dst-port=443 to-addresses=10.0.101.21 to-ports=443 comment="K3s HTTPS"
# 3. Set up Netwatch monitors
/tool netwatch
add host=10.0.101.21 interval=10s timeout=5s \
down-script={
:if ([/tool netwatch get [find host=10.0.101.22] status]="up") do={
/system script run k3s-use-node2
} else={
:if ([/tool netwatch get [find host=10.0.101.23] status]="up") do={
/system script run k3s-use-node3
}
}
} \
up-script="/system script run k3s-use-node1"
add host=10.0.101.22 interval=10s timeout=5s
add host=10.0.101.23 interval=10s timeout=5s
```
## Recommended: Configure K3s Services for Any Node Access
Make sure your services use NodePort or LoadBalancer type:
```yaml
# Example service configuration
apiVersion: v1
kind: Service
metadata:
name: myapp
spec:
type: NodePort
ports:
- port: 80
targetPort: 8080
nodePort: 32080 # This port will be accessible on ALL nodes
selector:
app: myapp
```
Then configure MikroTik to forward to the NodePort on any available node.
## Testing the Failover
1. Verify current routing:
```bash
curl -v http://204.110.191.2
```
2. Shut down node1:
```bash
ssh node1 sudo shutdown -h now
```
3. Watch MikroTik logs and verify traffic switches:
```mikrotik
/log print follow where topics~"info"
```
4. Verify service remains accessible:
```bash
curl -v http://204.110.191.2
```

35
home/cluster/n8n/deploy.sh Normal file
View file

@ -0,0 +1,35 @@
#!/bin/bash
echo "Deploying n8n to k3s cluster..."
# Create namespace
kubectl apply -f namespace.yaml
# Deploy PostgreSQL
kubectl apply -f secret.yaml
kubectl apply -f postgres-pvc.yaml
kubectl apply -f postgres-deployment.yaml
# Wait for PostgreSQL to be ready
echo "Waiting for PostgreSQL to be ready..."
kubectl wait --for=condition=ready pod -l app=postgres -n n8n --timeout=300s
# Deploy n8n
kubectl apply -f n8n-pvc.yaml
kubectl apply -f n8n-deployment.yaml
# Wait for n8n to be ready
echo "Waiting for n8n to be ready..."
kubectl wait --for=condition=ready pod -l app=n8n -n n8n --timeout=300s
# Create ingress
kubectl apply -f ingress.yaml
echo "n8n deployment complete!"
echo ""
echo "Access n8n at: https://n8n.w5isp.com"
echo ""
echo "To check the deployment status:"
echo "kubectl get pods -n n8n"
echo "kubectl get svc -n n8n"
echo "kubectl get ingress -n n8n"

25
home/cluster/n8n/ingress.yaml Normal file
View file

@ -0,0 +1,25 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: n8n-ingress
namespace: n8n
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
traefik.ingress.kubernetes.io/router.tls: "true"
spec:
tls:
- hosts:
- n8n.w5isp.com
secretName: n8n-tls
rules:
- host: n8n.w5isp.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: n8n
port:
number: 5678

107
home/cluster/n8n/n8n-deployment.yaml Normal file
View file

@ -0,0 +1,107 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: n8n-config
namespace: n8n
data:
N8N_HOST: "n8n.w5isp.com"
N8N_PORT: "5678"
N8N_PROTOCOL: "https"
N8N_EDITOR_BASE_URL: "https://n8n.w5isp.com/"
WEBHOOK_URL: "https://n8n.w5isp.com/"
N8N_METRICS: "true"
N8N_BASIC_AUTH_ACTIVE: "false"
DB_TYPE: "postgresdb"
DB_POSTGRESDB_HOST: "postgres"
DB_POSTGRESDB_PORT: "5432"
DB_POSTGRESDB_DATABASE: "n8n"
DB_POSTGRESDB_USER: "n8n"
EXECUTIONS_MODE: "regular"
N8N_PERSONALIZATION_ENABLED: "false"
N8N_VERSION_NOTIFICATIONS_ENABLED: "true"
N8N_HIDE_USAGE_PAGE: "true"
GENERIC_TIMEZONE: "America/Chicago"
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: n8n
namespace: n8n
spec:
replicas: 1
selector:
matchLabels:
app: n8n
template:
metadata:
labels:
app: n8n
spec:
initContainers:
- name: fix-permissions
image: busybox
command: ['sh', '-c', 'chown -R 1000:1000 /home/node/.n8n']
volumeMounts:
- name: n8n-data
mountPath: /home/node/.n8n
containers:
- name: n8n
image: n8nio/n8n:latest
ports:
- containerPort: 5678
env:
- name: DB_POSTGRESDB_PASSWORD
valueFrom:
secretKeyRef:
name: n8n-secret
key: DB_POSTGRESDB_PASSWORD
- name: N8N_ENCRYPTION_KEY
valueFrom:
secretKeyRef:
name: n8n-secret
key: N8N_ENCRYPTION_KEY
envFrom:
- configMapRef:
name: n8n-config
volumeMounts:
- name: n8n-data
mountPath: /home/node/.n8n
resources:
requests:
memory: "512Mi"
cpu: "250m"
limits:
memory: "2048Mi"
cpu: "1000m"
livenessProbe:
httpGet:
path: /healthz
port: 5678
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 5
readinessProbe:
httpGet:
path: /healthz
port: 5678
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
volumes:
- name: n8n-data
persistentVolumeClaim:
claimName: n8n-data
---
apiVersion: v1
kind: Service
metadata:
name: n8n
namespace: n8n
spec:
type: ClusterIP
selector:
app: n8n
ports:
- port: 5678
targetPort: 5678
name: http

12
home/cluster/n8n/n8n-pvc.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: n8n-data
namespace: n8n
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 5Gi

4
home/cluster/n8n/namespace.yaml Normal file
View file

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: n8n

74
home/cluster/n8n/postgres-deployment.yaml Normal file
View file

@ -0,0 +1,74 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: postgres
namespace: n8n
spec:
replicas: 1
selector:
matchLabels:
app: postgres
template:
metadata:
labels:
app: postgres
spec:
containers:
- name: postgres
image: postgres:16-alpine
ports:
- containerPort: 5432
env:
- name: POSTGRES_USER
value: "n8n"
- name: POSTGRES_DB
value: "n8n"
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: n8n-secret
key: POSTGRES_PASSWORD
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
resources:
requests:
memory: "256Mi"
cpu: "250m"
limits:
memory: "512Mi"
cpu: "500m"
livenessProbe:
exec:
command:
- /bin/sh
- -c
- pg_isready -U n8n
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
exec:
command:
- /bin/sh
- -c
- pg_isready -U n8n
initialDelaySeconds: 5
periodSeconds: 5
volumes:
- name: postgres-data
persistentVolumeClaim:
claimName: postgres-data
---
apiVersion: v1
kind: Service
metadata:
name: postgres
namespace: n8n
spec:
selector:
app: postgres
ports:
- port: 5432
targetPort: 5432

12
home/cluster/n8n/postgres-pvc.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: postgres-data
namespace: n8n
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 10Gi

10
home/cluster/n8n/secret.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Secret
metadata:
name: n8n-secret
namespace: n8n
type: Opaque
stringData:
N8N_ENCRYPTION_KEY: "ExpDR3+Wmq1Q8Z9jDkDbt774/Rip4dZ7bor4z3lTquk="
DB_POSTGRESDB_PASSWORD: "Nk+L6lf1x0BlQa3xIy9yDA8oHPGlcPyJyLLxSkALLWg="
POSTGRES_PASSWORD: "Nk+L6lf1x0BlQa3xIy9yDA8oHPGlcPyJyLLxSkALLWg="

29
home/cluster/node1.patch.yaml Normal file
View file

@ -0,0 +1,29 @@
machine:
# Static IP Configuration
network:
hostname: node1.w5isp.com
interfaces:
- deviceSelector:
physical: true
addresses:
- 10.0.101.21/24
routes:
- network: 0.0.0.0/0
gateway: 10.0.101.254
dhcp: false
vlans:
- addresses:
- 204.110.191.2/27
routes:
- network: 0.0.0.0/0
gateway: 204.110.191.30
vlanId: 9
kubelet:
extraMounts:
- destination: /var/lib/longhorn
type: bind
source: /var/lib/longhorn
options:
- bind
- rshared
- rw

22
home/cluster/node2.patch.yaml Normal file
View file

@ -0,0 +1,22 @@
machine:
# Static IP Configuration
network:
hostname: node2.w5isp.com
interfaces:
- deviceSelector:
physical: true
addresses:
- 10.0.101.22/24
routes:
- network: 0.0.0.0/0
gateway: 10.0.101.254
dhcp: false
kubelet:
extraMounts:
- destination: /var/lib/longhorn
type: bind
source: /var/lib/longhorn
options:
- bind
- rshared
- rw

22
home/cluster/node3.patch.yaml Normal file
View file

@ -0,0 +1,22 @@
machine:
# Static IP Configuration
network:
hostname: node3.w5isp.com
interfaces:
- deviceSelector:
physical: true
addresses:
- 10.0.101.23/24
routes:
- network: 0.0.0.0/0
gateway: 10.0.101.254
dhcp: false
kubelet:
extraMounts:
- destination: /var/lib/longhorn
type: bind
source: /var/lib/longhorn
options:
- bind
- rshared
- rw

34
home/cluster/nodered/deploy.sh Normal file
View file

@ -0,0 +1,34 @@
#!/bin/bash
echo "Deploying Node-RED to k3s cluster..."
# Create namespace
kubectl apply -f namespace.yaml
# Create PVC
kubectl apply -f pvc.yaml
# Create settings ConfigMap
kubectl apply -f settings-configmap.yaml
# Deploy Node-RED
kubectl apply -f deployment.yaml
# Wait for Node-RED to be ready
echo "Waiting for Node-RED to be ready..."
kubectl wait --for=condition=ready pod -l app=nodered -n nodered --timeout=300s
# Create service
kubectl apply -f service.yaml
# Create ingress
kubectl apply -f ingress.yaml
echo "Node-RED deployment complete!"
echo ""
echo "Access Node-RED at: https://nodered.w5isp.com"
echo ""
echo "To check the deployment status:"
echo "kubectl get pods -n nodered"
echo "kubectl get svc -n nodered"
echo "kubectl get ingress -n nodered"

74
home/cluster/nodered/deployment.yaml Normal file
View file

@ -0,0 +1,74 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: nodered
namespace: nodered
spec:
replicas: 1
selector:
matchLabels:
app: nodered
template:
metadata:
labels:
app: nodered
spec:
initContainers:
- name: fix-permissions
image: busybox
command: ['sh', '-c']
args:
- |
chown -R 1000:1000 /data
chmod 755 /data
volumeMounts:
- name: node-red-data
mountPath: /data
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
containers:
- name: nodered
image: nodered/node-red:latest
ports:
- containerPort: 1880
env:
- name: TZ
value: "America/Chicago"
volumeMounts:
- name: node-red-data
mountPath: /data
- name: node-red-settings
mountPath: /data/settings.js
subPath: settings.js
resources:
requests:
memory: "256Mi"
cpu: "100m"
limits:
memory: "512Mi"
cpu: "500m"
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
volumes:
- name: node-red-data
persistentVolumeClaim:
claimName: nodered-data
- name: node-red-settings
configMap:
name: nodered-settings

57
home/cluster/nodered/ingress.yaml Normal file
View file

@ -0,0 +1,57 @@
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: nodered-tls
namespace: nodered
spec:
secretName: nodered-tls
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
dnsNames:
- nodered.w5isp.com
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: nodered-https
namespace: nodered
spec:
entryPoints:
- websecure
routes:
- match: Host(`nodered.w5isp.com`)
kind: Rule
services:
- name: nodered
port: 80
tls:
secretName: nodered-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: nodered-http
namespace: nodered
spec:
entryPoints:
- web
routes:
- match: Host(`nodered.w5isp.com`)
kind: Rule
services:
- name: nodered
port: 80
middlewares:
- name: redirect-to-https
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: redirect-to-https
namespace: nodered
spec:
redirectScheme:
scheme: https
permanent: true

12
home/cluster/nodered/pvc.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nodered-data
namespace: nodered
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 5Gi

14
home/cluster/nodered/service.yaml Normal file
View file

@ -0,0 +1,14 @@
apiVersion: v1
kind: Service
metadata:
name: nodered
namespace: nodered
spec:
type: ClusterIP
selector:
app: nodered
ports:
- port: 80
targetPort: 1880
protocol: TCP
name: http

65
home/cluster/nodered/settings-configmap.yaml Normal file
View file

@ -0,0 +1,65 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: nodered-settings
namespace: nodered
data:
settings.js: |
module.exports = {
// The file containing the flows.
flowFile: 'flows.json',
// Node-RED editor theme
editorTheme: {
page: {
title: "Node-RED - W5ISP"
},
header: {
title: "Node-RED",
image: null
}
},
// Securing the Node-RED editor
adminAuth: {
type: "credentials",
users: [{
username: "admin",
password: "$2b$08$dKYDBSTCOTgDVQqPNXCq/uzopu6XMbayUNtlvHhoLF0vNVbtscH.a",
permissions: "*"
}]
},
// Securing Node-RED API (optional, uncomment to enable)
// httpNodeAuth: {user:"user",pass:"$2b$08$eqrvB6AnIA68TG8yIJGDfumTlW0tSgUAcrnSxs.sy3mdNYUFZca/a"},
// Enable HTTPS (handled by Kubernetes Ingress)
requireHttps: false,
// The maximum size of HTTP request body in bytes
apiMaxLength: '5mb',
// Context Storage
contextStorage: {
default: {
module: "memory"
}
},
// Configure the logging
logging: {
console: {
level: "info",
metrics: false,
audit: false
}
},
// Disable the editor UI entirely
disableEditor: false,
// Configure node settings
functionGlobalContext: {
// Add any global context variables here
}
}

8
home/cluster/schematic.yaml Normal file
View file

@ -0,0 +1,8 @@
customization:
systemExtensions:
officialExtensions:
- siderolabs/iscsi-tools
- siderolabs/qemu-guest-agent
- siderolabs/tailscale
- siderolabs/util-linux-tools

5
home/cluster/tailscale.patch.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: tailscale
environment:
- TS_AUTHKEY=tskey-auth-kQWvbQQPDQ11CNTRL-xzEZ6vSwfH22zJcVAHsFH2NemetVQ53Bg

7
home/cluster/talosconfig Normal file
View file

@ -0,0 +1,7 @@
context: home
contexts:
home:
endpoints: []
ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLVENCM0tBREFnRUNBaEVBZ1VTcEExTk1IYnhBNmxLVXVXVC9FVEFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTWpZeE1ERTRNVFl3TVRFNFdqQVRNUkV3RHdZRApWUVFLRXdodmN6cGhaRzFwYmpBcU1BVUdBeXRsY0FNaEFPWDI2YXhRYWMyNkhmbmtpOEZSTnNUeWZMU1FQSWFhCkphSW1SRlY4aVQwT28wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0I0QXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUgKQXdJd0h3WURWUjBqQkJnd0ZvQVVralc5TkJ1UUkySTBTQTFaRk0xa05LYVRMNW93QlFZREsyVndBMEVBa25hTQpJVTFTNjE1eS9HWkFRb3VFcmQxcUdmaDkyd2IrTDR4NGxTc09Fa1VjdTBXM1EzN3RWbElsZlFnbDRaK3ZzV2IxCnhNSWhrWVFVNUFRRW5rb1VEdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJUHlOTHBLZmJqZm9DbGVlRUhpYjlCUUZYdlNhVndjWEtYMjhHOHFMNWt3OQotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K

67
home/cluster/wavelog/README.md Normal file
View file

@ -0,0 +1,67 @@
# Wavelog Deployment
Wavelog is an open source amateur radio logging application deployed on k3s cluster at 204.110.191.2.
## Architecture
- **Application**: Wavelog PHP application
- **Database**: MariaDB 11 (10GB storage)
- **Storage**: 20GB for config, backups, uploads, and QSL cards
- **Ingress**: Traefik with cert-manager for SSL (Let's Encrypt)
- **Access**: https://log.w5isp.com
## Deployment
```bash
# Deploy everything
./deploy.sh
# Check status
kubectl get pods -n wavelog
kubectl get certificate -n wavelog
kubectl get ingressroute -n wavelog
```
## Initial Setup
1. Visit https://log.w5isp.com/install
2. Database configuration:
- **Host**: mariadb
- **Database**: wavelog
- **Username**: wavelog
- **Password**: B58R2Ivh9jkVgdMBcRFbDSpYc
3. Complete the installation wizard
4. Default admin login (change immediately):
- **Username**: m0abc
- **Password**: demo
## Files
- `namespace.yaml` - Wavelog namespace
- `mariadb-secret.yaml` - Database credentials
- `mariadb-deployment.yaml` - MariaDB StatefulSet
- `wavelog-pvc.yaml` - Persistent storage for Wavelog data
- `wavelog-deployment.yaml` - Wavelog application deployment
- `wavelog-ingressroute.yaml` - Traefik ingress with SSL
- `deploy.sh` - Deployment script
## Configuration
- **PHP Settings**:
- Upload max: 50MB
- Post max: 50MB
- Memory limit: 256MB
- Execution time: 300s
## Backup
Wavelog stores backups in `/var/www/html/application/backup` which is persisted on the PVC.
## Security
- All passwords have been generated securely
- Database is only accessible within the cluster
- SSL/TLS encryption via Let's Encrypt
- Do not commit secret files to version control

47
home/cluster/wavelog/deploy.sh Normal file
View file

@ -0,0 +1,47 @@
#!/bin/bash
set -e
echo "Deploying Wavelog to k3s cluster at 204.110.191.2"
# Use homelab context
kubectl config use-context homelab
# Create namespace
echo "Creating namespace..."
kubectl apply -f namespace.yaml
# Deploy MariaDB
echo "Deploying MariaDB..."
kubectl apply -f mariadb-secret.yaml
kubectl apply -f mariadb-deployment.yaml
# Wait for MariaDB to be ready
echo "Waiting for MariaDB to be ready..."
kubectl wait --for=condition=ready pod -l app=mariadb -n wavelog --timeout=300s
# Deploy Wavelog
echo "Deploying Wavelog application..."
kubectl apply -f wavelog-pvc.yaml
kubectl apply -f wavelog-deployment.yaml
# Deploy Traefik ingress
echo "Deploying Traefik ingress..."
kubectl apply -f wavelog-ingressroute.yaml
echo "Deployment complete!"
echo ""
echo "To check status:"
echo "kubectl get pods -n wavelog"
echo ""
echo "Access Wavelog at: https://log.w5isp.com"
echo ""
echo "Initial setup:"
echo "1. Visit https://log.w5isp.com/install"
echo "2. Database Host: mariadb"
echo "3. Database Name: wavelog"
echo "4. Database User: wavelog"
echo "5. Database Password: B58R2Ivh9jkVgdMBcRFbDSpYc"
echo ""
echo "Default admin credentials (change after login):"
echo "Username: m0abc"
echo "Password: demo"

67
home/cluster/wavelog/mariadb-deployment.yaml Normal file
View file

@ -0,0 +1,67 @@
---
apiVersion: v1
kind: Service
metadata:
name: mariadb
namespace: wavelog
spec:
selector:
app: mariadb
ports:
- port: 3306
targetPort: 3306
clusterIP: None
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: mariadb
namespace: wavelog
spec:
serviceName: mariadb
replicas: 1
selector:
matchLabels:
app: mariadb
template:
metadata:
labels:
app: mariadb
spec:
containers:
- name: mariadb
image: mariadb:11
ports:
- containerPort: 3306
envFrom:
- secretRef:
name: mariadb-secret
volumeMounts:
- name: mariadb-storage
mountPath: /var/lib/mysql
livenessProbe:
tcpSocket:
port: 3306
initialDelaySeconds: 60
periodSeconds: 30
readinessProbe:
tcpSocket:
port: 3306
initialDelaySeconds: 30
periodSeconds: 10
resources:
requests:
memory: "512Mi"
cpu: "250m"
limits:
memory: "1Gi"
cpu: "500m"
volumeClaimTemplates:
- metadata:
name: mariadb-storage
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 10Gi

12
home/cluster/wavelog/mariadb-secret.yaml Normal file
View file

@ -0,0 +1,12 @@
---
apiVersion: v1
kind: Secret
metadata:
name: mariadb-secret
namespace: wavelog
type: Opaque
stringData:
MYSQL_ROOT_PASSWORD: "SBcy7eZC6lLR5sSkQCkhmC1MXlA"
MYSQL_DATABASE: "wavelog"
MYSQL_USER: "wavelog"
MYSQL_PASSWORD: "B58R2Ivh9jkVgdMBcRFbDSpYc"

5
home/cluster/wavelog/namespace.yaml Normal file
View file

@ -0,0 +1,5 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: wavelog

56
home/cluster/wavelog/wavelog-config-job.yaml Normal file
View file

@ -0,0 +1,56 @@
apiVersion: batch/v1
kind: Job
metadata:
name: wavelog-configure
namespace: wavelog
spec:
template:
spec:
restartPolicy: Never
containers:
- name: configure
image: ghcr.io/wavelog/wavelog:latest
command: ["/bin/bash", "-c"]
args:
- |
set -e
echo "Creating Wavelog configuration files..."
# Create database.php
cat > /config/database.php <<'EOF'
<?php
defined('BASEPATH') OR exit('No direct script access allowed');
$active_group = 'default';
$query_builder = TRUE;
$db['default'] = array(
'dsn' => '',
'hostname' => 'mariadb.data.svc.cluster.local',
'username' => 'wavelog',
'password' => 's7hDEobNpX08UQxewlSLyrMGjbdnIcuw',
'database' => 'wavelog',
'dbdriver' => 'mysqli',
'dbprefix' => '',
'pconnect' => FALSE,
'db_debug' => FALSE,
'cache_on' => FALSE,
'cachedir' => '',
'char_set' => 'utf8mb4',
'dbcollat' => 'utf8mb4_general_ci',
'swap_pre' => '',
'encrypt' => FALSE,
'compress' => FALSE,
'stricton' => FALSE,
'failover' => array(),
'save_queries' => TRUE
);
EOF
echo "Configuration complete!"
volumeMounts:
- name: wavelog-data
mountPath: /config
subPath: config
volumes:
- name: wavelog-data
persistentVolumeClaim:
claimName: wavelog-data

176
home/cluster/wavelog/wavelog-deployment.yaml Normal file
View file

@ -0,0 +1,176 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: wavelog-config
namespace: wavelog
data:
# PHP configuration overrides
php.ini: |
upload_max_filesize = 50M
post_max_size = 50M
memory_limit = 256M
max_execution_time = 300
---
apiVersion: v1
kind: Service
metadata:
name: wavelog
namespace: wavelog
spec:
type: ClusterIP
selector:
app: wavelog
ports:
- port: 80
targetPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: wavelog
namespace: wavelog
spec:
replicas: 1
selector:
matchLabels:
app: wavelog
template:
metadata:
labels:
app: wavelog
spec:
initContainers:
- name: fix-permissions
image: busybox:latest
command: ["sh", "-c"]
args:
- |
echo "Fixing permissions for Wavelog directories..."
# Create all required directories
mkdir -p /var/www/html/application/config
mkdir -p /var/www/html/application/logs
mkdir -p /var/www/html/backup
mkdir -p /var/www/html/updates
mkdir -p /var/www/html/uploads
mkdir -p /var/www/html/images/eqsl_card_images
mkdir -p /var/www/html/assets/qslcard
# Set ownership to www-data (UID 33)
chown -R 33:33 /var/www/html/application/config
chown -R 33:33 /var/www/html/application/logs
chown -R 33:33 /var/www/html/backup
chown -R 33:33 /var/www/html/updates
chown -R 33:33 /var/www/html/uploads
chown -R 33:33 /var/www/html/images/eqsl_card_images
chown -R 33:33 /var/www/html/assets/qslcard
# Set directory permissions
find /var/www/html/application/config -type d -exec chmod 755 {} \;
find /var/www/html/application/logs -type d -exec chmod 755 {} \;
find /var/www/html/backup -type d -exec chmod 755 {} \;
find /var/www/html/updates -type d -exec chmod 755 {} \;
find /var/www/html/uploads -type d -exec chmod 755 {} \;
find /var/www/html/images/eqsl_card_images -type d -exec chmod 755 {} \;
find /var/www/html/assets/qslcard -type d -exec chmod 755 {} \;
# Set file permissions
find /var/www/html/application/config -type f -exec chmod 664 {} \;
find /var/www/html/application/logs -type f -exec chmod 664 {} \;
find /var/www/html/backup -type f -exec chmod 664 {} \;
find /var/www/html/updates -type f -exec chmod 664 {} \;
find /var/www/html/uploads -type f -exec chmod 664 {} \;
find /var/www/html/images/eqsl_card_images -type f -exec chmod 664 {} \;
find /var/www/html/assets/qslcard -type f -exec chmod 664 {} \;
echo "Permissions fixed!"
volumeMounts:
- name: wavelog-data
mountPath: /var/www/html/application/config
subPath: config
- name: wavelog-data
mountPath: /var/www/html/application/logs
subPath: logs
- name: wavelog-data
mountPath: /var/www/html/backup
subPath: backup-root
- name: wavelog-data
mountPath: /var/www/html/updates
subPath: updates
- name: wavelog-data
mountPath: /var/www/html/uploads
subPath: uploads-root
- name: wavelog-data
mountPath: /var/www/html/images/eqsl_card_images
subPath: eqsl_card_images
- name: wavelog-data
mountPath: /var/www/html/assets/qslcard
subPath: qslcard
containers:
- name: wavelog
image: ghcr.io/wavelog/wavelog:latest
ports:
- containerPort: 80
env:
- name: MYSQL_HOST
value: "mariadb.data.svc.cluster.local"
- name: MYSQL_PORT
value: "3306"
- name: MYSQL_DATABASE
value: "wavelog"
- name: MYSQL_USER
value: "wavelog"
- name: MYSQL_PASSWORD
valueFrom:
secretKeyRef:
name: wavelog-secret
key: database-password
volumeMounts:
- name: wavelog-data
mountPath: /var/www/html/application/config
subPath: config
- name: wavelog-data
mountPath: /var/www/html/application/logs
subPath: logs
- name: wavelog-data
mountPath: /var/www/html/backup
subPath: backup-root
- name: wavelog-data
mountPath: /var/www/html/updates
subPath: updates
- name: wavelog-data
mountPath: /var/www/html/uploads
subPath: uploads-root
- name: wavelog-data
mountPath: /var/www/html/images/eqsl_card_images
subPath: eqsl_card_images
- name: wavelog-data
mountPath: /var/www/html/assets/qslcard
subPath: qslcard
- name: php-config
mountPath: /usr/local/etc/php/conf.d/custom.ini
subPath: php.ini
livenessProbe:
tcpSocket:
port: 80
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
tcpSocket:
port: 80
initialDelaySeconds: 10
periodSeconds: 10
resources:
requests:
memory: "256Mi"
cpu: "200m"
limits:
memory: "512Mi"
cpu: "500m"
volumes:
- name: wavelog-data
persistentVolumeClaim:
claimName: wavelog-data
- name: php-config
configMap:
name: wavelog-config

25
home/cluster/wavelog/wavelog-ingress.yaml Normal file
View file

@ -0,0 +1,25 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: wavelog-ingress
namespace: wavelog
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
spec:
ingressClassName: traefik
tls:
- hosts:
- log.w5isp.com
secretName: wavelog-tls
rules:
- host: log.w5isp.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: wavelog
port:
number: 80

57
home/cluster/wavelog/wavelog-ingressroute.yaml Normal file
View file

@ -0,0 +1,57 @@
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: wavelog-cert
namespace: wavelog
spec:
secretName: wavelog-tls
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
dnsNames:
- log.w5isp.com
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: wavelog-https
namespace: wavelog
spec:
entryPoints:
- websecure
routes:
- match: Host(`log.w5isp.com`)
kind: Rule
services:
- name: wavelog
port: 80
tls:
secretName: wavelog-tls
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: wavelog-http
namespace: wavelog
spec:
entryPoints:
- web
routes:
- match: Host(`log.w5isp.com`)
kind: Rule
services:
- name: wavelog
port: 80
middlewares:
- name: redirect-to-https
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: redirect-to-https
namespace: wavelog
spec:
redirectScheme:
scheme: https
permanent: true

13
home/cluster/wavelog/wavelog-pvc.yaml Normal file
View file

@ -0,0 +1,13 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: wavelog-data
namespace: wavelog
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 20Gi

11
home/cluster/wavelog/wavelog-secret.yaml Normal file
View file

@ -0,0 +1,11 @@
apiVersion: v1
kind: Secret
metadata:
name: wavelog-secret
namespace: wavelog
type: Opaque
stringData:
database-host: "mariadb.data.svc.cluster.local"
database-name: "wavelog"
database-user: "wavelog"
database-password: "s7hDEobNpX08UQxewlSLyrMGjbdnIcuw"

580
home/cluster/worker.yaml Normal file
View file

@ -0,0 +1,580 @@
version: v1alpha1 # Indicates the schema used to decode the contents.
debug: false # Enable verbose logging to the console.
persist: true
# Provides machine specific configuration options.
machine:
type: worker # Defines the role of the machine within the cluster.
token: l1ubxp.d942qc3plno7pxlw # The `token` is used by a machine to join the PKI of the cluster.
# The root certificate authority of the PKI.
ca:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
key: ""
# Extra certificate subject alternative names for the machine's certificate.
certSANs: []
# # Uncomment this to enable SANs.
# - 10.0.0.10
# - 172.16.0.10
# - 192.168.0.10
# Used to provide additional options to the kubelet.
kubelet:
image: ghcr.io/siderolabs/kubelet:v1.34.0 # The `image` field is an optional reference to an alternative kubelet image.
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
# clusterDNS:
# - 10.96.0.10
# - 169.254.2.53
# # The `extraArgs` field is used to provide additional flags to the kubelet.
# extraArgs:
# key: value
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
# extraMounts:
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
# type: bind # Type specifies the mount kind.
# source: /var/lib/example # Source specifies the source path of the mount.
# # Options are fstab style mount options.
# options:
# - bind
# - rshared
# - rw
# # The `extraConfig` field is used to provide kubelet configuration overrides.
# extraConfig:
# serverTLSBootstrap: true
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
# credentialProviderConfig:
# apiVersion: kubelet.config.k8s.io/v1
# kind: CredentialProviderConfig
# providers:
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
# defaultCacheDuration: 12h
# matchImages:
# - '*.dkr.ecr.*.amazonaws.com'
# - '*.dkr.ecr.*.amazonaws.com.cn'
# - '*.dkr.ecr-fips.*.amazonaws.com'
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
# name: ecr-credential-provider
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
# nodeIP:
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
# validSubnets:
# - 10.0.0.0/8
# - '!10.0.0.3/32'
# - fdc7::/16
# Provides machine specific network configuration options.
network: {}
# # `interfaces` is used to define the network interface configuration.
# interfaces:
# - interface: enp0s1 # The interface name.
# # Assigns static IP addresses to the interface.
# addresses:
# - 192.168.2.0/24
# # A list of routes associated with the interface.
# routes:
# - network: 0.0.0.0/0 # The route's network (destination).
# gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
# metric: 1024 # The optional metric for the route.
# mtu: 1500 # The interface's MTU.
#
# # # Picks a network device using the selector.
# # # select a device with bus prefix 00:*.
# # deviceSelector:
# # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
# # deviceSelector:
# # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
# # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
# # deviceSelector:
# # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
# # # Bond specific options.
# # bond:
# # # The interfaces that make up the bond.
# # interfaces:
# # - enp2s0
# # - enp2s1
# # # Picks a network device using the selector.
# # deviceSelectors:
# # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
# # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
# # mode: 802.3ad # A bond option.
# # lacpRate: fast # A bond option.
# # # Bridge specific options.
# # bridge:
# # # The interfaces that make up the bridge.
# # interfaces:
# # - enxda4042ca9a51
# # - enxae2a6774c259
# # # Enable STP on this bridge.
# # stp:
# # enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
# # # Configure this device as a bridge port.
# # bridgePort:
# # master: br0 # The name of the bridge master interface
# # # Indicates if DHCP should be used to configure the interface.
# # dhcp: true
# # # DHCP specific options.
# # dhcpOptions:
# # routeMetric: 1024 # The priority of all routes received via DHCP.
# # # Wireguard specific configuration.
# # # wireguard server example
# # wireguard:
# # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # listenPort: 51111 # Specifies a device's listening port.
# # # Specifies a list of peer configurations to apply to a device.
# # peers:
# # - publicKey: ABCDEF... # Specifies the public key of this peer.
# # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
# # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# # allowedIPs:
# # - 192.168.1.0/24
# # # wireguard peer example
# # wireguard:
# # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# # # Specifies a list of peer configurations to apply to a device.
# # peers:
# # - publicKey: ABCDEF... # Specifies the public key of this peer.
# # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
# # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
# # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
# # allowedIPs:
# # - 192.168.1.0/24
# # # Virtual (shared) IP address configuration.
# # # layer2 vip example
# # vip:
# # ip: 172.16.199.55 # Specifies the IP address to be used.
# # Used to statically set the nameservers for the machine.
# nameservers:
# - 8.8.8.8
# - 1.1.1.1
# # Used to statically set arbitrary search domains.
# searchDomains:
# - example.org
# - example.com
# # Allows for extra entries to be added to the `/etc/hosts` file
# extraHostEntries:
# - ip: 192.168.1.100 # The IP of the host.
# # The host alias.
# aliases:
# - example
# - example.domain.tld
# # Configures KubeSpan feature.
# kubespan:
# enabled: true # Enable the KubeSpan feature.
# Used to provide instructions for installations.
install:
disk: /dev/nvme0n1 # The disk used for installations.
image: ghcr.io/siderolabs/installer:v1.11.1 # Allows for supplying the image used to perform the installation.
wipe: false # Indicates if the installation disk should be wiped at installation time.
# # Look up disk using disk attributes like model, size, serial and others.
# diskSelector:
# size: 4GB # Disk size.
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
# # Allows for supplying extra kernel args via the bootloader.
# extraKernelArgs:
# - talos.platform=metal
# - reboot=k
# Used to configure the machine's container image registry mirrors.
registries: {}
# # Specifies mirror configuration for each registry host namespace.
# mirrors:
# ghcr.io:
# # List of endpoints (URLs) for registry mirrors to use.
# endpoints:
# - https://registry.insecure
# - https://ghcr.io/v2/
# # Specifies TLS & auth configuration for HTTPS image registries.
# config:
# registry.insecure:
# # The TLS configuration for the registry.
# tls:
# insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
#
# # # Enable mutual TLS authentication with the registry.
# # clientIdentity:
# # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
# # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
#
# # # The auth configuration for this registry.
# # auth:
# # username: username # Optional registry authentication.
# # password: password # Optional registry authentication.
# Features describe individual Talos features that can be switched on or off.
features:
rbac: true # Enable role-based access control (RBAC).
stableHostname: true # Enable stable default hostname.
apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid.
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
# KubePrism - local proxy/load balancer on defined port that will distribute
kubePrism:
enabled: true # Enable KubePrism support - will start local load balancing proxy.
port: 7445 # KubePrism port.
# Configures host DNS caching resolver.
hostDNS:
enabled: true # Enable host DNS caching resolver.
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
# # Configure Talos API access from Kubernetes pods.
# kubernetesTalosAPIAccess:
# enabled: true # Enable Talos API access from Kubernetes pods.
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
# allowedRoles:
# - os:reader
# # The list of Kubernetes namespaces Talos API access is available from.
# allowedKubernetesNamespaces:
# - kube-system
# # Provides machine specific control plane configuration options.
# # ControlPlane definition example.
# controlPlane:
# # Controller manager machine specific configuration options.
# controllerManager:
# disabled: false # Disable kube-controller-manager on the node.
# # Scheduler machine specific configuration options.
# scheduler:
# disabled: true # Disable kube-scheduler on the node.
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
# # nginx static pod.
# pods:
# - apiVersion: v1
# kind: pod
# metadata:
# name: nginx
# spec:
# containers:
# - image: nginx
# name: nginx
# # Allows the addition of user specified files.
# # MachineFiles usage example.
# files:
# - content: '...' # The contents of the file.
# permissions: 0o666 # The file's permissions in octal.
# path: /tmp/file.txt # The path of the file.
# op: append # The operation to use
# # The `env` field allows for the addition of environment variables.
# # Environment variables definition examples.
# env:
# GRPC_GO_LOG_SEVERITY_LEVEL: info
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
# https_proxy: http://SERVER:PORT/
# env:
# GRPC_GO_LOG_SEVERITY_LEVEL: error
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
# env:
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
# # Used to configure the machine's time settings.
# # Example configuration for cloudflare ntp server.
# time:
# disabled: false # Indicates if the time service is disabled for the machine.
# # description: |
# servers:
# - time.cloudflare.com
# bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
# # Used to configure the machine's sysctls.
# # MachineSysctls usage example.
# sysctls:
# kernel.domainname: talos.dev
# net.ipv4.ip_forward: "0"
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
# # Used to configure the machine's sysfs.
# # MachineSysfs usage example.
# sysfs:
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
# # Configures the udev system.
# udev:
# # List of udev rules to apply to the udev system
# rules:
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
# # Configures the logging system.
# logging:
# # Logging destination.
# destinations:
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
# format: json_lines # Logs format.
# # Configures the kernel.
# kernel:
# # Kernel modules to load.
# modules:
# - name: brtfs # Module name.
# # Configures the seccomp profiles for the machine.
# seccompProfiles:
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
# # The `value` field is used to provide the seccomp profile.
# value:
# defaultAction: SCMP_ACT_LOG
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
# # override default open file limit
# baseRuntimeSpecOverrides:
# process:
# rlimits:
# - hard: 1024
# soft: 1024
# type: RLIMIT_NOFILE
# # Configures the node labels for the machine.
# # node labels example.
# nodeLabels:
# exampleLabel: exampleLabelValue
# # Configures the node annotations for the machine.
# # node annotations example.
# nodeAnnotations:
# customer.io/rack: r13a25
# # Configures the node taints for the machine. Effect is optional.
# # node taints example.
# nodeTaints:
# exampleTaint: exampleTaintValue:NoSchedule
# Provides cluster specific configuration options.
cluster:
id: eaZ-ULVPPORjVzp1Y4XpAOn4X8_UQTHwuGMLfNGZKgM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
secret: 0CQQzq2WnliOSsobOhMsAARA77nM8Phz6XiADm+IfzI= # Shared secret of cluster (base64 encoded random 32 bytes).
# Provides control plane specific configuration options.
controlPlane:
endpoint: https://10.0.101.21:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
clusterName: home # Configures the cluster's name.
# Provides cluster specific network configuration options.
network:
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
- 10.244.0.0/16
# The service subnet CIDR.
serviceSubnets:
- 10.96.0.0/12
# # The CNI used.
# cni:
# name: custom # Name of CNI to use.
# # URLs containing manifests to apply for the CNI.
# urls:
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
token: ehxond.kiubhs6w8x46jo2r # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
# The base64 encoded root certificate authority used by Kubernetes.
ca:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQVBlNFgzZjZEUjBMbU00dzI2TXZ6V2N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV3TVRneE5qQXhNVGhhRncwek5URXdNVFl4TmpBeApNVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVNIZWpBdWVwdjRXelpxTDkvSzNLdDdkSm1EaCtxWXI3Y2Q1QzB3S0J5RTYyZnRtRjg3TktJc3R1WU8KYkdWb1BjQ0QyVzU3YVVEdGl5dVVmWlJUdDczcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGSXZuSlh1eVZVVWtFZVlxQy8rU2ZDUUwyQ2tpTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUVZcmRtSkYKaVVoM2xIaWlSSzJCamF6N3hyUjkvM2lDblZ2bm5meWlnbVNDQWlFQS9CSW9PWWJ2WmU5K2J0emo2b0tlaGRQcwo3R2Y3TTJYK0xhMlRQc3pMemswPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
key: ""
# Configures cluster member discovery.
discovery:
enabled: true # Enable the cluster membership discovery feature.
# Configure registries used for cluster member discovery.
registries:
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
kubernetes:
disabled: true # Disable Kubernetes discovery registry.
# Service registry is using an external service to push and pull information about cluster members.
service: {}
# # External service endpoint.
# endpoint: https://discovery.talos.dev/
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
# # Decryption secret example (do not use in production!).
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
# # Decryption secret example (do not use in production!).
# secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
# # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
# # AggregatorCA example.
# aggregatorCA:
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
# # The base64 encoded private key for service account token generation.
# # AggregatorCA example.
# serviceAccount:
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
# # API server specific configuration options.
# apiServer:
# image: registry.k8s.io/kube-apiserver:v1.34.0 # The container image used in the API server manifest.
# # Extra arguments to supply to the API server.
# extraArgs:
# feature-gates: ServerSideApply=true
# http2-max-streams-per-connection: "32"
# # Extra certificate subject alternative names for the API server's certificate.
# certSANs:
# - 1.2.3.4
# - 4.5.6.7
# # Configure the API server admission plugins.
# admissionControl:
# - name: PodSecurity # Name is the name of the admission controller.
# # Configuration is an embedded configuration object to be used as the plugin's
# configuration:
# apiVersion: pod-security.admission.config.k8s.io/v1alpha1
# defaults:
# audit: restricted
# audit-version: latest
# enforce: baseline
# enforce-version: latest
# warn: restricted
# warn-version: latest
# exemptions:
# namespaces:
# - kube-system
# runtimeClasses: []
# usernames: []
# kind: PodSecurityConfiguration
# # Configure the API server audit policy.
# auditPolicy:
# apiVersion: audit.k8s.io/v1
# kind: Policy
# rules:
# - level: Metadata
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
# authorizationConfig:
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
# name: webhook # Name is used to describe the authorizer.
# # webhook is the configuration for the webhook authorizer.
# webhook:
# connectionInfo:
# type: InClusterConfig
# failurePolicy: Deny
# matchConditionSubjectAccessReviewVersion: v1
# matchConditions:
# - expression: has(request.resourceAttributes)
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
# subjectAccessReviewVersion: v1
# timeout: 3s
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
# name: in-cluster-authorizer # Name is used to describe the authorizer.
# # webhook is the configuration for the webhook authorizer.
# webhook:
# connectionInfo:
# type: InClusterConfig
# failurePolicy: NoOpinion
# matchConditionSubjectAccessReviewVersion: v1
# subjectAccessReviewVersion: v1
# timeout: 3s
# # Controller manager server specific configuration options.
# controllerManager:
# image: registry.k8s.io/kube-controller-manager:v1.34.0 # The container image used in the controller manager manifest.
# # Extra arguments to supply to the controller manager.
# extraArgs:
# feature-gates: ServerSideApply=true
# # Kube-proxy server-specific configuration options
# proxy:
# disabled: false # Disable kube-proxy deployment on cluster bootstrap.
# image: registry.k8s.io/kube-proxy:v1.34.0 # The container image used in the kube-proxy manifest.
# mode: ipvs # proxy mode of kube-proxy.
# # Extra arguments to supply to kube-proxy.
# extraArgs:
# proxy-mode: iptables
# # Scheduler server specific configuration options.
# scheduler:
# image: registry.k8s.io/kube-scheduler:v1.34.0 # The container image used in the scheduler manifest.
# # Extra arguments to supply to the scheduler.
# extraArgs:
# feature-gates: AllBeta=true
# # Etcd specific configuration options.
# etcd:
# image: gcr.io/etcd-development/etcd:v3.6.4 # The container image used to create the etcd service.
# # The `ca` is the root certificate authority of the PKI.
# ca:
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
# # Extra arguments to supply to etcd.
# extraArgs:
# election-timeout: "5000"
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
# advertisedSubnets:
# - 10.0.0.0/8
# # Core DNS specific configuration options.
# coreDNS:
# image: registry.k8s.io/coredns/coredns:v1.12.3 # The `image` field is an override to the default coredns image.
# # External cloud provider configuration.
# externalCloudProvider:
# enabled: true # Enable external cloud provider.
# # A list of urls that point to additional manifests for an external cloud provider.
# manifests:
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
# # A list of urls that point to additional manifests.
# extraManifests:
# - https://www.example.com/manifest1.yaml
# - https://www.example.com/manifest2.yaml
# # A map of key value pairs that will be added while fetching the extraManifests.
# extraManifestHeaders:
# Token: "1234567"
# X-ExtraInfo: info
# # A list of inline Kubernetes manifests.
# inlineManifests:
# - name: namespace-ci # Name of the manifest.
# contents: |- # Manifest contents as a string.
# apiVersion: v1
# kind: Namespace
# metadata:
# name: ci
# # Settings for admin kubeconfig generation.
# adminKubeconfig:
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
# # Allows running workload on control-plane nodes.
# allowSchedulingOnControlPlanes: true

8
talos/configs/talos-cp1.yaml
View file

@ -114,7 +114,13 @@ machine:
# Configures the node labels for the machine.
nodeLabels:
node.kubernetes.io/exclude-from-external-load-balancers: ""
# Configures the machine's time settings.
time:
servers:
- 0.us.pool.ntp.org
- 1.us.pool.ntp.org
- 2.us.pool.ntp.org
# # Provides machine specific control plane configuration options.
# # ControlPlane definition example.

8
talos/configs/talos-cp2.yaml
View file

@ -114,7 +114,13 @@ machine:
# Configures the node labels for the machine.
nodeLabels:
node.kubernetes.io/exclude-from-external-load-balancers: ""
# Configures the machine's time settings.
time:
servers:
- 0.us.pool.ntp.org
- 1.us.pool.ntp.org
- 2.us.pool.ntp.org
# # Provides machine specific control plane configuration options.
# # ControlPlane definition example.

8
talos/configs/talos-cp3.yaml
View file

@ -114,7 +114,13 @@ machine:
# Configures the node labels for the machine.
nodeLabels:
node.kubernetes.io/exclude-from-external-load-balancers: ""
# Configures the machine's time settings.
time:
servers:
- 0.us.pool.ntp.org
- 1.us.pool.ntp.org
- 2.us.pool.ntp.org
# # Provides machine specific control plane configuration options.
# # ControlPlane definition example.

7
talos/configs/talos-worker1.yaml
View file

@ -207,6 +207,13 @@ machine:
# soft: 1024
# type: RLIMIT_NOFILE
# Configures the machine's time settings.
time:
servers:
- 0.us.pool.ntp.org
- 1.us.pool.ntp.org
- 2.us.pool.ntp.org
# # Configures the node labels for the machine.
# # node labels example.

7
talos/configs/talos-worker2.yaml
View file

@ -207,6 +207,13 @@ machine:
# soft: 1024
# type: RLIMIT_NOFILE
# Configures the machine's time settings.
time:
servers:
- 0.us.pool.ntp.org
- 1.us.pool.ntp.org
- 2.us.pool.ntp.org
# # Configures the node labels for the machine.
# # node labels example.

7
talos/configs/talos-worker3.yaml
View file

@ -207,6 +207,13 @@ machine:
# soft: 1024
# type: RLIMIT_NOFILE
# Configures the machine's time settings.
time:
servers:
- 0.us.pool.ntp.org
- 1.us.pool.ntp.org
- 2.us.pool.ntp.org
# # Configures the node labels for the machine.
# # node labels example.

12
terraform/.sync-conflict-20260129-154537-ZJZJYMM.envrc Normal file
View file

@ -0,0 +1,12 @@
# OpenTofu CLI arguments
export TF_CLI_ARGS_plan="-parallelism=5"
export TF_CLI_ARGS_apply="-parallelism=5"
# HTTP Backend configuration (GitLab)
export TF_HTTP_ADDRESS="https://gitlab.com/api/v4/projects/77152227/terraform/state/gitlab"
export TF_HTTP_LOCK_ADDRESS="https://gitlab.com/api/v4/projects/77152227/terraform/state/gitlab/lock"
export TF_HTTP_UNLOCK_ADDRESS="https://gitlab.com/api/v4/projects/77152227/terraform/state/gitlab/lock"
export TF_HTTP_LOCK_METHOD="POST"
export TF_HTTP_UNLOCK_METHOD="DELETE"
export TF_HTTP_USERNAME="graham"
export TF_HTTP_PASSWORD="glpat-sHvHvna6AgdoSiJ-HE7PyW86MQp1OjFmcAk.01.0z0j9iera"

128
terraform/.terraform.lock.sync-conflict-20260129-152957-ZJZJYMM.hcl Normal file
View file

@ -0,0 +1,128 @@
# This file is maintained automatically by "tofu init".
# Manual edits may be lost in future updates.
provider "registry.opentofu.org/cloudflare/cloudflare" {
version = "5.15.0"
constraints = "~> 5.0"
hashes = [
"h1:EY8mWQO1NTqXuxnZxwVppF7AiLRdx7vRLYk6O7yzgPs=",
"zh:20a72bdbb28435f11d165b367732369e8f8163100a214e89ad720dae03fafa0c",
"zh:2eabd7a51fd7aafcab9861631d85c895914857e4fcd6fe2dd80bac22e74a1f47",
"zh:62828afbc1ba0e0a64bbb7d5d42ae3c2fbbaabb793010b07eba770ba91bae94f",
"zh:6693f1021e52c34a629300fbcd91f8bd4ca386fda3b45aec746b9c200c28a42c",
"zh:6873a15454b289e5baecc1d36ce8997266438761386a320753c63f13407f4a6b",
"zh:afbf4e56b3a5e5950b35b02b553313e4a2008415920b23f536682269c64ca549",
"zh:db367612900bc2e5a01c6a325e4cff9b1b04960ce9de3dd41671dda5a627ca1d",
"zh:eb7365eafc6160c3b304a9ce6a598e5400a2e779e9e2bd27976df244f79f774f",
"zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
]
}
provider "registry.opentofu.org/dnsimple/dnsimple" {
version = "2.0.0"
constraints = "~> 2.0"
hashes = [
"h1:wWsupXlmlShs8m4C2dTaNcYTxFJtDipftKWlXk+jX1U=",
"zh:0fb015799f6d37323cdc2776eed67657721df24311bf5b458f7fcce65ec66dea",
"zh:533cd0f6edd4ed6610b324b39aa3abb5e84293a3aaa176042826f17f10a20557",
"zh:77d13ff083eeeb408822e885934925b9010462ca7601d35f2a1c2b0d5faf2f52",
"zh:9be63f37c98050a30e43066805ac70db3e3ddfcf03607c9c8d8d13ebd3503648",
"zh:a66a61ab90840b5ae9513f302f76e2348acb8bca50cb702e1f6fbcd24b1111fb",
"zh:b65d2f77f20a9587f169aaeccd8e12f07a713294fd687043ff041538c5da5cf9",
"zh:c24faaefb7f87050f1dfbf6c7a9a522df07ab97e9ce73d7fd20bce761d092076",
"zh:d0072167c5f52cd63e245d6b136a8e62979c0b0979fbea5a07015d5bfb6e7191",
"zh:d07dee2322cf12ffc439059f7f3a58a5d740fe7ad934f96b84b0be3257ee31cb",
"zh:d0c898dcc7d51427348d641474a74521c029d2cd9713f262e404f5fb36f4c3a5",
"zh:d9322e1a3dba21316713ada4b8de6c4090ca6b76b418ef55b85dbe7c0a578391",
"zh:e0e0b5f07293ff2c0ddb1c561dcb430924897022995006c4bb71719cf3995d9d",
"zh:e4eb3deac11f7798ea991fd044aec6a23592cbd887a7f3d1d415e8f553ba7b39",
"zh:f1d307fe43f3a8be6a97111dbe025ccd0bb4a5c8dadd54abc48adec8701336b1",
"zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
]
}
provider "registry.opentofu.org/hashicorp/null" {
version = "3.2.4"
constraints = "~> 3.0"
hashes = [
"h1:i+WKhUHL2REY5EGmiHjfUljJB8UKZ9QdhdM5uTeUhC4=",
"zh:1769783386610bed8bb1e861a119fe25058be41895e3996d9216dd6bb8a7aee3",
"zh:32c62a9387ad0b861b5262b41c5e9ed6e940eda729c2a0e58100e6629af27ddb",
"zh:339bf8c2f9733fce068eb6d5612701144c752425cebeafab36563a16be460fb2",
"zh:36731f23343aee12a7e078067a98644c0126714c4fe9ac930eecb0f2361788c4",
"zh:3d106c7e32a929e2843f732625a582e562ff09120021e510a51a6f5d01175b8d",
"zh:74bcb3567708171ad83b234b92c9d63ab441ef882b770b0210c2b14fdbe3b1b6",
"zh:90b55bdbffa35df9204282251059e62c178b0ac7035958b93a647839643c0072",
"zh:ae24c0e5adc692b8f94cb23a000f91a316070fdc19418578dcf2134ff57cf447",
"zh:b5c10d4ad860c4c21273203d1de6d2f0286845edf1c64319fa2362df526b5f58",
"zh:e05bbd88e82e1d6234988c85db62fd66f11502645838fff594a2ec25352ecd80",
]
}
provider "registry.opentofu.org/kyswtn/porkbun" {
version = "0.1.3"
constraints = "~> 0.1"
hashes = [
"h1:9PQILbIAiWdXCl+alkJ66h0uPm8wMgKfFaowJ2W3GB8=",
"zh:162faaf9378691e126a02c913df206a04d9529a24dfb9db8de306932e01666ec",
"zh:2df2181e8011fb2d9f93141e203cd2d7d714b6e5c6eaf8da83315f3fe703559d",
"zh:3dc27db87d20d19595f9c979007f9fc3465c2cd9571d8c09866003b0f54d448a",
"zh:44c71797db99a99a19d0ddafacb8592347cbe46fb4fd67cc2515f75d3e1eab46",
"zh:5ba42ec732375f2f194152927bcd40e9733794c116f1c2df3ad08b370ed45de1",
"zh:6ea5c559d0e88ce70a07c905b7efc570274c3765fb9b6311ad256534b7c1dd36",
"zh:737912274b28ec5090cb7133c6e47b18c164cb399cd976664af3fabc882216fa",
"zh:76166d6ca5f8168ae76360b87bba7c376c2fca459b0643ee8ff191d2feda2cd5",
"zh:764cbe5795c584128f18a19dd445d8c086d7321bcb863bedec70a9bf5110766b",
"zh:78eb37c1e789016fcdab7809d01ef44c9f6e392afa311ca841b92e8c53d5e2fb",
"zh:9ffa835f6173af391a31e103f86e013ff96bc4b7b886e9229a752640dac4be72",
"zh:cd27d4b7c66f251de1e31acfaeb431722e0a00c6620440f535e7e1d202809e08",
"zh:e804ab2f486c9c3650bc25fe7c1a708e779519085badf594f1d8e4c983c80d9f",
"zh:e95ee1f927503684c43ad9ef28f8f4fcab7c92ecba7412dceb6dcb75a32e6b73",
"zh:f362da74b1952a7b92c2114c099471c4dc09991636ac473d9928dd22904018c4",
]
}
provider "registry.opentofu.org/pan-net/powerdns" {
version = "1.5.0"
constraints = "~> 1.5"
hashes = [
"h1:oMzrqQGFY88Cwx06YkFHP6io3jow/22FRZkeK0UZtGY=",
"zh:02d1a87c28635779f66d1dcf165b5f16530f809deb6c71c35c3e58d715a88bf4",
"zh:1285a419c7fd2947f891771bd77d2f6e7dd0cb00621c547b6993947085616009",
"zh:340faecd0a0036e721480564acbad2ba0da6a9c0c0cd633957dcde76a4ba3798",
"zh:5646f78d9980038c4ae70e09828da01c7cc6ba2b3b1e9ea8a1988efafaba1b75",
"zh:66fef65aede775d9972be163a2bd25d8fda5a8ad2235ceef30d515bf35e2e5d4",
"zh:7130faa5dd892b1d41b9b3ebd1b2d7854bf780193073de58806e088311bb554c",
"zh:9f47b66ce7f4b23d25c4a726ffc5e504f797f247912cfa5dff23b3da0ba18982",
"zh:ada63a886bc5d7980eeb22b59b166713617847626627007d2e8429eeb4346327",
"zh:c853237b7831942d3d0f0f7a7a334e8f9df8a12f217c5680a76db256e368230d",
"zh:d2e8827d9d8662a892dbd1df6155823c8167db6f6762f38885037c7da87612b1",
"zh:d6e1069bb9d9f368e5d55a8bdf55de23636a586d698515f0075733499d6b9ccc",
"zh:dd224d521af2f72bfdc3498c5ccd54b09844cfaa347b3008f61faad465cc9769",
"zh:e02960d79ccfeeaea64c07aa1ad88cdd3688f49b670c9b607ea188283cd519d6",
]
}
provider "registry.opentofu.org/vultr/vultr" {
version = "2.28.0"
constraints = "~> 2.28"
hashes = [
"h1:YLj0Kd8/HXNJJWMJ2Uq46r97SePDlGsLjor3Giqr3l0=",
"zh:081b2517a23293849982d756200ccc5e3e6414b13364ff69433cfc9231f512c5",
"zh:1c347a05b0be1b6756a8c2e166520fb39eaa2c3f44e57c2702aa58bd8b65bcef",
"zh:204eb6826ae12b56991cab3731ba08e13d87c7fe31e246df59342570fb616df0",
"zh:60fccc6b46623eb4c4f27590dcc12874ca50cbcc6d73d7c117ef54a1e8de5cb2",
"zh:623fccedab77a40ea1e48ab90dc13edb85d0e57c12ebb2dda63e7454fd08dd81",
"zh:6cb057b6829f9654a77f5f4e9c97193180ca956d0f8760b3d484f521701aa814",
"zh:8c7192c66096b895a944913d7414f541cd0b300052df86856ce408d50bec3f68",
"zh:97f8cc46937237a3272aa30799ddab9972cae804ec8e7fcc850f0b2dd7ab2884",
"zh:9848294291468e520a0a8032079afd747ea7157eba614b3b18c89f226a25f93f",
"zh:a2f971d3a30d7e3952f8439a94f880f739b03645bc617d7e3acc3771da426148",
"zh:ad5d4fd1f24d23f51c8bd1f45d0be9edefba9175702bccff5fa9007247c6e48f",
"zh:b65aedaaaf75898d61e2c7d6909011103d716f7df5da13d355033f749626f03c",
"zh:d9f9bd59d911bc7eb2a08bbeb5f4a04db1e7afcf0ebf18fab16a9c8a6133af16",
"zh:e3a1cd0022c4d48706ee2c5cf4d88f1d7684b24070225fbb1b21e61ae19dcf54",
"zh:f1bbef24eb56b38f3f54673087dd2de10ca871df1f8752e7630bbd11bb00dcc8",
"zh:f6559ec45a1aee36f431e1f42a09fe7a6b0751c4c1036fe56edfc174478548da",
]
}

39
terraform/dns_aprs.tf Normal file
View file

@ -0,0 +1,39 @@
# DNS configuration for aprs.me domain
# Points to Traefik ingress on k3s cluster for APRS application
resource "powerdns_record" "aprs_me_soa" {
depends_on = [powerdns_zone.aprs_me]
zone = "aprs.me."
name = "aprs.me."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
resource "powerdns_record" "aprs_me_root" {
depends_on = [powerdns_zone.aprs_me]
zone = "aprs.me."
name = "aprs.me."
type = "A"
ttl = 3600
records = ["204.110.191.195"] # Traefik ingress on k3s cluster
}
resource "powerdns_record" "aprs_me_www" {
depends_on = [powerdns_zone.aprs_me]
zone = "aprs.me."
name = "www.aprs.me."
type = "A"
ttl = 3600
records = ["204.110.191.195"] # Traefik ingress on k3s cluster
}
# CAA record for Let's Encrypt SSL certificates
resource "powerdns_record" "aprs_me_caa" {
depends_on = [powerdns_zone.aprs_me]
zone = "aprs.me."
name = "aprs.me."
type = "CAA"
ttl = 3600
records = ["0 issue \"letsencrypt.org\""]
}

80
terraform/dns_manero.tf Normal file
View file

@ -0,0 +1,80 @@
# PowerDNS records for manero.org
# Zone defined in dns_powerdns_zones.tf
resource "powerdns_record" "manero_soa" {
depends_on = [powerdns_zone.manero_org]
zone = "manero.org."
name = "manero.org."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
# Root A records (GitHub Pages)
resource "powerdns_record" "manero_root_a" {
depends_on = [powerdns_zone.manero_org]
zone = "manero.org."
name = "manero.org."
type = "A"
ttl = 3600
records = [
"185.199.108.153",
"185.199.109.153",
"185.199.110.153",
"185.199.111.153"
]
}
resource "powerdns_record" "manero_irc_a" {
depends_on = [powerdns_zone.manero_org]
zone = "manero.org."
name = "irc.manero.org."
type = "A"
ttl = 3600
records = ["149.28.242.178"]
}
resource "powerdns_record" "manero_us_a" {
depends_on = [powerdns_zone.manero_org]
zone = "manero.org."
name = "us.manero.org."
type = "A"
ttl = 3600
records = ["149.28.242.178"]
}
resource "powerdns_record" "manero_us_aaaa" {
depends_on = [powerdns_zone.manero_org]
zone = "manero.org."
name = "us.manero.org."
type = "AAAA"
ttl = 3600
records = ["2001:19f0:6401:19e6:5400:5ff:fe45:5701"]
}
resource "powerdns_record" "manero_ca_a" {
depends_on = [powerdns_zone.manero_org]
zone = "manero.org."
name = "ca.manero.org."
type = "A"
ttl = 3600
records = ["167.114.209.151"]
}
resource "powerdns_record" "manero_tankfox_a" {
depends_on = [powerdns_zone.manero_org]
zone = "manero.org."
name = "tankfox.manero.org."
type = "A"
ttl = 3600
records = ["137.184.202.89"]
}
resource "powerdns_record" "manero_404_cname" {
depends_on = [powerdns_zone.manero_org]
zone = "manero.org."
name = "404.manero.org."
type = "CNAME"
ttl = 3600
records = ["404.al."]
}

100
terraform/dns_mcintire.tf Normal file
View file

@ -0,0 +1,100 @@
resource "powerdns_record" "mcintire_soa" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "mcintire.me."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
# Mailcow MX records (primary and backup)
resource "powerdns_record" "mcintire_mx" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "mcintire.me."
type = "MX"
ttl = 3600
records = [
"10 mail.mcintire.me.",
"20 mail.nsnw.ca."
]
}
# Mail server
resource "powerdns_record" "mcintire_mail" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "mail.mcintire.me."
type = "A"
ttl = 3600
records = ["204.110.191.5"]
}
# Autodiscover for mail clients
resource "powerdns_record" "mcintire_autodiscover" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "autodiscover.mcintire.me."
type = "CNAME"
ttl = 3600
records = ["mail.w5isp.com."]
}
# Autodiscover SRV record
resource "powerdns_record" "mcintire_autodiscover_srv" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "_autodiscover._tcp.mcintire.me."
type = "SRV"
ttl = 3600
records = ["0 0 443 mail.w5isp.com."]
}
# Autoconfig for mail clients
resource "powerdns_record" "mcintire_autoconfig" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "autoconfig.mcintire.me."
type = "CNAME"
ttl = 3600
records = ["mail.w5isp.com."]
}
# SPF record for Mailcow
resource "powerdns_record" "mcintire_spf_mailcow" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "mcintire.me."
type = "TXT"
ttl = 3600
records = ["\"v=spf1 mx a ip4:204.110.191.5 ~all\""]
}
# DMARC record for Mailcow
resource "powerdns_record" "mcintire_dmarc_mailcow" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "_dmarc.mcintire.me."
type = "TXT"
ttl = 3600
records = ["\"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1\""]
}
# DKIM record from Mailcow
resource "powerdns_record" "mcintire_dkim_mailcow" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "dkim._domainkey.mcintire.me."
type = "TXT"
ttl = 3600
records = ["\"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB\""]
}
resource "powerdns_record" "mcintire_photos" {
depends_on = [powerdns_zone.mcintire_me]
zone = "mcintire.me."
name = "photos.mcintire.me."
type = "A"
ttl = 3600
records = ["204.110.191.8"]
}

80
terraform/dns_ntxarms.tf Normal file
View file

@ -0,0 +1,80 @@
# SOA record for ntxarms.com
resource "powerdns_record" "ntxarms_soa" {
depends_on = [powerdns_zone.ntxarms_com]
zone = "ntxarms.com."
name = "ntxarms.com."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
# Root A record
resource "powerdns_record" "ntxarms_root" {
depends_on = [powerdns_zone.ntxarms_com]
zone = "ntxarms.com."
name = "ntxarms.com."
type = "A"
ttl = 3600
records = ["75.2.60.5"]
}
# www CNAME to Netlify
resource "powerdns_record" "ntxarms_www" {
depends_on = [powerdns_zone.ntxarms_com]
zone = "ntxarms.com."
name = "www.ntxarms.com."
type = "CNAME"
ttl = 3600
records = ["ntxarms.netlify.app."]
}
# Fastmail MX records
resource "powerdns_record" "ntxarms_mx" {
depends_on = [powerdns_zone.ntxarms_com]
zone = "ntxarms.com."
name = "ntxarms.com."
type = "MX"
ttl = 3600
records = [
"10 in1-smtp.messagingengine.com.",
"20 in2-smtp.messagingengine.com."
]
}
# Fastmail DKIM records
resource "powerdns_record" "ntxarms_dkim_fm1" {
depends_on = [powerdns_zone.ntxarms_com]
zone = "ntxarms.com."
name = "fm1._domainkey.ntxarms.com."
type = "CNAME"
ttl = 3600
records = ["fm1.ntxarms.com.dkim.fmhosted.com."]
}
resource "powerdns_record" "ntxarms_dkim_fm2" {
depends_on = [powerdns_zone.ntxarms_com]
zone = "ntxarms.com."
name = "fm2._domainkey.ntxarms.com."
type = "CNAME"
ttl = 3600
records = ["fm2.ntxarms.com.dkim.fmhosted.com."]
}
resource "powerdns_record" "ntxarms_dkim_fm3" {
depends_on = [powerdns_zone.ntxarms_com]
zone = "ntxarms.com."
name = "fm3._domainkey.ntxarms.com."
type = "CNAME"
ttl = 3600
records = ["fm3.ntxarms.com.dkim.fmhosted.com."]
}
# Fastmail SPF record
resource "powerdns_record" "ntxarms_spf" {
depends_on = [powerdns_zone.ntxarms_com]
zone = "ntxarms.com."
name = "ntxarms.com."
type = "TXT"
ttl = 3600
records = ["\"v=spf1 include:spf.messagingengine.com ?all\""]
}

91
terraform/dns_powerdns_zones.tf Normal file
View file

@ -0,0 +1,91 @@
# Vultr PowerDNS Zones
# All zones managed on the Vultr PowerDNS instance
#
# AXFR Configuration:
# AXFR (zone transfers) and notifications are configured globally in the PowerDNS
# ConfigMap (allow-axfr-ips and also-notify settings). These apply to all zones.
resource "powerdns_zone" "w5isp_com" {
name = "w5isp.com."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "aprs_me" {
name = "aprs.me."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "mcintire_me" {
name = "mcintire.me."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "manero_org" {
name = "manero.org."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "ntxarms_com" {
name = "ntxarms.com."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "towerops_net" {
name = "towerops.net."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "vntx_net" {
name = "vntx.net."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "vntx_org" {
name = "vntx.org."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
# Reverse DNS zones
resource "powerdns_zone" "reverse_188" {
name = "188.110.204.in-addr.arpa."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "reverse_189" {
name = "189.110.204.in-addr.arpa."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "reverse_190" {
name = "190.110.204.in-addr.arpa."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}
resource "powerdns_zone" "reverse_191" {
name = "191.110.204.in-addr.arpa."
kind = "Primary"
soa_edit_api = "DEFAULT"
nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."]
}

103
terraform/dns_reverse.tf Normal file
View file

@ -0,0 +1,103 @@
# Reverse DNS zones are defined in dns_powerdns_zones.tf
# SOA records for reverse zones
resource "powerdns_record" "vntx1_soa" {
depends_on = [powerdns_zone.reverse_188]
zone = "188.110.204.in-addr.arpa."
name = "188.110.204.in-addr.arpa."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
resource "powerdns_record" "vntx2_soa" {
depends_on = [powerdns_zone.reverse_189]
zone = "189.110.204.in-addr.arpa."
name = "189.110.204.in-addr.arpa."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
resource "powerdns_record" "vntx3_soa" {
depends_on = [powerdns_zone.reverse_190]
zone = "190.110.204.in-addr.arpa."
name = "190.110.204.in-addr.arpa."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
resource "powerdns_record" "vntx4_soa" {
depends_on = [powerdns_zone.reverse_191]
zone = "191.110.204.in-addr.arpa."
name = "191.110.204.in-addr.arpa."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
resource "powerdns_record" "ptr_records1" {
depends_on = [powerdns_zone.reverse_188]
for_each = {
for i in range(256) : tostring(i) => {
name = "${i}.188.110.204.in-addr.arpa."
record = "${i}.188.client.vntx.net."
}
}
zone = "188.110.204.in-addr.arpa."
name = each.value.name
type = "PTR"
ttl = 3600
records = [each.value.record]
}
resource "powerdns_record" "ptr_records2" {
depends_on = [powerdns_zone.reverse_189]
for_each = {
for i in range(256) : tostring(i) => {
name = "${i}.189.110.204.in-addr.arpa."
record = "${i}.189.client.vntx.net."
}
}
zone = "189.110.204.in-addr.arpa."
name = each.value.name
type = "PTR"
ttl = 3600
records = [each.value.record]
}
resource "powerdns_record" "ptr_records3" {
depends_on = [powerdns_zone.reverse_190]
for_each = {
for i in range(256) : tostring(i) => {
name = "${i}.190.110.204.in-addr.arpa."
record = "${i}.190.client.vntx.net."
}
if !contains([119, 168], i)
}
zone = "190.110.204.in-addr.arpa."
name = each.value.name
type = "PTR"
ttl = 3600
records = [each.value.record]
}
resource "powerdns_record" "ptr_records4" {
depends_on = [powerdns_zone.reverse_191]
for_each = {
for i in range(256) : tostring(i) => {
name = "${i}.191.110.204.in-addr.arpa."
record = tostring(i) == "5" ? "mail.mcintire.me." : "${i}.191.client.vntx.net."
}
}
zone = "191.110.204.in-addr.arpa."
name = each.value.name
type = "PTR"
ttl = 3600
records = [each.value.record]
}

62
terraform/dns_towerops.tf Normal file
View file

@ -0,0 +1,62 @@
# PowerDNS records for towerops.net
# SendGrid email authentication records
# SOA record for towerops.net
resource "powerdns_record" "towerops_soa" {
depends_on = [powerdns_zone.towerops_net]
zone = "towerops.net."
name = "towerops.net."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
# Root A record
resource "powerdns_record" "towerops_root_a" {
depends_on = [powerdns_zone.towerops_net]
zone = "towerops.net."
name = "towerops.net."
type = "A"
ttl = 3600
records = ["204.110.191.195"]
}
# SendGrid domain CNAME
resource "powerdns_record" "towerops_sendgrid_domain" {
depends_on = [powerdns_zone.towerops_net]
zone = "towerops.net."
name = "em6505.towerops.net."
type = "CNAME"
ttl = 600
records = ["u177982.wl233.sendgrid.net."]
}
# SendGrid DKIM key 1
resource "powerdns_record" "towerops_sendgrid_dkim1" {
depends_on = [powerdns_zone.towerops_net]
zone = "towerops.net."
name = "s1._domainkey.towerops.net."
type = "CNAME"
ttl = 600
records = ["s1.domainkey.u177982.wl233.sendgrid.net."]
}
# SendGrid DKIM key 2
resource "powerdns_record" "towerops_sendgrid_dkim2" {
depends_on = [powerdns_zone.towerops_net]
zone = "towerops.net."
name = "s2._domainkey.towerops.net."
type = "CNAME"
ttl = 600
records = ["s2.domainkey.u177982.wl233.sendgrid.net."]
}
# DMARC policy
resource "powerdns_record" "towerops_dmarc" {
depends_on = [powerdns_zone.towerops_net]
zone = "towerops.net."
name = "_dmarc.towerops.net."
type = "TXT"
ttl = 600
records = ["\"v=DMARC1; p=none;\""]
}

148
terraform/dns_vntx_net.tf Normal file
View file

@ -0,0 +1,148 @@
# SOA record for vntx.net
resource "powerdns_record" "vntx_net_soa" {
depends_on = [powerdns_zone.vntx_net]
zone = "vntx.net."
name = "vntx.net."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
# Generate client IP records dynamically
locals {
# Subnets to create client records for
vntx_subnets = [188, 189, 190, 191]
# Generate all client IPs dynamically
client_ips = merge([
for subnet in local.vntx_subnets : {
for i in range(1, 255) : "${i}.${subnet}.client" => "204.110.${subnet}.${i}"
}
]...)
# Named hosts with specific IPs
named_hosts = {
"climax" = "204.110.188.62"
"core" = "10.254.254.253"
"culleoka" = "204.110.188.158"
"edge" = "204.110.191.190"
"librenms" = "204.110.191.227"
"logs" = "204.110.191.229"
"monitor" = "204.110.191.241"
"netbox" = "204.110.191.243"
"newhope" = "204.110.188.190"
"ns1" = "204.110.191.249"
"ns2" = "204.110.191.239"
"preseem" = "204.110.191.225"
"resolver-01" = "204.110.191.240"
"resolver-02" = "204.110.191.250"
"resolver1" = "204.110.191.240"
"resolver2" = "204.110.191.250"
"unimus" = "204.110.191.238"
"verona" = "204.110.188.254"
"@" = "198.185.159.144"
"routers" = "155.138.241.157"
"vpn" = "204.110.191.247"
"radius" = "204.110.191.248"
"speedtest" = "204.110.191.228"
"aprs" = "204.110.191.232"
"g2" = "204.110.191.221"
"net" = "104.238.146.79"
"uisp" = "204.110.191.224"
"dns" = "204.110.191.193"
}
# Merge client IPs and named hosts
all_a_records = merge(local.client_ips, local.named_hosts)
}
resource "powerdns_record" "vntx_a_records" {
for_each = local.all_a_records
depends_on = [powerdns_zone.vntx_net]
zone = "vntx.net."
name = each.key == "@" ? "vntx.net." : "${each.key}.vntx.net."
type = "A"
ttl = 3600
records = [each.value]
}
# Microsoft 365 MX record
resource "powerdns_record" "vntx_mx" {
depends_on = [powerdns_zone.vntx_net]
zone = "vntx.net."
name = "vntx.net."
type = "MX"
ttl = 3600
records = ["0 vntx-net.mail.protection.outlook.com."]
}
resource "powerdns_record" "vntx_txt_records" {
for_each = {
"_twilio" = "twilio-domain-verification=12bf63d61b86412618bdb4ab6c2b287a"
"_dmarc" = "v=DMARC1; p=none"
"_updown" = "updown-page=p/34yuc"
"_github-challenge-vntx" = "34ea2705e4"
"_github-pages-challenge-gmcintire" = "d125f4244edd0120ee0fa073d3acf1"
"krs._domainkey.mg" = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHbWtJ5uPGEOPmJrT36WBXKxVL0b4fqjIM4n6oXK4zaUucqYp7jeoKG+FTO5XEjyja7hsP9WahntUrVb8WI5V6Cj0CznesMrM7oQRntcyuy8mSD1zilmZe4q2Kc65gj2MRrkg3tkJfogXHNz2rxmquNu/DxsFLeQP8a2E5tYXVFwIDAQAB"
"pic._domainkey.mg" = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdv4ZUjhb9l0Nt1aEJMnH/TVNdVn9CEKkb8+RX3qBPMFGmJWrJ3BIFwOSTUBiPeCgd2vc4zOOv7iQhEgNTlIVNT/V1sY70Myo5t+tJCuJQT/G4h5D1u7LZB6YEOKTgd5wF5AoW/nLvKVEPyKl5mThB9KmIGqF5FMm9C9FWP8m6SQIDAQAB"
"s1._domainkey.mg" = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI3w7b9bBNcWzSH8DspZbRNp+9G9pHbCfmHmr3r2JqXh+F8bFlCK6gJqEQW7SIJgYMmSJ5GlYyy4A3VxJJFcWLZb3dxMoWkGjrJ3gEUNQGmG6rnJ7eXJxKb5J2mGgEfQgCgkWXPFRmJhKXPWoZP3RqU2vJZ3t7vJxWHmv0bQPHKQIDAQAB"
"s2._domainkey.mg" = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDc3JXQvGMBl3cW+3N2OPLJwlP4cMvPp9yOQM9X1TLxJWX7Hd7m6rJ1Xf2T3PGP9ZDPfJGXh+PfGPYVJYP2JXGPfP9HPfP3GPfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHQIDAQAB"
"@" = "v=spf1 include:spf.protection.outlook.com include:mailgun.org -all"
}
depends_on = [powerdns_zone.vntx_net]
zone = "vntx.net."
name = each.key == "@" ? "vntx.net." : "${each.key}.vntx.net."
type = "TXT"
ttl = 3600
records = ["\"${each.value}\""]
}
resource "powerdns_record" "vntx_cname_records" {
for_each = {
# Current records
"mg" = "mailgun.org."
"email.mg" = "mailgun.org."
"*.w5isp" = "dokku.w5isp.com."
"mail.speedtest" = "mail.speedtest.vntx.net.s2.mailersendapp.com."
"status" = "stats.uptimerobot.com."
"ntp" = "0.us.pool.ntp.org."
"iptrack" = "dokku.w5isp.com."
"_4080c249b6e72dd04f2a9508aa1a1b7f.kivrak" = "_de3e5d511f3869bbd271b935a3b4f973.tljzshvwok.acm-validations.aws."
"_83337805c305955c6823504cc5e6ca29" = "_baf97cdcc7b6458fa5719e4261e9932f.sdgjtdhdhz.acm-validations.aws."
"_bc1077259b1fbbb11c1e16756e1883f9.irc" = "793f217a963b25f361ec1975e0fd7d54.dc2ec86a36550aed25a0011c0b2b044b.62f7abe714ec1.comodoca.com."
"177982" = "sendgrid.net."
"4809fce066c3da4d14197c7276ba083f.irc" = "b58bf151af520d34d8fad99d05274cb536893031.comodoca.com."
"9p83fpanfdgs8xdgcnzd" = "verify.squarespace.com."
"activate" = "verona-networks-checkout.gaiia-consumer.com."
"autodiscover.o365" = "autodiscover.outlook.com."
"autodiscover" = "autodiscover.outlook.com."
"em924886" = "return.smtp2go.net."
"em9279" = "u177982.wl233.sendgrid.net."
"email" = "mandrillapp.com."
"enterpriseenrollment.o365" = "enterpriseenrollment.manage.microsoft.com."
"enterpriseregistration.o365" = "enterpriseregistration.windows.net."
"link" = "track.smtp2go.net."
"lyncdiscover.o365" = "webdir.online.lync.com."
"mte1._domainkey" = "dkim1.mandrillapp.com."
"mte2._domainkey" = "dkim2.mandrillapp.com."
"portal" = "verona-networks-clientportal.gaiia-consumer.com."
"s1._domainkey" = "s1.domainkey.u177982.wl233.sendgrid.net."
"s2._domainkey" = "s2.domainkey.u177982.wl233.sendgrid.net."
"s924886._domainkey" = "dkim.smtp2go.net."
"sip.o365" = "sipdir.online.lync.com."
"uptime" = "page.updown.io."
"url62" = "sendgrid.net."
"url9812" = "sendgrid.net."
"www" = "ext-cust.squarespace.com."
}
depends_on = [powerdns_zone.vntx_net]
zone = "vntx.net."
name = "${each.key}.vntx.net."
type = "CNAME"
ttl = 3600
records = [each.value]
}

12
terraform/dns_vntx_org.tf Normal file
View file

@ -0,0 +1,12 @@
# DNS records for vntx.org domain
# Zone defined in dns_powerdns_zones.tf
# SOA record for vntx.org
resource "powerdns_record" "vntx_org_soa" {
depends_on = [powerdns_zone.vntx_org]
zone = "vntx.org."
name = "vntx.org."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}

262
terraform/dns_w5isp.tf Normal file
View file

@ -0,0 +1,262 @@
resource "powerdns_record" "w5isp_soa" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "w5isp.com."
type = "SOA"
ttl = 3600
records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
}
resource "powerdns_record" "w5isp_root" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.5"]
}
resource "powerdns_record" "w5isp_git" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "git.w5isp.com."
type = "A"
ttl = 3600
records = ["66.206.18.163"]
}
resource "powerdns_record" "w5isp_home" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "home.w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.1"]
}
resource "powerdns_record" "w5isp_photos" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "photos.w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.8"]
}
resource "powerdns_record" "w5isp_skippy" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "skippy.w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.8"]
}
resource "powerdns_record" "w5isp_ha" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "ha.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa."]
}
resource "powerdns_record" "w5isp_mx1" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "w5isp.com."
type = "MX"
ttl = 3600
records = ["10 mail.w5isp.com."]
}
resource "powerdns_record" "w5isp_txt" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "w5isp.com."
type = "TXT"
ttl = 3600
records = ["\"v=spf1 mx a ip4:204.110.191.5 ~all\""]
}
# DKIM record
resource "powerdns_record" "w5isp_dkim" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "dkim._domainkey.w5isp.com."
type = "TXT"
ttl = 3600
records = ["\"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB\""]
}
resource "powerdns_record" "w5isp_g" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "g.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["mail.mcintire.me."]
}
resource "powerdns_record" "w5isp_truck" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "truck.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["mail.mcintire.me."]
}
resource "powerdns_record" "w5isp_sendgrid1" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "em40.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["u177982.wl233.sendgrid.net."]
}
resource "powerdns_record" "w5isp_sendgrid2" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "s1._domainkey.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["s1.domainkey.u177982.wl233.sendgrid.net."]
}
resource "powerdns_record" "w5isp_sendgrid3" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "s2._domainkey.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["s2.domainkey.u177982.wl233.sendgrid.net."]
}
resource "powerdns_record" "w5isp_dmarc" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "_dmarc.w5isp.com."
type = "TXT"
ttl = 3600
records = ["\"v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1\""]
}
# Mail server
resource "powerdns_record" "w5isp_mail" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "mail.w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.5"]
}
resource "powerdns_record" "w5isp_sync" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "sync.w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.216"]
}
resource "powerdns_record" "w5isp_log" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "log.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["mail.mcintire.me."]
}
resource "powerdns_record" "w5isp_autodiscover" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "autodiscover.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["mail.w5isp.com."]
}
resource "powerdns_record" "w5isp_autodiscover_srv" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "_autodiscover._tcp.w5isp.com."
type = "SRV"
ttl = 3600
records = ["0 0 443 mail.w5isp.com."]
}
resource "powerdns_record" "w5isp_autoconfig" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "autoconfig.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["mail.w5isp.com."]
}
resource "powerdns_record" "w5isp_n8n" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "n8n.w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.2"] # Traefik ingress on k3s cluster
}
resource "powerdns_record" "w5isp_nodered" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "nodered.w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.2"] # Node-RED via Traefik on k3s cluster
}
resource "powerdns_record" "w5isp_headscale" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "headscale.w5isp.com."
type = "A"
ttl = 3600
records = ["66.206.18.166"]
}
resource "powerdns_record" "w5isp_hs" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "hs.w5isp.com."
type = "A"
ttl = 3600
records = ["66.206.18.166"]
}
resource "powerdns_record" "w5isp_dokku" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "dokku.w5isp.com."
type = "A"
ttl = 3600
records = ["204.110.191.218"]
}
resource "powerdns_record" "w5isp_camper" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "camper.w5isp.com."
type = "CNAME"
ttl = 3600
records = ["skippy.w5isp.com."]
}
resource "powerdns_record" "w5isp_wildcard" {
depends_on = [powerdns_zone.w5isp_com]
zone = "w5isp.com."
name = "*.w5isp.com."
type = "A"
ttl = 3600
records = ["172.245.56.83"]
}

56
terraform/main.sync-conflict-20260129-153613-ZJZJYMM.tf Normal file
View file

@ -0,0 +1,56 @@
terraform {
required_providers {
dnsimple = {
source = "dnsimple/dnsimple"
version = "~> 2.0"
}
porkbun = {
source = "kyswtn/porkbun"
version = "~> 0.1"
}
powerdns = {
source = "pan-net/powerdns"
version = "~> 1.5"
}
vultr = {
source = "vultr/vultr"
version = "~> 2.28"
}
cloudflare = {
source = "cloudflare/cloudflare"
version = "~> 5.0"
}
null = {
source = "hashicorp/null"
version = "~> 3.0"
}
}
}
terraform {
backend "http" {
# Backend credentials should be set via environment variables:
# TF_HTTP_ADDRESS, TF_HTTP_LOCK_ADDRESS, TF_HTTP_UNLOCK_ADDRESS
# TF_HTTP_USERNAME, TF_HTTP_PASSWORD
}
}
provider "dnsimple" {
token = var.dnsimple_token
account = var.dnsimple_account
}
provider "porkbun" {
api_key = var.porkbun_api_key
secret_api_key = var.porkbun_secret_api_key
}
provider "powerdns" {
api_key = var.pdns_api_key
server_url = var.pdns_server_url
}
provider "cloudflare" {
# API token is read from CLOUDFLARE_API_TOKEN environment variable
# No explicit api_token parameter needed - provider automatically reads the env var
}

218
terraform/variables.sync-conflict-20260129-153936-ZJZJYMM.tf Normal file
View file

@ -0,0 +1,218 @@
# Vultr Variables
variable "vultr_api_key" {
description = "Vultr API key"
type = string
sensitive = true
default = ""
}
# Proxmox Variables
variable "proxmox_api_url" {
description = "Proxmox API URL"
type = string
default = "https://10.0.16.231:8006"
}
variable "proxmox_user" {
description = "Proxmox user for authentication"
type = string
default = "root@pam"
}
variable "proxmox_password" {
description = "Proxmox password"
type = string
sensitive = true
}
variable "proxmox_tls_insecure" {
description = "Allow insecure TLS connections to Proxmox"
type = bool
default = true
}
variable "proxmox_nodes" {
description = "List of Proxmox nodes to distribute VMs across"
type = list(string)
default = ["vm2-380"]
}
variable "cluster_name" {
description = "Name prefix for the K3s cluster nodes"
type = string
default = "home-k3s"
}
variable "vm_template" {
description = "Name of the VM template to clone"
type = string
default = "debian-13-cloudinit"
}
variable "storage_pool" {
description = "Storage pool for VM disks"
type = string
default = "ceph"
}
variable "network_bridge" {
description = "Network bridge to use for VMs"
type = string
default = "vmbr0"
}
variable "network_cidr" {
description = "Network CIDR for the cluster"
type = string
default = "10.0.16.0/22"
}
variable "network_gateway" {
description = "Network gateway"
type = string
default = "10.0.19.254"
}
variable "control_plane_count" {
description = "Number of control plane nodes"
type = number
default = 3
}
variable "control_plane_cores" {
description = "Number of CPU cores for control plane nodes"
type = number
default = 2
}
variable "control_plane_memory" {
description = "Memory in MB for control plane nodes"
type = number
default = 8192
}
variable "control_plane_disk_size" {
description = "Disk size for control plane nodes (in GB)"
type = number
default = 32
}
variable "control_plane_ip_start" {
description = "Starting IP offset for control plane nodes"
type = number
default = 868 # 10.0.19.100 = offset 868 from 10.0.16.0 (3*256 + 100)
}
variable "worker_count" {
description = "Number of worker nodes"
type = number
default = 3
}
variable "worker_cores" {
description = "Number of CPU cores for worker nodes"
type = number
default = 4
}
variable "worker_memory" {
description = "Memory in MB for worker nodes"
type = number
default = 8192
}
variable "worker_disk_size" {
description = "Disk size for worker nodes (in GB)"
type = number
default = 64
}
variable "worker_ip_start" {
description = "Starting IP offset for worker nodes"
type = number
default = 878 # 10.0.19.110 = offset 878 from 10.0.16.0 (3*256 + 110)
}
variable "ssh_user" {
description = "SSH user for the VMs"
type = string
default = "debian"
}
variable "ssh_public_key" {
description = "SSH public key for access to VMs"
type = string
default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLyVSEEAEbGZZqwPwEup0XrlTpu3x3iF9ExvvQPA4xN graham@mcintire.me"
}
# DNS Provider Variables
variable "dnsimple_token" {
description = "DNSimple API token"
type = string
sensitive = true
}
variable "dnsimple_account" {
description = "DNSimple account ID"
type = string
default = "143471"
}
variable "porkbun_api_key" {
description = "Porkbun API key"
type = string
sensitive = true
}
variable "porkbun_secret_api_key" {
description = "Porkbun secret API key"
type = string
sensitive = true
}
variable "proxmox_host" {
description = "Proxmox host for VM deployment"
type = string
default = "vm2-380"
}
variable "template_name" {
description = "VM template name"
type = string
default = "ubuntu"
}
variable "nic_name" {
description = "Network interface name"
type = string
default = "vmbr0"
}
variable "api_url" {
description = "Proxmox API URL (legacy)"
type = string
default = "https://10.0.0.2:8006/api2/json"
}
variable "token_secret" {
description = "Proxmox token secret"
type = string
sensitive = true
}
variable "token_id" {
description = "Proxmox token ID"
type = string
}
variable "pdns_api_key" {
description = "PowerDNS API key"
type = string
sensitive = true
}
variable "pdns_server_url" {
description = "PowerDNS server URL"
type = string
}