From a1e787093e0ace6c4fc697458d313efb65672239 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Fri, 30 Jan 2026 17:27:52 -0600 Subject: [PATCH] update --- ...E.sync-conflict-20260129-151421-ZJZJYMM.md | 242 ++++++++ ....sync-conflict-20260129-152638-ZJZJYMM.yml | 16 + ....sync-conflict-20260129-152606-ZJZJYMM.yml | 37 ++ ....sync-conflict-20260129-154743-ZJZJYMM.yml | 31 + ....sync-conflict-20260129-161634-ZJZJYMM.yml | 30 + ....sync-conflict-20260129-143855-ZJZJYMM.yml | 25 + ....sync-conflict-20260129-150906-ZJZJYMM.yml | 268 ++++++++ ....sync-conflict-20260129-143542-ZJZJYMM.yml | 268 ++++++++ ....sync-conflict-20260129-151531-ZJZJYMM.yml | 266 ++++++++ ....sync-conflict-20260129-142816-ZJZJYMM.yml | 269 ++++++++ ....sync-conflict-20260129-142452-ZJZJYMM.yml | 37 ++ ....sync-conflict-20260129-153457-ZJZJYMM.yml | 94 +++ ....sync-conflict-20260129-161402-ZJZJYMM.yml | 10 + ....sync-conflict-20260129-153130-ZJZJYMM.yml | 46 ++ ...osts.sync-conflict-20260129-160647-ZJZJYMM | 31 + ansible/playbook.yml | 0 ansible/roles/almalinux/tasks/main.yml | 0 .../general/files/etc/update-motd.d/20-banner | 0 ansible/roles/ns/handlers/main.yml | 0 ansible/roles/ns/tasks/main.yml | 0 ...e.sync-conflict-20260129-150118-ZJZJYMM.j2 | 53 ++ ansible/roles/ubuntu/tasks/main.yml | 0 ansible/scripts/fix-deprecated-imports.sh | 0 ansible/update_dns.sh | 0 home/cluster/add-node3-to-etcd.sh | 74 +++ home/cluster/aprs/README.md | 57 ++ home/cluster/aprs/aprs-configmap.yaml | 20 + home/cluster/aprs/aprs-ingressroute.yaml | 70 +++ home/cluster/aprs/aprs-rbac.yaml | 30 + home/cluster/aprs/aprs-secret-secure.yaml | 13 + .../aprs-statefulset-with-pullsecret.yaml | 127 ++++ home/cluster/aprs/create-image-pull-secret.sh | 25 + home/cluster/aprs/deploy.sh | 44 ++ home/cluster/aprs/install-postgis-manual.sh | 18 + home/cluster/aprs/namespace.yaml | 5 + .../aprs/postgres-deployment-normal.yaml | 74 +++ .../aprs/postgres-deployment-repair.yaml | 55 ++ home/cluster/aprs/postgres-deployment.yaml | 87 +++ home/cluster/aprs/postgres-normal-mode.sh | 10 + home/cluster/aprs/postgres-repair-mode.sh | 11 + home/cluster/aprs/postgres-secret-secure.yaml | 14 + home/cluster/controlplane.yaml | 559 +++++++++++++++++ home/cluster/deploy.md | 335 ++++++++++ home/cluster/k3s-upgrade/plan.yaml | 43 ++ home/cluster/longhorn-uservolume.yaml | 8 + home/cluster/mariadb/mariadb-deployment.yaml | 130 ++++ home/cluster/metallb-config.yaml | 18 + home/cluster/mikrotik-ha-setup.md | 177 ++++++ home/cluster/n8n/deploy.sh | 35 ++ home/cluster/n8n/ingress.yaml | 25 + home/cluster/n8n/n8n-deployment.yaml | 107 ++++ home/cluster/n8n/n8n-pvc.yaml | 12 + home/cluster/n8n/namespace.yaml | 4 + home/cluster/n8n/postgres-deployment.yaml | 74 +++ home/cluster/n8n/postgres-pvc.yaml | 12 + home/cluster/n8n/secret.yaml | 10 + home/cluster/node1.patch.yaml | 29 + home/cluster/node2.patch.yaml | 22 + home/cluster/node3.patch.yaml | 22 + home/cluster/nodered/deploy.sh | 34 + home/cluster/nodered/deployment.yaml | 74 +++ home/cluster/nodered/ingress.yaml | 57 ++ home/cluster/nodered/pvc.yaml | 12 + home/cluster/nodered/service.yaml | 14 + home/cluster/nodered/settings-configmap.yaml | 65 ++ home/cluster/schematic.yaml | 8 + home/cluster/tailscale.patch.yaml | 5 + home/cluster/talosconfig | 7 + home/cluster/wavelog/README.md | 67 ++ home/cluster/wavelog/deploy.sh | 47 ++ home/cluster/wavelog/mariadb-deployment.yaml | 67 ++ home/cluster/wavelog/mariadb-secret.yaml | 12 + home/cluster/wavelog/namespace.yaml | 5 + home/cluster/wavelog/wavelog-config-job.yaml | 56 ++ home/cluster/wavelog/wavelog-deployment.yaml | 176 ++++++ home/cluster/wavelog/wavelog-ingress.yaml | 25 + .../cluster/wavelog/wavelog-ingressroute.yaml | 57 ++ home/cluster/wavelog/wavelog-pvc.yaml | 13 + home/cluster/wavelog/wavelog-secret.yaml | 11 + home/cluster/worker.yaml | 580 ++++++++++++++++++ talos/configs/talos-cp1.yaml | 8 +- talos/configs/talos-cp2.yaml | 8 +- talos/configs/talos-cp3.yaml | 8 +- talos/configs/talos-worker1.yaml | 7 + talos/configs/talos-worker2.yaml | 7 + talos/configs/talos-worker3.yaml | 7 + ...ync-conflict-20260129-154537-ZJZJYMM.envrc | 12 + ....sync-conflict-20260129-152957-ZJZJYMM.hcl | 128 ++++ terraform/dns_aprs.tf | 39 ++ terraform/dns_manero.tf | 80 +++ terraform/dns_mcintire.tf | 100 +++ terraform/dns_ntxarms.tf | 80 +++ terraform/dns_powerdns_zones.tf | 91 +++ terraform/dns_reverse.tf | 103 ++++ terraform/dns_towerops.tf | 62 ++ terraform/dns_vntx_net.tf | 148 +++++ terraform/dns_vntx_org.tf | 12 + terraform/dns_w5isp.tf | 262 ++++++++ ...n.sync-conflict-20260129-153613-ZJZJYMM.tf | 56 ++ ...s.sync-conflict-20260129-153936-ZJZJYMM.tf | 218 +++++++ 100 files changed, 6904 insertions(+), 3 deletions(-) create mode 100644 CLAUDE.sync-conflict-20260129-151421-ZJZJYMM.md create mode 100644 ansible/group_vars/bind9_servers/aprs.me.sync-conflict-20260129-152638-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/main.sync-conflict-20260129-152606-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/manero.org.sync-conflict-20260129-154743-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/mcintire.me.sync-conflict-20260129-161634-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/ntxarms.com.sync-conflict-20260129-143855-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/reverse_188.sync-conflict-20260129-150906-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/reverse_189.sync-conflict-20260129-143542-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/reverse_190.sync-conflict-20260129-151531-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/reverse_191.sync-conflict-20260129-142816-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/towerops.net.sync-conflict-20260129-142452-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/vntx.net.sync-conflict-20260129-153457-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/vntx.org.sync-conflict-20260129-161402-ZJZJYMM.yml create mode 100644 ansible/group_vars/bind9_servers/w5isp.com.sync-conflict-20260129-153130-ZJZJYMM.yml create mode 100644 ansible/hosts.sync-conflict-20260129-160647-ZJZJYMM mode change 100755 => 100644 ansible/playbook.yml mode change 100755 => 100644 ansible/roles/almalinux/tasks/main.yml mode change 100755 => 100644 ansible/roles/general/files/etc/update-motd.d/20-banner mode change 100755 => 100644 ansible/roles/ns/handlers/main.yml mode change 100755 => 100644 ansible/roles/ns/tasks/main.yml create mode 100644 ansible/roles/ns/templates/zone.sync-conflict-20260129-150118-ZJZJYMM.j2 mode change 100755 => 100644 ansible/roles/ubuntu/tasks/main.yml mode change 100755 => 100644 ansible/scripts/fix-deprecated-imports.sh mode change 100755 => 100644 ansible/update_dns.sh create mode 100644 home/cluster/add-node3-to-etcd.sh create mode 100644 home/cluster/aprs/README.md create mode 100644 home/cluster/aprs/aprs-configmap.yaml create mode 100644 home/cluster/aprs/aprs-ingressroute.yaml create mode 100644 home/cluster/aprs/aprs-rbac.yaml create mode 100644 home/cluster/aprs/aprs-secret-secure.yaml create mode 100644 home/cluster/aprs/aprs-statefulset-with-pullsecret.yaml create mode 100644 home/cluster/aprs/create-image-pull-secret.sh create mode 100644 home/cluster/aprs/deploy.sh create mode 100644 home/cluster/aprs/install-postgis-manual.sh create mode 100644 home/cluster/aprs/namespace.yaml create mode 100644 home/cluster/aprs/postgres-deployment-normal.yaml create mode 100644 home/cluster/aprs/postgres-deployment-repair.yaml create mode 100644 home/cluster/aprs/postgres-deployment.yaml create mode 100644 home/cluster/aprs/postgres-normal-mode.sh create mode 100644 home/cluster/aprs/postgres-repair-mode.sh create mode 100644 home/cluster/aprs/postgres-secret-secure.yaml create mode 100644 home/cluster/controlplane.yaml create mode 100644 home/cluster/deploy.md create mode 100644 home/cluster/k3s-upgrade/plan.yaml create mode 100644 home/cluster/longhorn-uservolume.yaml create mode 100644 home/cluster/mariadb/mariadb-deployment.yaml create mode 100644 home/cluster/metallb-config.yaml create mode 100644 home/cluster/mikrotik-ha-setup.md create mode 100644 home/cluster/n8n/deploy.sh create mode 100644 home/cluster/n8n/ingress.yaml create mode 100644 home/cluster/n8n/n8n-deployment.yaml create mode 100644 home/cluster/n8n/n8n-pvc.yaml create mode 100644 home/cluster/n8n/namespace.yaml create mode 100644 home/cluster/n8n/postgres-deployment.yaml create mode 100644 home/cluster/n8n/postgres-pvc.yaml create mode 100644 home/cluster/n8n/secret.yaml create mode 100644 home/cluster/node1.patch.yaml create mode 100644 home/cluster/node2.patch.yaml create mode 100644 home/cluster/node3.patch.yaml create mode 100644 home/cluster/nodered/deploy.sh create mode 100644 home/cluster/nodered/deployment.yaml create mode 100644 home/cluster/nodered/ingress.yaml create mode 100644 home/cluster/nodered/pvc.yaml create mode 100644 home/cluster/nodered/service.yaml create mode 100644 home/cluster/nodered/settings-configmap.yaml create mode 100644 home/cluster/schematic.yaml create mode 100644 home/cluster/tailscale.patch.yaml create mode 100644 home/cluster/talosconfig create mode 100644 home/cluster/wavelog/README.md create mode 100644 home/cluster/wavelog/deploy.sh create mode 100644 home/cluster/wavelog/mariadb-deployment.yaml create mode 100644 home/cluster/wavelog/mariadb-secret.yaml create mode 100644 home/cluster/wavelog/namespace.yaml create mode 100644 home/cluster/wavelog/wavelog-config-job.yaml create mode 100644 home/cluster/wavelog/wavelog-deployment.yaml create mode 100644 home/cluster/wavelog/wavelog-ingress.yaml create mode 100644 home/cluster/wavelog/wavelog-ingressroute.yaml create mode 100644 home/cluster/wavelog/wavelog-pvc.yaml create mode 100644 home/cluster/wavelog/wavelog-secret.yaml create mode 100644 home/cluster/worker.yaml create mode 100644 terraform/.sync-conflict-20260129-154537-ZJZJYMM.envrc create mode 100644 terraform/.terraform.lock.sync-conflict-20260129-152957-ZJZJYMM.hcl create mode 100644 terraform/dns_aprs.tf create mode 100644 terraform/dns_manero.tf create mode 100644 terraform/dns_mcintire.tf create mode 100644 terraform/dns_ntxarms.tf create mode 100644 terraform/dns_powerdns_zones.tf create mode 100644 terraform/dns_reverse.tf create mode 100644 terraform/dns_towerops.tf create mode 100644 terraform/dns_vntx_net.tf create mode 100644 terraform/dns_vntx_org.tf create mode 100644 terraform/dns_w5isp.tf create mode 100644 terraform/main.sync-conflict-20260129-153613-ZJZJYMM.tf create mode 100644 terraform/variables.sync-conflict-20260129-153936-ZJZJYMM.tf diff --git a/CLAUDE.sync-conflict-20260129-151421-ZJZJYMM.md b/CLAUDE.sync-conflict-20260129-151421-ZJZJYMM.md new file mode 100644 index 0000000..d5ed89a --- /dev/null +++ b/CLAUDE.sync-conflict-20260129-151421-ZJZJYMM.md @@ -0,0 +1,242 @@ +# CLAUDE.md + +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. + +## Repository Overview + +This is a multi-environment infrastructure-as-code repository managing: +- **Ansible**: Configuration management for servers across multiple environments (VNTX, home, app servers) +- **Terraform**: DNS infrastructure management across DNSimple, Porkbun, and PowerDNS +- **Home Lab**: Server configurations with Tailscale integration + +## Common Commands + +### Proxmox VM Provisioning + +BIND9 and future infrastructure VMs are provisioned using the main Ansible playbook: + +```bash +cd ansible +source .envrc # Load Proxmox credentials from .envrc + +# Provision and configure BIND9 nameserver at 204.110.191.222 +ansible-playbook playbook.yml --tags provision,bind9 + +# VM settings (aligned with terraform/variables.tf): +# - Node: vm2-380 (var.proxmox_host) +# - Template: debian-13-cloudinit (VMID 9000) +# - Storage: local-lvm (for BIND9 and general infrastructure VMs) +# - Network: vmbr0 +# +# Note: Talos K3s nodes use different template and Longhorn for persistent storage +``` + +### Ansible Operations +```bash +# Run main playbook +cd ansible && ./run.sh + +# Bootstrap new host +make bootstrap-init HOSTNAME=hostname ANSIBLE_HOST=ip_address + +# Run specific playbook +ansible-playbook general.yml + +# Run with specific tags +ansible-playbook -t caddy general.yml + +# Gather facts from all hosts +make facts +``` + +### Terraform Operations +**IMPORTANT**: Use OpenTofu (tofu) instead of terraform for all operations. + +```bash +cd terraform +tofu init +tofu plan +tofu apply + +# Format terraform files before committing +tofu fmt +``` + +### Kubernetes Operations (K3s cluster at 204.110.191.2) +```bash +# Set kubeconfig +export KUBECONFIG=/Users/graham/dev/infra/home/ansible/kubeconfig + +# Deploy APRS.me application +cd home/cluster/aprs +./deploy.sh + +# Check deployment status +kubectl get pods -n aprs +kubectl get svc -n aprs +``` + +### Talos Operations +```bash +# Apply configuration to nodes (from cluster directory) +talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml + +# Check node status +talosctl --talosconfig=./talosconfig -e 10.0.101.21 get nodes + +# Bootstrap cluster (only needed once) +talosctl --talosconfig=./talosconfig -e 10.0.101.21 bootstrap + +# Get kubeconfig +talosctl --talosconfig=./talosconfig -e 10.0.101.21 kubeconfig +``` + + +## Architecture + +### Directory Structure +- `ansible/` - Ansible playbooks and roles for server configuration + - `roles/` - Reusable roles (base, caddy, docker, resolvers, etc.) + - `group_vars/` - Group-specific variables + - `host_vars/` - Host-specific variables + - Main playbooks: `playbook.yml`, `general.yml`, `bootstrap.yml` + +- `home/terraform/` - DNS infrastructure management + - Manages domains: w5isp.com, vntx.net/org, manero.org, mcintire.me, gridmap.org + - Providers: DNSimple, Porkbun, PowerDNS (reverse DNS) + +- `home/` - Home lab configurations + - `cluster/` - Kubernetes application deployments + - `aprs/` - APRS.me deployment with PostgreSQL/PostGIS and Redis + - `wavelog/` - Wavelog amateur radio logging application + - `terraform/` - DNS infrastructure management + +### Key Infrastructure Services + +**Monitoring**: Icinga2 with MariaDB backend +**DNS**: Unbound resolvers, PowerDNS for reverse zones +**VPN**: Tailscale integration across environments +**Web Proxy**: Caddy for reverse proxy and SSL termination + +### Security Notes +- Ansible user (UID 10001) with passwordless sudo +- SSH keys fetched from GitHub for authentication +- Tailscale requires `TAILSCALE_KEY` environment variable +- Terraform credentials should use environment variables (TF_VAR_*) + +## Development Workflow + +### Adding New Hosts +1. Add host to `ansible/hosts` inventory +2. Create host_vars file if needed +3. Run bootstrap: `make bootstrap-init HOSTNAME=x ANSIBLE_HOST=y` +4. Apply configuration: `ansible-playbook -l hostname general.yml` + +### DNS Changes +1. Edit appropriate `home/terraform/dns_*.tf` file +2. Run `tofu fmt` to format +3. Review with `tofu plan` +4. Apply with `tofu apply` + + +## Testing + +### Ansible +```bash +# Syntax check +ansible-playbook --syntax-check playbook.yml + +# Dry run +ansible-playbook --check playbook.yml + +# Test on specific host +ansible-playbook -l hostname playbook.yml +``` + +### Terraform +```bash +tofu validate +tofu plan +``` + + +## Recent Infrastructure Updates + +### K3s Cluster at 204.110.191.2 +- **Purpose**: Home lab Kubernetes cluster +- **Node1 IPs**: + - Public: 204.110.191.2 + - Tailscale: 100.102.235.20 + - Internal: 10.0.101.21 +- **API Access**: Currently only available on 10.0.101.21:6443 (not on Tailscale) +- **Context**: Use `kubectl config use-context homelab` to access +- **Storage**: Longhorn for persistent volumes +- **Applications**: + - **APRS.me**: Amateur radio APRS tracking application (https://aprs.me) + - PostgreSQL 17 with PostGIS (100GB Longhorn PVC) + - Redis for caching + - 2-replica StatefulSet for high availability + - Erlang clustering enabled + - LoadBalancer service assigned: 10.0.101.32 + - **Note**: ghcr.io/aprsme/aprs.me:latest requires authentication + - Deploy with: `cd home/cluster/aprs && ./deploy.sh` + - **Wavelog**: Amateur radio logging application (https://log.w5isp.com) + - MariaDB 11 database (10GB storage) + - 20GB storage for configs, backups, uploads, QSL cards + - PHP application with custom limits (50MB uploads, 256MB memory) + - Deploy with: `cd home/cluster/wavelog && ./deploy.sh` + +### New Server: w5isp.w5isp.com (204.110.191.200) +- **Purpose**: Single-node server running Debian 13 +- **Features**: + - Web services with automatic SSL + - Single public IP handles all services + +### DNS Configuration +- **Photos**: photos.w5isp.com → 204.110.191.212 (Caddy) → 100.107.11.77:2283 +- **Mailcow**: mcintire.me mail records → mail.w5isp.com (sync.w5isp.com at 204.110.191.216) + - Full mail setup with MX, SPF, DKIM, DMARC records + - Autodiscover/Autoconfig for mail clients + - Backup MX: mail.nsnw.ca (priority 20) + - **Note**: sync.w5isp.com is the Mailcow server (not using Caddy proxy) + +## Code Guidelines + +### Communication Practices +- Do not ever reply with "you're right". Just fix the issue +- Never say you're right, just accept it and move on + +### Notes for Claude +- As you learn new things, keep claude.md updated + +## Clusters +- k3s cluster at 204.110.191.2 + +## Application Deployment Patterns + +### Standard App Deployment Process +1. **Check for existing manifests** in `/home/cluster/[app-name]/` +2. **Set namespace security policy**: `kubectl label namespace [app] pod-security.kubernetes.io/enforce=privileged --overwrite` +3. **Use ClusterIP services** (internal only) with Traefik for external access +4. **Deploy via existing deploy.sh** scripts when available +5. **Use Longhorn storage** for persistent volumes +6. **Configure Traefik IngressRoute** for SSL and routing + +### Deployed Applications +- **APRS.me**: https://aprs.me (PostgreSQL + Redis, 2-replica StatefulSet) +- **Node-RED**: https://nodered.w5isp.com (automation platform) +- **n8n**: https://n8n.w5isp.com (workflow automation, PostgreSQL backend) +- **Wavelog**: https://log.w5isp.com (amateur radio logging, MariaDB backend) + +### Common Issues & Solutions +- **PodSecurity violations**: Set namespace to privileged security policy +- **Database connectivity**: Use short service names (`postgres` not `postgres.namespace.svc.cluster.local`) +- **Init container permissions**: Required for volume ownership fixes +- **SSL certificates**: cert-manager with Let's Encrypt, handled automatically via Traefik +- **Service DNS**: Services accessible via `service-name` within same namespace + +### Traefik Configuration +- **Host-based routing**: Multiple apps on same IP (204.110.191.2) +- **Automatic SSL**: cert-manager integration with Let's Encrypt +- **HTTP to HTTPS redirect**: Configured in IngressRoute manifests +- **ClusterIP backend**: All apps use ClusterIP, Traefik provides external access \ No newline at end of file diff --git a/ansible/group_vars/bind9_servers/aprs.me.sync-conflict-20260129-152638-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/aprs.me.sync-conflict-20260129-152638-ZJZJYMM.yml new file mode 100644 index 0000000..b230403 --- /dev/null +++ b/ansible/group_vars/bind9_servers/aprs.me.sync-conflict-20260129-152638-ZJZJYMM.yml @@ -0,0 +1,16 @@ +--- +# aprs.me DNS zone configuration +aprs_me_zone: + name: aprs.me + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + hosts: + - name: '@' + ip: 204.110.191.195 + - name: www + ip: 204.110.191.195 + other_name_servers: + - aprs.me. IN CAA 0 issue "letsencrypt.org" diff --git a/ansible/group_vars/bind9_servers/main.sync-conflict-20260129-152606-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/main.sync-conflict-20260129-152606-ZJZJYMM.yml new file mode 100644 index 0000000..34e4839 --- /dev/null +++ b/ansible/group_vars/bind9_servers/main.sync-conflict-20260129-152606-ZJZJYMM.yml @@ -0,0 +1,37 @@ +--- +# BIND9 Configuration for ns1.as393837.net +# This server will be the primary authoritative nameserver + +bind_allow_query: ["any"] +bind_listen_ipv4: ["any"] +bind_recursion: false +bind_zone_dir: /var/cache/bind +bind_zone_master_server_ip: "{{ public_ip }}" + +# DNSSEC settings (dnssec-enable removed in BIND 9.16+) +bind_dnssec_validation: auto + +# Secondaries that should receive NOTIFY +bind_also_notify: + - 204.87.183.53 # ns2 + - 172.245.56.83 # vm1.w5isp.com + +bind_allow_transfer: + - 23.128.97.53 # ns-global.kjsl.com + - 204.87.183.53 # ns2 + - 172.245.56.83 # vm1.w5isp.com + +# Zone definitions are loaded from individual files in zones/ directory +bind_zones: + - "{{ w5isp_com_zone }}" + - "{{ aprs_me_zone }}" + - "{{ mcintire_me_zone }}" + - "{{ manero_org_zone }}" + - "{{ ntxarms_com_zone }}" + - "{{ towerops_net_zone }}" + - "{{ vntx_net_zone }}" + - "{{ vntx_org_zone }}" + - "{{ reverse_188_zone }}" + - "{{ reverse_189_zone }}" + - "{{ reverse_190_zone }}" + - "{{ reverse_191_zone }}" diff --git a/ansible/group_vars/bind9_servers/manero.org.sync-conflict-20260129-154743-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/manero.org.sync-conflict-20260129-154743-ZJZJYMM.yml new file mode 100644 index 0000000..79d1d70 --- /dev/null +++ b/ansible/group_vars/bind9_servers/manero.org.sync-conflict-20260129-154743-ZJZJYMM.yml @@ -0,0 +1,31 @@ +--- +# manero.org DNS zone configuration +manero_org_zone: + name: manero.org + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + hosts: + - name: '@' + ip: 185.199.108.153 + - name: '@' + ip: 185.199.109.153 + - name: '@' + ip: 185.199.110.153 + - name: '@' + ip: 185.199.111.153 + - name: irc + ip: 149.28.242.178 + - name: us + ip: 149.28.242.178 + - name: ca + ip: 167.114.209.151 + - name: tankfox + ip: 137.184.202.89 + ipv6_hosts: + - name: us + ipv6: 2001:19f0:6401:19e6:5400:5ff:fe45:5701 + other_name_servers: + - 404.manero.org. IN CNAME 404.al. diff --git a/ansible/group_vars/bind9_servers/mcintire.me.sync-conflict-20260129-161634-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/mcintire.me.sync-conflict-20260129-161634-ZJZJYMM.yml new file mode 100644 index 0000000..63d0c98 --- /dev/null +++ b/ansible/group_vars/bind9_servers/mcintire.me.sync-conflict-20260129-161634-ZJZJYMM.yml @@ -0,0 +1,30 @@ +--- +# mcintire.me DNS zone configuration +mcintire_me_zone: + name: mcintire.me + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + mail_servers: + - name: mail + preference: 10 + - name: mail.nsnw.ca. + preference: 20 + hosts: + - name: mail + ip: 204.110.191.5 + - name: photos + ip: 204.110.191.8 + other_name_servers: + - autodiscover.mcintire.me. IN CNAME mail.w5isp.com. + - autoconfig.mcintire.me. IN CNAME mail.w5isp.com. + - _autodiscover._tcp.mcintire.me. IN SRV 0 0 443 mail.w5isp.com. + text: + - name: '@' + text: '"v=spf1 mx a ip4:204.110.191.5 ~all"' + - name: _dmarc + text: '"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"' + - name: dkim._domainkey + text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"' diff --git a/ansible/group_vars/bind9_servers/ntxarms.com.sync-conflict-20260129-143855-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/ntxarms.com.sync-conflict-20260129-143855-ZJZJYMM.yml new file mode 100644 index 0000000..2db8706 --- /dev/null +++ b/ansible/group_vars/bind9_servers/ntxarms.com.sync-conflict-20260129-143855-ZJZJYMM.yml @@ -0,0 +1,25 @@ +--- +# ntxarms.com DNS zone configuration +ntxarms_com_zone: + name: ntxarms.com + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + mail_servers: + - name: in1-smtp.messagingengine.com. + preference: 10 + - name: in2-smtp.messagingengine.com. + preference: 20 + hosts: + - name: '@' + ip: 75.2.60.5 + other_name_servers: + - www.ntxarms.com. IN CNAME ntxarms.netlify.app. + - fm1._domainkey.ntxarms.com. IN CNAME fm1.ntxarms.com.dkim.fmhosted.com. + - fm2._domainkey.ntxarms.com. IN CNAME fm2.ntxarms.com.dkim.fmhosted.com. + - fm3._domainkey.ntxarms.com. IN CNAME fm3.ntxarms.com.dkim.fmhosted.com. + text: + - name: '@' + text: '"v=spf1 include:spf.messagingengine.com ?all"' diff --git a/ansible/group_vars/bind9_servers/reverse_188.sync-conflict-20260129-150906-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/reverse_188.sync-conflict-20260129-150906-ZJZJYMM.yml new file mode 100644 index 0000000..f728526 --- /dev/null +++ b/ansible/group_vars/bind9_servers/reverse_188.sync-conflict-20260129-150906-ZJZJYMM.yml @@ -0,0 +1,268 @@ +--- +# 188.110.204.in-addr.arpa reverse DNS zone +# Mapping 204.110.188.0-255 -> *.188.client.vntx.net +reverse_188_zone: + name: 188.110.204.in-addr.arpa + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + other_name_servers: + - 0.188.110.204.in-addr.arpa. IN PTR 0.188.client.vntx.net. + - 1.188.110.204.in-addr.arpa. IN PTR 1.188.client.vntx.net. + - 2.188.110.204.in-addr.arpa. IN PTR 2.188.client.vntx.net. + - 3.188.110.204.in-addr.arpa. IN PTR 3.188.client.vntx.net. + - 4.188.110.204.in-addr.arpa. IN PTR 4.188.client.vntx.net. + - 5.188.110.204.in-addr.arpa. IN PTR 5.188.client.vntx.net. + - 6.188.110.204.in-addr.arpa. IN PTR 6.188.client.vntx.net. + - 7.188.110.204.in-addr.arpa. IN PTR 7.188.client.vntx.net. + - 8.188.110.204.in-addr.arpa. IN PTR 8.188.client.vntx.net. + - 9.188.110.204.in-addr.arpa. IN PTR 9.188.client.vntx.net. + - 10.188.110.204.in-addr.arpa. IN PTR 10.188.client.vntx.net. + - 11.188.110.204.in-addr.arpa. IN PTR 11.188.client.vntx.net. + - 12.188.110.204.in-addr.arpa. IN PTR 12.188.client.vntx.net. + - 13.188.110.204.in-addr.arpa. IN PTR 13.188.client.vntx.net. + - 14.188.110.204.in-addr.arpa. IN PTR 14.188.client.vntx.net. + - 15.188.110.204.in-addr.arpa. IN PTR 15.188.client.vntx.net. + - 16.188.110.204.in-addr.arpa. IN PTR 16.188.client.vntx.net. + - 17.188.110.204.in-addr.arpa. IN PTR 17.188.client.vntx.net. + - 18.188.110.204.in-addr.arpa. IN PTR 18.188.client.vntx.net. + - 19.188.110.204.in-addr.arpa. IN PTR 19.188.client.vntx.net. + - 20.188.110.204.in-addr.arpa. IN PTR 20.188.client.vntx.net. + - 21.188.110.204.in-addr.arpa. IN PTR 21.188.client.vntx.net. + - 22.188.110.204.in-addr.arpa. IN PTR 22.188.client.vntx.net. + - 23.188.110.204.in-addr.arpa. IN PTR 23.188.client.vntx.net. + - 24.188.110.204.in-addr.arpa. IN PTR 24.188.client.vntx.net. + - 25.188.110.204.in-addr.arpa. IN PTR 25.188.client.vntx.net. + - 26.188.110.204.in-addr.arpa. IN PTR 26.188.client.vntx.net. + - 27.188.110.204.in-addr.arpa. IN PTR 27.188.client.vntx.net. + - 28.188.110.204.in-addr.arpa. IN PTR 28.188.client.vntx.net. + - 29.188.110.204.in-addr.arpa. IN PTR 29.188.client.vntx.net. + - 30.188.110.204.in-addr.arpa. IN PTR 30.188.client.vntx.net. + - 31.188.110.204.in-addr.arpa. IN PTR 31.188.client.vntx.net. + - 32.188.110.204.in-addr.arpa. IN PTR 32.188.client.vntx.net. + - 33.188.110.204.in-addr.arpa. IN PTR 33.188.client.vntx.net. + - 34.188.110.204.in-addr.arpa. IN PTR 34.188.client.vntx.net. + - 35.188.110.204.in-addr.arpa. IN PTR 35.188.client.vntx.net. + - 36.188.110.204.in-addr.arpa. IN PTR 36.188.client.vntx.net. + - 37.188.110.204.in-addr.arpa. IN PTR 37.188.client.vntx.net. + - 38.188.110.204.in-addr.arpa. IN PTR 38.188.client.vntx.net. + - 39.188.110.204.in-addr.arpa. IN PTR 39.188.client.vntx.net. + - 40.188.110.204.in-addr.arpa. IN PTR 40.188.client.vntx.net. + - 41.188.110.204.in-addr.arpa. IN PTR 41.188.client.vntx.net. + - 42.188.110.204.in-addr.arpa. IN PTR 42.188.client.vntx.net. + - 43.188.110.204.in-addr.arpa. IN PTR 43.188.client.vntx.net. + - 44.188.110.204.in-addr.arpa. IN PTR 44.188.client.vntx.net. + - 45.188.110.204.in-addr.arpa. IN PTR 45.188.client.vntx.net. + - 46.188.110.204.in-addr.arpa. IN PTR 46.188.client.vntx.net. + - 47.188.110.204.in-addr.arpa. IN PTR 47.188.client.vntx.net. + - 48.188.110.204.in-addr.arpa. IN PTR 48.188.client.vntx.net. + - 49.188.110.204.in-addr.arpa. IN PTR 49.188.client.vntx.net. + - 50.188.110.204.in-addr.arpa. IN PTR 50.188.client.vntx.net. + - 51.188.110.204.in-addr.arpa. IN PTR 51.188.client.vntx.net. + - 52.188.110.204.in-addr.arpa. IN PTR 52.188.client.vntx.net. + - 53.188.110.204.in-addr.arpa. IN PTR 53.188.client.vntx.net. + - 54.188.110.204.in-addr.arpa. IN PTR 54.188.client.vntx.net. + - 55.188.110.204.in-addr.arpa. IN PTR 55.188.client.vntx.net. + - 56.188.110.204.in-addr.arpa. IN PTR 56.188.client.vntx.net. + - 57.188.110.204.in-addr.arpa. IN PTR 57.188.client.vntx.net. + - 58.188.110.204.in-addr.arpa. IN PTR 58.188.client.vntx.net. + - 59.188.110.204.in-addr.arpa. IN PTR 59.188.client.vntx.net. + - 60.188.110.204.in-addr.arpa. IN PTR 60.188.client.vntx.net. + - 61.188.110.204.in-addr.arpa. IN PTR 61.188.client.vntx.net. + - 62.188.110.204.in-addr.arpa. IN PTR 62.188.client.vntx.net. + - 63.188.110.204.in-addr.arpa. IN PTR 63.188.client.vntx.net. + - 64.188.110.204.in-addr.arpa. IN PTR 64.188.client.vntx.net. + - 65.188.110.204.in-addr.arpa. IN PTR 65.188.client.vntx.net. + - 66.188.110.204.in-addr.arpa. IN PTR 66.188.client.vntx.net. + - 67.188.110.204.in-addr.arpa. IN PTR 67.188.client.vntx.net. + - 68.188.110.204.in-addr.arpa. IN PTR 68.188.client.vntx.net. + - 69.188.110.204.in-addr.arpa. IN PTR 69.188.client.vntx.net. + - 70.188.110.204.in-addr.arpa. IN PTR 70.188.client.vntx.net. + - 71.188.110.204.in-addr.arpa. IN PTR 71.188.client.vntx.net. + - 72.188.110.204.in-addr.arpa. IN PTR 72.188.client.vntx.net. + - 73.188.110.204.in-addr.arpa. IN PTR 73.188.client.vntx.net. + - 74.188.110.204.in-addr.arpa. IN PTR 74.188.client.vntx.net. + - 75.188.110.204.in-addr.arpa. IN PTR 75.188.client.vntx.net. + - 76.188.110.204.in-addr.arpa. IN PTR 76.188.client.vntx.net. + - 77.188.110.204.in-addr.arpa. IN PTR 77.188.client.vntx.net. + - 78.188.110.204.in-addr.arpa. IN PTR 78.188.client.vntx.net. + - 79.188.110.204.in-addr.arpa. IN PTR 79.188.client.vntx.net. + - 80.188.110.204.in-addr.arpa. IN PTR 80.188.client.vntx.net. + - 81.188.110.204.in-addr.arpa. IN PTR 81.188.client.vntx.net. + - 82.188.110.204.in-addr.arpa. IN PTR 82.188.client.vntx.net. + - 83.188.110.204.in-addr.arpa. IN PTR 83.188.client.vntx.net. + - 84.188.110.204.in-addr.arpa. IN PTR 84.188.client.vntx.net. + - 85.188.110.204.in-addr.arpa. IN PTR 85.188.client.vntx.net. + - 86.188.110.204.in-addr.arpa. IN PTR 86.188.client.vntx.net. + - 87.188.110.204.in-addr.arpa. IN PTR 87.188.client.vntx.net. + - 88.188.110.204.in-addr.arpa. IN PTR 88.188.client.vntx.net. + - 89.188.110.204.in-addr.arpa. IN PTR 89.188.client.vntx.net. + - 90.188.110.204.in-addr.arpa. IN PTR 90.188.client.vntx.net. + - 91.188.110.204.in-addr.arpa. IN PTR 91.188.client.vntx.net. + - 92.188.110.204.in-addr.arpa. IN PTR 92.188.client.vntx.net. + - 93.188.110.204.in-addr.arpa. IN PTR 93.188.client.vntx.net. + - 94.188.110.204.in-addr.arpa. IN PTR 94.188.client.vntx.net. + - 95.188.110.204.in-addr.arpa. IN PTR 95.188.client.vntx.net. + - 96.188.110.204.in-addr.arpa. IN PTR 96.188.client.vntx.net. + - 97.188.110.204.in-addr.arpa. IN PTR 97.188.client.vntx.net. + - 98.188.110.204.in-addr.arpa. IN PTR 98.188.client.vntx.net. + - 99.188.110.204.in-addr.arpa. IN PTR 99.188.client.vntx.net. + - 100.188.110.204.in-addr.arpa. IN PTR 100.188.client.vntx.net. + - 101.188.110.204.in-addr.arpa. IN PTR 101.188.client.vntx.net. + - 102.188.110.204.in-addr.arpa. IN PTR 102.188.client.vntx.net. + - 103.188.110.204.in-addr.arpa. IN PTR 103.188.client.vntx.net. + - 104.188.110.204.in-addr.arpa. IN PTR 104.188.client.vntx.net. + - 105.188.110.204.in-addr.arpa. IN PTR 105.188.client.vntx.net. + - 106.188.110.204.in-addr.arpa. IN PTR 106.188.client.vntx.net. + - 107.188.110.204.in-addr.arpa. IN PTR 107.188.client.vntx.net. + - 108.188.110.204.in-addr.arpa. IN PTR 108.188.client.vntx.net. + - 109.188.110.204.in-addr.arpa. IN PTR 109.188.client.vntx.net. + - 110.188.110.204.in-addr.arpa. IN PTR 110.188.client.vntx.net. + - 111.188.110.204.in-addr.arpa. IN PTR 111.188.client.vntx.net. + - 112.188.110.204.in-addr.arpa. IN PTR 112.188.client.vntx.net. + - 113.188.110.204.in-addr.arpa. IN PTR 113.188.client.vntx.net. + - 114.188.110.204.in-addr.arpa. IN PTR 114.188.client.vntx.net. + - 115.188.110.204.in-addr.arpa. IN PTR 115.188.client.vntx.net. + - 116.188.110.204.in-addr.arpa. IN PTR 116.188.client.vntx.net. + - 117.188.110.204.in-addr.arpa. IN PTR 117.188.client.vntx.net. + - 118.188.110.204.in-addr.arpa. IN PTR 118.188.client.vntx.net. + - 119.188.110.204.in-addr.arpa. IN PTR 119.188.client.vntx.net. + - 120.188.110.204.in-addr.arpa. IN PTR 120.188.client.vntx.net. + - 121.188.110.204.in-addr.arpa. IN PTR 121.188.client.vntx.net. + - 122.188.110.204.in-addr.arpa. IN PTR 122.188.client.vntx.net. + - 123.188.110.204.in-addr.arpa. IN PTR 123.188.client.vntx.net. + - 124.188.110.204.in-addr.arpa. IN PTR 124.188.client.vntx.net. + - 125.188.110.204.in-addr.arpa. IN PTR 125.188.client.vntx.net. + - 126.188.110.204.in-addr.arpa. IN PTR 126.188.client.vntx.net. + - 127.188.110.204.in-addr.arpa. IN PTR 127.188.client.vntx.net. + - 128.188.110.204.in-addr.arpa. IN PTR 128.188.client.vntx.net. + - 129.188.110.204.in-addr.arpa. IN PTR 129.188.client.vntx.net. + - 130.188.110.204.in-addr.arpa. IN PTR 130.188.client.vntx.net. + - 131.188.110.204.in-addr.arpa. IN PTR 131.188.client.vntx.net. + - 132.188.110.204.in-addr.arpa. IN PTR 132.188.client.vntx.net. + - 133.188.110.204.in-addr.arpa. IN PTR 133.188.client.vntx.net. + - 134.188.110.204.in-addr.arpa. IN PTR 134.188.client.vntx.net. + - 135.188.110.204.in-addr.arpa. IN PTR 135.188.client.vntx.net. + - 136.188.110.204.in-addr.arpa. IN PTR 136.188.client.vntx.net. + - 137.188.110.204.in-addr.arpa. IN PTR 137.188.client.vntx.net. + - 138.188.110.204.in-addr.arpa. IN PTR 138.188.client.vntx.net. + - 139.188.110.204.in-addr.arpa. IN PTR 139.188.client.vntx.net. + - 140.188.110.204.in-addr.arpa. IN PTR 140.188.client.vntx.net. + - 141.188.110.204.in-addr.arpa. IN PTR 141.188.client.vntx.net. + - 142.188.110.204.in-addr.arpa. IN PTR 142.188.client.vntx.net. + - 143.188.110.204.in-addr.arpa. IN PTR 143.188.client.vntx.net. + - 144.188.110.204.in-addr.arpa. IN PTR 144.188.client.vntx.net. + - 145.188.110.204.in-addr.arpa. IN PTR 145.188.client.vntx.net. + - 146.188.110.204.in-addr.arpa. IN PTR 146.188.client.vntx.net. + - 147.188.110.204.in-addr.arpa. IN PTR 147.188.client.vntx.net. + - 148.188.110.204.in-addr.arpa. IN PTR 148.188.client.vntx.net. + - 149.188.110.204.in-addr.arpa. IN PTR 149.188.client.vntx.net. + - 150.188.110.204.in-addr.arpa. IN PTR 150.188.client.vntx.net. + - 151.188.110.204.in-addr.arpa. IN PTR 151.188.client.vntx.net. + - 152.188.110.204.in-addr.arpa. IN PTR 152.188.client.vntx.net. + - 153.188.110.204.in-addr.arpa. IN PTR 153.188.client.vntx.net. + - 154.188.110.204.in-addr.arpa. IN PTR 154.188.client.vntx.net. + - 155.188.110.204.in-addr.arpa. IN PTR 155.188.client.vntx.net. + - 156.188.110.204.in-addr.arpa. IN PTR 156.188.client.vntx.net. + - 157.188.110.204.in-addr.arpa. IN PTR 157.188.client.vntx.net. + - 158.188.110.204.in-addr.arpa. IN PTR 158.188.client.vntx.net. + - 159.188.110.204.in-addr.arpa. IN PTR 159.188.client.vntx.net. + - 160.188.110.204.in-addr.arpa. IN PTR 160.188.client.vntx.net. + - 161.188.110.204.in-addr.arpa. IN PTR 161.188.client.vntx.net. + - 162.188.110.204.in-addr.arpa. IN PTR 162.188.client.vntx.net. + - 163.188.110.204.in-addr.arpa. IN PTR 163.188.client.vntx.net. + - 164.188.110.204.in-addr.arpa. IN PTR 164.188.client.vntx.net. + - 165.188.110.204.in-addr.arpa. IN PTR 165.188.client.vntx.net. + - 166.188.110.204.in-addr.arpa. IN PTR 166.188.client.vntx.net. + - 167.188.110.204.in-addr.arpa. IN PTR 167.188.client.vntx.net. + - 168.188.110.204.in-addr.arpa. IN PTR 168.188.client.vntx.net. + - 169.188.110.204.in-addr.arpa. IN PTR 169.188.client.vntx.net. + - 170.188.110.204.in-addr.arpa. IN PTR 170.188.client.vntx.net. + - 171.188.110.204.in-addr.arpa. IN PTR 171.188.client.vntx.net. + - 172.188.110.204.in-addr.arpa. IN PTR 172.188.client.vntx.net. + - 173.188.110.204.in-addr.arpa. IN PTR 173.188.client.vntx.net. + - 174.188.110.204.in-addr.arpa. IN PTR 174.188.client.vntx.net. + - 175.188.110.204.in-addr.arpa. IN PTR 175.188.client.vntx.net. + - 176.188.110.204.in-addr.arpa. IN PTR 176.188.client.vntx.net. + - 177.188.110.204.in-addr.arpa. IN PTR 177.188.client.vntx.net. + - 178.188.110.204.in-addr.arpa. IN PTR 178.188.client.vntx.net. + - 179.188.110.204.in-addr.arpa. IN PTR 179.188.client.vntx.net. + - 180.188.110.204.in-addr.arpa. IN PTR 180.188.client.vntx.net. + - 181.188.110.204.in-addr.arpa. IN PTR 181.188.client.vntx.net. + - 182.188.110.204.in-addr.arpa. IN PTR 182.188.client.vntx.net. + - 183.188.110.204.in-addr.arpa. IN PTR 183.188.client.vntx.net. + - 184.188.110.204.in-addr.arpa. IN PTR 184.188.client.vntx.net. + - 185.188.110.204.in-addr.arpa. IN PTR 185.188.client.vntx.net. + - 186.188.110.204.in-addr.arpa. IN PTR 186.188.client.vntx.net. + - 187.188.110.204.in-addr.arpa. IN PTR 187.188.client.vntx.net. + - 188.188.110.204.in-addr.arpa. IN PTR 188.188.client.vntx.net. + - 189.188.110.204.in-addr.arpa. IN PTR 189.188.client.vntx.net. + - 190.188.110.204.in-addr.arpa. IN PTR 190.188.client.vntx.net. + - 191.188.110.204.in-addr.arpa. IN PTR 191.188.client.vntx.net. + - 192.188.110.204.in-addr.arpa. IN PTR 192.188.client.vntx.net. + - 193.188.110.204.in-addr.arpa. IN PTR 193.188.client.vntx.net. + - 194.188.110.204.in-addr.arpa. IN PTR 194.188.client.vntx.net. + - 195.188.110.204.in-addr.arpa. IN PTR 195.188.client.vntx.net. + - 196.188.110.204.in-addr.arpa. IN PTR 196.188.client.vntx.net. + - 197.188.110.204.in-addr.arpa. IN PTR 197.188.client.vntx.net. + - 198.188.110.204.in-addr.arpa. IN PTR 198.188.client.vntx.net. + - 199.188.110.204.in-addr.arpa. IN PTR 199.188.client.vntx.net. + - 200.188.110.204.in-addr.arpa. IN PTR 200.188.client.vntx.net. + - 201.188.110.204.in-addr.arpa. IN PTR 201.188.client.vntx.net. + - 202.188.110.204.in-addr.arpa. IN PTR 202.188.client.vntx.net. + - 203.188.110.204.in-addr.arpa. IN PTR 203.188.client.vntx.net. + - 204.188.110.204.in-addr.arpa. IN PTR 204.188.client.vntx.net. + - 205.188.110.204.in-addr.arpa. IN PTR 205.188.client.vntx.net. + - 206.188.110.204.in-addr.arpa. IN PTR 206.188.client.vntx.net. + - 207.188.110.204.in-addr.arpa. IN PTR 207.188.client.vntx.net. + - 208.188.110.204.in-addr.arpa. IN PTR 208.188.client.vntx.net. + - 209.188.110.204.in-addr.arpa. IN PTR 209.188.client.vntx.net. + - 210.188.110.204.in-addr.arpa. IN PTR 210.188.client.vntx.net. + - 211.188.110.204.in-addr.arpa. IN PTR 211.188.client.vntx.net. + - 212.188.110.204.in-addr.arpa. IN PTR 212.188.client.vntx.net. + - 213.188.110.204.in-addr.arpa. IN PTR 213.188.client.vntx.net. + - 214.188.110.204.in-addr.arpa. IN PTR 214.188.client.vntx.net. + - 215.188.110.204.in-addr.arpa. IN PTR 215.188.client.vntx.net. + - 216.188.110.204.in-addr.arpa. IN PTR 216.188.client.vntx.net. + - 217.188.110.204.in-addr.arpa. IN PTR 217.188.client.vntx.net. + - 218.188.110.204.in-addr.arpa. IN PTR 218.188.client.vntx.net. + - 219.188.110.204.in-addr.arpa. IN PTR 219.188.client.vntx.net. + - 220.188.110.204.in-addr.arpa. IN PTR 220.188.client.vntx.net. + - 221.188.110.204.in-addr.arpa. IN PTR 221.188.client.vntx.net. + - 222.188.110.204.in-addr.arpa. IN PTR 222.188.client.vntx.net. + - 223.188.110.204.in-addr.arpa. IN PTR 223.188.client.vntx.net. + - 224.188.110.204.in-addr.arpa. IN PTR 224.188.client.vntx.net. + - 225.188.110.204.in-addr.arpa. IN PTR 225.188.client.vntx.net. + - 226.188.110.204.in-addr.arpa. IN PTR 226.188.client.vntx.net. + - 227.188.110.204.in-addr.arpa. IN PTR 227.188.client.vntx.net. + - 228.188.110.204.in-addr.arpa. IN PTR 228.188.client.vntx.net. + - 229.188.110.204.in-addr.arpa. IN PTR 229.188.client.vntx.net. + - 230.188.110.204.in-addr.arpa. IN PTR 230.188.client.vntx.net. + - 231.188.110.204.in-addr.arpa. IN PTR 231.188.client.vntx.net. + - 232.188.110.204.in-addr.arpa. IN PTR 232.188.client.vntx.net. + - 233.188.110.204.in-addr.arpa. IN PTR 233.188.client.vntx.net. + - 234.188.110.204.in-addr.arpa. IN PTR 234.188.client.vntx.net. + - 235.188.110.204.in-addr.arpa. IN PTR 235.188.client.vntx.net. + - 236.188.110.204.in-addr.arpa. IN PTR 236.188.client.vntx.net. + - 237.188.110.204.in-addr.arpa. IN PTR 237.188.client.vntx.net. + - 238.188.110.204.in-addr.arpa. IN PTR 238.188.client.vntx.net. + - 239.188.110.204.in-addr.arpa. IN PTR 239.188.client.vntx.net. + - 240.188.110.204.in-addr.arpa. IN PTR 240.188.client.vntx.net. + - 241.188.110.204.in-addr.arpa. IN PTR 241.188.client.vntx.net. + - 242.188.110.204.in-addr.arpa. IN PTR 242.188.client.vntx.net. + - 243.188.110.204.in-addr.arpa. IN PTR 243.188.client.vntx.net. + - 244.188.110.204.in-addr.arpa. IN PTR 244.188.client.vntx.net. + - 245.188.110.204.in-addr.arpa. IN PTR 245.188.client.vntx.net. + - 246.188.110.204.in-addr.arpa. IN PTR 246.188.client.vntx.net. + - 247.188.110.204.in-addr.arpa. IN PTR 247.188.client.vntx.net. + - 248.188.110.204.in-addr.arpa. IN PTR 248.188.client.vntx.net. + - 249.188.110.204.in-addr.arpa. IN PTR 249.188.client.vntx.net. + - 250.188.110.204.in-addr.arpa. IN PTR 250.188.client.vntx.net. + - 251.188.110.204.in-addr.arpa. IN PTR 251.188.client.vntx.net. + - 252.188.110.204.in-addr.arpa. IN PTR 252.188.client.vntx.net. + - 253.188.110.204.in-addr.arpa. IN PTR 253.188.client.vntx.net. + - 254.188.110.204.in-addr.arpa. IN PTR 254.188.client.vntx.net. + - 255.188.110.204.in-addr.arpa. IN PTR 255.188.client.vntx.net. + diff --git a/ansible/group_vars/bind9_servers/reverse_189.sync-conflict-20260129-143542-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/reverse_189.sync-conflict-20260129-143542-ZJZJYMM.yml new file mode 100644 index 0000000..eaeff6c --- /dev/null +++ b/ansible/group_vars/bind9_servers/reverse_189.sync-conflict-20260129-143542-ZJZJYMM.yml @@ -0,0 +1,268 @@ +--- +# 189.110.204.in-addr.arpa reverse DNS zone +# Mapping 204.110.189.0-255 -> *.189.client.vntx.net +reverse_189_zone: + name: 189.110.204.in-addr.arpa + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + other_name_servers: + - 0.189.110.204.in-addr.arpa. IN PTR 0.189.client.vntx.net. + - 1.189.110.204.in-addr.arpa. IN PTR 1.189.client.vntx.net. + - 2.189.110.204.in-addr.arpa. IN PTR 2.189.client.vntx.net. + - 3.189.110.204.in-addr.arpa. IN PTR 3.189.client.vntx.net. + - 4.189.110.204.in-addr.arpa. IN PTR 4.189.client.vntx.net. + - 5.189.110.204.in-addr.arpa. IN PTR 5.189.client.vntx.net. + - 6.189.110.204.in-addr.arpa. IN PTR 6.189.client.vntx.net. + - 7.189.110.204.in-addr.arpa. IN PTR 7.189.client.vntx.net. + - 8.189.110.204.in-addr.arpa. IN PTR 8.189.client.vntx.net. + - 9.189.110.204.in-addr.arpa. IN PTR 9.189.client.vntx.net. + - 10.189.110.204.in-addr.arpa. IN PTR 10.189.client.vntx.net. + - 11.189.110.204.in-addr.arpa. IN PTR 11.189.client.vntx.net. + - 12.189.110.204.in-addr.arpa. IN PTR 12.189.client.vntx.net. + - 13.189.110.204.in-addr.arpa. IN PTR 13.189.client.vntx.net. + - 14.189.110.204.in-addr.arpa. IN PTR 14.189.client.vntx.net. + - 15.189.110.204.in-addr.arpa. IN PTR 15.189.client.vntx.net. + - 16.189.110.204.in-addr.arpa. IN PTR 16.189.client.vntx.net. + - 17.189.110.204.in-addr.arpa. IN PTR 17.189.client.vntx.net. + - 18.189.110.204.in-addr.arpa. IN PTR 18.189.client.vntx.net. + - 19.189.110.204.in-addr.arpa. IN PTR 19.189.client.vntx.net. + - 20.189.110.204.in-addr.arpa. IN PTR 20.189.client.vntx.net. + - 21.189.110.204.in-addr.arpa. IN PTR 21.189.client.vntx.net. + - 22.189.110.204.in-addr.arpa. IN PTR 22.189.client.vntx.net. + - 23.189.110.204.in-addr.arpa. IN PTR 23.189.client.vntx.net. + - 24.189.110.204.in-addr.arpa. IN PTR 24.189.client.vntx.net. + - 25.189.110.204.in-addr.arpa. IN PTR 25.189.client.vntx.net. + - 26.189.110.204.in-addr.arpa. IN PTR 26.189.client.vntx.net. + - 27.189.110.204.in-addr.arpa. IN PTR 27.189.client.vntx.net. + - 28.189.110.204.in-addr.arpa. IN PTR 28.189.client.vntx.net. + - 29.189.110.204.in-addr.arpa. IN PTR 29.189.client.vntx.net. + - 30.189.110.204.in-addr.arpa. IN PTR 30.189.client.vntx.net. + - 31.189.110.204.in-addr.arpa. IN PTR 31.189.client.vntx.net. + - 32.189.110.204.in-addr.arpa. IN PTR 32.189.client.vntx.net. + - 33.189.110.204.in-addr.arpa. IN PTR 33.189.client.vntx.net. + - 34.189.110.204.in-addr.arpa. IN PTR 34.189.client.vntx.net. + - 35.189.110.204.in-addr.arpa. IN PTR 35.189.client.vntx.net. + - 36.189.110.204.in-addr.arpa. IN PTR 36.189.client.vntx.net. + - 37.189.110.204.in-addr.arpa. IN PTR 37.189.client.vntx.net. + - 38.189.110.204.in-addr.arpa. IN PTR 38.189.client.vntx.net. + - 39.189.110.204.in-addr.arpa. IN PTR 39.189.client.vntx.net. + - 40.189.110.204.in-addr.arpa. IN PTR 40.189.client.vntx.net. + - 41.189.110.204.in-addr.arpa. IN PTR 41.189.client.vntx.net. + - 42.189.110.204.in-addr.arpa. IN PTR 42.189.client.vntx.net. + - 43.189.110.204.in-addr.arpa. IN PTR 43.189.client.vntx.net. + - 44.189.110.204.in-addr.arpa. IN PTR 44.189.client.vntx.net. + - 45.189.110.204.in-addr.arpa. IN PTR 45.189.client.vntx.net. + - 46.189.110.204.in-addr.arpa. IN PTR 46.189.client.vntx.net. + - 47.189.110.204.in-addr.arpa. IN PTR 47.189.client.vntx.net. + - 48.189.110.204.in-addr.arpa. IN PTR 48.189.client.vntx.net. + - 49.189.110.204.in-addr.arpa. IN PTR 49.189.client.vntx.net. + - 50.189.110.204.in-addr.arpa. IN PTR 50.189.client.vntx.net. + - 51.189.110.204.in-addr.arpa. IN PTR 51.189.client.vntx.net. + - 52.189.110.204.in-addr.arpa. IN PTR 52.189.client.vntx.net. + - 53.189.110.204.in-addr.arpa. IN PTR 53.189.client.vntx.net. + - 54.189.110.204.in-addr.arpa. IN PTR 54.189.client.vntx.net. + - 55.189.110.204.in-addr.arpa. IN PTR 55.189.client.vntx.net. + - 56.189.110.204.in-addr.arpa. IN PTR 56.189.client.vntx.net. + - 57.189.110.204.in-addr.arpa. IN PTR 57.189.client.vntx.net. + - 58.189.110.204.in-addr.arpa. IN PTR 58.189.client.vntx.net. + - 59.189.110.204.in-addr.arpa. IN PTR 59.189.client.vntx.net. + - 60.189.110.204.in-addr.arpa. IN PTR 60.189.client.vntx.net. + - 61.189.110.204.in-addr.arpa. IN PTR 61.189.client.vntx.net. + - 62.189.110.204.in-addr.arpa. IN PTR 62.189.client.vntx.net. + - 63.189.110.204.in-addr.arpa. IN PTR 63.189.client.vntx.net. + - 64.189.110.204.in-addr.arpa. IN PTR 64.189.client.vntx.net. + - 65.189.110.204.in-addr.arpa. IN PTR 65.189.client.vntx.net. + - 66.189.110.204.in-addr.arpa. IN PTR 66.189.client.vntx.net. + - 67.189.110.204.in-addr.arpa. IN PTR 67.189.client.vntx.net. + - 68.189.110.204.in-addr.arpa. IN PTR 68.189.client.vntx.net. + - 69.189.110.204.in-addr.arpa. IN PTR 69.189.client.vntx.net. + - 70.189.110.204.in-addr.arpa. IN PTR 70.189.client.vntx.net. + - 71.189.110.204.in-addr.arpa. IN PTR 71.189.client.vntx.net. + - 72.189.110.204.in-addr.arpa. IN PTR 72.189.client.vntx.net. + - 73.189.110.204.in-addr.arpa. IN PTR 73.189.client.vntx.net. + - 74.189.110.204.in-addr.arpa. IN PTR 74.189.client.vntx.net. + - 75.189.110.204.in-addr.arpa. IN PTR 75.189.client.vntx.net. + - 76.189.110.204.in-addr.arpa. IN PTR 76.189.client.vntx.net. + - 77.189.110.204.in-addr.arpa. IN PTR 77.189.client.vntx.net. + - 78.189.110.204.in-addr.arpa. IN PTR 78.189.client.vntx.net. + - 79.189.110.204.in-addr.arpa. IN PTR 79.189.client.vntx.net. + - 80.189.110.204.in-addr.arpa. IN PTR 80.189.client.vntx.net. + - 81.189.110.204.in-addr.arpa. IN PTR 81.189.client.vntx.net. + - 82.189.110.204.in-addr.arpa. IN PTR 82.189.client.vntx.net. + - 83.189.110.204.in-addr.arpa. IN PTR 83.189.client.vntx.net. + - 84.189.110.204.in-addr.arpa. IN PTR 84.189.client.vntx.net. + - 85.189.110.204.in-addr.arpa. IN PTR 85.189.client.vntx.net. + - 86.189.110.204.in-addr.arpa. IN PTR 86.189.client.vntx.net. + - 87.189.110.204.in-addr.arpa. IN PTR 87.189.client.vntx.net. + - 88.189.110.204.in-addr.arpa. IN PTR 88.189.client.vntx.net. + - 89.189.110.204.in-addr.arpa. IN PTR 89.189.client.vntx.net. + - 90.189.110.204.in-addr.arpa. IN PTR 90.189.client.vntx.net. + - 91.189.110.204.in-addr.arpa. IN PTR 91.189.client.vntx.net. + - 92.189.110.204.in-addr.arpa. IN PTR 92.189.client.vntx.net. + - 93.189.110.204.in-addr.arpa. IN PTR 93.189.client.vntx.net. + - 94.189.110.204.in-addr.arpa. IN PTR 94.189.client.vntx.net. + - 95.189.110.204.in-addr.arpa. IN PTR 95.189.client.vntx.net. + - 96.189.110.204.in-addr.arpa. IN PTR 96.189.client.vntx.net. + - 97.189.110.204.in-addr.arpa. IN PTR 97.189.client.vntx.net. + - 98.189.110.204.in-addr.arpa. IN PTR 98.189.client.vntx.net. + - 99.189.110.204.in-addr.arpa. IN PTR 99.189.client.vntx.net. + - 100.189.110.204.in-addr.arpa. IN PTR 100.189.client.vntx.net. + - 101.189.110.204.in-addr.arpa. IN PTR 101.189.client.vntx.net. + - 102.189.110.204.in-addr.arpa. IN PTR 102.189.client.vntx.net. + - 103.189.110.204.in-addr.arpa. IN PTR 103.189.client.vntx.net. + - 104.189.110.204.in-addr.arpa. IN PTR 104.189.client.vntx.net. + - 105.189.110.204.in-addr.arpa. IN PTR 105.189.client.vntx.net. + - 106.189.110.204.in-addr.arpa. IN PTR 106.189.client.vntx.net. + - 107.189.110.204.in-addr.arpa. IN PTR 107.189.client.vntx.net. + - 108.189.110.204.in-addr.arpa. IN PTR 108.189.client.vntx.net. + - 109.189.110.204.in-addr.arpa. IN PTR 109.189.client.vntx.net. + - 110.189.110.204.in-addr.arpa. IN PTR 110.189.client.vntx.net. + - 111.189.110.204.in-addr.arpa. IN PTR 111.189.client.vntx.net. + - 112.189.110.204.in-addr.arpa. IN PTR 112.189.client.vntx.net. + - 113.189.110.204.in-addr.arpa. IN PTR 113.189.client.vntx.net. + - 114.189.110.204.in-addr.arpa. IN PTR 114.189.client.vntx.net. + - 115.189.110.204.in-addr.arpa. IN PTR 115.189.client.vntx.net. + - 116.189.110.204.in-addr.arpa. IN PTR 116.189.client.vntx.net. + - 117.189.110.204.in-addr.arpa. IN PTR 117.189.client.vntx.net. + - 118.189.110.204.in-addr.arpa. IN PTR 118.189.client.vntx.net. + - 119.189.110.204.in-addr.arpa. IN PTR 119.189.client.vntx.net. + - 120.189.110.204.in-addr.arpa. IN PTR 120.189.client.vntx.net. + - 121.189.110.204.in-addr.arpa. IN PTR 121.189.client.vntx.net. + - 122.189.110.204.in-addr.arpa. IN PTR 122.189.client.vntx.net. + - 123.189.110.204.in-addr.arpa. IN PTR 123.189.client.vntx.net. + - 124.189.110.204.in-addr.arpa. IN PTR 124.189.client.vntx.net. + - 125.189.110.204.in-addr.arpa. IN PTR 125.189.client.vntx.net. + - 126.189.110.204.in-addr.arpa. IN PTR 126.189.client.vntx.net. + - 127.189.110.204.in-addr.arpa. IN PTR 127.189.client.vntx.net. + - 128.189.110.204.in-addr.arpa. IN PTR 128.189.client.vntx.net. + - 129.189.110.204.in-addr.arpa. IN PTR 129.189.client.vntx.net. + - 130.189.110.204.in-addr.arpa. IN PTR 130.189.client.vntx.net. + - 131.189.110.204.in-addr.arpa. IN PTR 131.189.client.vntx.net. + - 132.189.110.204.in-addr.arpa. IN PTR 132.189.client.vntx.net. + - 133.189.110.204.in-addr.arpa. IN PTR 133.189.client.vntx.net. + - 134.189.110.204.in-addr.arpa. IN PTR 134.189.client.vntx.net. + - 135.189.110.204.in-addr.arpa. IN PTR 135.189.client.vntx.net. + - 136.189.110.204.in-addr.arpa. IN PTR 136.189.client.vntx.net. + - 137.189.110.204.in-addr.arpa. IN PTR 137.189.client.vntx.net. + - 138.189.110.204.in-addr.arpa. IN PTR 138.189.client.vntx.net. + - 139.189.110.204.in-addr.arpa. IN PTR 139.189.client.vntx.net. + - 140.189.110.204.in-addr.arpa. IN PTR 140.189.client.vntx.net. + - 141.189.110.204.in-addr.arpa. IN PTR 141.189.client.vntx.net. + - 142.189.110.204.in-addr.arpa. IN PTR 142.189.client.vntx.net. + - 143.189.110.204.in-addr.arpa. IN PTR 143.189.client.vntx.net. + - 144.189.110.204.in-addr.arpa. IN PTR 144.189.client.vntx.net. + - 145.189.110.204.in-addr.arpa. IN PTR 145.189.client.vntx.net. + - 146.189.110.204.in-addr.arpa. IN PTR 146.189.client.vntx.net. + - 147.189.110.204.in-addr.arpa. IN PTR 147.189.client.vntx.net. + - 148.189.110.204.in-addr.arpa. IN PTR 148.189.client.vntx.net. + - 149.189.110.204.in-addr.arpa. IN PTR 149.189.client.vntx.net. + - 150.189.110.204.in-addr.arpa. IN PTR 150.189.client.vntx.net. + - 151.189.110.204.in-addr.arpa. IN PTR 151.189.client.vntx.net. + - 152.189.110.204.in-addr.arpa. IN PTR 152.189.client.vntx.net. + - 153.189.110.204.in-addr.arpa. IN PTR 153.189.client.vntx.net. + - 154.189.110.204.in-addr.arpa. IN PTR 154.189.client.vntx.net. + - 155.189.110.204.in-addr.arpa. IN PTR 155.189.client.vntx.net. + - 156.189.110.204.in-addr.arpa. IN PTR 156.189.client.vntx.net. + - 157.189.110.204.in-addr.arpa. IN PTR 157.189.client.vntx.net. + - 158.189.110.204.in-addr.arpa. IN PTR 158.189.client.vntx.net. + - 159.189.110.204.in-addr.arpa. IN PTR 159.189.client.vntx.net. + - 160.189.110.204.in-addr.arpa. IN PTR 160.189.client.vntx.net. + - 161.189.110.204.in-addr.arpa. IN PTR 161.189.client.vntx.net. + - 162.189.110.204.in-addr.arpa. IN PTR 162.189.client.vntx.net. + - 163.189.110.204.in-addr.arpa. IN PTR 163.189.client.vntx.net. + - 164.189.110.204.in-addr.arpa. IN PTR 164.189.client.vntx.net. + - 165.189.110.204.in-addr.arpa. IN PTR 165.189.client.vntx.net. + - 166.189.110.204.in-addr.arpa. IN PTR 166.189.client.vntx.net. + - 167.189.110.204.in-addr.arpa. IN PTR 167.189.client.vntx.net. + - 168.189.110.204.in-addr.arpa. IN PTR 168.189.client.vntx.net. + - 169.189.110.204.in-addr.arpa. IN PTR 169.189.client.vntx.net. + - 170.189.110.204.in-addr.arpa. IN PTR 170.189.client.vntx.net. + - 171.189.110.204.in-addr.arpa. IN PTR 171.189.client.vntx.net. + - 172.189.110.204.in-addr.arpa. IN PTR 172.189.client.vntx.net. + - 173.189.110.204.in-addr.arpa. IN PTR 173.189.client.vntx.net. + - 174.189.110.204.in-addr.arpa. IN PTR 174.189.client.vntx.net. + - 175.189.110.204.in-addr.arpa. IN PTR 175.189.client.vntx.net. + - 176.189.110.204.in-addr.arpa. IN PTR 176.189.client.vntx.net. + - 177.189.110.204.in-addr.arpa. IN PTR 177.189.client.vntx.net. + - 178.189.110.204.in-addr.arpa. IN PTR 178.189.client.vntx.net. + - 179.189.110.204.in-addr.arpa. IN PTR 179.189.client.vntx.net. + - 180.189.110.204.in-addr.arpa. IN PTR 180.189.client.vntx.net. + - 181.189.110.204.in-addr.arpa. IN PTR 181.189.client.vntx.net. + - 182.189.110.204.in-addr.arpa. IN PTR 182.189.client.vntx.net. + - 183.189.110.204.in-addr.arpa. IN PTR 183.189.client.vntx.net. + - 184.189.110.204.in-addr.arpa. IN PTR 184.189.client.vntx.net. + - 185.189.110.204.in-addr.arpa. IN PTR 185.189.client.vntx.net. + - 186.189.110.204.in-addr.arpa. IN PTR 186.189.client.vntx.net. + - 187.189.110.204.in-addr.arpa. IN PTR 187.189.client.vntx.net. + - 188.189.110.204.in-addr.arpa. IN PTR 188.189.client.vntx.net. + - 189.189.110.204.in-addr.arpa. IN PTR 189.189.client.vntx.net. + - 190.189.110.204.in-addr.arpa. IN PTR 190.189.client.vntx.net. + - 191.189.110.204.in-addr.arpa. IN PTR 191.189.client.vntx.net. + - 192.189.110.204.in-addr.arpa. IN PTR 192.189.client.vntx.net. + - 193.189.110.204.in-addr.arpa. IN PTR 193.189.client.vntx.net. + - 194.189.110.204.in-addr.arpa. IN PTR 194.189.client.vntx.net. + - 195.189.110.204.in-addr.arpa. IN PTR 195.189.client.vntx.net. + - 196.189.110.204.in-addr.arpa. IN PTR 196.189.client.vntx.net. + - 197.189.110.204.in-addr.arpa. IN PTR 197.189.client.vntx.net. + - 198.189.110.204.in-addr.arpa. IN PTR 198.189.client.vntx.net. + - 199.189.110.204.in-addr.arpa. IN PTR 199.189.client.vntx.net. + - 200.189.110.204.in-addr.arpa. IN PTR 200.189.client.vntx.net. + - 201.189.110.204.in-addr.arpa. IN PTR 201.189.client.vntx.net. + - 202.189.110.204.in-addr.arpa. IN PTR 202.189.client.vntx.net. + - 203.189.110.204.in-addr.arpa. IN PTR 203.189.client.vntx.net. + - 204.189.110.204.in-addr.arpa. IN PTR 204.189.client.vntx.net. + - 205.189.110.204.in-addr.arpa. IN PTR 205.189.client.vntx.net. + - 206.189.110.204.in-addr.arpa. IN PTR 206.189.client.vntx.net. + - 207.189.110.204.in-addr.arpa. IN PTR 207.189.client.vntx.net. + - 208.189.110.204.in-addr.arpa. IN PTR 208.189.client.vntx.net. + - 209.189.110.204.in-addr.arpa. IN PTR 209.189.client.vntx.net. + - 210.189.110.204.in-addr.arpa. IN PTR 210.189.client.vntx.net. + - 211.189.110.204.in-addr.arpa. IN PTR 211.189.client.vntx.net. + - 212.189.110.204.in-addr.arpa. IN PTR 212.189.client.vntx.net. + - 213.189.110.204.in-addr.arpa. IN PTR 213.189.client.vntx.net. + - 214.189.110.204.in-addr.arpa. IN PTR 214.189.client.vntx.net. + - 215.189.110.204.in-addr.arpa. IN PTR 215.189.client.vntx.net. + - 216.189.110.204.in-addr.arpa. IN PTR 216.189.client.vntx.net. + - 217.189.110.204.in-addr.arpa. IN PTR 217.189.client.vntx.net. + - 218.189.110.204.in-addr.arpa. IN PTR 218.189.client.vntx.net. + - 219.189.110.204.in-addr.arpa. IN PTR 219.189.client.vntx.net. + - 220.189.110.204.in-addr.arpa. IN PTR 220.189.client.vntx.net. + - 221.189.110.204.in-addr.arpa. IN PTR 221.189.client.vntx.net. + - 222.189.110.204.in-addr.arpa. IN PTR 222.189.client.vntx.net. + - 223.189.110.204.in-addr.arpa. IN PTR 223.189.client.vntx.net. + - 224.189.110.204.in-addr.arpa. IN PTR 224.189.client.vntx.net. + - 225.189.110.204.in-addr.arpa. IN PTR 225.189.client.vntx.net. + - 226.189.110.204.in-addr.arpa. IN PTR 226.189.client.vntx.net. + - 227.189.110.204.in-addr.arpa. IN PTR 227.189.client.vntx.net. + - 228.189.110.204.in-addr.arpa. IN PTR 228.189.client.vntx.net. + - 229.189.110.204.in-addr.arpa. IN PTR 229.189.client.vntx.net. + - 230.189.110.204.in-addr.arpa. IN PTR 230.189.client.vntx.net. + - 231.189.110.204.in-addr.arpa. IN PTR 231.189.client.vntx.net. + - 232.189.110.204.in-addr.arpa. IN PTR 232.189.client.vntx.net. + - 233.189.110.204.in-addr.arpa. IN PTR 233.189.client.vntx.net. + - 234.189.110.204.in-addr.arpa. IN PTR 234.189.client.vntx.net. + - 235.189.110.204.in-addr.arpa. IN PTR 235.189.client.vntx.net. + - 236.189.110.204.in-addr.arpa. IN PTR 236.189.client.vntx.net. + - 237.189.110.204.in-addr.arpa. IN PTR 237.189.client.vntx.net. + - 238.189.110.204.in-addr.arpa. IN PTR 238.189.client.vntx.net. + - 239.189.110.204.in-addr.arpa. IN PTR 239.189.client.vntx.net. + - 240.189.110.204.in-addr.arpa. IN PTR 240.189.client.vntx.net. + - 241.189.110.204.in-addr.arpa. IN PTR 241.189.client.vntx.net. + - 242.189.110.204.in-addr.arpa. IN PTR 242.189.client.vntx.net. + - 243.189.110.204.in-addr.arpa. IN PTR 243.189.client.vntx.net. + - 244.189.110.204.in-addr.arpa. IN PTR 244.189.client.vntx.net. + - 245.189.110.204.in-addr.arpa. IN PTR 245.189.client.vntx.net. + - 246.189.110.204.in-addr.arpa. IN PTR 246.189.client.vntx.net. + - 247.189.110.204.in-addr.arpa. IN PTR 247.189.client.vntx.net. + - 248.189.110.204.in-addr.arpa. IN PTR 248.189.client.vntx.net. + - 249.189.110.204.in-addr.arpa. IN PTR 249.189.client.vntx.net. + - 250.189.110.204.in-addr.arpa. IN PTR 250.189.client.vntx.net. + - 251.189.110.204.in-addr.arpa. IN PTR 251.189.client.vntx.net. + - 252.189.110.204.in-addr.arpa. IN PTR 252.189.client.vntx.net. + - 253.189.110.204.in-addr.arpa. IN PTR 253.189.client.vntx.net. + - 254.189.110.204.in-addr.arpa. IN PTR 254.189.client.vntx.net. + - 255.189.110.204.in-addr.arpa. IN PTR 255.189.client.vntx.net. + diff --git a/ansible/group_vars/bind9_servers/reverse_190.sync-conflict-20260129-151531-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/reverse_190.sync-conflict-20260129-151531-ZJZJYMM.yml new file mode 100644 index 0000000..5f5b811 --- /dev/null +++ b/ansible/group_vars/bind9_servers/reverse_190.sync-conflict-20260129-151531-ZJZJYMM.yml @@ -0,0 +1,266 @@ +--- +# 190.110.204.in-addr.arpa reverse DNS zone +# Mapping 204.110.190.0-255 -> *.190.client.vntx.net (excludes 119, 168) +reverse_190_zone: + name: 190.110.204.in-addr.arpa + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + other_name_servers: + - 0.190.110.204.in-addr.arpa. IN PTR 0.190.client.vntx.net. + - 1.190.110.204.in-addr.arpa. IN PTR 1.190.client.vntx.net. + - 2.190.110.204.in-addr.arpa. IN PTR 2.190.client.vntx.net. + - 3.190.110.204.in-addr.arpa. IN PTR 3.190.client.vntx.net. + - 4.190.110.204.in-addr.arpa. IN PTR 4.190.client.vntx.net. + - 5.190.110.204.in-addr.arpa. IN PTR 5.190.client.vntx.net. + - 6.190.110.204.in-addr.arpa. IN PTR 6.190.client.vntx.net. + - 7.190.110.204.in-addr.arpa. IN PTR 7.190.client.vntx.net. + - 8.190.110.204.in-addr.arpa. IN PTR 8.190.client.vntx.net. + - 9.190.110.204.in-addr.arpa. IN PTR 9.190.client.vntx.net. + - 10.190.110.204.in-addr.arpa. IN PTR 10.190.client.vntx.net. + - 11.190.110.204.in-addr.arpa. IN PTR 11.190.client.vntx.net. + - 12.190.110.204.in-addr.arpa. IN PTR 12.190.client.vntx.net. + - 13.190.110.204.in-addr.arpa. IN PTR 13.190.client.vntx.net. + - 14.190.110.204.in-addr.arpa. IN PTR 14.190.client.vntx.net. + - 15.190.110.204.in-addr.arpa. IN PTR 15.190.client.vntx.net. + - 16.190.110.204.in-addr.arpa. IN PTR 16.190.client.vntx.net. + - 17.190.110.204.in-addr.arpa. IN PTR 17.190.client.vntx.net. + - 18.190.110.204.in-addr.arpa. IN PTR 18.190.client.vntx.net. + - 19.190.110.204.in-addr.arpa. IN PTR 19.190.client.vntx.net. + - 20.190.110.204.in-addr.arpa. IN PTR 20.190.client.vntx.net. + - 21.190.110.204.in-addr.arpa. IN PTR 21.190.client.vntx.net. + - 22.190.110.204.in-addr.arpa. IN PTR 22.190.client.vntx.net. + - 23.190.110.204.in-addr.arpa. IN PTR 23.190.client.vntx.net. + - 24.190.110.204.in-addr.arpa. IN PTR 24.190.client.vntx.net. + - 25.190.110.204.in-addr.arpa. IN PTR 25.190.client.vntx.net. + - 26.190.110.204.in-addr.arpa. IN PTR 26.190.client.vntx.net. + - 27.190.110.204.in-addr.arpa. IN PTR 27.190.client.vntx.net. + - 28.190.110.204.in-addr.arpa. IN PTR 28.190.client.vntx.net. + - 29.190.110.204.in-addr.arpa. IN PTR 29.190.client.vntx.net. + - 30.190.110.204.in-addr.arpa. IN PTR 30.190.client.vntx.net. + - 31.190.110.204.in-addr.arpa. IN PTR 31.190.client.vntx.net. + - 32.190.110.204.in-addr.arpa. IN PTR 32.190.client.vntx.net. + - 33.190.110.204.in-addr.arpa. IN PTR 33.190.client.vntx.net. + - 34.190.110.204.in-addr.arpa. IN PTR 34.190.client.vntx.net. + - 35.190.110.204.in-addr.arpa. IN PTR 35.190.client.vntx.net. + - 36.190.110.204.in-addr.arpa. IN PTR 36.190.client.vntx.net. + - 37.190.110.204.in-addr.arpa. IN PTR 37.190.client.vntx.net. + - 38.190.110.204.in-addr.arpa. IN PTR 38.190.client.vntx.net. + - 39.190.110.204.in-addr.arpa. IN PTR 39.190.client.vntx.net. + - 40.190.110.204.in-addr.arpa. IN PTR 40.190.client.vntx.net. + - 41.190.110.204.in-addr.arpa. IN PTR 41.190.client.vntx.net. + - 42.190.110.204.in-addr.arpa. IN PTR 42.190.client.vntx.net. + - 43.190.110.204.in-addr.arpa. IN PTR 43.190.client.vntx.net. + - 44.190.110.204.in-addr.arpa. IN PTR 44.190.client.vntx.net. + - 45.190.110.204.in-addr.arpa. IN PTR 45.190.client.vntx.net. + - 46.190.110.204.in-addr.arpa. IN PTR 46.190.client.vntx.net. + - 47.190.110.204.in-addr.arpa. IN PTR 47.190.client.vntx.net. + - 48.190.110.204.in-addr.arpa. IN PTR 48.190.client.vntx.net. + - 49.190.110.204.in-addr.arpa. IN PTR 49.190.client.vntx.net. + - 50.190.110.204.in-addr.arpa. IN PTR 50.190.client.vntx.net. + - 51.190.110.204.in-addr.arpa. IN PTR 51.190.client.vntx.net. + - 52.190.110.204.in-addr.arpa. IN PTR 52.190.client.vntx.net. + - 53.190.110.204.in-addr.arpa. IN PTR 53.190.client.vntx.net. + - 54.190.110.204.in-addr.arpa. IN PTR 54.190.client.vntx.net. + - 55.190.110.204.in-addr.arpa. IN PTR 55.190.client.vntx.net. + - 56.190.110.204.in-addr.arpa. IN PTR 56.190.client.vntx.net. + - 57.190.110.204.in-addr.arpa. IN PTR 57.190.client.vntx.net. + - 58.190.110.204.in-addr.arpa. IN PTR 58.190.client.vntx.net. + - 59.190.110.204.in-addr.arpa. IN PTR 59.190.client.vntx.net. + - 60.190.110.204.in-addr.arpa. IN PTR 60.190.client.vntx.net. + - 61.190.110.204.in-addr.arpa. IN PTR 61.190.client.vntx.net. + - 62.190.110.204.in-addr.arpa. IN PTR 62.190.client.vntx.net. + - 63.190.110.204.in-addr.arpa. IN PTR 63.190.client.vntx.net. + - 64.190.110.204.in-addr.arpa. IN PTR 64.190.client.vntx.net. + - 65.190.110.204.in-addr.arpa. IN PTR 65.190.client.vntx.net. + - 66.190.110.204.in-addr.arpa. IN PTR 66.190.client.vntx.net. + - 67.190.110.204.in-addr.arpa. IN PTR 67.190.client.vntx.net. + - 68.190.110.204.in-addr.arpa. IN PTR 68.190.client.vntx.net. + - 69.190.110.204.in-addr.arpa. IN PTR 69.190.client.vntx.net. + - 70.190.110.204.in-addr.arpa. IN PTR 70.190.client.vntx.net. + - 71.190.110.204.in-addr.arpa. IN PTR 71.190.client.vntx.net. + - 72.190.110.204.in-addr.arpa. IN PTR 72.190.client.vntx.net. + - 73.190.110.204.in-addr.arpa. IN PTR 73.190.client.vntx.net. + - 74.190.110.204.in-addr.arpa. IN PTR 74.190.client.vntx.net. + - 75.190.110.204.in-addr.arpa. IN PTR 75.190.client.vntx.net. + - 76.190.110.204.in-addr.arpa. IN PTR 76.190.client.vntx.net. + - 77.190.110.204.in-addr.arpa. IN PTR 77.190.client.vntx.net. + - 78.190.110.204.in-addr.arpa. IN PTR 78.190.client.vntx.net. + - 79.190.110.204.in-addr.arpa. IN PTR 79.190.client.vntx.net. + - 80.190.110.204.in-addr.arpa. IN PTR 80.190.client.vntx.net. + - 81.190.110.204.in-addr.arpa. IN PTR 81.190.client.vntx.net. + - 82.190.110.204.in-addr.arpa. IN PTR 82.190.client.vntx.net. + - 83.190.110.204.in-addr.arpa. IN PTR 83.190.client.vntx.net. + - 84.190.110.204.in-addr.arpa. IN PTR 84.190.client.vntx.net. + - 85.190.110.204.in-addr.arpa. IN PTR 85.190.client.vntx.net. + - 86.190.110.204.in-addr.arpa. IN PTR 86.190.client.vntx.net. + - 87.190.110.204.in-addr.arpa. IN PTR 87.190.client.vntx.net. + - 88.190.110.204.in-addr.arpa. IN PTR 88.190.client.vntx.net. + - 89.190.110.204.in-addr.arpa. IN PTR 89.190.client.vntx.net. + - 90.190.110.204.in-addr.arpa. IN PTR 90.190.client.vntx.net. + - 91.190.110.204.in-addr.arpa. IN PTR 91.190.client.vntx.net. + - 92.190.110.204.in-addr.arpa. IN PTR 92.190.client.vntx.net. + - 93.190.110.204.in-addr.arpa. IN PTR 93.190.client.vntx.net. + - 94.190.110.204.in-addr.arpa. IN PTR 94.190.client.vntx.net. + - 95.190.110.204.in-addr.arpa. IN PTR 95.190.client.vntx.net. + - 96.190.110.204.in-addr.arpa. IN PTR 96.190.client.vntx.net. + - 97.190.110.204.in-addr.arpa. IN PTR 97.190.client.vntx.net. + - 98.190.110.204.in-addr.arpa. IN PTR 98.190.client.vntx.net. + - 99.190.110.204.in-addr.arpa. IN PTR 99.190.client.vntx.net. + - 100.190.110.204.in-addr.arpa. IN PTR 100.190.client.vntx.net. + - 101.190.110.204.in-addr.arpa. IN PTR 101.190.client.vntx.net. + - 102.190.110.204.in-addr.arpa. IN PTR 102.190.client.vntx.net. + - 103.190.110.204.in-addr.arpa. IN PTR 103.190.client.vntx.net. + - 104.190.110.204.in-addr.arpa. IN PTR 104.190.client.vntx.net. + - 105.190.110.204.in-addr.arpa. IN PTR 105.190.client.vntx.net. + - 106.190.110.204.in-addr.arpa. IN PTR 106.190.client.vntx.net. + - 107.190.110.204.in-addr.arpa. IN PTR 107.190.client.vntx.net. + - 108.190.110.204.in-addr.arpa. IN PTR 108.190.client.vntx.net. + - 109.190.110.204.in-addr.arpa. IN PTR 109.190.client.vntx.net. + - 110.190.110.204.in-addr.arpa. IN PTR 110.190.client.vntx.net. + - 111.190.110.204.in-addr.arpa. IN PTR 111.190.client.vntx.net. + - 112.190.110.204.in-addr.arpa. IN PTR 112.190.client.vntx.net. + - 113.190.110.204.in-addr.arpa. IN PTR 113.190.client.vntx.net. + - 114.190.110.204.in-addr.arpa. IN PTR 114.190.client.vntx.net. + - 115.190.110.204.in-addr.arpa. IN PTR 115.190.client.vntx.net. + - 116.190.110.204.in-addr.arpa. IN PTR 116.190.client.vntx.net. + - 117.190.110.204.in-addr.arpa. IN PTR 117.190.client.vntx.net. + - 118.190.110.204.in-addr.arpa. IN PTR 118.190.client.vntx.net. + - 120.190.110.204.in-addr.arpa. IN PTR 120.190.client.vntx.net. + - 121.190.110.204.in-addr.arpa. IN PTR 121.190.client.vntx.net. + - 122.190.110.204.in-addr.arpa. IN PTR 122.190.client.vntx.net. + - 123.190.110.204.in-addr.arpa. IN PTR 123.190.client.vntx.net. + - 124.190.110.204.in-addr.arpa. IN PTR 124.190.client.vntx.net. + - 125.190.110.204.in-addr.arpa. IN PTR 125.190.client.vntx.net. + - 126.190.110.204.in-addr.arpa. IN PTR 126.190.client.vntx.net. + - 127.190.110.204.in-addr.arpa. IN PTR 127.190.client.vntx.net. + - 128.190.110.204.in-addr.arpa. IN PTR 128.190.client.vntx.net. + - 129.190.110.204.in-addr.arpa. IN PTR 129.190.client.vntx.net. + - 130.190.110.204.in-addr.arpa. IN PTR 130.190.client.vntx.net. + - 131.190.110.204.in-addr.arpa. IN PTR 131.190.client.vntx.net. + - 132.190.110.204.in-addr.arpa. IN PTR 132.190.client.vntx.net. + - 133.190.110.204.in-addr.arpa. IN PTR 133.190.client.vntx.net. + - 134.190.110.204.in-addr.arpa. IN PTR 134.190.client.vntx.net. + - 135.190.110.204.in-addr.arpa. IN PTR 135.190.client.vntx.net. + - 136.190.110.204.in-addr.arpa. IN PTR 136.190.client.vntx.net. + - 137.190.110.204.in-addr.arpa. IN PTR 137.190.client.vntx.net. + - 138.190.110.204.in-addr.arpa. IN PTR 138.190.client.vntx.net. + - 139.190.110.204.in-addr.arpa. IN PTR 139.190.client.vntx.net. + - 140.190.110.204.in-addr.arpa. IN PTR 140.190.client.vntx.net. + - 141.190.110.204.in-addr.arpa. IN PTR 141.190.client.vntx.net. + - 142.190.110.204.in-addr.arpa. IN PTR 142.190.client.vntx.net. + - 143.190.110.204.in-addr.arpa. IN PTR 143.190.client.vntx.net. + - 144.190.110.204.in-addr.arpa. IN PTR 144.190.client.vntx.net. + - 145.190.110.204.in-addr.arpa. IN PTR 145.190.client.vntx.net. + - 146.190.110.204.in-addr.arpa. IN PTR 146.190.client.vntx.net. + - 147.190.110.204.in-addr.arpa. IN PTR 147.190.client.vntx.net. + - 148.190.110.204.in-addr.arpa. IN PTR 148.190.client.vntx.net. + - 149.190.110.204.in-addr.arpa. IN PTR 149.190.client.vntx.net. + - 150.190.110.204.in-addr.arpa. IN PTR 150.190.client.vntx.net. + - 151.190.110.204.in-addr.arpa. IN PTR 151.190.client.vntx.net. + - 152.190.110.204.in-addr.arpa. IN PTR 152.190.client.vntx.net. + - 153.190.110.204.in-addr.arpa. IN PTR 153.190.client.vntx.net. + - 154.190.110.204.in-addr.arpa. IN PTR 154.190.client.vntx.net. + - 155.190.110.204.in-addr.arpa. IN PTR 155.190.client.vntx.net. + - 156.190.110.204.in-addr.arpa. IN PTR 156.190.client.vntx.net. + - 157.190.110.204.in-addr.arpa. IN PTR 157.190.client.vntx.net. + - 158.190.110.204.in-addr.arpa. IN PTR 158.190.client.vntx.net. + - 159.190.110.204.in-addr.arpa. IN PTR 159.190.client.vntx.net. + - 160.190.110.204.in-addr.arpa. IN PTR 160.190.client.vntx.net. + - 161.190.110.204.in-addr.arpa. IN PTR 161.190.client.vntx.net. + - 162.190.110.204.in-addr.arpa. IN PTR 162.190.client.vntx.net. + - 163.190.110.204.in-addr.arpa. IN PTR 163.190.client.vntx.net. + - 164.190.110.204.in-addr.arpa. IN PTR 164.190.client.vntx.net. + - 165.190.110.204.in-addr.arpa. IN PTR 165.190.client.vntx.net. + - 166.190.110.204.in-addr.arpa. IN PTR 166.190.client.vntx.net. + - 167.190.110.204.in-addr.arpa. IN PTR 167.190.client.vntx.net. + - 169.190.110.204.in-addr.arpa. IN PTR 169.190.client.vntx.net. + - 170.190.110.204.in-addr.arpa. IN PTR 170.190.client.vntx.net. + - 171.190.110.204.in-addr.arpa. IN PTR 171.190.client.vntx.net. + - 172.190.110.204.in-addr.arpa. IN PTR 172.190.client.vntx.net. + - 173.190.110.204.in-addr.arpa. IN PTR 173.190.client.vntx.net. + - 174.190.110.204.in-addr.arpa. IN PTR 174.190.client.vntx.net. + - 175.190.110.204.in-addr.arpa. IN PTR 175.190.client.vntx.net. + - 176.190.110.204.in-addr.arpa. IN PTR 176.190.client.vntx.net. + - 177.190.110.204.in-addr.arpa. IN PTR 177.190.client.vntx.net. + - 178.190.110.204.in-addr.arpa. IN PTR 178.190.client.vntx.net. + - 179.190.110.204.in-addr.arpa. IN PTR 179.190.client.vntx.net. + - 180.190.110.204.in-addr.arpa. IN PTR 180.190.client.vntx.net. + - 181.190.110.204.in-addr.arpa. IN PTR 181.190.client.vntx.net. + - 182.190.110.204.in-addr.arpa. IN PTR 182.190.client.vntx.net. + - 183.190.110.204.in-addr.arpa. IN PTR 183.190.client.vntx.net. + - 184.190.110.204.in-addr.arpa. IN PTR 184.190.client.vntx.net. + - 185.190.110.204.in-addr.arpa. IN PTR 185.190.client.vntx.net. + - 186.190.110.204.in-addr.arpa. IN PTR 186.190.client.vntx.net. + - 187.190.110.204.in-addr.arpa. IN PTR 187.190.client.vntx.net. + - 188.190.110.204.in-addr.arpa. IN PTR 188.190.client.vntx.net. + - 189.190.110.204.in-addr.arpa. IN PTR 189.190.client.vntx.net. + - 190.190.110.204.in-addr.arpa. IN PTR 190.190.client.vntx.net. + - 191.190.110.204.in-addr.arpa. IN PTR 191.190.client.vntx.net. + - 192.190.110.204.in-addr.arpa. IN PTR 192.190.client.vntx.net. + - 193.190.110.204.in-addr.arpa. IN PTR 193.190.client.vntx.net. + - 194.190.110.204.in-addr.arpa. IN PTR 194.190.client.vntx.net. + - 195.190.110.204.in-addr.arpa. IN PTR 195.190.client.vntx.net. + - 196.190.110.204.in-addr.arpa. IN PTR 196.190.client.vntx.net. + - 197.190.110.204.in-addr.arpa. IN PTR 197.190.client.vntx.net. + - 198.190.110.204.in-addr.arpa. IN PTR 198.190.client.vntx.net. + - 199.190.110.204.in-addr.arpa. IN PTR 199.190.client.vntx.net. + - 200.190.110.204.in-addr.arpa. IN PTR 200.190.client.vntx.net. + - 201.190.110.204.in-addr.arpa. IN PTR 201.190.client.vntx.net. + - 202.190.110.204.in-addr.arpa. IN PTR 202.190.client.vntx.net. + - 203.190.110.204.in-addr.arpa. IN PTR 203.190.client.vntx.net. + - 204.190.110.204.in-addr.arpa. IN PTR 204.190.client.vntx.net. + - 205.190.110.204.in-addr.arpa. IN PTR 205.190.client.vntx.net. + - 206.190.110.204.in-addr.arpa. IN PTR 206.190.client.vntx.net. + - 207.190.110.204.in-addr.arpa. IN PTR 207.190.client.vntx.net. + - 208.190.110.204.in-addr.arpa. IN PTR 208.190.client.vntx.net. + - 209.190.110.204.in-addr.arpa. IN PTR 209.190.client.vntx.net. + - 210.190.110.204.in-addr.arpa. IN PTR 210.190.client.vntx.net. + - 211.190.110.204.in-addr.arpa. IN PTR 211.190.client.vntx.net. + - 212.190.110.204.in-addr.arpa. IN PTR 212.190.client.vntx.net. + - 213.190.110.204.in-addr.arpa. IN PTR 213.190.client.vntx.net. + - 214.190.110.204.in-addr.arpa. IN PTR 214.190.client.vntx.net. + - 215.190.110.204.in-addr.arpa. IN PTR 215.190.client.vntx.net. + - 216.190.110.204.in-addr.arpa. IN PTR 216.190.client.vntx.net. + - 217.190.110.204.in-addr.arpa. IN PTR 217.190.client.vntx.net. + - 218.190.110.204.in-addr.arpa. IN PTR 218.190.client.vntx.net. + - 219.190.110.204.in-addr.arpa. IN PTR 219.190.client.vntx.net. + - 220.190.110.204.in-addr.arpa. IN PTR 220.190.client.vntx.net. + - 221.190.110.204.in-addr.arpa. IN PTR 221.190.client.vntx.net. + - 222.190.110.204.in-addr.arpa. IN PTR 222.190.client.vntx.net. + - 223.190.110.204.in-addr.arpa. IN PTR 223.190.client.vntx.net. + - 224.190.110.204.in-addr.arpa. IN PTR 224.190.client.vntx.net. + - 225.190.110.204.in-addr.arpa. IN PTR 225.190.client.vntx.net. + - 226.190.110.204.in-addr.arpa. IN PTR 226.190.client.vntx.net. + - 227.190.110.204.in-addr.arpa. IN PTR 227.190.client.vntx.net. + - 228.190.110.204.in-addr.arpa. IN PTR 228.190.client.vntx.net. + - 229.190.110.204.in-addr.arpa. IN PTR 229.190.client.vntx.net. + - 230.190.110.204.in-addr.arpa. IN PTR 230.190.client.vntx.net. + - 231.190.110.204.in-addr.arpa. IN PTR 231.190.client.vntx.net. + - 232.190.110.204.in-addr.arpa. IN PTR 232.190.client.vntx.net. + - 233.190.110.204.in-addr.arpa. IN PTR 233.190.client.vntx.net. + - 234.190.110.204.in-addr.arpa. IN PTR 234.190.client.vntx.net. + - 235.190.110.204.in-addr.arpa. IN PTR 235.190.client.vntx.net. + - 236.190.110.204.in-addr.arpa. IN PTR 236.190.client.vntx.net. + - 237.190.110.204.in-addr.arpa. IN PTR 237.190.client.vntx.net. + - 238.190.110.204.in-addr.arpa. IN PTR 238.190.client.vntx.net. + - 239.190.110.204.in-addr.arpa. IN PTR 239.190.client.vntx.net. + - 240.190.110.204.in-addr.arpa. IN PTR 240.190.client.vntx.net. + - 241.190.110.204.in-addr.arpa. IN PTR 241.190.client.vntx.net. + - 242.190.110.204.in-addr.arpa. IN PTR 242.190.client.vntx.net. + - 243.190.110.204.in-addr.arpa. IN PTR 243.190.client.vntx.net. + - 244.190.110.204.in-addr.arpa. IN PTR 244.190.client.vntx.net. + - 245.190.110.204.in-addr.arpa. IN PTR 245.190.client.vntx.net. + - 246.190.110.204.in-addr.arpa. IN PTR 246.190.client.vntx.net. + - 247.190.110.204.in-addr.arpa. IN PTR 247.190.client.vntx.net. + - 248.190.110.204.in-addr.arpa. IN PTR 248.190.client.vntx.net. + - 249.190.110.204.in-addr.arpa. IN PTR 249.190.client.vntx.net. + - 250.190.110.204.in-addr.arpa. IN PTR 250.190.client.vntx.net. + - 251.190.110.204.in-addr.arpa. IN PTR 251.190.client.vntx.net. + - 252.190.110.204.in-addr.arpa. IN PTR 252.190.client.vntx.net. + - 253.190.110.204.in-addr.arpa. IN PTR 253.190.client.vntx.net. + - 254.190.110.204.in-addr.arpa. IN PTR 254.190.client.vntx.net. + - 255.190.110.204.in-addr.arpa. IN PTR 255.190.client.vntx.net. + diff --git a/ansible/group_vars/bind9_servers/reverse_191.sync-conflict-20260129-142816-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/reverse_191.sync-conflict-20260129-142816-ZJZJYMM.yml new file mode 100644 index 0000000..2c69efc --- /dev/null +++ b/ansible/group_vars/bind9_servers/reverse_191.sync-conflict-20260129-142816-ZJZJYMM.yml @@ -0,0 +1,269 @@ +--- +# 191.110.204.in-addr.arpa reverse DNS zone +# Mapping 204.110.191.0-255 -> *.191.client.vntx.net +# Exception: 204.110.191.5 -> mail.mcintire.me +reverse_191_zone: + name: 191.110.204.in-addr.arpa + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + other_name_servers: + - 0.191.110.204.in-addr.arpa. IN PTR 0.191.client.vntx.net. + - 1.191.110.204.in-addr.arpa. IN PTR 1.191.client.vntx.net. + - 2.191.110.204.in-addr.arpa. IN PTR 2.191.client.vntx.net. + - 3.191.110.204.in-addr.arpa. IN PTR 3.191.client.vntx.net. + - 4.191.110.204.in-addr.arpa. IN PTR 4.191.client.vntx.net. + - 5.191.110.204.in-addr.arpa. IN PTR mail.mcintire.me. + - 6.191.110.204.in-addr.arpa. IN PTR 6.191.client.vntx.net. + - 7.191.110.204.in-addr.arpa. IN PTR 7.191.client.vntx.net. + - 8.191.110.204.in-addr.arpa. IN PTR 8.191.client.vntx.net. + - 9.191.110.204.in-addr.arpa. IN PTR 9.191.client.vntx.net. + - 10.191.110.204.in-addr.arpa. IN PTR 10.191.client.vntx.net. + - 11.191.110.204.in-addr.arpa. IN PTR 11.191.client.vntx.net. + - 12.191.110.204.in-addr.arpa. IN PTR 12.191.client.vntx.net. + - 13.191.110.204.in-addr.arpa. IN PTR 13.191.client.vntx.net. + - 14.191.110.204.in-addr.arpa. IN PTR 14.191.client.vntx.net. + - 15.191.110.204.in-addr.arpa. IN PTR 15.191.client.vntx.net. + - 16.191.110.204.in-addr.arpa. IN PTR 16.191.client.vntx.net. + - 17.191.110.204.in-addr.arpa. IN PTR 17.191.client.vntx.net. + - 18.191.110.204.in-addr.arpa. IN PTR 18.191.client.vntx.net. + - 19.191.110.204.in-addr.arpa. IN PTR 19.191.client.vntx.net. + - 20.191.110.204.in-addr.arpa. IN PTR 20.191.client.vntx.net. + - 21.191.110.204.in-addr.arpa. IN PTR 21.191.client.vntx.net. + - 22.191.110.204.in-addr.arpa. IN PTR 22.191.client.vntx.net. + - 23.191.110.204.in-addr.arpa. IN PTR 23.191.client.vntx.net. + - 24.191.110.204.in-addr.arpa. IN PTR 24.191.client.vntx.net. + - 25.191.110.204.in-addr.arpa. IN PTR 25.191.client.vntx.net. + - 26.191.110.204.in-addr.arpa. IN PTR 26.191.client.vntx.net. + - 27.191.110.204.in-addr.arpa. IN PTR 27.191.client.vntx.net. + - 28.191.110.204.in-addr.arpa. IN PTR 28.191.client.vntx.net. + - 29.191.110.204.in-addr.arpa. IN PTR 29.191.client.vntx.net. + - 30.191.110.204.in-addr.arpa. IN PTR 30.191.client.vntx.net. + - 31.191.110.204.in-addr.arpa. IN PTR 31.191.client.vntx.net. + - 32.191.110.204.in-addr.arpa. IN PTR 32.191.client.vntx.net. + - 33.191.110.204.in-addr.arpa. IN PTR 33.191.client.vntx.net. + - 34.191.110.204.in-addr.arpa. IN PTR 34.191.client.vntx.net. + - 35.191.110.204.in-addr.arpa. IN PTR 35.191.client.vntx.net. + - 36.191.110.204.in-addr.arpa. IN PTR 36.191.client.vntx.net. + - 37.191.110.204.in-addr.arpa. IN PTR 37.191.client.vntx.net. + - 38.191.110.204.in-addr.arpa. IN PTR 38.191.client.vntx.net. + - 39.191.110.204.in-addr.arpa. IN PTR 39.191.client.vntx.net. + - 40.191.110.204.in-addr.arpa. IN PTR 40.191.client.vntx.net. + - 41.191.110.204.in-addr.arpa. IN PTR 41.191.client.vntx.net. + - 42.191.110.204.in-addr.arpa. IN PTR 42.191.client.vntx.net. + - 43.191.110.204.in-addr.arpa. IN PTR 43.191.client.vntx.net. + - 44.191.110.204.in-addr.arpa. IN PTR 44.191.client.vntx.net. + - 45.191.110.204.in-addr.arpa. IN PTR 45.191.client.vntx.net. + - 46.191.110.204.in-addr.arpa. IN PTR 46.191.client.vntx.net. + - 47.191.110.204.in-addr.arpa. IN PTR 47.191.client.vntx.net. + - 48.191.110.204.in-addr.arpa. IN PTR 48.191.client.vntx.net. + - 49.191.110.204.in-addr.arpa. IN PTR 49.191.client.vntx.net. + - 50.191.110.204.in-addr.arpa. IN PTR 50.191.client.vntx.net. + - 51.191.110.204.in-addr.arpa. IN PTR 51.191.client.vntx.net. + - 52.191.110.204.in-addr.arpa. IN PTR 52.191.client.vntx.net. + - 53.191.110.204.in-addr.arpa. IN PTR 53.191.client.vntx.net. + - 54.191.110.204.in-addr.arpa. IN PTR 54.191.client.vntx.net. + - 55.191.110.204.in-addr.arpa. IN PTR 55.191.client.vntx.net. + - 56.191.110.204.in-addr.arpa. IN PTR 56.191.client.vntx.net. + - 57.191.110.204.in-addr.arpa. IN PTR 57.191.client.vntx.net. + - 58.191.110.204.in-addr.arpa. IN PTR 58.191.client.vntx.net. + - 59.191.110.204.in-addr.arpa. IN PTR 59.191.client.vntx.net. + - 60.191.110.204.in-addr.arpa. IN PTR 60.191.client.vntx.net. + - 61.191.110.204.in-addr.arpa. IN PTR 61.191.client.vntx.net. + - 62.191.110.204.in-addr.arpa. IN PTR 62.191.client.vntx.net. + - 63.191.110.204.in-addr.arpa. IN PTR 63.191.client.vntx.net. + - 64.191.110.204.in-addr.arpa. IN PTR 64.191.client.vntx.net. + - 65.191.110.204.in-addr.arpa. IN PTR 65.191.client.vntx.net. + - 66.191.110.204.in-addr.arpa. IN PTR 66.191.client.vntx.net. + - 67.191.110.204.in-addr.arpa. IN PTR 67.191.client.vntx.net. + - 68.191.110.204.in-addr.arpa. IN PTR 68.191.client.vntx.net. + - 69.191.110.204.in-addr.arpa. IN PTR 69.191.client.vntx.net. + - 70.191.110.204.in-addr.arpa. IN PTR 70.191.client.vntx.net. + - 71.191.110.204.in-addr.arpa. IN PTR 71.191.client.vntx.net. + - 72.191.110.204.in-addr.arpa. IN PTR 72.191.client.vntx.net. + - 73.191.110.204.in-addr.arpa. IN PTR 73.191.client.vntx.net. + - 74.191.110.204.in-addr.arpa. IN PTR 74.191.client.vntx.net. + - 75.191.110.204.in-addr.arpa. IN PTR 75.191.client.vntx.net. + - 76.191.110.204.in-addr.arpa. IN PTR 76.191.client.vntx.net. + - 77.191.110.204.in-addr.arpa. IN PTR 77.191.client.vntx.net. + - 78.191.110.204.in-addr.arpa. IN PTR 78.191.client.vntx.net. + - 79.191.110.204.in-addr.arpa. IN PTR 79.191.client.vntx.net. + - 80.191.110.204.in-addr.arpa. IN PTR 80.191.client.vntx.net. + - 81.191.110.204.in-addr.arpa. IN PTR 81.191.client.vntx.net. + - 82.191.110.204.in-addr.arpa. IN PTR 82.191.client.vntx.net. + - 83.191.110.204.in-addr.arpa. IN PTR 83.191.client.vntx.net. + - 84.191.110.204.in-addr.arpa. IN PTR 84.191.client.vntx.net. + - 85.191.110.204.in-addr.arpa. IN PTR 85.191.client.vntx.net. + - 86.191.110.204.in-addr.arpa. IN PTR 86.191.client.vntx.net. + - 87.191.110.204.in-addr.arpa. IN PTR 87.191.client.vntx.net. + - 88.191.110.204.in-addr.arpa. IN PTR 88.191.client.vntx.net. + - 89.191.110.204.in-addr.arpa. IN PTR 89.191.client.vntx.net. + - 90.191.110.204.in-addr.arpa. IN PTR 90.191.client.vntx.net. + - 91.191.110.204.in-addr.arpa. IN PTR 91.191.client.vntx.net. + - 92.191.110.204.in-addr.arpa. IN PTR 92.191.client.vntx.net. + - 93.191.110.204.in-addr.arpa. IN PTR 93.191.client.vntx.net. + - 94.191.110.204.in-addr.arpa. IN PTR 94.191.client.vntx.net. + - 95.191.110.204.in-addr.arpa. IN PTR 95.191.client.vntx.net. + - 96.191.110.204.in-addr.arpa. IN PTR 96.191.client.vntx.net. + - 97.191.110.204.in-addr.arpa. IN PTR 97.191.client.vntx.net. + - 98.191.110.204.in-addr.arpa. IN PTR 98.191.client.vntx.net. + - 99.191.110.204.in-addr.arpa. IN PTR 99.191.client.vntx.net. + - 100.191.110.204.in-addr.arpa. IN PTR 100.191.client.vntx.net. + - 101.191.110.204.in-addr.arpa. IN PTR 101.191.client.vntx.net. + - 102.191.110.204.in-addr.arpa. IN PTR 102.191.client.vntx.net. + - 103.191.110.204.in-addr.arpa. IN PTR 103.191.client.vntx.net. + - 104.191.110.204.in-addr.arpa. IN PTR 104.191.client.vntx.net. + - 105.191.110.204.in-addr.arpa. IN PTR 105.191.client.vntx.net. + - 106.191.110.204.in-addr.arpa. IN PTR 106.191.client.vntx.net. + - 107.191.110.204.in-addr.arpa. IN PTR 107.191.client.vntx.net. + - 108.191.110.204.in-addr.arpa. IN PTR 108.191.client.vntx.net. + - 109.191.110.204.in-addr.arpa. IN PTR 109.191.client.vntx.net. + - 110.191.110.204.in-addr.arpa. IN PTR 110.191.client.vntx.net. + - 111.191.110.204.in-addr.arpa. IN PTR 111.191.client.vntx.net. + - 112.191.110.204.in-addr.arpa. IN PTR 112.191.client.vntx.net. + - 113.191.110.204.in-addr.arpa. IN PTR 113.191.client.vntx.net. + - 114.191.110.204.in-addr.arpa. IN PTR 114.191.client.vntx.net. + - 115.191.110.204.in-addr.arpa. IN PTR 115.191.client.vntx.net. + - 116.191.110.204.in-addr.arpa. IN PTR 116.191.client.vntx.net. + - 117.191.110.204.in-addr.arpa. IN PTR 117.191.client.vntx.net. + - 118.191.110.204.in-addr.arpa. IN PTR 118.191.client.vntx.net. + - 119.191.110.204.in-addr.arpa. IN PTR 119.191.client.vntx.net. + - 120.191.110.204.in-addr.arpa. IN PTR 120.191.client.vntx.net. + - 121.191.110.204.in-addr.arpa. IN PTR 121.191.client.vntx.net. + - 122.191.110.204.in-addr.arpa. IN PTR 122.191.client.vntx.net. + - 123.191.110.204.in-addr.arpa. IN PTR 123.191.client.vntx.net. + - 124.191.110.204.in-addr.arpa. IN PTR 124.191.client.vntx.net. + - 125.191.110.204.in-addr.arpa. IN PTR 125.191.client.vntx.net. + - 126.191.110.204.in-addr.arpa. IN PTR 126.191.client.vntx.net. + - 127.191.110.204.in-addr.arpa. IN PTR 127.191.client.vntx.net. + - 128.191.110.204.in-addr.arpa. IN PTR 128.191.client.vntx.net. + - 129.191.110.204.in-addr.arpa. IN PTR 129.191.client.vntx.net. + - 130.191.110.204.in-addr.arpa. IN PTR 130.191.client.vntx.net. + - 131.191.110.204.in-addr.arpa. IN PTR 131.191.client.vntx.net. + - 132.191.110.204.in-addr.arpa. IN PTR 132.191.client.vntx.net. + - 133.191.110.204.in-addr.arpa. IN PTR 133.191.client.vntx.net. + - 134.191.110.204.in-addr.arpa. IN PTR 134.191.client.vntx.net. + - 135.191.110.204.in-addr.arpa. IN PTR 135.191.client.vntx.net. + - 136.191.110.204.in-addr.arpa. IN PTR 136.191.client.vntx.net. + - 137.191.110.204.in-addr.arpa. IN PTR 137.191.client.vntx.net. + - 138.191.110.204.in-addr.arpa. IN PTR 138.191.client.vntx.net. + - 139.191.110.204.in-addr.arpa. IN PTR 139.191.client.vntx.net. + - 140.191.110.204.in-addr.arpa. IN PTR 140.191.client.vntx.net. + - 141.191.110.204.in-addr.arpa. IN PTR 141.191.client.vntx.net. + - 142.191.110.204.in-addr.arpa. IN PTR 142.191.client.vntx.net. + - 143.191.110.204.in-addr.arpa. IN PTR 143.191.client.vntx.net. + - 144.191.110.204.in-addr.arpa. IN PTR 144.191.client.vntx.net. + - 145.191.110.204.in-addr.arpa. IN PTR 145.191.client.vntx.net. + - 146.191.110.204.in-addr.arpa. IN PTR 146.191.client.vntx.net. + - 147.191.110.204.in-addr.arpa. IN PTR 147.191.client.vntx.net. + - 148.191.110.204.in-addr.arpa. IN PTR 148.191.client.vntx.net. + - 149.191.110.204.in-addr.arpa. IN PTR 149.191.client.vntx.net. + - 150.191.110.204.in-addr.arpa. IN PTR 150.191.client.vntx.net. + - 151.191.110.204.in-addr.arpa. IN PTR 151.191.client.vntx.net. + - 152.191.110.204.in-addr.arpa. IN PTR 152.191.client.vntx.net. + - 153.191.110.204.in-addr.arpa. IN PTR 153.191.client.vntx.net. + - 154.191.110.204.in-addr.arpa. IN PTR 154.191.client.vntx.net. + - 155.191.110.204.in-addr.arpa. IN PTR 155.191.client.vntx.net. + - 156.191.110.204.in-addr.arpa. IN PTR 156.191.client.vntx.net. + - 157.191.110.204.in-addr.arpa. IN PTR 157.191.client.vntx.net. + - 158.191.110.204.in-addr.arpa. IN PTR 158.191.client.vntx.net. + - 159.191.110.204.in-addr.arpa. IN PTR 159.191.client.vntx.net. + - 160.191.110.204.in-addr.arpa. IN PTR 160.191.client.vntx.net. + - 161.191.110.204.in-addr.arpa. IN PTR 161.191.client.vntx.net. + - 162.191.110.204.in-addr.arpa. IN PTR 162.191.client.vntx.net. + - 163.191.110.204.in-addr.arpa. IN PTR 163.191.client.vntx.net. + - 164.191.110.204.in-addr.arpa. IN PTR 164.191.client.vntx.net. + - 165.191.110.204.in-addr.arpa. IN PTR 165.191.client.vntx.net. + - 166.191.110.204.in-addr.arpa. IN PTR 166.191.client.vntx.net. + - 167.191.110.204.in-addr.arpa. IN PTR 167.191.client.vntx.net. + - 168.191.110.204.in-addr.arpa. IN PTR 168.191.client.vntx.net. + - 169.191.110.204.in-addr.arpa. IN PTR 169.191.client.vntx.net. + - 170.191.110.204.in-addr.arpa. IN PTR 170.191.client.vntx.net. + - 171.191.110.204.in-addr.arpa. IN PTR 171.191.client.vntx.net. + - 172.191.110.204.in-addr.arpa. IN PTR 172.191.client.vntx.net. + - 173.191.110.204.in-addr.arpa. IN PTR 173.191.client.vntx.net. + - 174.191.110.204.in-addr.arpa. IN PTR 174.191.client.vntx.net. + - 175.191.110.204.in-addr.arpa. IN PTR 175.191.client.vntx.net. + - 176.191.110.204.in-addr.arpa. IN PTR 176.191.client.vntx.net. + - 177.191.110.204.in-addr.arpa. IN PTR 177.191.client.vntx.net. + - 178.191.110.204.in-addr.arpa. IN PTR 178.191.client.vntx.net. + - 179.191.110.204.in-addr.arpa. IN PTR 179.191.client.vntx.net. + - 180.191.110.204.in-addr.arpa. IN PTR 180.191.client.vntx.net. + - 181.191.110.204.in-addr.arpa. IN PTR 181.191.client.vntx.net. + - 182.191.110.204.in-addr.arpa. IN PTR 182.191.client.vntx.net. + - 183.191.110.204.in-addr.arpa. IN PTR 183.191.client.vntx.net. + - 184.191.110.204.in-addr.arpa. IN PTR 184.191.client.vntx.net. + - 185.191.110.204.in-addr.arpa. IN PTR 185.191.client.vntx.net. + - 186.191.110.204.in-addr.arpa. IN PTR 186.191.client.vntx.net. + - 187.191.110.204.in-addr.arpa. IN PTR 187.191.client.vntx.net. + - 188.191.110.204.in-addr.arpa. IN PTR 188.191.client.vntx.net. + - 189.191.110.204.in-addr.arpa. IN PTR 189.191.client.vntx.net. + - 190.191.110.204.in-addr.arpa. IN PTR 190.191.client.vntx.net. + - 191.191.110.204.in-addr.arpa. IN PTR 191.191.client.vntx.net. + - 192.191.110.204.in-addr.arpa. IN PTR 192.191.client.vntx.net. + - 193.191.110.204.in-addr.arpa. IN PTR 193.191.client.vntx.net. + - 194.191.110.204.in-addr.arpa. IN PTR 194.191.client.vntx.net. + - 195.191.110.204.in-addr.arpa. IN PTR 195.191.client.vntx.net. + - 196.191.110.204.in-addr.arpa. IN PTR 196.191.client.vntx.net. + - 197.191.110.204.in-addr.arpa. IN PTR 197.191.client.vntx.net. + - 198.191.110.204.in-addr.arpa. IN PTR 198.191.client.vntx.net. + - 199.191.110.204.in-addr.arpa. IN PTR 199.191.client.vntx.net. + - 200.191.110.204.in-addr.arpa. IN PTR 200.191.client.vntx.net. + - 201.191.110.204.in-addr.arpa. IN PTR 201.191.client.vntx.net. + - 202.191.110.204.in-addr.arpa. IN PTR 202.191.client.vntx.net. + - 203.191.110.204.in-addr.arpa. IN PTR 203.191.client.vntx.net. + - 204.191.110.204.in-addr.arpa. IN PTR 204.191.client.vntx.net. + - 205.191.110.204.in-addr.arpa. IN PTR 205.191.client.vntx.net. + - 206.191.110.204.in-addr.arpa. IN PTR 206.191.client.vntx.net. + - 207.191.110.204.in-addr.arpa. IN PTR 207.191.client.vntx.net. + - 208.191.110.204.in-addr.arpa. IN PTR 208.191.client.vntx.net. + - 209.191.110.204.in-addr.arpa. IN PTR 209.191.client.vntx.net. + - 210.191.110.204.in-addr.arpa. IN PTR 210.191.client.vntx.net. + - 211.191.110.204.in-addr.arpa. IN PTR 211.191.client.vntx.net. + - 212.191.110.204.in-addr.arpa. IN PTR 212.191.client.vntx.net. + - 213.191.110.204.in-addr.arpa. IN PTR 213.191.client.vntx.net. + - 214.191.110.204.in-addr.arpa. IN PTR 214.191.client.vntx.net. + - 215.191.110.204.in-addr.arpa. IN PTR 215.191.client.vntx.net. + - 216.191.110.204.in-addr.arpa. IN PTR 216.191.client.vntx.net. + - 217.191.110.204.in-addr.arpa. IN PTR 217.191.client.vntx.net. + - 218.191.110.204.in-addr.arpa. IN PTR 218.191.client.vntx.net. + - 219.191.110.204.in-addr.arpa. IN PTR 219.191.client.vntx.net. + - 220.191.110.204.in-addr.arpa. IN PTR 220.191.client.vntx.net. + - 221.191.110.204.in-addr.arpa. IN PTR 221.191.client.vntx.net. + - 222.191.110.204.in-addr.arpa. IN PTR 222.191.client.vntx.net. + - 223.191.110.204.in-addr.arpa. IN PTR 223.191.client.vntx.net. + - 224.191.110.204.in-addr.arpa. IN PTR 224.191.client.vntx.net. + - 225.191.110.204.in-addr.arpa. IN PTR 225.191.client.vntx.net. + - 226.191.110.204.in-addr.arpa. IN PTR 226.191.client.vntx.net. + - 227.191.110.204.in-addr.arpa. IN PTR 227.191.client.vntx.net. + - 228.191.110.204.in-addr.arpa. IN PTR 228.191.client.vntx.net. + - 229.191.110.204.in-addr.arpa. IN PTR 229.191.client.vntx.net. + - 230.191.110.204.in-addr.arpa. IN PTR 230.191.client.vntx.net. + - 231.191.110.204.in-addr.arpa. IN PTR 231.191.client.vntx.net. + - 232.191.110.204.in-addr.arpa. IN PTR 232.191.client.vntx.net. + - 233.191.110.204.in-addr.arpa. IN PTR 233.191.client.vntx.net. + - 234.191.110.204.in-addr.arpa. IN PTR 234.191.client.vntx.net. + - 235.191.110.204.in-addr.arpa. IN PTR 235.191.client.vntx.net. + - 236.191.110.204.in-addr.arpa. IN PTR 236.191.client.vntx.net. + - 237.191.110.204.in-addr.arpa. IN PTR 237.191.client.vntx.net. + - 238.191.110.204.in-addr.arpa. IN PTR 238.191.client.vntx.net. + - 239.191.110.204.in-addr.arpa. IN PTR 239.191.client.vntx.net. + - 240.191.110.204.in-addr.arpa. IN PTR 240.191.client.vntx.net. + - 241.191.110.204.in-addr.arpa. IN PTR 241.191.client.vntx.net. + - 242.191.110.204.in-addr.arpa. IN PTR 242.191.client.vntx.net. + - 243.191.110.204.in-addr.arpa. IN PTR 243.191.client.vntx.net. + - 244.191.110.204.in-addr.arpa. IN PTR 244.191.client.vntx.net. + - 245.191.110.204.in-addr.arpa. IN PTR 245.191.client.vntx.net. + - 246.191.110.204.in-addr.arpa. IN PTR 246.191.client.vntx.net. + - 247.191.110.204.in-addr.arpa. IN PTR 247.191.client.vntx.net. + - 248.191.110.204.in-addr.arpa. IN PTR 248.191.client.vntx.net. + - 249.191.110.204.in-addr.arpa. IN PTR 249.191.client.vntx.net. + - 250.191.110.204.in-addr.arpa. IN PTR 250.191.client.vntx.net. + - 251.191.110.204.in-addr.arpa. IN PTR 251.191.client.vntx.net. + - 252.191.110.204.in-addr.arpa. IN PTR 252.191.client.vntx.net. + - 253.191.110.204.in-addr.arpa. IN PTR 253.191.client.vntx.net. + - 254.191.110.204.in-addr.arpa. IN PTR 254.191.client.vntx.net. + - 255.191.110.204.in-addr.arpa. IN PTR 255.191.client.vntx.net. + diff --git a/ansible/group_vars/bind9_servers/towerops.net.sync-conflict-20260129-142452-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/towerops.net.sync-conflict-20260129-142452-ZJZJYMM.yml new file mode 100644 index 0000000..649483a --- /dev/null +++ b/ansible/group_vars/bind9_servers/towerops.net.sync-conflict-20260129-142452-ZJZJYMM.yml @@ -0,0 +1,37 @@ +--- +# towerops.net DNS zone configuration +towerops_net_zone: + name: towerops.net + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + mail_servers: + - name: mail.mcintire.me. + preference: 10 + - name: mail.nsnw.ca. + preference: 20 + hosts: + - name: '@' + ip: 204.110.191.195 + other_name_servers: + - autodiscover.towerops.net. IN CNAME mail.mcintire.me. + - autoconfig.towerops.net. IN CNAME mail.mcintire.me. + - _autodiscover._tcp.towerops.net. IN SRV 0 0 443 mail.mcintire.me. + - 4uwsaywjpmk35j36pfiz4vr37dyy4v7z._domainkey.towerops.net. IN CNAME 4uwsaywjpmk35j36pfiz4vr37dyy4v7z.dkim.amazonses.com. + - l7lbifvot6nv3wwho5rs35xzqzzinz5f._domainkey.towerops.net. IN CNAME l7lbifvot6nv3wwho5rs35xzqzzinz5f.dkim.amazonses.com. + - 2skkb53ep3vfbkdstfmm2elfthurggid._domainkey.towerops.net. IN CNAME 2skkb53ep3vfbkdstfmm2elfthurggid.dkim.amazonses.com. + - mail.towerops.net. IN MX 10 feedback-smtp.us-east-1.amazonses.com. + - em6505.towerops.net. IN CNAME u177982.wl233.sendgrid.net. + - s1._domainkey.towerops.net. IN CNAME s1.domainkey.u177982.wl233.sendgrid.net. + - s2._domainkey.towerops.net. IN CNAME s2.domainkey.u177982.wl233.sendgrid.net. + text: + - name: '@' + text: '"v=spf1 mx a ip4:204.110.191.5 ~all"' + - name: mail + text: '"v=spf1 include:amazonses.com ~all"' + - name: _dmarc + text: '"v=DMARC1; p=none;"' + - name: dkim._domainkey + text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFm6nd0L7/nAO4m0MPxdjwRAup5C90DPSPa0TQBDT8S2WvASyQUPV8xSbICGMj6FjZYNd5ph/0VK47gDulxQgNQT96IVf2ooTfkvY/80bAyEdtJbpjEUzQnX5YBi/pJigQx2EeCdaojUZumeIdlFlzeb8QQIEtQhVnyc1Xc/Z8ljPMW1H9DXLSDINjV6UTaXX+PZ7jgpRKgU+RnJNcqTAkhhKQ4bMcRfOam/lF6wPOWte1A7ir08TdE8O67ioqygkr/ivAp7xvV4vGOkY6buLLE+c3exY+my2qTCZgJyUMAhkZzYqzGo1csfHH8x+O2XN/k8Z5jPhq8LSvl9XkllKwIDAQAB"' diff --git a/ansible/group_vars/bind9_servers/vntx.net.sync-conflict-20260129-153457-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/vntx.net.sync-conflict-20260129-153457-ZJZJYMM.yml new file mode 100644 index 0000000..35cd6c7 --- /dev/null +++ b/ansible/group_vars/bind9_servers/vntx.net.sync-conflict-20260129-153457-ZJZJYMM.yml @@ -0,0 +1,94 @@ +--- +# vntx.net DNS zone configuration +# NOTE: This zone includes 1,016 dynamically generated client records (*.188.client, *.189.client, *.190.client, *.191.client) +# These records map IPs 204.110.188.1-254, 204.110.189.1-254, 204.110.190.1-254, 204.110.191.1-254 +# Consider keeping these in Terraform or generating them programmatically via a template + +vntx_net_zone: + name: vntx.net + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + mail_servers: + - name: vntx-net.mail.protection.outlook.com. + preference: 0 + hosts: + - name: '@' + ip: 198.185.159.144 + - name: climax + ip: 204.110.188.62 + - name: core + ip: 10.254.254.253 + - name: culleoka + ip: 204.110.188.158 + - name: edge + ip: 204.110.191.190 + - name: librenms + ip: 204.110.191.227 + - name: logs + ip: 204.110.191.229 + - name: monitor + ip: 204.110.191.241 + - name: netbox + ip: 204.110.191.243 + - name: newhope + ip: 204.110.188.190 + - name: ns1 + ip: 204.110.191.249 + - name: ns2 + ip: 204.110.191.239 + - name: preseem + ip: 204.110.191.225 + - name: resolver-01 + ip: 204.110.191.240 + - name: resolver-02 + ip: 204.110.191.250 + - name: resolver1 + ip: 204.110.191.240 + - name: resolver2 + ip: 204.110.191.250 + - name: unimus + ip: 204.110.191.238 + - name: verona + ip: 204.110.188.254 + - name: routers + ip: 155.138.241.157 + - name: vpn + ip: 204.110.191.247 + - name: radius + ip: 204.110.191.248 + - name: speedtest + ip: 204.110.191.228 + - name: aprs + ip: 204.110.191.232 + - name: g2 + ip: 204.110.191.221 + - name: net + ip: 104.238.146.79 + - name: uisp + ip: 204.110.191.224 + - name: dns + ip: 204.110.191.193 + text: + - name: '@' + text: '"v=spf1 include:spf.protection.outlook.com include:mailgun.org -all"' + - name: _twilio + text: '"twilio-domain-verification=12bf63d61b86412618bdb4ab6c2b287a"' + - name: _dmarc + text: '"v=DMARC1; p=none"' + - name: _updown + text: '"updown-page=p/34yuc"' + - name: _github-challenge-vntx + text: '"34ea2705e4"' + - name: _github-pages-challenge-gmcintire + text: '"d125f4244edd0120ee0fa073d3acf1"' + - name: krs._domainkey.mg + text: '"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHbWtJ5uPGEOPmJrT36WBXKxVL0b4fqjIM4n6oXK4zaUucqYp7jeoKG+FTO5XEjyja7hsP9WahntUrVb8WI5V6Cj0CznesMrM7oQRntcyuy8mSD1zilmZe4q2Kc65gj2MRrkg3tkJfogXHNz2rxmquNu/DxsFLeQP8a2E5tYXVFwIDAQAB"' + - name: pic._domainkey.mg + text: '"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdv4ZUjhb9l0Nt1aEJMnH/TVNdVn9CEKkb8+RX3qBPMFGmJWrJ3BIFwOSTUBiPeCgd2vc4zOOv7iQhEgNTlIVNT/V1sY70Myo5t+tJCuJQT/G4h5D1u7LZB6YEOKTgd5wF5AoW/nLvKVEPyKl5mThB9KmIGqF5FMm9C9FWP8m6SQIDAQAB"' + - name: s1._domainkey.mg + text: '"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI3w7b9bBNcWzSH8DspZbRNp+9G9pHbCfmHmr3r2JqXh+F8bFlCK6gJqEQW7SIJgYMmSJ5GlYyy4A3VxJJFcWLZb3dxMoWkGjrJ3gEUNQGmG6rnJ7eXJxKb5J2mGgEfQgCgkWXPFRmJhKXPWoZP3RqU2vJZ3t7vJxWHmv0bQPHKQIDAQAB"' + - name: s2._domainkey.mg + text: '"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDc3JXQvGMBl3cW+3N2OPLJwlP4cMvPp9yOQM9X1TLxJWX7Hd7m6rJ1Xf2T3PGP9ZDPfJGXh+PfGPYVJYP2JXGPfP9HPfP3GPfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHQIDAQAB"' diff --git a/ansible/group_vars/bind9_servers/vntx.org.sync-conflict-20260129-161402-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/vntx.org.sync-conflict-20260129-161402-ZJZJYMM.yml new file mode 100644 index 0000000..084017f --- /dev/null +++ b/ansible/group_vars/bind9_servers/vntx.org.sync-conflict-20260129-161402-ZJZJYMM.yml @@ -0,0 +1,10 @@ +--- +# vntx.org DNS zone configuration +vntx_org_zone: + name: vntx.org + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + hosts: [] diff --git a/ansible/group_vars/bind9_servers/w5isp.com.sync-conflict-20260129-153130-ZJZJYMM.yml b/ansible/group_vars/bind9_servers/w5isp.com.sync-conflict-20260129-153130-ZJZJYMM.yml new file mode 100644 index 0000000..114be24 --- /dev/null +++ b/ansible/group_vars/bind9_servers/w5isp.com.sync-conflict-20260129-153130-ZJZJYMM.yml @@ -0,0 +1,46 @@ +--- +# w5isp.com DNS zone configuration +w5isp_com_zone: + name: w5isp.com + type: master + create_reverse_zones: false + name_servers: + - ns1.as393837.net. + - ns-global.kjsl.com. + mail_servers: + - name: mail + preference: 10 + hosts: + - name: "@" + ip: 204.110.191.5 + - name: home + ip: 204.110.191.1 + - name: photos + ip: 204.110.191.8 + - name: skippy + ip: 204.110.191.8 + - name: mail + ip: 204.110.191.5 + - name: dokku + ip: 204.110.191.218 + - name: "vm1" + ip: 172.245.56.83 + - name: "pangolin" + ip: 172.245.56.83 + - name: "*" + ip: 172.245.56.83 + other_name_servers: + - ha.w5isp.com. IN CNAME q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa. + - autodiscover.w5isp.com. IN CNAME mail.w5isp.com. + - autoconfig.w5isp.com. IN CNAME mail.w5isp.com. + - em40.w5isp.com. IN CNAME u177982.wl233.sendgrid.net. + - s1._domainkey.w5isp.com. IN CNAME s1.domainkey.u177982.wl233.sendgrid.net. + - s2._domainkey.w5isp.com. IN CNAME s2.domainkey.u177982.wl233.sendgrid.net. + - _autodiscover._tcp.w5isp.com. IN SRV 0 0 443 mail.w5isp.com. + text: + - name: "@" + text: '"v=spf1 mx a ip4:204.110.191.5 ~all"' + - name: dkim._domainkey + text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB"' + - name: _dmarc + text: '"v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1"' diff --git a/ansible/hosts.sync-conflict-20260129-160647-ZJZJYMM b/ansible/hosts.sync-conflict-20260129-160647-ZJZJYMM new file mode 100644 index 0000000..31ba462 --- /dev/null +++ b/ansible/hosts.sync-conflict-20260129-160647-ZJZJYMM @@ -0,0 +1,31 @@ +[vntx_servers] +#logs.vntx.net +radius.vntx.net +vpn.vntx.net +netbox.vntx.net +#ntp.vntx.net +unimus.vntx.net + +[monitoring_servers] +monitor.vntx.net + +[home_servers] +skippy.w5isp.com +mail.mcintire.me ansible_host=204.110.191.5 +dokku.w5isp.com +camper + +[caddy_servers] +skippy.w5isp.com + +#[syncthing_servers] +#sync.w5isp.com + +[bind9_servers] +ns1.as393837.net ansible_host=204.110.191.222 +vm1.w5isp.com ansible_host=172.245.56.83 + +[dns_servers:children] +bind9_servers + +[postgresql_servers] diff --git a/ansible/playbook.yml b/ansible/playbook.yml old mode 100755 new mode 100644 diff --git a/ansible/roles/almalinux/tasks/main.yml b/ansible/roles/almalinux/tasks/main.yml old mode 100755 new mode 100644 diff --git a/ansible/roles/general/files/etc/update-motd.d/20-banner b/ansible/roles/general/files/etc/update-motd.d/20-banner old mode 100755 new mode 100644 diff --git a/ansible/roles/ns/handlers/main.yml b/ansible/roles/ns/handlers/main.yml old mode 100755 new mode 100644 diff --git a/ansible/roles/ns/tasks/main.yml b/ansible/roles/ns/tasks/main.yml old mode 100755 new mode 100644 diff --git a/ansible/roles/ns/templates/zone.sync-conflict-20260129-150118-ZJZJYMM.j2 b/ansible/roles/ns/templates/zone.sync-conflict-20260129-150118-ZJZJYMM.j2 new file mode 100644 index 0000000..963b418 --- /dev/null +++ b/ansible/roles/ns/templates/zone.sync-conflict-20260129-150118-ZJZJYMM.j2 @@ -0,0 +1,53 @@ +$ORIGIN {{ item.name }}. +$TTL 3600 + +; SOA Record +@ IN SOA {{ item.name_servers[0] }} hostmaster.{{ item.name }}. ( + {{ ansible_date_time.epoch }} ; Serial + 10800 ; Refresh + 3600 ; Retry + 604800 ; Expire + 3600 ) ; Negative Cache TTL + +; Name Servers +{% for ns in item.name_servers %} +@ IN NS {{ ns }} +{% endfor %} + +; MX Records +{% if item.mail_servers is defined %} +{% for mx in item.mail_servers %} +@ IN MX {{ mx.preference }} {{ mx.name }} +{% endfor %} +{% endif %} + +; A Records +{% if item.hosts is defined %} +{% for host in item.hosts %} +{{ host.name }} IN A {{ host.ip }} +{% endfor %} +{% endif %} + +; TXT Records +{% if item.text is defined %} +{% for txt in item.text %} +{% set txt_value = txt.text.strip('"') %} +{% if txt_value | length > 255 %} +{{ txt.name }} IN TXT ( "{{ txt_value[:255] }}" +{% set remaining = txt_value[255:] %} +{% for i in range(0, remaining | length, 255) %} + "{{ remaining[i:i+255] }}"{% if not loop.last %} {% endif %} + +{% endfor %} ) +{% else %} +{{ txt.name }} IN TXT "{{ txt_value }}" +{% endif %} +{% endfor %} +{% endif %} + +; Other Records (CNAME, SRV, etc.) +{% if item.other_name_servers is defined %} +{% for record in item.other_name_servers %} +{{ record }} +{% endfor %} +{% endif %} diff --git a/ansible/roles/ubuntu/tasks/main.yml b/ansible/roles/ubuntu/tasks/main.yml old mode 100755 new mode 100644 diff --git a/ansible/scripts/fix-deprecated-imports.sh b/ansible/scripts/fix-deprecated-imports.sh old mode 100755 new mode 100644 diff --git a/ansible/update_dns.sh b/ansible/update_dns.sh old mode 100755 new mode 100644 diff --git a/home/cluster/add-node3-to-etcd.sh b/home/cluster/add-node3-to-etcd.sh new file mode 100644 index 0000000..4f6bea6 --- /dev/null +++ b/home/cluster/add-node3-to-etcd.sh @@ -0,0 +1,74 @@ +#!/bin/bash +# Script to properly join node3 to existing K3s etcd cluster +# Run this script ON node3 + +set -e + +echo "=== Adding node3 to existing K3s etcd cluster ===" + +# Step 1: Stop K3s and clean up +echo "Stopping K3s and cleaning up..." +sudo systemctl stop k3s || true +sudo systemctl stop k3s-agent || true + +# Remove server data to prevent conflicts +echo "Cleaning up previous server data..." +sudo rm -rf /var/lib/rancher/k3s/server + +# Step 2: Get the token from an existing server +echo "" +echo "You need to get the cluster token from node1 or node2." +echo "On node1 or node2, run:" +echo " sudo cat /var/lib/rancher/k3s/server/token" +echo "" +read -p "Enter the K3s cluster token: " K3S_TOKEN + +# Step 3: Create proper K3s configuration for joining existing cluster +echo "Creating K3s configuration..." +sudo mkdir -p /etc/rancher/k3s + +# Important: We need to specify this is joining an existing cluster +cat << EOF | sudo tee /etc/rancher/k3s/config.yaml +# Join existing cluster - do not initialize new one +server: "https://10.0.101.21:6443" +token: "${K3S_TOKEN}" + +# Additional configuration +tls-san: + - "10.0.101.23" + - "node3" + +node-ip: "10.0.101.23" +EOF + +# Step 4: Uninstall K3s agent if it exists +if [ -f /usr/local/bin/k3s-agent-uninstall.sh ]; then + echo "Uninstalling K3s agent..." + sudo /usr/local/bin/k3s-agent-uninstall.sh +fi + +# Step 5: Install K3s as server joining the existing cluster +echo "Installing K3s as server (joining existing cluster)..." +curl -sfL https://get.k3s.io | sh -s - server \ + --server https://10.0.101.21:6443 \ + --token "${K3S_TOKEN}" + +# Step 6: Wait for services to start +echo "Waiting for K3s to start..." +sleep 20 + +# Step 7: Check status +echo "Checking K3s status..." +sudo systemctl status k3s --no-pager || true +sudo journalctl -u k3s -n 50 --no-pager + +echo "" +echo "=== Setup complete ===" +echo "If you see errors about etcd already being initialized, that's expected." +echo "Check from your local machine with:" +echo " kubectl get nodes" +echo "" +echo "The node should now show roles: control-plane,etcd,master" +echo "" +echo "To check etcd cluster members from node1:" +echo " sudo k3s etcdctl member list" \ No newline at end of file diff --git a/home/cluster/aprs/README.md b/home/cluster/aprs/README.md new file mode 100644 index 0000000..4f3ec8f --- /dev/null +++ b/home/cluster/aprs/README.md @@ -0,0 +1,57 @@ +# APRS.me Deployment + +APRS.me amateur radio tracking application deployed on k3s cluster at 204.110.191.2. + +## Architecture + +- **Application**: 2-replica StatefulSet with Erlang clustering +- **Database**: PostgreSQL 17 with PostGIS extension (100GB Longhorn storage) +- **Cache**: Redis for job queuing and caching +- **Ingress**: Traefik with cert-manager for SSL (Let's Encrypt) +- **Access**: https://aprs.me (DNS points to 204.110.191.3) + +## Prerequisites + +1. GitHub container registry access for `ghcr.io/aprsme/aprs.me:latest` + - Create a GitHub personal access token with `read:packages` scope + - Run: `./create-image-pull-secret.sh ` + +## Deployment + +```bash +# Deploy everything +./deploy.sh + +# Check status +kubectl get pods -n aprs +kubectl get certificate -n aprs +kubectl get ingressroute -n aprs +``` + +## Files + +- `namespace.yaml` - APRS namespace +- `postgres-secret-secure.yaml` - PostgreSQL credentials (secured) +- `postgres-deployment.yaml` - PostgreSQL 17 with PostGIS StatefulSet +- `redis.yaml` - Redis cache deployment +- `aprs-secret-secure.yaml` - Application secrets (secured) +- `aprs-configmap.yaml` - APRS configuration (callsign, server, etc.) +- `aprs-rbac.yaml` - Service account and permissions for clustering +- `aprs-statefulset-with-pullsecret.yaml` - APRS application StatefulSet +- `aprs-ingressroute.yaml` - Traefik ingress with SSL certificate +- `create-image-pull-secret.sh` - Helper to create GitHub image pull secret +- `deploy.sh` - Deployment script + +## Configuration + +- **APRS Callsign**: W5ISP-2 +- **APRS Server**: dallas.aprs2.net:10152 +- **Filter**: r/33/-96/1000000000000 +- **Passcode**: 15748 +- **LoadBalancer IP**: 10.0.101.32 (internal) +- **Public Access**: https://aprs.me via Traefik at 204.110.191.3 + +## Secrets + +All passwords have been generated securely and stored in `*-secure.yaml` files. +Do not commit these files to version control. \ No newline at end of file diff --git a/home/cluster/aprs/aprs-configmap.yaml b/home/cluster/aprs/aprs-configmap.yaml new file mode 100644 index 0000000..68296f3 --- /dev/null +++ b/home/cluster/aprs/aprs-configmap.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: aprs-config + namespace: aprs +data: + # APRS-IS Connection Configuration + APRS_CALLSIGN: "W5ISP-1" + APRS_SERVER: "204.110.191.232" + APRS_PORT: "10152" + APRS_FILTER: "r/33/-96/1000000000000" + APRS_PASSCODE: "15748" + + # Application Configuration + PACKET_RETENTION_DAYS: "7" + CLUSTER_ENABLED: "true" + PHX_SERVER: "true" + PORT: "4000" + POOL_SIZE: "10" \ No newline at end of file diff --git a/home/cluster/aprs/aprs-ingressroute.yaml b/home/cluster/aprs/aprs-ingressroute.yaml new file mode 100644 index 0000000..01f1225 --- /dev/null +++ b/home/cluster/aprs/aprs-ingressroute.yaml @@ -0,0 +1,70 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: aprs-me-cert + namespace: aprs +spec: + secretName: aprs-me-tls + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + dnsNames: + - aprs.me + - www.aprs.me +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: real-ip + namespace: aprs +spec: + headers: + customRequestHeaders: + X-Forwarded-Proto: "https" +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: aprs-https + namespace: aprs +spec: + entryPoints: + - websecure + routes: + - match: Host(`aprs.me`) || Host(`www.aprs.me`) + kind: Rule + middlewares: + - name: real-ip + services: + - name: aprs + port: 80 + tls: + secretName: aprs-me-tls +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: aprs-http + namespace: aprs +spec: + entryPoints: + - web + routes: + - match: Host(`aprs.me`) || Host(`www.aprs.me`) + kind: Rule + services: + - name: aprs + port: 80 + middlewares: + - name: redirect-to-https +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: redirect-to-https + namespace: aprs +spec: + redirectScheme: + scheme: https + permanent: true \ No newline at end of file diff --git a/home/cluster/aprs/aprs-rbac.yaml b/home/cluster/aprs/aprs-rbac.yaml new file mode 100644 index 0000000..f8698cb --- /dev/null +++ b/home/cluster/aprs/aprs-rbac.yaml @@ -0,0 +1,30 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: aprs + namespace: aprs +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: aprs-endpoints-reader + namespace: aprs +rules: +- apiGroups: [""] + resources: ["endpoints", "pods"] + verbs: ["get", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: aprs-endpoints-reader + namespace: aprs +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: aprs-endpoints-reader +subjects: +- kind: ServiceAccount + name: aprs + namespace: aprs \ No newline at end of file diff --git a/home/cluster/aprs/aprs-secret-secure.yaml b/home/cluster/aprs/aprs-secret-secure.yaml new file mode 100644 index 0000000..6122924 --- /dev/null +++ b/home/cluster/aprs/aprs-secret-secure.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: aprs-secret + namespace: aprs +type: Opaque +stringData: + DATABASE_URL: "postgres://aprs:17fZZOsYeeBCf0GN8olKaKrYCsUca25V@postgres-aprs:5432/aprsdb" + REDIS_URL: "redis://redis:6379" + SECRET_KEY_BASE: "sz31WoKApm6ud9Aik5DPRnKDQ7fd7w7GaisbPY6spkybhfU0IiuwuQbp5hxrpQzWiZnAn6045RQlhXENgrOQ" + ERLANG_COOKIE: "3LOiBOvsjdCdJGFd2m2jmLYjh44" + PHX_HOST: "aprs.me" \ No newline at end of file diff --git a/home/cluster/aprs/aprs-statefulset-with-pullsecret.yaml b/home/cluster/aprs/aprs-statefulset-with-pullsecret.yaml new file mode 100644 index 0000000..7288f65 --- /dev/null +++ b/home/cluster/aprs/aprs-statefulset-with-pullsecret.yaml @@ -0,0 +1,127 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: aprs-headless + namespace: aprs +spec: + clusterIP: None + selector: + app: aprs + ports: + - name: epmd + port: 4369 + targetPort: 4369 +--- +apiVersion: v1 +kind: Service +metadata: + name: aprs + namespace: aprs +spec: + type: ClusterIP + selector: + app: aprs + ports: + - name: http + port: 80 + targetPort: 4000 +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: aprs + namespace: aprs +spec: + serviceName: aprs-headless + replicas: 2 + selector: + matchLabels: + app: aprs + template: + metadata: + labels: + app: aprs + spec: + serviceAccountName: aprs + imagePullSecrets: + - name: ghcr-secret + initContainers: + - name: migrate + image: ghcr.io/aprsme/aprs.me:latest + command: ["/app/bin/migrate"] + envFrom: + - configMapRef: + name: aprs-config + - secretRef: + name: aprs-secret + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + containers: + - name: aprs + image: ghcr.io/aprsme/aprs.me:latest + ports: + - containerPort: 4000 + name: http + - containerPort: 4369 + name: epmd + envFrom: + - configMapRef: + name: aprs-config + - secretRef: + name: aprs-secret + env: + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: RELEASE_NAME + value: "aprsme@$(POD_NAME).aprs-headless.aprs.svc.cluster.local" + livenessProbe: + httpGet: + path: / + port: 4000 + initialDelaySeconds: 30 + periodSeconds: 10 + readinessProbe: + httpGet: + path: / + port: 4000 + initialDelaySeconds: 10 + periodSeconds: 5 + resources: + requests: + memory: "512Mi" + cpu: "250m" + limits: + memory: "1Gi" + cpu: "500m" + volumeMounts: + - name: tmp-volume + mountPath: /tmp + - name: app-volume + mountPath: /app/tmp + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + volumes: + - name: tmp-volume + emptyDir: {} + - name: app-volume + emptyDir: {} \ No newline at end of file diff --git a/home/cluster/aprs/create-image-pull-secret.sh b/home/cluster/aprs/create-image-pull-secret.sh new file mode 100644 index 0000000..c85622a --- /dev/null +++ b/home/cluster/aprs/create-image-pull-secret.sh @@ -0,0 +1,25 @@ +#!/bin/bash + +# Create a GitHub personal access token with read:packages scope +# Then run this script with your GitHub username and token + +if [ "$#" -ne 2 ]; then + echo "Usage: $0 " + echo "Create a token at: https://github.com/settings/tokens/new" + echo "Required scope: read:packages" + exit 1 +fi + +GITHUB_USER=$1 +GITHUB_TOKEN=$2 + +kubectl create secret docker-registry ghcr-secret \ + --docker-server=ghcr.io \ + --docker-username=$GITHUB_USER \ + --docker-password=$GITHUB_TOKEN \ + --namespace=aprs + +echo "Secret created! Now update the StatefulSet to use it:" +echo "Add this to the pod spec:" +echo " imagePullSecrets:" +echo " - name: ghcr-secret" \ No newline at end of file diff --git a/home/cluster/aprs/deploy.sh b/home/cluster/aprs/deploy.sh new file mode 100644 index 0000000..595d357 --- /dev/null +++ b/home/cluster/aprs/deploy.sh @@ -0,0 +1,44 @@ +#!/bin/bash +set -e + +echo "Deploying APRS.me to cluster at 204.110.191.2" + +# Use homelab context +kubectl config use-context admin@home + +# Create namespace +echo "Creating namespace..." +kubectl apply -f namespace.yaml --validate=false + +# Deploy PostgreSQL with PostGIS +echo "Deploying PostgreSQL 17 with PostGIS..." +kubectl apply -f postgres-secret-secure.yaml --validate=false +kubectl apply -f postgres-deployment.yaml --validate=false + +# Wait for PostgreSQL to be ready +echo "Waiting for PostgreSQL to be ready..." +kubectl wait --for=condition=ready pod -l app=postgres-aprs -n aprs --timeout=300s + +# Deploy APRS.me +echo "Deploying APRS.me application..." +kubectl apply -f aprs-secret-secure.yaml --validate=false +kubectl apply -f aprs-configmap.yaml --validate=false +kubectl apply -f aprs-rbac.yaml --validate=false +kubectl apply -f aprs-statefulset-with-pullsecret.yaml --validate=false + +# Deploy Traefik ingress +echo "Deploying Traefik ingress..." +kubectl apply -f aprs-ingressroute.yaml --validate=false + +echo "Deployment complete!" +echo "" +echo "To check status:" +echo "kubectl get pods -n aprs" +echo "" +echo "To get the LoadBalancer IP:" +echo "kubectl get svc aprs -n aprs" +echo "" +echo "Remember to:" +echo "1. Create GitHub image pull secret: ./create-image-pull-secret.sh " +echo "2. Access the application at: https://aprs.me" +echo "3. DNS points to 204.110.191.2 (Traefik ingress)" diff --git a/home/cluster/aprs/install-postgis-manual.sh b/home/cluster/aprs/install-postgis-manual.sh new file mode 100644 index 0000000..1979d4c --- /dev/null +++ b/home/cluster/aprs/install-postgis-manual.sh @@ -0,0 +1,18 @@ +#!/bin/bash +# Manual commands to install PostGIS on the PostgreSQL LXC container + +echo "Run these commands on the Proxmox host:" +echo "" +echo "# 1. Update package list in the container" +echo "pct exec 300 -- apt-get update" +echo "" +echo "# 2. Install PostGIS for PostgreSQL 15" +echo "pct exec 300 -- apt-get install -y postgresql-15-postgis-3" +echo "" +echo "# 3. Enable PostGIS extension in the APRS database" +echo "pct exec 300 -- sudo -u postgres psql -d aprs -c 'CREATE EXTENSION IF NOT EXISTS postgis;'" +echo "" +echo "# 4. Verify installation" +echo "pct exec 300 -- sudo -u postgres psql -d aprs -c 'SELECT PostGIS_Version();'" +echo "" +echo "After running these commands, the APRS migrations should work." \ No newline at end of file diff --git a/home/cluster/aprs/namespace.yaml b/home/cluster/aprs/namespace.yaml new file mode 100644 index 0000000..99428aa --- /dev/null +++ b/home/cluster/aprs/namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: aprs \ No newline at end of file diff --git a/home/cluster/aprs/postgres-deployment-normal.yaml b/home/cluster/aprs/postgres-deployment-normal.yaml new file mode 100644 index 0000000..1e6042d --- /dev/null +++ b/home/cluster/aprs/postgres-deployment-normal.yaml @@ -0,0 +1,74 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: postgres-aprs + namespace: aprs +spec: + selector: + app: postgres-aprs + ports: + - port: 5432 + targetPort: 5432 + clusterIP: None +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: postgres-aprs + namespace: aprs +spec: + serviceName: postgres-aprs + replicas: 1 + selector: + matchLabels: + app: postgres-aprs + template: + metadata: + labels: + app: postgres-aprs + spec: + terminationGracePeriodSeconds: 600 # 10 minutes to shutdown gracefully + containers: + - name: postgres + image: postgis/postgis:17-3.4 + ports: + - containerPort: 5432 + envFrom: + - secretRef: + name: postgres-aprs-secret + env: + - name: PGDATA + value: /var/lib/postgresql/data/pgdata + volumeMounts: + - name: postgres-storage + mountPath: /var/lib/postgresql/data + livenessProbe: + exec: + command: + - /bin/sh + - -c + - pg_isready -U $POSTGRES_USER -d $POSTGRES_DB + initialDelaySeconds: 300 # 5 minutes to start + periodSeconds: 30 # Check every 30s + timeoutSeconds: 10 # 10s timeout for probe + failureThreshold: 20 # Allow 20 failures (10 minutes) + readinessProbe: + exec: + command: + - /bin/sh + - -c + - pg_isready -U $POSTGRES_USER -d $POSTGRES_DB + initialDelaySeconds: 300 # 5 minutes to start + periodSeconds: 30 # Check every 30s + timeoutSeconds: 10 # 10s timeout for probe + failureThreshold: 20 # Allow 20 failures (10 minutes) + volumeClaimTemplates: + - metadata: + name: postgres-storage + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 100Gi \ No newline at end of file diff --git a/home/cluster/aprs/postgres-deployment-repair.yaml b/home/cluster/aprs/postgres-deployment-repair.yaml new file mode 100644 index 0000000..aed8c1a --- /dev/null +++ b/home/cluster/aprs/postgres-deployment-repair.yaml @@ -0,0 +1,55 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: postgres-aprs + namespace: aprs +spec: + selector: + app: postgres-aprs + ports: + - port: 5432 + targetPort: 5432 + clusterIP: None +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: postgres-aprs + namespace: aprs +spec: + serviceName: postgres-aprs + replicas: 1 + selector: + matchLabels: + app: postgres-aprs + template: + metadata: + labels: + app: postgres-aprs + spec: + terminationGracePeriodSeconds: 3600 # 1 hour to shutdown gracefully + containers: + - name: postgres + image: postgis/postgis:17-3.4 + ports: + - containerPort: 5432 + envFrom: + - secretRef: + name: postgres-aprs-secret + env: + - name: PGDATA + value: /var/lib/postgresql/data/pgdata + volumeMounts: + - name: postgres-storage + mountPath: /var/lib/postgresql/data + # NO HEALTH CHECKS - Pod will run indefinitely even if unhealthy + volumeClaimTemplates: + - metadata: + name: postgres-storage + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 100Gi \ No newline at end of file diff --git a/home/cluster/aprs/postgres-deployment.yaml b/home/cluster/aprs/postgres-deployment.yaml new file mode 100644 index 0000000..ecb6134 --- /dev/null +++ b/home/cluster/aprs/postgres-deployment.yaml @@ -0,0 +1,87 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: postgres-aprs + namespace: aprs +spec: + selector: + app: postgres-aprs + ports: + - port: 5432 + targetPort: 5432 + type: ClusterIP +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: postgres-aprs + namespace: aprs +spec: + serviceName: postgres-aprs + replicas: 1 + selector: + matchLabels: + app: postgres-aprs + template: + metadata: + labels: + app: postgres-aprs + spec: + terminationGracePeriodSeconds: 600 # 10 minutes to shutdown gracefully + securityContext: + fsGroup: 999 + fsGroupChangePolicy: OnRootMismatch + containers: + - name: postgres + image: postgis/postgis:17-3.4 + ports: + - containerPort: 5432 + envFrom: + - secretRef: + name: postgres-aprs-secret + env: + - name: PGDATA + value: /var/lib/postgresql/data/pgdata + volumeMounts: + - name: postgres-storage + mountPath: /var/lib/postgresql/data + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 999 + runAsGroup: 999 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + livenessProbe: + exec: + command: + - /bin/sh + - -c + - pg_isready -U $POSTGRES_USER -d $POSTGRES_DB + initialDelaySeconds: 60 # 1 minute to start + periodSeconds: 30 # Check every 30s + timeoutSeconds: 10 # 10s timeout for probe + failureThreshold: 3 # Allow 3 failures + readinessProbe: + exec: + command: + - /bin/sh + - -c + - pg_isready -U $POSTGRES_USER -d $POSTGRES_DB + initialDelaySeconds: 30 # 30 seconds to start + periodSeconds: 10 # Check every 10s + timeoutSeconds: 5 # 5s timeout for probe + failureThreshold: 3 # Allow 3 failures + volumeClaimTemplates: + - metadata: + name: postgres-storage + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 256Gi \ No newline at end of file diff --git a/home/cluster/aprs/postgres-normal-mode.sh b/home/cluster/aprs/postgres-normal-mode.sh new file mode 100644 index 0000000..26b3b15 --- /dev/null +++ b/home/cluster/aprs/postgres-normal-mode.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# Restore normal mode for PostgreSQL (with health checks) + +echo "Restoring PostgreSQL normal mode (with health checks)..." +export KUBECONFIG=/Users/graham/dev/infra/home/ansible/kubeconfig + +kubectl apply -f postgres-deployment-normal.yaml + +echo "PostgreSQL is now in normal mode with health checks enabled" +echo "Monitor with: kubectl logs -n aprs postgres-aprs-0 -f" \ No newline at end of file diff --git a/home/cluster/aprs/postgres-repair-mode.sh b/home/cluster/aprs/postgres-repair-mode.sh new file mode 100644 index 0000000..cf220c1 --- /dev/null +++ b/home/cluster/aprs/postgres-repair-mode.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# Enable repair mode for PostgreSQL (no health checks) + +echo "Enabling PostgreSQL repair mode (no health checks)..." +export KUBECONFIG=/Users/graham/dev/infra/home/ansible/kubeconfig + +kubectl apply -f postgres-deployment-repair.yaml + +echo "PostgreSQL is now in repair mode - it will run indefinitely without health checks" +echo "Monitor with: kubectl logs -n aprs postgres-aprs-0 -f" +echo "To restore normal mode, run: ./postgres-normal-mode.sh" \ No newline at end of file diff --git a/home/cluster/aprs/postgres-secret-secure.yaml b/home/cluster/aprs/postgres-secret-secure.yaml new file mode 100644 index 0000000..5338bed --- /dev/null +++ b/home/cluster/aprs/postgres-secret-secure.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: postgres-aprs-secret + namespace: aprs +type: Opaque +stringData: + POSTGRES_DB: aprsdb + POSTGRES_USER: aprs + POSTGRES_PASSWORD: "17fZZOsYeeBCf0GN8olKaKrYCsUca25V" + POSTGRES_REPLICATION_MODE: master + POSTGRES_REPLICATION_USER: replicator + POSTGRES_REPLICATION_PASSWORD: "qVXVmSA3HOVgn6zLY3TrhvUHxmPUMhc0" \ No newline at end of file diff --git a/home/cluster/controlplane.yaml b/home/cluster/controlplane.yaml new file mode 100644 index 0000000..3de067f --- /dev/null +++ b/home/cluster/controlplane.yaml @@ -0,0 +1,559 @@ +version: v1alpha1 # Indicates the schema used to decode the contents. +debug: false # Enable verbose logging to the console. +persist: true +# Provides machine specific configuration options. +machine: + type: controlplane # Defines the role of the machine within the cluster. + token: l1ubxp.d942qc3plno7pxlw # The `token` is used by a machine to join the PKI of the cluster. + # The root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSFNWZnhiOWpZWnVaQWVvUFlBYmVxSU1hK1RYT3o3bzZwaSt0cXY1Mk1mbgotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K + # Extra certificate subject alternative names for the machine's certificate. + certSANs: [] + # # Uncomment this to enable SANs. + # - 10.0.0.10 + # - 172.16.0.10 + # - 192.168.0.10 + + # Used to provide additional options to the kubelet. + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.34.0 # The `image` field is an optional reference to an alternative kubelet image. + defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. + disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + # Extra mounts for Longhorn storage + extraMounts: + - destination: /var/mnt/longhorn + type: bind + source: /var/mnt/longhorn + options: + - bind + - rshared + - rw + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraArgs` field is used to provide additional flags to the kubelet. + # extraArgs: + # key: value + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 + # Provides machine specific network configuration options. + network: {} + # # `interfaces` is used to define the network interface configuration. + # interfaces: + # - interface: enp0s1 # The interface name. + # # Assigns static IP addresses to the interface. + # addresses: + # - 192.168.2.0/24 + # # A list of routes associated with the interface. + # routes: + # - network: 0.0.0.0/0 # The route's network (destination). + # gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + # metric: 1024 # The optional metric for the route. + # mtu: 1500 # The interface's MTU. + # + # # # Picks a network device using the selector. + + # # # select a device with bus prefix 00:*. + # # deviceSelector: + # # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # # deviceSelector: + # # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # # driver: virtio_net # Kernel driver, supports matching by wildcard. + # # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # # deviceSelector: + # # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # # driver: virtio_net # Kernel driver, supports matching by wildcard. + + # # # Bond specific options. + # # bond: + # # # The interfaces that make up the bond. + # # interfaces: + # # - enp2s0 + # # - enp2s1 + # # # Picks a network device using the selector. + # # deviceSelectors: + # # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # # driver: virtio_net # Kernel driver, supports matching by wildcard. + # # mode: 802.3ad # A bond option. + # # lacpRate: fast # A bond option. + + # # # Bridge specific options. + # # bridge: + # # # The interfaces that make up the bridge. + # # interfaces: + # # - enxda4042ca9a51 + # # - enxae2a6774c259 + # # # Enable STP on this bridge. + # # stp: + # # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # # Configure this device as a bridge port. + # # bridgePort: + # # master: br0 # The name of the bridge master interface + + # # # Indicates if DHCP should be used to configure the interface. + # # dhcp: true + + # # # DHCP specific options. + # # dhcpOptions: + # # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # # Wireguard specific configuration. + + # # # wireguard server example + # # wireguard: + # # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # listenPort: 51111 # Specifies a device's listening port. + # # # Specifies a list of peer configurations to apply to a device. + # # peers: + # # - publicKey: ABCDEF... # Specifies the public key of this peer. + # # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # # allowedIPs: + # # - 192.168.1.0/24 + # # # wireguard peer example + # # wireguard: + # # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # # Specifies a list of peer configurations to apply to a device. + # # peers: + # # - publicKey: ABCDEF... # Specifies the public key of this peer. + # # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # # allowedIPs: + # # - 192.168.1.0/24 + + # # # Virtual (shared) IP address configuration. + + # # # layer2 vip example + # # vip: + # # ip: 172.16.199.55 # Specifies the IP address to be used. + + # # Used to statically set the nameservers for the machine. + # nameservers: + # - 8.8.8.8 + # - 1.1.1.1 + + # # Used to statically set arbitrary search domains. + # searchDomains: + # - example.org + # - example.com + + # # Allows for extra entries to be added to the `/etc/hosts` file + # extraHostEntries: + # - ip: 192.168.1.100 # The IP of the host. + # # The host alias. + # aliases: + # - example + # - example.domain.tld + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. + + # Used to provide instructions for installations. + install: + disk: /dev/nvme0n1 # The disk used for installations. + image: ghcr.io/siderolabs/installer:v1.11.1 # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + + # # Allows for supplying extra kernel args via the bootloader. + # extraKernelArgs: + # - talos.platform=metal + # - reboot=k + # Used to configure the machine's container image registry mirrors. + registries: {} + # # Specifies mirror configuration for each registry host namespace. + # mirrors: + # ghcr.io: + # # List of endpoints (URLs) for registry mirrors to use. + # endpoints: + # - https://registry.insecure + # - https://ghcr.io/v2/ + + # # Specifies TLS & auth configuration for HTTPS image registries. + # config: + # registry.insecure: + # # The TLS configuration for the registry. + # tls: + # insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + # + # # # Enable mutual TLS authentication with the registry. + # # clientIdentity: + # # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # + # # # The auth configuration for this registry. + # # auth: + # # username: username # Optional registry authentication. + # # password: password # Optional registry authentication. + + # Features describe individual Talos features that can be switched on or off. + features: + rbac: true # Enable role-based access control (RBAC). + stableHostname: true # Enable stable default hostname. + apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid. + diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. + # KubePrism - local proxy/load balancer on defined port that will distribute + kubePrism: + enabled: true # Enable KubePrism support - will start local load balancing proxy. + port: 7445 # KubePrism port. + # Configures host DNS caching resolver. + hostDNS: + enabled: true # Enable host DNS caching resolver. + forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system + # Configures the node labels for the machine. + nodeLabels: + node.kubernetes.io/exclude-from-external-load-balancers: "" + + # # Provides machine specific control plane configuration options. + + # # ControlPlane definition example. + # controlPlane: + # # Controller manager machine specific configuration options. + # controllerManager: + # disabled: false # Disable kube-controller-manager on the node. + # # Scheduler machine specific configuration options. + # scheduler: + # disabled: true # Disable kube-scheduler on the node. + + # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. + + # # nginx static pod. + # pods: + # - apiVersion: v1 + # kind: pod + # metadata: + # name: nginx + # spec: + # containers: + # - image: nginx + # name: nginx + + # # Allows the addition of user specified files. + + # # MachineFiles usage example. + # files: + # - content: '...' # The contents of the file. + # permissions: 0o666 # The file's permissions in octal. + # path: /tmp/file.txt # The path of the file. + # op: append # The operation to use + + # # The `env` field allows for the addition of environment variables. + + # # Environment variables definition examples. + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: info + # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + # https_proxy: http://SERVER:PORT/ + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: error + # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ + # env: + # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ + + # # Used to configure the machine's time settings. + + # # Example configuration for cloudflare ntp server. + # time: + # disabled: false # Indicates if the time service is disabled for the machine. + # # description: | + # servers: + # - time.cloudflare.com + # bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. + + # # Used to configure the machine's sysctls. + + # # MachineSysctls usage example. + # sysctls: + # kernel.domainname: talos.dev + # net.ipv4.ip_forward: "0" + # net/ipv6/conf/eth0.100/disable_ipv6: "1" + + # # Used to configure the machine's sysfs. + + # # MachineSysfs usage example. + # sysfs: + # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance + + # # Configures the udev system. + # udev: + # # List of udev rules to apply to the udev system + # rules: + # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" + + # # Configures the logging system. + # logging: + # # Logging destination. + # destinations: + # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + # format: json_lines # Logs format. + + # # Configures the kernel. + # kernel: + # # Kernel modules to load. + # modules: + # - name: brtfs # Module name. + + # # Configures the seccomp profiles for the machine. + # seccompProfiles: + # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # # The `value` field is used to provide the seccomp profile. + # value: + # defaultAction: SCMP_ACT_LOG + + # # Override (patch) settings in the default OCI runtime spec for CRI containers. + + # # override default open file limit + # baseRuntimeSpecOverrides: + # process: + # rlimits: + # - hard: 1024 + # soft: 1024 + # type: RLIMIT_NOFILE + + # # Configures the node annotations for the machine. + + # # node annotations example. + # nodeAnnotations: + # customer.io/rack: r13a25 + + # # Configures the node taints for the machine. Effect is optional. + + # # node taints example. + # nodeTaints: + # exampleTaint: exampleTaintValue:NoSchedule +# Provides cluster specific configuration options. +cluster: + id: eaZ-ULVPPORjVzp1Y4XpAOn4X8_UQTHwuGMLfNGZKgM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: 0CQQzq2WnliOSsobOhMsAARA77nM8Phz6XiADm+IfzI= # Shared secret of cluster (base64 encoded random 32 bytes). + # Provides control plane specific configuration options. + controlPlane: + endpoint: https://10.0.101.21:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + clusterName: home # Configures the cluster's name. + # Provides cluster specific network configuration options. + network: + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 + + # # The CNI used. + # cni: + # name: custom # Name of CNI to use. + # # URLs containing manifests to apply for the CNI. + # urls: + # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml + token: ehxond.kiubhs6w8x46jo2r # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + secretboxEncryptionSecret: JqgvvHbtZe38JaE26u/q0XZMjAX0ilWNGywpYUh44RI= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + # The base64 encoded root certificate authority used by Kubernetes. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQVBlNFgzZjZEUjBMbU00dzI2TXZ6V2N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV3TVRneE5qQXhNVGhhRncwek5URXdNVFl4TmpBeApNVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVNIZWpBdWVwdjRXelpxTDkvSzNLdDdkSm1EaCtxWXI3Y2Q1QzB3S0J5RTYyZnRtRjg3TktJc3R1WU8KYkdWb1BjQ0QyVzU3YVVEdGl5dVVmWlJUdDczcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGSXZuSlh1eVZVVWtFZVlxQy8rU2ZDUUwyQ2tpTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUVZcmRtSkYKaVVoM2xIaWlSSzJCamF6N3hyUjkvM2lDblZ2bm5meWlnbVNDQWlFQS9CSW9PWWJ2WmU5K2J0emo2b0tlaGRQcwo3R2Y3TTJYK0xhMlRQc3pMemswPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpWb29Icy9Lb3VEektMR0Q4Y0dHMTVIYVk2dGttTkJnUzNSWUtmYmV3ejlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaDNvd0xucWIrRnMyYWkvZnl0eXJlM1NaZzRmcW1LKzNIZVF0TUNnY2hPdG43WmhmT3pTaQpMTGJtRG14bGFEM0FnOWx1ZTJsQTdZc3JsSDJVVTdlOTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. + aggregatorCA: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYakNDQVFXZ0F3SUJBZ0lRWXZJOHVYbG5USDRqOURxeGh4YzdDekFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMU1UQXhPREUyTURFeE9Gb1hEVE0xTVRBeE5qRTJNREV4T0Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCRVFmUjVBWHBrNE1OSTk4ZlJQd3p4bmxVbkUwYTBCc2J6N1lDZjFCYzZYalh3OWxEckRICjJsTGt5RlhxK2FoTnZaUloyZWlZTkVQT2Jvak51WnV3R2JHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVhdnoza2JMaFFJNFdvRXVvcDdGUVk0QXdsTlF3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnCkg0b3BCbmppclN5R1pvTjBTbGtsRG96MlllUERtR09qSytXcmNsRmxnUDhDSUZLSmpSdXBFa3U2R1haNExneXIKQ3NMMWdXbkNzMklPS2FRbzlIOUhrb0NuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUs3MTlkZDZMZ0JidFFjZkdmNHZQVkVCWWFLWElseFM1enQ1NStZbFEzOTlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFUkI5SGtCZW1UZ3cwajN4OUUvRFBHZVZTY1RSclFHeHZQdGdKL1VGenBlTmZEMlVPc01mYQpVdVRJVmVyNXFFMjlsRm5aNkpnMFE4NXVpTTI1bTdBWnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + # The base64 encoded private key for service account token generation. + serviceAccount: + key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBeTNXQnIxcFBpSTdHTkNuV05kelgxTWIvMkwwclNFVWZ6dEZUM3pzbnI3ZjZGbUV0CmJpVEt3ampOZG53NlNaR0dZamhob1ZuK1piNS9HS2dhem9jempNNjBDWHBpSG5ETnB1aGF0bnp0ZWVVZjJmQUoKMFJaTitoTWRJM3ZMcmhBUHlldWhxRXlYYlBFTm5rVmhvbkhrdGtxZCt5dXByNzJjd0p0bkxqZTcxRXJuOFlCZgpFQ1NtNDJiOFE2L2pWbGJjdkdFYzFkSWlGRG9iRkNDU0QrSzg4bklPckxWemU0YVRwZTdNU3NZUTVLb0JQdTJNCmJqNG85QjI5ajFvWVpJZjV6akgxdlNCb1AzejNKQ1kvOTJhSnFYaS9adHA5b1FWa2NCZjRqVjdSVVYrbklVWjIKOW8yVTU5OExnRWZjRFNXbEdlMDBOZkh6SzduSXN6Y1UwNjJsNmV1VVJLNitMcytWK1RIRG1xdHVJSHQzTm1pNQphdU5QZlEwYTRRQ0M3bHdTY0VITFpNVVdrd0oxR2QyQzg4Y0I0M1p5K2lnckhFenIwUHU3czNLcjFxTlBDN3gvCkpEY0M4T2UzY0p6MWp2K3RjZlZWYnQ0NVp2dHB0aUhkNkhTaDR4NmxvZTRGWUdFbE5JREJld2V3WkgrakM0RWQKdTZUdDg4WEpNbm5FMnYzR3FqVWloNExMUitqREdJcE5FN0tlNUc4a0dkK1ZXNUdRaHJVdWZIWlY2YjB0Zi81dgpETHJ6d0V2OCtUa1paT3h3Lyt5RDVXZ2RRYkQ5c3ZGQUJEdk9XOGhvTm1ySUg1Q2dKcmtOcERjWHRTcUR0UUJuCkNJWmxIUGpvT1F2djZZZEhhamFSTFZFR3A5M0EwR3VJR0Q0ZlJsS0U2SnlpNlpHTCtsWDdmK2owY0tNQ0F3RUEKQVFLQ0FnQVRpNzVoc2pOaDB4V0hmVjF1MzBCODJJRkx1U0NuV0x5dGliNmMrM25jajdnZTNrY1hCY0hVMXRBbQpTZGp2cUdOWW5FSUUxamh5WGRLbjg3NWZpTzJTNFdpNllGOTh2U21FbDEzZm1qRFdQUVRLVXgwZVVSNDhvQWwwCmx6Z0NDTmo3ZFArYXc0RG9ubC9JakxITWdWU1BqcXVPcmFzbmp2ZTRLVFhJWXVKUWlzR3RtYitJTlgweTYzbmcKcHMwWVJrLythUFgwTkxQQmJiT2NRMlRFMGV1RS95QVp4M1RJc1MwT0M5cmtkQks3WlBtcHFmaUx2cjBBZHJyMwpRcGlGVCtyWHZFVDNYbDJsZThQaVhTcFlBaW5IZGlvdEgyQmlUN3BPYW44ZVZiV1dNN0pDcUJwVnBWUmcwalN3CnBqYWxyTEFueFhuMmxML2Z1NEZrZGk0eUI4U2dnR2xsbGVxUnQyUG12QUl0S21ZeDVhL2w4cWJqYXRDZkJaeWwKcVROTkRxTnNoZHBKK1FaVGhsekdFVHdDSCs3aTd4MXZjYVdxV3I4dFZSbjZKdmg3S3krUHZvZVFEa3lDSUhSMgptN041VlBBS09QZnp5aFVZampIcnhlK1FlV0I3UTBMM3Ezdm4xMkxGbGZFeTh1UllxUm5UaU9DaytOMFB6WDJ3ClJvYUg1VG0yOW9IblRTRy92T1FWWEE5UmkzMmdFUGcyaFBleHR0Z1hKeDlWYXZIaHl3eDYvb0t3YitDbERkaHAKOTE0bHV2dkI4bk5BTHVIMWRvK244djhmeEYyVXJhL0ZOcklQNDlSdlZCK055VFFqbGkwNndEbHM4bW4wQTJocAowU0pZTW5HdGo1SDVxQXJDS20xcGY3Z1JJVm56M053YlVqME9HSm5ad1BPbWt6OW1nUUtDQVFFQTFsR2lha3BWCnNXd0gydWIxb3JIdU5iWmNOc1cxRW4rRzNTdXEzWmc0NkwvUmpXSHp1R1FuSWg1VGlER0tVTmNacG1zeE5pb1QKeTZHMmpmNThPZVdLVnNaa2tLYXlKT3BkNlE5a2l1Y1dzOERwYitsU2Z5L2VDdlg5VzBhcDArdEo0SjdGdEloWQpTdTFZT3NIRVVqSCthMGJmWnlVRFlWT2tENXRWTW43YnQyNlhQNXE4cEg3OTVQdUhCRkpQZHlaYllXcEc2U0V6CmZ6Q2N2NWh6SWo4NGV0T2lPWCsrdUNkcDhkQ284YWw4dnNEOTJ3Rk1DMzJYYmxiL0NtT2VmK1lieEVWOU1nVVUKeTZaaStMWHhMQzZYekE5RE1WMnUwV3ZDUVdUaXBDcmJXbHN4WUR0a3YwSUNZQnhSa2lmSEMxMzRSK0d5ckJiRgpDcEJlMXY0UkZ5eVkyd0tDQVFFQTh3Y3dIcmFMOGdXV1EwN0ZzN0xwNXJKa1ZvTTlaQUN1QzYyeUtHaFhDZWtaClNSMm9OcVdNM1dZMVZqV2dSazhha0pXckRtdmp1eURKNkxtcS9Db1M1a2h6Mm8xY3NGTWJ2UUdKOHhIWDZmVUcKWGFZa3Z2WHBGdzkwSlhCR1pYanVVS1BhcVQzS2VWTDdlTXI3TFkySzhNMkNNVGpqZHoyVDZ2bzhGeTM5ZnVEWgpYOTBiUU5FaUQxV2dldzRPU0lRWjNPdndXbU9lM0UzSGd0SmE0ZkVYaGhTbzg0dDhHTituYU9uMmdrOHJ5cjE0Ck9GVkcra3pkb21jQjNOQ1RJZFJkZS93NHk5SVFEMHBPb0M5SlN6MHJReGtBWXpKemt0MGVVaXRNUWpGU1NuS1EKblJxSUZLM0pZdng5QTVtSWNHOGU3R01mUEtZbTVrczA2c1BnWTVkTjJRS0NBUUVBMWpVcnJ5N3k3VzA3Z0tnOQpOTXJBZTBEMGMrNHhwL1o4ZGt5eDc5KzRhYkZuSWZlWUlHRkIxOUVWemxjdGx0VVhGd1dtWHl1NU0xdERXakxVCk9RM2FzaGFDNXkwbGVzNGc1Tk4wdTN4emJXQlFNWUd6NmRtUEJjZU4zaEFIcC85UWpNaEVkTWVkNysyL3RLSjgKdFdhd2tzcDRlZUE5dTZaY29SaXhFOUpGaXRabko3UmgvY3ZMdW5WSUlxS2VPRW5ISmR1U1dtckx6TUZxdWZrRwpnbUZMOHovWnNieWpnKzRvN3YrT0RGUkprV0xWbDNKNWJqYXVCeU8rcjhTWDQ5KzdPdlgxUnV4Yk41enE2UWo0CnJ4ODJxMGRKOG1wZlU0TnYyZXFhdUZqNWV4c1FnODE1U2N3UkViemNMc2ZCSXZSZU5vSTRFZGFFUktXOWxRYkYKVUROTDV3S0NBUUJrd2M4bWZLSnF0ZnhGYll3ejQzSnNEZnZoamtuT2d5V2xlOThJTjdJV1Rza0g4ajdDWVVLVQpyQUppK3BxM2E2WmsyVmh4QXpRSWFpQ3Ixd1pYdzQzUVlhdCtxZXNLdzNvVmsyVEJITjI2aHJhYjd2ei9HdThICmU0VzQyK0tqd1U1MHFtcEdqbks2ZURnQUxZK1RwRUk5Y2NhUFo3bU92ejNyUnRIUS9tVkJ6RER6T0xWSzJ5blcKMTdaUUxsU25wZlVmRGNhNWd1SGpEbkF3QWN4aUxsV0ZabDFoazZ2Z21DRk5NdXJidmIwM01mUjh6b1k5MGM1MQp2V1VkU25BbHIya090VlJLMUkySitWRzl3YjBPYjQ3WEk2OXdjUU5QbVZNdjEvbW0yOUgxUWFoSktpM08vUG9vCml1dTlxVkxTNG84Y2pEL3dJaWF3aGUrcmdZZ3ZZaFNKQW9JQkFRQ1doNkphNmwvNGovamJIVjRPOENxdWI3cUwKZ05iam1rU3Zua3JNYTRWS1l4ZWs0UWNsdVNzaUNOaFBjZVY3MGpQemdZQWNBV3ZNTVZTTG1uVFRGbU9XYlJ1MwpMeHZyMXBqc0Z4M2RlSHhKUFVZNGJub0Y0ZnZyclRKNVh4MHM2dzh1Z0ZNVWFGSno3THB2TFJhWEw0eHpjUTd1CmRTY2ZkRkw1aGZxVmZ3RDFQdXlFK2ZHb1ltb081Z21XblA1QW1GRERFa2dsTHlHOEhER3FERC9XYXNMbGdhZm8KZDVEejJPcm9HdGdzeElSajM5Q2ZZcm1jclllNDhXdXdSR2dJcmM4dURLZlR3a2RmTlpGTVdMcUlZdHM0Z1M0NwpQeFh2c3VoS1BhTWovaFhGanhzdWlROTFxdDRUbWw3TnFtNjM4cFEyeDFYb0lldmdRUXBTN2dVSW1vc1AKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K + # API server specific configuration options. + apiServer: + image: registry.k8s.io/kube-apiserver:v1.34.0 # The container image used in the API server manifest. + # Extra certificate subject alternative names for the API server's certificate. + certSANs: + - 10.0.101.21 + disablePodSecurityPolicy: true # Disable PodSecurityPolicy in the API server and default manifests. + # Configure the API server admission plugins. + admissionControl: + - name: PodSecurity # Name is the name of the admission controller. + # Configuration is an embedded configuration object to be used as the plugin's + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration + # Configure the API server audit policy. + auditPolicy: + apiVersion: audit.k8s.io/v1 + kind: Policy + rules: + - level: Metadata + + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s + # Controller manager server specific configuration options. + controllerManager: + image: registry.k8s.io/kube-controller-manager:v1.34.0 # The container image used in the controller manager manifest. + # Kube-proxy server-specific configuration options + proxy: + image: registry.k8s.io/kube-proxy:v1.34.0 # The container image used in the kube-proxy manifest. + + # # Disable kube-proxy deployment on cluster bootstrap. + # disabled: false + # Scheduler server specific configuration options. + scheduler: + image: registry.k8s.io/kube-scheduler:v1.34.0 # The container image used in the scheduler manifest. + # Configures cluster member discovery. + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: + disabled: true # Disable Kubernetes discovery registry. + # Service registry is using an external service to push and pull information about cluster members. + service: {} + # # External service endpoint. + # endpoint: https://discovery.talos.dev/ + # Etcd specific configuration options. + etcd: + # The `ca` is the root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmekNDQVNTZ0F3SUJBZ0lSQVBPYnhxSEJhTEcrRWlEblFYbFF1amt3Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TlRFd01UZ3hOakF4TVRoYUZ3MHpOVEV3TVRZeE5qQXhNVGhhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFUcG43ZDFHMjdJCk9lZzJLQ3E3bzhQWFV0Vm1yY0tSQkFMc2c2OXZoczdFZUU2aEkzSUdPcTNYcWpTdVAxbGJicVVlZWlNNTRDU1kKYXNTK0tvaUtjUmlubzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpKZUhoZ0xsRWxxCno0L0l6WG51bGtUTU5hQVJNQW9HQ0NxR1NNNDlCQU1DQTBrQU1FWUNJUURwZ1BRdTlpWDdoU05JbFJKek9JNDEKZ2pjZXNLQmo2T2d6dFE2M0dGa2ZuQUloQU9NaS9RYTRYc2FwOVFxSXJvd0tUaU9mZ25IS1YxeUZDVExqS29lRQpSTTdYCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtPNi9KcjFrT2l0a08wbVllTnB6L3d5QjNmYUVWUWN2RmZETndXUHIxZGRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFNlorM2RSdHV5RG5vTmlncXU2UEQxMUxWWnEzQ2tRUUM3SU92YjRiT3hIaE9vU055QmpxdAoxNm8wcmo5WlcyNmxIbm9qT2VBa21HckV2aXFJaW5FWXB3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + + # # The container image used to create the etcd service. + # image: gcr.io/etcd-development/etcd:v3.6.4 + + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 + # A list of urls that point to additional manifests. + extraManifests: [] + # - https://www.example.com/manifest1.yaml + # - https://www.example.com/manifest2.yaml + + # A list of inline Kubernetes manifests. + inlineManifests: [] + # - name: namespace-ci # Name of the manifest. + # contents: |- # Manifest contents as a string. + # apiVersion: v1 + # kind: Namespace + # metadata: + # name: ci + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # Core DNS specific configuration options. + # coreDNS: + # image: registry.k8s.io/coredns/coredns:v1.12.3 # The `image` field is an override to the default coredns image. + + # # External cloud provider configuration. + # externalCloudProvider: + # enabled: true # Enable external cloud provider. + # # A list of urls that point to additional manifests for an external cloud provider. + # manifests: + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml + + # # A map of key value pairs that will be added while fetching the extraManifests. + # extraManifestHeaders: + # Token: "1234567" + # X-ExtraInfo: info + + # # Settings for admin kubeconfig generation. + # adminKubeconfig: + # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). + + # # Allows running workload on control-plane nodes. + allowSchedulingOnControlPlanes: true diff --git a/home/cluster/deploy.md b/home/cluster/deploy.md new file mode 100644 index 0000000..88fcbad --- /dev/null +++ b/home/cluster/deploy.md @@ -0,0 +1,335 @@ +# Cluster Deployment Guide + +This document tracks the commands and process for provisioning the k3s cluster with Talos. + +## Initial Talos Setup + +Fresh Talos cluster has been set up. Document deployment commands below as they are executed. + +## Deployment Commands Log + +### Latest APRS Deployment (2025-10-18) + +```bash +# Generate kubeconfig from Talos +talosctl --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 kubeconfig + +# Force re-deploy APRS.me with new GitHub pull token +cd /Users/graham/dev/infra/home/cluster/aprs +./deploy.sh + +# Check pod status +kubectl get pods -n aprs -o wide + +# Force restart of APRS StatefulSet to pull new image with GitHub token +kubectl delete pod aprs-0 -n aprs +kubectl rollout restart statefulset/aprs -n aprs + +# Check persistent volume claim status +kubectl get pvc -n aprs +kubectl get storageclass + +# Check cluster nodes +kubectl get nodes -o wide +``` + +**Status**: Image pull now working with GitHub token, but PostgreSQL stuck due to missing storage class + +### Storage Configuration (2025-10-18) + +```bash +# Initially tried Longhorn but had iscsi-tools issues in Talos +kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.2/deploy/longhorn.yaml +kubectl label namespace longhorn-system pod-security.kubernetes.io/enforce=privileged --overwrite +kubectl rollout restart ds/longhorn-manager -n longhorn-system + +# Installed local-path-provisioner as alternative +kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.28/deploy/local-path-storage.yaml +kubectl label namespace local-path-storage pod-security.kubernetes.io/enforce=privileged --overwrite +kubectl rollout restart deployment/local-path-provisioner -n local-path-storage + +# Updated PostgreSQL to use local-path with 256GB storage +# Modified postgres-deployment.yaml: storageClassName: local-path, storage: 256Gi +kubectl delete pvc postgres-storage-postgres-aprs-0 -n aprs +kubectl delete statefulset postgres-aprs -n aprs +kubectl apply -f /Users/graham/dev/infra/home/cluster/aprs/postgres-deployment.yaml + +# Verify storage configuration +kubectl get pvc -n aprs +kubectl get storageclass +``` + +**Status**: PostgreSQL with PostGIS now configured with 256GB local-path storage, APRS.me deploying with GitHub token + +### Longhorn Storage Final Configuration (2025-10-18) + +```bash +# Updated controlplane.yaml to add kubelet extraMounts for Longhorn +# Added: +# extraMounts: +# - destination: /var/mnt/longhorn +# type: bind +# source: /var/mnt/longhorn +# options: [bind, rshared, rw] + +# Applied updated configuration to both nodes +talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml +talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.22 --nodes 10.0.101.22 --file controlplane.yaml --config-patch @node2.patch.yaml --config-patch @tailscale.patch.yaml + +# Generated custom Talos image with iscsi-tools extension +curl -X POST --data-binary @schematic.yaml https://factory.talos.dev/schematics +# Returned schematic ID: 077514df2c1b6436460bc60faabc976687b16193b8a1290fda4366c69024fec2 + +# Upgraded both nodes with custom image including iscsi-tools +talosctl upgrade --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --image factory.talos.dev/metal-installer/708747e350d604ae9e57227d8dcf274091453ddb1097b765d4ea8884f1992c1f:v1.11.3 --preserve --force +talosctl upgrade --talosconfig=./talosconfig -e 10.0.101.22 --nodes 10.0.101.22 --image factory.talos.dev/metal-installer/708747e350d604ae9e57227d8dcf274091453ddb1097b765d4ea8884f1992c1f:v1.11.3 --preserve --force + +# Reinstalled Longhorn after node upgrade +kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.2/deploy/longhorn.yaml +kubectl label namespace longhorn-system pod-security.kubernetes.io/enforce=privileged --overwrite + +# Configured PostgreSQL to use Longhorn storage with 256GB +# Modified postgres-deployment.yaml: storageClassName: longhorn, storage: 256Gi +kubectl delete pvc postgres-storage-postgres-aprs-0 -n aprs +kubectl delete statefulset postgres-aprs -n aprs +kubectl apply -f /Users/graham/dev/infra/home/cluster/aprs/postgres-deployment.yaml + +# Verify Longhorn storage +kubectl get storageclass +kubectl get nodes.longhorn.io -n longhorn-system +kubectl get pvc -n aprs +``` + +**Status**: Longhorn storage successfully configured on both nodes, PostgreSQL with PostGIS using 256GB Longhorn storage + +### APRS.me Application Deployment Success (2025-10-19) + +```bash +# Fixed PostgreSQL service to use ClusterIP instead of headless service +# Modified postgres-deployment.yaml: type: ClusterIP +kubectl delete svc postgres-aprs -n aprs +kubectl apply -f /Users/graham/dev/infra/home/cluster/aprs/postgres-deployment.yaml + +# Fixed PostgreSQL permissions with fsGroup +# Added to postgres-deployment.yaml: +# securityContext: +# fsGroup: 999 +# fsGroupChangePolicy: OnRootMismatch + +# Shortened PostgreSQL readiness probe delays +# Updated readiness probe: initialDelaySeconds: 30, periodSeconds: 10, failureThreshold: 3 + +# Fixed APRS container permissions +# Removed strict runAsUser constraints from aprs-statefulset-with-pullsecret.yaml +# Added writable volumes for tmp directories + +# Set APRS namespace to privileged pod security +kubectl label namespace aprs pod-security.kubernetes.io/enforce=privileged --overwrite + +# Final deployment verification +kubectl get pods -n aprs +kubectl get svc -n aprs +kubectl logs aprs-0 -n aprs -c aprs +``` + +**Status**: ✅ APRS.me application fully deployed and operational +- PostgreSQL 17 with PostGIS running on 256GB Longhorn storage +- Redis cache operational +- APRS.me web application responding on port 4000 +- APRS-IS packet receiver active and processing +- Multi-replica deployment with Erlang clustering +- All services healthy and ready + +### MetalLB LoadBalancer Configuration (2025-10-19) + +```bash +# Install MetalLB for LoadBalancer services +kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.14.8/config/manifests/metallb-native.yaml +kubectl wait --for=condition=ready pod -l app=metallb -n metallb-system --timeout=60s + +# Create MetalLB configuration with public IP +cat > /Users/graham/dev/infra/home/cluster/metallb-config.yaml << 'EOF' +--- +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: public-ip-pool + namespace: metallb-system +spec: + addresses: + - 204.110.191.2/32 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: public-ip-advertisement + namespace: metallb-system +spec: + ipAddressPools: + - public-ip-pool +EOF + +# Apply MetalLB configuration +kubectl apply -f /Users/graham/dev/infra/home/cluster/metallb-config.yaml +``` + +**Status**: ✅ LoadBalancer services now working with MetalLB +- Traefik assigned external IP 204.110.191.2 +- HTTPS access to aprs.me working correctly +- HTTP redirects to HTTPS automatically + +### Attempted APRS Deployment + +```bash +# Attempted to deploy APRS application +cd /Users/graham/dev/infra/home/cluster/aprs +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" ./deploy.sh +``` + +**Issue**: Kubernetes API at 10.0.101.21:6443 not accessible - connection timeout. +**Current Context**: admin@home +**Status**: Deployment blocked - need cluster connectivity + +### Network Configuration Fix + +```bash +# Fixed node1.patch.yaml to remove conflicting default route from VLAN 10 +# VLAN 10 now only has IP assignment, main interface handles routing +``` + +**Issue**: Dual default routes caused connectivity loss +**Fix**: Removed default route from VLAN 9 configuration to prevent dual route conflicts + +### Security Context Fixes for PodSecurity Policy + +```bash +# Fixed PostgreSQL deployment security context +kubectl apply -f postgres-deployment.yaml + +# Fixed Redis deployment security context +kubectl apply -f redis.yaml + +# Fixed APRS StatefulSet security context (migrate + aprs containers) +kubectl apply -f aprs-statefulset-with-pullsecret.yaml +``` + +### Node1 Public IP Configuration + +```bash +# Updated node1.patch.yaml with public IP 204.110.191.2/27 +# Gateway: 204.110.191.30 on VLAN 9 +# Applied node1 configuration with public IP +talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml +``` + +### Cert-Manager Deployment + +```bash +# Check if cert-manager is installed +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl get pods -n cert-manager + +# Install cert-manager v1.16.1 +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml + +# Wait for cert-manager to be ready +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=cert-manager -n cert-manager --timeout=300s + +# Deploy Let's Encrypt ClusterIssuer (had webhook timeout issues) +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl delete validatingwebhookconfiguration cert-manager-webhook +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f cert-manager/letsencrypt-prod.yaml +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml +``` + +### Traefik Deployment + +```bash +# Create traefik namespace +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl create namespace traefik-system + +# Install Traefik via Helm with LoadBalancer +helm repo update +helm install traefik traefik/traefik --namespace traefik-system --set service.type=LoadBalancer + +# Wait for Traefik to be ready +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=traefik -n traefik-system --timeout=300s + +# Deploy APRS IngressRoute and Certificate (temporarily removed webhook) +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl delete validatingwebhookconfiguration cert-manager-webhook +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f aprs/aprs-ingressroute.yaml +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml +``` + +### Longhorn Storage Deployment + +```bash +# Install Longhorn v1.7.1 +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.1/deploy/longhorn.yaml + +# Set privileged security policy for Longhorn namespace (required for hostPath volumes) +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl label namespace longhorn-system pod-security.kubernetes.io/enforce=privileged + +# Restart DaemonSet to apply new security policy +PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl rollout restart ds/longhorn-manager -n longhorn-system + +# Note: Longhorn may take several minutes to fully initialize and create storage class +``` + +### DNS Configuration Update + +```bash +# Updated aprs.me DNS records to point to new cluster IP +# File: home/terraform/dns_aprs_me_cloudflare.tf +# Changed from 204.110.191.3 to 204.110.191.2 + +# Verify DNS changes (records already applied correctly) +tofu -chdir=/Users/graham/dev/infra/home/terraform plan -target=cloudflare_record.aprs_me_root -target=cloudflare_record.aprs_me_www +tofu -chdir=/Users/graham/dev/infra/home/terraform state show cloudflare_record.aprs_me_root + +# Confirmed: Both aprs.me and www.aprs.me point to 204.110.191.2 +``` + +### Node-RED Deployment (2025-10-19) + +```bash +# Added 204.110.191.3 to node1 configuration +talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml + +# Deployed nginx proxy for multiple services on 204.110.191.3:8080/8443 +cd /Users/graham/dev/infra/home/cluster/nginx-proxy +./deploy.sh + +# Deployed Node-RED to cluster +cd /Users/graham/dev/infra/home/cluster/nodered +./deploy.sh + +# Updated DNS for nodered.w5isp.com to point to 204.110.191.3 +tofu -chdir=/Users/graham/dev/infra/home/terraform apply -target=dnsimple_zone_record.w5isp_nodered -auto-approve +``` + +**Status**: ✅ Node-RED deployed and accessible +- Traefik handles routing and SSL termination via host-based routing +- APRS: https://aprs.me (204.110.191.2 via Traefik) +- Node-RED: https://nodered.w5isp.com (204.110.191.2 via Traefik) +- Both services use ClusterIP (internal only) +- Uses Longhorn for persistent storage + +## Key Configuration Files + +- `controlplane.yaml` - Talos control plane configuration +- `worker.yaml` - Talos worker node configuration +- `node1.patch.yaml`, `node2.patch.yaml`, `node3.patch.yaml` - Node-specific patches +- `talosconfig` - Talos client configuration + +## Notes + +- Cluster uses Talos Linux as the operating system +- Applications deployed via kubectl with manifests in subdirectories +- Each application has its own deploy.sh script for easy deployment + +## Reproduction Steps + +1. Apply Talos configurations to nodes +2. Bootstrap cluster +3. Deploy applications as needed + +_Detailed steps will be added as deployment progresses._ \ No newline at end of file diff --git a/home/cluster/k3s-upgrade/plan.yaml b/home/cluster/k3s-upgrade/plan.yaml new file mode 100644 index 0000000..04a453a --- /dev/null +++ b/home/cluster/k3s-upgrade/plan.yaml @@ -0,0 +1,43 @@ +# Server plan +apiVersion: upgrade.cattle.io/v1 +kind: Plan +metadata: + name: server-plan + namespace: system-upgrade +spec: + concurrency: 1 + cordon: true + nodeSelector: + matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: In + values: + - "true" + serviceAccountName: system-upgrade + upgrade: + image: rancher/k3s-upgrade + channel: https://update.k3s.io/v1-release/channels/stable +--- +# Agent plan +apiVersion: upgrade.cattle.io/v1 +kind: Plan +metadata: + name: agent-plan + namespace: system-upgrade +spec: + concurrency: 1 + cordon: true + nodeSelector: + matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: DoesNotExist + prepare: + args: + - prepare + - server-plan + image: rancher/k3s-upgrade + serviceAccountName: system-upgrade + upgrade: + image: rancher/k3s-upgrade + channel: https://update.k3s.io/v1-release/channels/stable + diff --git a/home/cluster/longhorn-uservolume.yaml b/home/cluster/longhorn-uservolume.yaml new file mode 100644 index 0000000..ae8ab77 --- /dev/null +++ b/home/cluster/longhorn-uservolume.yaml @@ -0,0 +1,8 @@ +apiVersion: v1alpha1 +kind: UserVolumeConfig +name: longhorn +provisioning: + diskSelector: + match: disk.transport == "nvme" + grow: false + maxSize: 1700GB \ No newline at end of file diff --git a/home/cluster/mariadb/mariadb-deployment.yaml b/home/cluster/mariadb/mariadb-deployment.yaml new file mode 100644 index 0000000..cf61975 --- /dev/null +++ b/home/cluster/mariadb/mariadb-deployment.yaml @@ -0,0 +1,130 @@ +apiVersion: v1 +kind: Secret +metadata: + name: mariadb-secret + namespace: data +type: Opaque +stringData: + root-password: "TxN9RnbTQw9GarJg5mDvsuW2bFSYot7L" + replication-password: "nXhalxeheXryAy8R6qTJWhCw4P1CtUXu" +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: mariadb-config + namespace: data +data: + my.cnf: | + [mysqld] + bind-address = 0.0.0.0 + default_storage_engine = InnoDB + binlog_format = ROW + innodb_autoinc_lock_mode = 2 + innodb_flush_log_at_trx_commit = 0 + query_cache_size = 0 + query_cache_type = 0 + character-set-server = utf8mb4 + collation-server = utf8mb4_unicode_ci +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: mariadb-data + namespace: data +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 20Gi +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: mariadb + namespace: data + labels: + app: mariadb +spec: + replicas: 1 + selector: + matchLabels: + app: mariadb + template: + metadata: + labels: + app: mariadb + spec: + containers: + - name: mariadb + image: mariadb:11 + ports: + - containerPort: 3306 + name: mysql + env: + - name: MYSQL_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: mariadb-secret + key: root-password + - name: MYSQL_DATABASE + value: "forgejo" + - name: MYSQL_USER + value: "forgejo" + - name: MYSQL_PASSWORD + value: "nJWD2Iv44Y2j4eQSFupjq9fBKX3rI6pg" + volumeMounts: + - name: data + mountPath: /var/lib/mysql + - name: config + mountPath: /etc/mysql/conf.d + resources: + requests: + memory: "512Mi" + cpu: "250m" + limits: + memory: "2Gi" + cpu: "1000m" + livenessProbe: + exec: + command: + - /bin/bash + - -c + - "mariadb-admin ping -h localhost -u root -p$MYSQL_ROOT_PASSWORD" + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + exec: + command: + - /bin/bash + - -c + - "mariadb-admin ping -h localhost -u root -p$MYSQL_ROOT_PASSWORD" + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + volumes: + - name: data + persistentVolumeClaim: + claimName: mariadb-data + - name: config + configMap: + name: mariadb-config +--- +apiVersion: v1 +kind: Service +metadata: + name: mariadb + namespace: data + labels: + app: mariadb +spec: + type: ClusterIP + ports: + - port: 3306 + targetPort: 3306 + protocol: TCP + name: mysql + selector: + app: mariadb \ No newline at end of file diff --git a/home/cluster/metallb-config.yaml b/home/cluster/metallb-config.yaml new file mode 100644 index 0000000..4af92be --- /dev/null +++ b/home/cluster/metallb-config.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: public-ip-pool + namespace: metallb-system +spec: + addresses: + - 204.110.191.2/32 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: public-ip-advertisement + namespace: metallb-system +spec: + ipAddressPools: + - public-ip-pool \ No newline at end of file diff --git a/home/cluster/mikrotik-ha-setup.md b/home/cluster/mikrotik-ha-setup.md new file mode 100644 index 0000000..8523868 --- /dev/null +++ b/home/cluster/mikrotik-ha-setup.md @@ -0,0 +1,177 @@ +# High Availability Setup with MikroTik + +## Overview +Using MikroTik's built-in features to ensure K3s cluster remains accessible when node1 is down. + +## Option 1: MikroTik Load Balancing with PCC (Per Connection Classifier) + +### On MikroTik Router: +```mikrotik +# 1. Create address list for K3s nodes +/ip firewall address-list +add address=10.0.101.21 list=k3s-nodes comment="node1" +add address=10.0.101.22 list=k3s-nodes comment="node2" +add address=10.0.101.23 list=k3s-nodes comment="node3" + +# 2. Create NAT rules for incoming traffic to distribute to nodes +# For HTTP/HTTPS traffic (ports 80, 443) +/ip firewall nat +add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \ + dst-port=80 to-addresses=10.0.101.21-10.0.101.23 to-ports=80 \ + comment="K3s HTTP load balance" + +add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \ + dst-port=443 to-addresses=10.0.101.21-10.0.101.23 to-ports=443 \ + comment="K3s HTTPS load balance" + +# 3. Add connection marking for load balancing +/ip firewall mangle +add chain=prerouting action=mark-connection new-connection-mark=k3s-conn-1 \ + dst-address=204.110.191.2 dst-port=80,443 protocol=tcp \ + per-connection-classifier=both-addresses:3/0 + +add chain=prerouting action=mark-connection new-connection-mark=k3s-conn-2 \ + dst-address=204.110.191.2 dst-port=80,443 protocol=tcp \ + per-connection-classifier=both-addresses:3/1 + +add chain=prerouting action=mark-connection new-connection-mark=k3s-conn-3 \ + dst-address=204.110.191.2 dst-port=80,443 protocol=tcp \ + per-connection-classifier=both-addresses:3/2 +``` + +## Option 2: MikroTik with VRRP (Virtual Router Redundancy Protocol) + +### Prerequisites: +- Assign additional IPs to each node for VRRP +- Configure MikroTik to route to VRRP virtual IP + +### On Each K3s Node: +```bash +# Install keepalived +sudo apt-get update && sudo apt-get install -y keepalived + +# Create keepalived configuration +sudo tee /etc/keepalived/keepalived.conf << EOF +vrrp_instance VI_1 { + state BACKUP # All nodes start as BACKUP + interface eth0 # Your network interface + virtual_router_id 51 # Same on all nodes + priority $(hostname | grep -o '[0-9]*')0 # node1=10, node2=20, node3=30 + advert_int 1 + authentication { + auth_type PASS + auth_pass k3scluster + } + virtual_ipaddress { + 10.0.101.100/24 # Virtual IP for cluster + } +} +EOF + +# Start keepalived +sudo systemctl enable --now keepalived +``` + +### On MikroTik: +```mikrotik +# Route public IP traffic to VRRP virtual IP +/ip firewall nat +add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \ + dst-port=80,443 to-addresses=10.0.101.100 \ + comment="K3s VRRP Virtual IP" +``` + +## Option 3: MikroTik Netwatch with Failover (Simplest) + +This monitors nodes and updates NAT dynamically: + +```mikrotik +# 1. Create scripts for failover +/system script +add name="k3s-use-node1" source={ + /ip firewall nat set [find comment="K3s HTTP"] to-addresses=10.0.101.21 + /ip firewall nat set [find comment="K3s HTTPS"] to-addresses=10.0.101.21 + :log info "K3s traffic switched to node1" +} + +add name="k3s-use-node2" source={ + /ip firewall nat set [find comment="K3s HTTP"] to-addresses=10.0.101.22 + /ip firewall nat set [find comment="K3s HTTPS"] to-addresses=10.0.101.22 + :log info "K3s traffic switched to node2" +} + +add name="k3s-use-node3" source={ + /ip firewall nat set [find comment="K3s HTTP"] to-addresses=10.0.101.23 + /ip firewall nat set [find comment="K3s HTTPS"] to-addresses=10.0.101.23 + :log info "K3s traffic switched to node3" +} + +# 2. Create initial NAT rules +/ip firewall nat +add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \ + dst-port=80 to-addresses=10.0.101.21 to-ports=80 comment="K3s HTTP" + +add chain=dstnat action=dst-nat protocol=tcp dst-address=204.110.191.2 \ + dst-port=443 to-addresses=10.0.101.21 to-ports=443 comment="K3s HTTPS" + +# 3. Set up Netwatch monitors +/tool netwatch +add host=10.0.101.21 interval=10s timeout=5s \ + down-script={ + :if ([/tool netwatch get [find host=10.0.101.22] status]="up") do={ + /system script run k3s-use-node2 + } else={ + :if ([/tool netwatch get [find host=10.0.101.23] status]="up") do={ + /system script run k3s-use-node3 + } + } + } \ + up-script="/system script run k3s-use-node1" + +add host=10.0.101.22 interval=10s timeout=5s +add host=10.0.101.23 interval=10s timeout=5s +``` + +## Recommended: Configure K3s Services for Any Node Access + +Make sure your services use NodePort or LoadBalancer type: + +```yaml +# Example service configuration +apiVersion: v1 +kind: Service +metadata: + name: myapp +spec: + type: NodePort + ports: + - port: 80 + targetPort: 8080 + nodePort: 32080 # This port will be accessible on ALL nodes + selector: + app: myapp +``` + +Then configure MikroTik to forward to the NodePort on any available node. + +## Testing the Failover + +1. Verify current routing: + ```bash + curl -v http://204.110.191.2 + ``` + +2. Shut down node1: + ```bash + ssh node1 sudo shutdown -h now + ``` + +3. Watch MikroTik logs and verify traffic switches: + ```mikrotik + /log print follow where topics~"info" + ``` + +4. Verify service remains accessible: + ```bash + curl -v http://204.110.191.2 + ``` \ No newline at end of file diff --git a/home/cluster/n8n/deploy.sh b/home/cluster/n8n/deploy.sh new file mode 100644 index 0000000..458d246 --- /dev/null +++ b/home/cluster/n8n/deploy.sh @@ -0,0 +1,35 @@ +#!/bin/bash + +echo "Deploying n8n to k3s cluster..." + +# Create namespace +kubectl apply -f namespace.yaml + +# Deploy PostgreSQL +kubectl apply -f secret.yaml +kubectl apply -f postgres-pvc.yaml +kubectl apply -f postgres-deployment.yaml + +# Wait for PostgreSQL to be ready +echo "Waiting for PostgreSQL to be ready..." +kubectl wait --for=condition=ready pod -l app=postgres -n n8n --timeout=300s + +# Deploy n8n +kubectl apply -f n8n-pvc.yaml +kubectl apply -f n8n-deployment.yaml + +# Wait for n8n to be ready +echo "Waiting for n8n to be ready..." +kubectl wait --for=condition=ready pod -l app=n8n -n n8n --timeout=300s + +# Create ingress +kubectl apply -f ingress.yaml + +echo "n8n deployment complete!" +echo "" +echo "Access n8n at: https://n8n.w5isp.com" +echo "" +echo "To check the deployment status:" +echo "kubectl get pods -n n8n" +echo "kubectl get svc -n n8n" +echo "kubectl get ingress -n n8n" \ No newline at end of file diff --git a/home/cluster/n8n/ingress.yaml b/home/cluster/n8n/ingress.yaml new file mode 100644 index 0000000..9d8fb29 --- /dev/null +++ b/home/cluster/n8n/ingress.yaml @@ -0,0 +1,25 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: n8n-ingress + namespace: n8n + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.entrypoints: "websecure" + traefik.ingress.kubernetes.io/router.tls: "true" +spec: + tls: + - hosts: + - n8n.w5isp.com + secretName: n8n-tls + rules: + - host: n8n.w5isp.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: n8n + port: + number: 5678 \ No newline at end of file diff --git a/home/cluster/n8n/n8n-deployment.yaml b/home/cluster/n8n/n8n-deployment.yaml new file mode 100644 index 0000000..beb7548 --- /dev/null +++ b/home/cluster/n8n/n8n-deployment.yaml @@ -0,0 +1,107 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: n8n-config + namespace: n8n +data: + N8N_HOST: "n8n.w5isp.com" + N8N_PORT: "5678" + N8N_PROTOCOL: "https" + N8N_EDITOR_BASE_URL: "https://n8n.w5isp.com/" + WEBHOOK_URL: "https://n8n.w5isp.com/" + N8N_METRICS: "true" + N8N_BASIC_AUTH_ACTIVE: "false" + DB_TYPE: "postgresdb" + DB_POSTGRESDB_HOST: "postgres" + DB_POSTGRESDB_PORT: "5432" + DB_POSTGRESDB_DATABASE: "n8n" + DB_POSTGRESDB_USER: "n8n" + EXECUTIONS_MODE: "regular" + N8N_PERSONALIZATION_ENABLED: "false" + N8N_VERSION_NOTIFICATIONS_ENABLED: "true" + N8N_HIDE_USAGE_PAGE: "true" + GENERIC_TIMEZONE: "America/Chicago" +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: n8n + namespace: n8n +spec: + replicas: 1 + selector: + matchLabels: + app: n8n + template: + metadata: + labels: + app: n8n + spec: + initContainers: + - name: fix-permissions + image: busybox + command: ['sh', '-c', 'chown -R 1000:1000 /home/node/.n8n'] + volumeMounts: + - name: n8n-data + mountPath: /home/node/.n8n + containers: + - name: n8n + image: n8nio/n8n:latest + ports: + - containerPort: 5678 + env: + - name: DB_POSTGRESDB_PASSWORD + valueFrom: + secretKeyRef: + name: n8n-secret + key: DB_POSTGRESDB_PASSWORD + - name: N8N_ENCRYPTION_KEY + valueFrom: + secretKeyRef: + name: n8n-secret + key: N8N_ENCRYPTION_KEY + envFrom: + - configMapRef: + name: n8n-config + volumeMounts: + - name: n8n-data + mountPath: /home/node/.n8n + resources: + requests: + memory: "512Mi" + cpu: "250m" + limits: + memory: "2048Mi" + cpu: "1000m" + livenessProbe: + httpGet: + path: /healthz + port: 5678 + initialDelaySeconds: 30 + periodSeconds: 30 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /healthz + port: 5678 + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + volumes: + - name: n8n-data + persistentVolumeClaim: + claimName: n8n-data +--- +apiVersion: v1 +kind: Service +metadata: + name: n8n + namespace: n8n +spec: + type: ClusterIP + selector: + app: n8n + ports: + - port: 5678 + targetPort: 5678 + name: http \ No newline at end of file diff --git a/home/cluster/n8n/n8n-pvc.yaml b/home/cluster/n8n/n8n-pvc.yaml new file mode 100644 index 0000000..9424854 --- /dev/null +++ b/home/cluster/n8n/n8n-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: n8n-data + namespace: n8n +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 5Gi \ No newline at end of file diff --git a/home/cluster/n8n/namespace.yaml b/home/cluster/n8n/namespace.yaml new file mode 100644 index 0000000..0a40b77 --- /dev/null +++ b/home/cluster/n8n/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: n8n \ No newline at end of file diff --git a/home/cluster/n8n/postgres-deployment.yaml b/home/cluster/n8n/postgres-deployment.yaml new file mode 100644 index 0000000..f55ecdd --- /dev/null +++ b/home/cluster/n8n/postgres-deployment.yaml @@ -0,0 +1,74 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: postgres + namespace: n8n +spec: + replicas: 1 + selector: + matchLabels: + app: postgres + template: + metadata: + labels: + app: postgres + spec: + containers: + - name: postgres + image: postgres:16-alpine + ports: + - containerPort: 5432 + env: + - name: POSTGRES_USER + value: "n8n" + - name: POSTGRES_DB + value: "n8n" + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: n8n-secret + key: POSTGRES_PASSWORD + - name: PGDATA + value: /var/lib/postgresql/data/pgdata + volumeMounts: + - name: postgres-data + mountPath: /var/lib/postgresql/data + resources: + requests: + memory: "256Mi" + cpu: "250m" + limits: + memory: "512Mi" + cpu: "500m" + livenessProbe: + exec: + command: + - /bin/sh + - -c + - pg_isready -U n8n + initialDelaySeconds: 30 + periodSeconds: 10 + readinessProbe: + exec: + command: + - /bin/sh + - -c + - pg_isready -U n8n + initialDelaySeconds: 5 + periodSeconds: 5 + volumes: + - name: postgres-data + persistentVolumeClaim: + claimName: postgres-data +--- +apiVersion: v1 +kind: Service +metadata: + name: postgres + namespace: n8n +spec: + selector: + app: postgres + ports: + - port: 5432 + targetPort: 5432 \ No newline at end of file diff --git a/home/cluster/n8n/postgres-pvc.yaml b/home/cluster/n8n/postgres-pvc.yaml new file mode 100644 index 0000000..55f37b8 --- /dev/null +++ b/home/cluster/n8n/postgres-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: postgres-data + namespace: n8n +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 10Gi \ No newline at end of file diff --git a/home/cluster/n8n/secret.yaml b/home/cluster/n8n/secret.yaml new file mode 100644 index 0000000..920f37c --- /dev/null +++ b/home/cluster/n8n/secret.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Secret +metadata: + name: n8n-secret + namespace: n8n +type: Opaque +stringData: + N8N_ENCRYPTION_KEY: "ExpDR3+Wmq1Q8Z9jDkDbt774/Rip4dZ7bor4z3lTquk=" + DB_POSTGRESDB_PASSWORD: "Nk+L6lf1x0BlQa3xIy9yDA8oHPGlcPyJyLLxSkALLWg=" + POSTGRES_PASSWORD: "Nk+L6lf1x0BlQa3xIy9yDA8oHPGlcPyJyLLxSkALLWg=" \ No newline at end of file diff --git a/home/cluster/node1.patch.yaml b/home/cluster/node1.patch.yaml new file mode 100644 index 0000000..8886995 --- /dev/null +++ b/home/cluster/node1.patch.yaml @@ -0,0 +1,29 @@ +machine: + # Static IP Configuration + network: + hostname: node1.w5isp.com + interfaces: + - deviceSelector: + physical: true + addresses: + - 10.0.101.21/24 + routes: + - network: 0.0.0.0/0 + gateway: 10.0.101.254 + dhcp: false + vlans: + - addresses: + - 204.110.191.2/27 + routes: + - network: 0.0.0.0/0 + gateway: 204.110.191.30 + vlanId: 9 + kubelet: + extraMounts: + - destination: /var/lib/longhorn + type: bind + source: /var/lib/longhorn + options: + - bind + - rshared + - rw diff --git a/home/cluster/node2.patch.yaml b/home/cluster/node2.patch.yaml new file mode 100644 index 0000000..46de701 --- /dev/null +++ b/home/cluster/node2.patch.yaml @@ -0,0 +1,22 @@ +machine: + # Static IP Configuration + network: + hostname: node2.w5isp.com + interfaces: + - deviceSelector: + physical: true + addresses: + - 10.0.101.22/24 + routes: + - network: 0.0.0.0/0 + gateway: 10.0.101.254 + dhcp: false + kubelet: + extraMounts: + - destination: /var/lib/longhorn + type: bind + source: /var/lib/longhorn + options: + - bind + - rshared + - rw diff --git a/home/cluster/node3.patch.yaml b/home/cluster/node3.patch.yaml new file mode 100644 index 0000000..6353567 --- /dev/null +++ b/home/cluster/node3.patch.yaml @@ -0,0 +1,22 @@ +machine: + # Static IP Configuration + network: + hostname: node3.w5isp.com + interfaces: + - deviceSelector: + physical: true + addresses: + - 10.0.101.23/24 + routes: + - network: 0.0.0.0/0 + gateway: 10.0.101.254 + dhcp: false + kubelet: + extraMounts: + - destination: /var/lib/longhorn + type: bind + source: /var/lib/longhorn + options: + - bind + - rshared + - rw diff --git a/home/cluster/nodered/deploy.sh b/home/cluster/nodered/deploy.sh new file mode 100644 index 0000000..28a9fde --- /dev/null +++ b/home/cluster/nodered/deploy.sh @@ -0,0 +1,34 @@ +#!/bin/bash + +echo "Deploying Node-RED to k3s cluster..." + +# Create namespace +kubectl apply -f namespace.yaml + +# Create PVC +kubectl apply -f pvc.yaml + +# Create settings ConfigMap +kubectl apply -f settings-configmap.yaml + +# Deploy Node-RED +kubectl apply -f deployment.yaml + +# Wait for Node-RED to be ready +echo "Waiting for Node-RED to be ready..." +kubectl wait --for=condition=ready pod -l app=nodered -n nodered --timeout=300s + +# Create service +kubectl apply -f service.yaml + +# Create ingress +kubectl apply -f ingress.yaml + +echo "Node-RED deployment complete!" +echo "" +echo "Access Node-RED at: https://nodered.w5isp.com" +echo "" +echo "To check the deployment status:" +echo "kubectl get pods -n nodered" +echo "kubectl get svc -n nodered" +echo "kubectl get ingress -n nodered" \ No newline at end of file diff --git a/home/cluster/nodered/deployment.yaml b/home/cluster/nodered/deployment.yaml new file mode 100644 index 0000000..15bb3dd --- /dev/null +++ b/home/cluster/nodered/deployment.yaml @@ -0,0 +1,74 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nodered + namespace: nodered +spec: + replicas: 1 + selector: + matchLabels: + app: nodered + template: + metadata: + labels: + app: nodered + spec: + initContainers: + - name: fix-permissions + image: busybox + command: ['sh', '-c'] + args: + - | + chown -R 1000:1000 /data + chmod 755 /data + volumeMounts: + - name: node-red-data + mountPath: /data + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + containers: + - name: nodered + image: nodered/node-red:latest + ports: + - containerPort: 1880 + env: + - name: TZ + value: "America/Chicago" + volumeMounts: + - name: node-red-data + mountPath: /data + - name: node-red-settings + mountPath: /data/settings.js + subPath: settings.js + resources: + requests: + memory: "256Mi" + cpu: "100m" + limits: + memory: "512Mi" + cpu: "500m" + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + volumes: + - name: node-red-data + persistentVolumeClaim: + claimName: nodered-data + - name: node-red-settings + configMap: + name: nodered-settings \ No newline at end of file diff --git a/home/cluster/nodered/ingress.yaml b/home/cluster/nodered/ingress.yaml new file mode 100644 index 0000000..e058fc4 --- /dev/null +++ b/home/cluster/nodered/ingress.yaml @@ -0,0 +1,57 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: nodered-tls + namespace: nodered +spec: + secretName: nodered-tls + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + dnsNames: + - nodered.w5isp.com +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: nodered-https + namespace: nodered +spec: + entryPoints: + - websecure + routes: + - match: Host(`nodered.w5isp.com`) + kind: Rule + services: + - name: nodered + port: 80 + tls: + secretName: nodered-tls +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: nodered-http + namespace: nodered +spec: + entryPoints: + - web + routes: + - match: Host(`nodered.w5isp.com`) + kind: Rule + services: + - name: nodered + port: 80 + middlewares: + - name: redirect-to-https +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: redirect-to-https + namespace: nodered +spec: + redirectScheme: + scheme: https + permanent: true \ No newline at end of file diff --git a/home/cluster/nodered/pvc.yaml b/home/cluster/nodered/pvc.yaml new file mode 100644 index 0000000..73fe3a9 --- /dev/null +++ b/home/cluster/nodered/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: nodered-data + namespace: nodered +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 5Gi \ No newline at end of file diff --git a/home/cluster/nodered/service.yaml b/home/cluster/nodered/service.yaml new file mode 100644 index 0000000..ec6fdfd --- /dev/null +++ b/home/cluster/nodered/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: nodered + namespace: nodered +spec: + type: ClusterIP + selector: + app: nodered + ports: + - port: 80 + targetPort: 1880 + protocol: TCP + name: http \ No newline at end of file diff --git a/home/cluster/nodered/settings-configmap.yaml b/home/cluster/nodered/settings-configmap.yaml new file mode 100644 index 0000000..a65316c --- /dev/null +++ b/home/cluster/nodered/settings-configmap.yaml @@ -0,0 +1,65 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: nodered-settings + namespace: nodered +data: + settings.js: | + module.exports = { + // The file containing the flows. + flowFile: 'flows.json', + + // Node-RED editor theme + editorTheme: { + page: { + title: "Node-RED - W5ISP" + }, + header: { + title: "Node-RED", + image: null + } + }, + + // Securing the Node-RED editor + adminAuth: { + type: "credentials", + users: [{ + username: "admin", + password: "$2b$08$dKYDBSTCOTgDVQqPNXCq/uzopu6XMbayUNtlvHhoLF0vNVbtscH.a", + permissions: "*" + }] + }, + + // Securing Node-RED API (optional, uncomment to enable) + // httpNodeAuth: {user:"user",pass:"$2b$08$eqrvB6AnIA68TG8yIJGDfumTlW0tSgUAcrnSxs.sy3mdNYUFZca/a"}, + + // Enable HTTPS (handled by Kubernetes Ingress) + requireHttps: false, + + // The maximum size of HTTP request body in bytes + apiMaxLength: '5mb', + + // Context Storage + contextStorage: { + default: { + module: "memory" + } + }, + + // Configure the logging + logging: { + console: { + level: "info", + metrics: false, + audit: false + } + }, + + // Disable the editor UI entirely + disableEditor: false, + + // Configure node settings + functionGlobalContext: { + // Add any global context variables here + } + } \ No newline at end of file diff --git a/home/cluster/schematic.yaml b/home/cluster/schematic.yaml new file mode 100644 index 0000000..7bf09c9 --- /dev/null +++ b/home/cluster/schematic.yaml @@ -0,0 +1,8 @@ +customization: + systemExtensions: + officialExtensions: + - siderolabs/iscsi-tools + - siderolabs/qemu-guest-agent + - siderolabs/tailscale + - siderolabs/util-linux-tools + diff --git a/home/cluster/tailscale.patch.yaml b/home/cluster/tailscale.patch.yaml new file mode 100644 index 0000000..27d190f --- /dev/null +++ b/home/cluster/tailscale.patch.yaml @@ -0,0 +1,5 @@ +apiVersion: v1alpha1 +kind: ExtensionServiceConfig +name: tailscale +environment: + - TS_AUTHKEY=tskey-auth-kQWvbQQPDQ11CNTRL-xzEZ6vSwfH22zJcVAHsFH2NemetVQ53Bg diff --git a/home/cluster/talosconfig b/home/cluster/talosconfig new file mode 100644 index 0000000..9d7adc1 --- /dev/null +++ b/home/cluster/talosconfig @@ -0,0 +1,7 @@ +context: home +contexts: + home: + endpoints: [] + ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLVENCM0tBREFnRUNBaEVBZ1VTcEExTk1IYnhBNmxLVXVXVC9FVEFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTWpZeE1ERTRNVFl3TVRFNFdqQVRNUkV3RHdZRApWUVFLRXdodmN6cGhaRzFwYmpBcU1BVUdBeXRsY0FNaEFPWDI2YXhRYWMyNkhmbmtpOEZSTnNUeWZMU1FQSWFhCkphSW1SRlY4aVQwT28wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0I0QXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUgKQXdJd0h3WURWUjBqQkJnd0ZvQVVralc5TkJ1UUkySTBTQTFaRk0xa05LYVRMNW93QlFZREsyVndBMEVBa25hTQpJVTFTNjE1eS9HWkFRb3VFcmQxcUdmaDkyd2IrTDR4NGxTc09Fa1VjdTBXM1EzN3RWbElsZlFnbDRaK3ZzV2IxCnhNSWhrWVFVNUFRRW5rb1VEdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJUHlOTHBLZmJqZm9DbGVlRUhpYjlCUUZYdlNhVndjWEtYMjhHOHFMNWt3OQotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K diff --git a/home/cluster/wavelog/README.md b/home/cluster/wavelog/README.md new file mode 100644 index 0000000..fc76c23 --- /dev/null +++ b/home/cluster/wavelog/README.md @@ -0,0 +1,67 @@ +# Wavelog Deployment + +Wavelog is an open source amateur radio logging application deployed on k3s cluster at 204.110.191.2. + +## Architecture + +- **Application**: Wavelog PHP application +- **Database**: MariaDB 11 (10GB storage) +- **Storage**: 20GB for config, backups, uploads, and QSL cards +- **Ingress**: Traefik with cert-manager for SSL (Let's Encrypt) +- **Access**: https://log.w5isp.com + +## Deployment + +```bash +# Deploy everything +./deploy.sh + +# Check status +kubectl get pods -n wavelog +kubectl get certificate -n wavelog +kubectl get ingressroute -n wavelog +``` + +## Initial Setup + +1. Visit https://log.w5isp.com/install +2. Database configuration: + - **Host**: mariadb + - **Database**: wavelog + - **Username**: wavelog + - **Password**: B58R2Ivh9jkVgdMBcRFbDSpYc + +3. Complete the installation wizard + +4. Default admin login (change immediately): + - **Username**: m0abc + - **Password**: demo + +## Files + +- `namespace.yaml` - Wavelog namespace +- `mariadb-secret.yaml` - Database credentials +- `mariadb-deployment.yaml` - MariaDB StatefulSet +- `wavelog-pvc.yaml` - Persistent storage for Wavelog data +- `wavelog-deployment.yaml` - Wavelog application deployment +- `wavelog-ingressroute.yaml` - Traefik ingress with SSL +- `deploy.sh` - Deployment script + +## Configuration + +- **PHP Settings**: + - Upload max: 50MB + - Post max: 50MB + - Memory limit: 256MB + - Execution time: 300s + +## Backup + +Wavelog stores backups in `/var/www/html/application/backup` which is persisted on the PVC. + +## Security + +- All passwords have been generated securely +- Database is only accessible within the cluster +- SSL/TLS encryption via Let's Encrypt +- Do not commit secret files to version control \ No newline at end of file diff --git a/home/cluster/wavelog/deploy.sh b/home/cluster/wavelog/deploy.sh new file mode 100644 index 0000000..af73040 --- /dev/null +++ b/home/cluster/wavelog/deploy.sh @@ -0,0 +1,47 @@ +#!/bin/bash +set -e + +echo "Deploying Wavelog to k3s cluster at 204.110.191.2" + +# Use homelab context +kubectl config use-context homelab + +# Create namespace +echo "Creating namespace..." +kubectl apply -f namespace.yaml + +# Deploy MariaDB +echo "Deploying MariaDB..." +kubectl apply -f mariadb-secret.yaml +kubectl apply -f mariadb-deployment.yaml + +# Wait for MariaDB to be ready +echo "Waiting for MariaDB to be ready..." +kubectl wait --for=condition=ready pod -l app=mariadb -n wavelog --timeout=300s + +# Deploy Wavelog +echo "Deploying Wavelog application..." +kubectl apply -f wavelog-pvc.yaml +kubectl apply -f wavelog-deployment.yaml + +# Deploy Traefik ingress +echo "Deploying Traefik ingress..." +kubectl apply -f wavelog-ingressroute.yaml + +echo "Deployment complete!" +echo "" +echo "To check status:" +echo "kubectl get pods -n wavelog" +echo "" +echo "Access Wavelog at: https://log.w5isp.com" +echo "" +echo "Initial setup:" +echo "1. Visit https://log.w5isp.com/install" +echo "2. Database Host: mariadb" +echo "3. Database Name: wavelog" +echo "4. Database User: wavelog" +echo "5. Database Password: B58R2Ivh9jkVgdMBcRFbDSpYc" +echo "" +echo "Default admin credentials (change after login):" +echo "Username: m0abc" +echo "Password: demo" \ No newline at end of file diff --git a/home/cluster/wavelog/mariadb-deployment.yaml b/home/cluster/wavelog/mariadb-deployment.yaml new file mode 100644 index 0000000..582cc6a --- /dev/null +++ b/home/cluster/wavelog/mariadb-deployment.yaml @@ -0,0 +1,67 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: mariadb + namespace: wavelog +spec: + selector: + app: mariadb + ports: + - port: 3306 + targetPort: 3306 + clusterIP: None +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: mariadb + namespace: wavelog +spec: + serviceName: mariadb + replicas: 1 + selector: + matchLabels: + app: mariadb + template: + metadata: + labels: + app: mariadb + spec: + containers: + - name: mariadb + image: mariadb:11 + ports: + - containerPort: 3306 + envFrom: + - secretRef: + name: mariadb-secret + volumeMounts: + - name: mariadb-storage + mountPath: /var/lib/mysql + livenessProbe: + tcpSocket: + port: 3306 + initialDelaySeconds: 60 + periodSeconds: 30 + readinessProbe: + tcpSocket: + port: 3306 + initialDelaySeconds: 30 + periodSeconds: 10 + resources: + requests: + memory: "512Mi" + cpu: "250m" + limits: + memory: "1Gi" + cpu: "500m" + volumeClaimTemplates: + - metadata: + name: mariadb-storage + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 10Gi \ No newline at end of file diff --git a/home/cluster/wavelog/mariadb-secret.yaml b/home/cluster/wavelog/mariadb-secret.yaml new file mode 100644 index 0000000..eea5c87 --- /dev/null +++ b/home/cluster/wavelog/mariadb-secret.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: mariadb-secret + namespace: wavelog +type: Opaque +stringData: + MYSQL_ROOT_PASSWORD: "SBcy7eZC6lLR5sSkQCkhmC1MXlA" + MYSQL_DATABASE: "wavelog" + MYSQL_USER: "wavelog" + MYSQL_PASSWORD: "B58R2Ivh9jkVgdMBcRFbDSpYc" \ No newline at end of file diff --git a/home/cluster/wavelog/namespace.yaml b/home/cluster/wavelog/namespace.yaml new file mode 100644 index 0000000..4517736 --- /dev/null +++ b/home/cluster/wavelog/namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: wavelog \ No newline at end of file diff --git a/home/cluster/wavelog/wavelog-config-job.yaml b/home/cluster/wavelog/wavelog-config-job.yaml new file mode 100644 index 0000000..5174730 --- /dev/null +++ b/home/cluster/wavelog/wavelog-config-job.yaml @@ -0,0 +1,56 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: wavelog-configure + namespace: wavelog +spec: + template: + spec: + restartPolicy: Never + containers: + - name: configure + image: ghcr.io/wavelog/wavelog:latest + command: ["/bin/bash", "-c"] + args: + - | + set -e + echo "Creating Wavelog configuration files..." + + # Create database.php + cat > /config/database.php <<'EOF' + '', + 'hostname' => 'mariadb.data.svc.cluster.local', + 'username' => 'wavelog', + 'password' => 's7hDEobNpX08UQxewlSLyrMGjbdnIcuw', + 'database' => 'wavelog', + 'dbdriver' => 'mysqli', + 'dbprefix' => '', + 'pconnect' => FALSE, + 'db_debug' => FALSE, + 'cache_on' => FALSE, + 'cachedir' => '', + 'char_set' => 'utf8mb4', + 'dbcollat' => 'utf8mb4_general_ci', + 'swap_pre' => '', + 'encrypt' => FALSE, + 'compress' => FALSE, + 'stricton' => FALSE, + 'failover' => array(), + 'save_queries' => TRUE + ); + EOF + + echo "Configuration complete!" + volumeMounts: + - name: wavelog-data + mountPath: /config + subPath: config + volumes: + - name: wavelog-data + persistentVolumeClaim: + claimName: wavelog-data \ No newline at end of file diff --git a/home/cluster/wavelog/wavelog-deployment.yaml b/home/cluster/wavelog/wavelog-deployment.yaml new file mode 100644 index 0000000..0afa7de --- /dev/null +++ b/home/cluster/wavelog/wavelog-deployment.yaml @@ -0,0 +1,176 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: wavelog-config + namespace: wavelog +data: + # PHP configuration overrides + php.ini: | + upload_max_filesize = 50M + post_max_size = 50M + memory_limit = 256M + max_execution_time = 300 +--- +apiVersion: v1 +kind: Service +metadata: + name: wavelog + namespace: wavelog +spec: + type: ClusterIP + selector: + app: wavelog + ports: + - port: 80 + targetPort: 80 +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: wavelog + namespace: wavelog +spec: + replicas: 1 + selector: + matchLabels: + app: wavelog + template: + metadata: + labels: + app: wavelog + spec: + initContainers: + - name: fix-permissions + image: busybox:latest + command: ["sh", "-c"] + args: + - | + echo "Fixing permissions for Wavelog directories..." + # Create all required directories + mkdir -p /var/www/html/application/config + mkdir -p /var/www/html/application/logs + mkdir -p /var/www/html/backup + mkdir -p /var/www/html/updates + mkdir -p /var/www/html/uploads + mkdir -p /var/www/html/images/eqsl_card_images + mkdir -p /var/www/html/assets/qslcard + + # Set ownership to www-data (UID 33) + chown -R 33:33 /var/www/html/application/config + chown -R 33:33 /var/www/html/application/logs + chown -R 33:33 /var/www/html/backup + chown -R 33:33 /var/www/html/updates + chown -R 33:33 /var/www/html/uploads + chown -R 33:33 /var/www/html/images/eqsl_card_images + chown -R 33:33 /var/www/html/assets/qslcard + + # Set directory permissions + find /var/www/html/application/config -type d -exec chmod 755 {} \; + find /var/www/html/application/logs -type d -exec chmod 755 {} \; + find /var/www/html/backup -type d -exec chmod 755 {} \; + find /var/www/html/updates -type d -exec chmod 755 {} \; + find /var/www/html/uploads -type d -exec chmod 755 {} \; + find /var/www/html/images/eqsl_card_images -type d -exec chmod 755 {} \; + find /var/www/html/assets/qslcard -type d -exec chmod 755 {} \; + + # Set file permissions + find /var/www/html/application/config -type f -exec chmod 664 {} \; + find /var/www/html/application/logs -type f -exec chmod 664 {} \; + find /var/www/html/backup -type f -exec chmod 664 {} \; + find /var/www/html/updates -type f -exec chmod 664 {} \; + find /var/www/html/uploads -type f -exec chmod 664 {} \; + find /var/www/html/images/eqsl_card_images -type f -exec chmod 664 {} \; + find /var/www/html/assets/qslcard -type f -exec chmod 664 {} \; + + echo "Permissions fixed!" + volumeMounts: + - name: wavelog-data + mountPath: /var/www/html/application/config + subPath: config + - name: wavelog-data + mountPath: /var/www/html/application/logs + subPath: logs + - name: wavelog-data + mountPath: /var/www/html/backup + subPath: backup-root + - name: wavelog-data + mountPath: /var/www/html/updates + subPath: updates + - name: wavelog-data + mountPath: /var/www/html/uploads + subPath: uploads-root + - name: wavelog-data + mountPath: /var/www/html/images/eqsl_card_images + subPath: eqsl_card_images + - name: wavelog-data + mountPath: /var/www/html/assets/qslcard + subPath: qslcard + containers: + - name: wavelog + image: ghcr.io/wavelog/wavelog:latest + ports: + - containerPort: 80 + env: + - name: MYSQL_HOST + value: "mariadb.data.svc.cluster.local" + - name: MYSQL_PORT + value: "3306" + - name: MYSQL_DATABASE + value: "wavelog" + - name: MYSQL_USER + value: "wavelog" + - name: MYSQL_PASSWORD + valueFrom: + secretKeyRef: + name: wavelog-secret + key: database-password + volumeMounts: + - name: wavelog-data + mountPath: /var/www/html/application/config + subPath: config + - name: wavelog-data + mountPath: /var/www/html/application/logs + subPath: logs + - name: wavelog-data + mountPath: /var/www/html/backup + subPath: backup-root + - name: wavelog-data + mountPath: /var/www/html/updates + subPath: updates + - name: wavelog-data + mountPath: /var/www/html/uploads + subPath: uploads-root + - name: wavelog-data + mountPath: /var/www/html/images/eqsl_card_images + subPath: eqsl_card_images + - name: wavelog-data + mountPath: /var/www/html/assets/qslcard + subPath: qslcard + - name: php-config + mountPath: /usr/local/etc/php/conf.d/custom.ini + subPath: php.ini + livenessProbe: + tcpSocket: + port: 80 + initialDelaySeconds: 30 + periodSeconds: 30 + readinessProbe: + tcpSocket: + port: 80 + initialDelaySeconds: 10 + periodSeconds: 10 + resources: + requests: + memory: "256Mi" + cpu: "200m" + limits: + memory: "512Mi" + cpu: "500m" + volumes: + - name: wavelog-data + persistentVolumeClaim: + claimName: wavelog-data + - name: php-config + configMap: + name: wavelog-config \ No newline at end of file diff --git a/home/cluster/wavelog/wavelog-ingress.yaml b/home/cluster/wavelog/wavelog-ingress.yaml new file mode 100644 index 0000000..9ff5328 --- /dev/null +++ b/home/cluster/wavelog/wavelog-ingress.yaml @@ -0,0 +1,25 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: wavelog-ingress + namespace: wavelog + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.entrypoints: "websecure" +spec: + ingressClassName: traefik + tls: + - hosts: + - log.w5isp.com + secretName: wavelog-tls + rules: + - host: log.w5isp.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: wavelog + port: + number: 80 \ No newline at end of file diff --git a/home/cluster/wavelog/wavelog-ingressroute.yaml b/home/cluster/wavelog/wavelog-ingressroute.yaml new file mode 100644 index 0000000..710b84d --- /dev/null +++ b/home/cluster/wavelog/wavelog-ingressroute.yaml @@ -0,0 +1,57 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wavelog-cert + namespace: wavelog +spec: + secretName: wavelog-tls + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + dnsNames: + - log.w5isp.com +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: wavelog-https + namespace: wavelog +spec: + entryPoints: + - websecure + routes: + - match: Host(`log.w5isp.com`) + kind: Rule + services: + - name: wavelog + port: 80 + tls: + secretName: wavelog-tls +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: wavelog-http + namespace: wavelog +spec: + entryPoints: + - web + routes: + - match: Host(`log.w5isp.com`) + kind: Rule + services: + - name: wavelog + port: 80 + middlewares: + - name: redirect-to-https +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: redirect-to-https + namespace: wavelog +spec: + redirectScheme: + scheme: https + permanent: true \ No newline at end of file diff --git a/home/cluster/wavelog/wavelog-pvc.yaml b/home/cluster/wavelog/wavelog-pvc.yaml new file mode 100644 index 0000000..e7277a9 --- /dev/null +++ b/home/cluster/wavelog/wavelog-pvc.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: wavelog-data + namespace: wavelog +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 20Gi \ No newline at end of file diff --git a/home/cluster/wavelog/wavelog-secret.yaml b/home/cluster/wavelog/wavelog-secret.yaml new file mode 100644 index 0000000..bdada7a --- /dev/null +++ b/home/cluster/wavelog/wavelog-secret.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Secret +metadata: + name: wavelog-secret + namespace: wavelog +type: Opaque +stringData: + database-host: "mariadb.data.svc.cluster.local" + database-name: "wavelog" + database-user: "wavelog" + database-password: "s7hDEobNpX08UQxewlSLyrMGjbdnIcuw" \ No newline at end of file diff --git a/home/cluster/worker.yaml b/home/cluster/worker.yaml new file mode 100644 index 0000000..e1ef867 --- /dev/null +++ b/home/cluster/worker.yaml @@ -0,0 +1,580 @@ +version: v1alpha1 # Indicates the schema used to decode the contents. +debug: false # Enable verbose logging to the console. +persist: true +# Provides machine specific configuration options. +machine: + type: worker # Defines the role of the machine within the cluster. + token: l1ubxp.d942qc3plno7pxlw # The `token` is used by a machine to join the PKI of the cluster. + # The root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: "" + # Extra certificate subject alternative names for the machine's certificate. + certSANs: [] + # # Uncomment this to enable SANs. + # - 10.0.0.10 + # - 172.16.0.10 + # - 192.168.0.10 + + # Used to provide additional options to the kubelet. + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.34.0 # The `image` field is an optional reference to an alternative kubelet image. + defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. + disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraArgs` field is used to provide additional flags to the kubelet. + # extraArgs: + # key: value + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 + # Provides machine specific network configuration options. + network: {} + # # `interfaces` is used to define the network interface configuration. + # interfaces: + # - interface: enp0s1 # The interface name. + # # Assigns static IP addresses to the interface. + # addresses: + # - 192.168.2.0/24 + # # A list of routes associated with the interface. + # routes: + # - network: 0.0.0.0/0 # The route's network (destination). + # gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). + # metric: 1024 # The optional metric for the route. + # mtu: 1500 # The interface's MTU. + # + # # # Picks a network device using the selector. + + # # # select a device with bus prefix 00:*. + # # deviceSelector: + # # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # # deviceSelector: + # # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # # driver: virtio_net # Kernel driver, supports matching by wildcard. + # # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver. + # # deviceSelector: + # # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # # driver: virtio_net # Kernel driver, supports matching by wildcard. + + # # # Bond specific options. + # # bond: + # # # The interfaces that make up the bond. + # # interfaces: + # # - enp2s0 + # # - enp2s1 + # # # Picks a network device using the selector. + # # deviceSelectors: + # # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard. + # # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard. + # # driver: virtio_net # Kernel driver, supports matching by wildcard. + # # mode: 802.3ad # A bond option. + # # lacpRate: fast # A bond option. + + # # # Bridge specific options. + # # bridge: + # # # The interfaces that make up the bridge. + # # interfaces: + # # - enxda4042ca9a51 + # # - enxae2a6774c259 + # # # Enable STP on this bridge. + # # stp: + # # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. + + # # # Configure this device as a bridge port. + # # bridgePort: + # # master: br0 # The name of the bridge master interface + + # # # Indicates if DHCP should be used to configure the interface. + # # dhcp: true + + # # # DHCP specific options. + # # dhcpOptions: + # # routeMetric: 1024 # The priority of all routes received via DHCP. + + # # # Wireguard specific configuration. + + # # # wireguard server example + # # wireguard: + # # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # listenPort: 51111 # Specifies a device's listening port. + # # # Specifies a list of peer configurations to apply to a device. + # # peers: + # # - publicKey: ABCDEF... # Specifies the public key of this peer. + # # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. + # # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # # allowedIPs: + # # - 192.168.1.0/24 + # # # wireguard peer example + # # wireguard: + # # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). + # # # Specifies a list of peer configurations to apply to a device. + # # peers: + # # - publicKey: ABCDEF... # Specifies the public key of this peer. + # # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry. + # # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. + # # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. + # # allowedIPs: + # # - 192.168.1.0/24 + + # # # Virtual (shared) IP address configuration. + + # # # layer2 vip example + # # vip: + # # ip: 172.16.199.55 # Specifies the IP address to be used. + + # # Used to statically set the nameservers for the machine. + # nameservers: + # - 8.8.8.8 + # - 1.1.1.1 + + # # Used to statically set arbitrary search domains. + # searchDomains: + # - example.org + # - example.com + + # # Allows for extra entries to be added to the `/etc/hosts` file + # extraHostEntries: + # - ip: 192.168.1.100 # The IP of the host. + # # The host alias. + # aliases: + # - example + # - example.domain.tld + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. + + # Used to provide instructions for installations. + install: + disk: /dev/nvme0n1 # The disk used for installations. + image: ghcr.io/siderolabs/installer:v1.11.1 # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + + # # Allows for supplying extra kernel args via the bootloader. + # extraKernelArgs: + # - talos.platform=metal + # - reboot=k + # Used to configure the machine's container image registry mirrors. + registries: {} + # # Specifies mirror configuration for each registry host namespace. + # mirrors: + # ghcr.io: + # # List of endpoints (URLs) for registry mirrors to use. + # endpoints: + # - https://registry.insecure + # - https://ghcr.io/v2/ + + # # Specifies TLS & auth configuration for HTTPS image registries. + # config: + # registry.insecure: + # # The TLS configuration for the registry. + # tls: + # insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). + # + # # # Enable mutual TLS authentication with the registry. + # # clientIdentity: + # # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # + # # # The auth configuration for this registry. + # # auth: + # # username: username # Optional registry authentication. + # # password: password # Optional registry authentication. + + # Features describe individual Talos features that can be switched on or off. + features: + rbac: true # Enable role-based access control (RBAC). + stableHostname: true # Enable stable default hostname. + apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid. + diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. + # KubePrism - local proxy/load balancer on defined port that will distribute + kubePrism: + enabled: true # Enable KubePrism support - will start local load balancing proxy. + port: 7445 # KubePrism port. + # Configures host DNS caching resolver. + hostDNS: + enabled: true # Enable host DNS caching resolver. + forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system + + # # Provides machine specific control plane configuration options. + + # # ControlPlane definition example. + # controlPlane: + # # Controller manager machine specific configuration options. + # controllerManager: + # disabled: false # Disable kube-controller-manager on the node. + # # Scheduler machine specific configuration options. + # scheduler: + # disabled: true # Disable kube-scheduler on the node. + + # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. + + # # nginx static pod. + # pods: + # - apiVersion: v1 + # kind: pod + # metadata: + # name: nginx + # spec: + # containers: + # - image: nginx + # name: nginx + + # # Allows the addition of user specified files. + + # # MachineFiles usage example. + # files: + # - content: '...' # The contents of the file. + # permissions: 0o666 # The file's permissions in octal. + # path: /tmp/file.txt # The path of the file. + # op: append # The operation to use + + # # The `env` field allows for the addition of environment variables. + + # # Environment variables definition examples. + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: info + # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + # https_proxy: http://SERVER:PORT/ + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: error + # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ + # env: + # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ + + # # Used to configure the machine's time settings. + + # # Example configuration for cloudflare ntp server. + # time: + # disabled: false # Indicates if the time service is disabled for the machine. + # # description: | + # servers: + # - time.cloudflare.com + # bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. + + # # Used to configure the machine's sysctls. + + # # MachineSysctls usage example. + # sysctls: + # kernel.domainname: talos.dev + # net.ipv4.ip_forward: "0" + # net/ipv6/conf/eth0.100/disable_ipv6: "1" + + # # Used to configure the machine's sysfs. + + # # MachineSysfs usage example. + # sysfs: + # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance + + # # Configures the udev system. + # udev: + # # List of udev rules to apply to the udev system + # rules: + # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" + + # # Configures the logging system. + # logging: + # # Logging destination. + # destinations: + # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + # format: json_lines # Logs format. + + # # Configures the kernel. + # kernel: + # # Kernel modules to load. + # modules: + # - name: brtfs # Module name. + + # # Configures the seccomp profiles for the machine. + # seccompProfiles: + # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # # The `value` field is used to provide the seccomp profile. + # value: + # defaultAction: SCMP_ACT_LOG + + # # Override (patch) settings in the default OCI runtime spec for CRI containers. + + # # override default open file limit + # baseRuntimeSpecOverrides: + # process: + # rlimits: + # - hard: 1024 + # soft: 1024 + # type: RLIMIT_NOFILE + + # # Configures the node labels for the machine. + + # # node labels example. + # nodeLabels: + # exampleLabel: exampleLabelValue + + # # Configures the node annotations for the machine. + + # # node annotations example. + # nodeAnnotations: + # customer.io/rack: r13a25 + + # # Configures the node taints for the machine. Effect is optional. + + # # node taints example. + # nodeTaints: + # exampleTaint: exampleTaintValue:NoSchedule +# Provides cluster specific configuration options. +cluster: + id: eaZ-ULVPPORjVzp1Y4XpAOn4X8_UQTHwuGMLfNGZKgM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: 0CQQzq2WnliOSsobOhMsAARA77nM8Phz6XiADm+IfzI= # Shared secret of cluster (base64 encoded random 32 bytes). + # Provides control plane specific configuration options. + controlPlane: + endpoint: https://10.0.101.21:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + clusterName: home # Configures the cluster's name. + # Provides cluster specific network configuration options. + network: + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 + + # # The CNI used. + # cni: + # name: custom # Name of CNI to use. + # # URLs containing manifests to apply for the CNI. + # urls: + # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml + token: ehxond.kiubhs6w8x46jo2r # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + # The base64 encoded root certificate authority used by Kubernetes. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQVBlNFgzZjZEUjBMbU00dzI2TXZ6V2N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV3TVRneE5qQXhNVGhhRncwek5URXdNVFl4TmpBeApNVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVNIZWpBdWVwdjRXelpxTDkvSzNLdDdkSm1EaCtxWXI3Y2Q1QzB3S0J5RTYyZnRtRjg3TktJc3R1WU8KYkdWb1BjQ0QyVzU3YVVEdGl5dVVmWlJUdDczcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGSXZuSlh1eVZVVWtFZVlxQy8rU2ZDUUwyQ2tpTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUVZcmRtSkYKaVVoM2xIaWlSSzJCamF6N3hyUjkvM2lDblZ2bm5meWlnbVNDQWlFQS9CSW9PWWJ2WmU5K2J0emo2b0tlaGRQcwo3R2Y3TTJYK0xhMlRQc3pMemswPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: "" + # Configures cluster member discovery. + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: + disabled: true # Disable Kubernetes discovery registry. + # Service registry is using an external service to push and pull information about cluster members. + service: {} + # # External service endpoint. + # endpoint: https://discovery.talos.dev/ + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. + + # # AggregatorCA example. + # aggregatorCA: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # The base64 encoded private key for service account token generation. + + # # AggregatorCA example. + # serviceAccount: + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # API server specific configuration options. + # apiServer: + # image: registry.k8s.io/kube-apiserver:v1.34.0 # The container image used in the API server manifest. + # # Extra arguments to supply to the API server. + # extraArgs: + # feature-gates: ServerSideApply=true + # http2-max-streams-per-connection: "32" + # # Extra certificate subject alternative names for the API server's certificate. + # certSANs: + # - 1.2.3.4 + # - 4.5.6.7 + # # Configure the API server admission plugins. + # admissionControl: + # - name: PodSecurity # Name is the name of the admission controller. + # # Configuration is an embedded configuration object to be used as the plugin's + # configuration: + # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + # defaults: + # audit: restricted + # audit-version: latest + # enforce: baseline + # enforce-version: latest + # warn: restricted + # warn-version: latest + # exemptions: + # namespaces: + # - kube-system + # runtimeClasses: [] + # usernames: [] + # kind: PodSecurityConfiguration + # # Configure the API server audit policy. + # auditPolicy: + # apiVersion: audit.k8s.io/v1 + # kind: Policy + # rules: + # - level: Metadata + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s + + # # Controller manager server specific configuration options. + # controllerManager: + # image: registry.k8s.io/kube-controller-manager:v1.34.0 # The container image used in the controller manager manifest. + # # Extra arguments to supply to the controller manager. + # extraArgs: + # feature-gates: ServerSideApply=true + + # # Kube-proxy server-specific configuration options + # proxy: + # disabled: false # Disable kube-proxy deployment on cluster bootstrap. + # image: registry.k8s.io/kube-proxy:v1.34.0 # The container image used in the kube-proxy manifest. + # mode: ipvs # proxy mode of kube-proxy. + # # Extra arguments to supply to kube-proxy. + # extraArgs: + # proxy-mode: iptables + + # # Scheduler server specific configuration options. + # scheduler: + # image: registry.k8s.io/kube-scheduler:v1.34.0 # The container image used in the scheduler manifest. + # # Extra arguments to supply to the scheduler. + # extraArgs: + # feature-gates: AllBeta=true + + # # Etcd specific configuration options. + # etcd: + # image: gcr.io/etcd-development/etcd:v3.6.4 # The container image used to create the etcd service. + # # The `ca` is the root certificate authority of the PKI. + # ca: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # # Extra arguments to supply to etcd. + # extraArgs: + # election-timeout: "5000" + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 + + # # Core DNS specific configuration options. + # coreDNS: + # image: registry.k8s.io/coredns/coredns:v1.12.3 # The `image` field is an override to the default coredns image. + + # # External cloud provider configuration. + # externalCloudProvider: + # enabled: true # Enable external cloud provider. + # # A list of urls that point to additional manifests for an external cloud provider. + # manifests: + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml + + # # A list of urls that point to additional manifests. + # extraManifests: + # - https://www.example.com/manifest1.yaml + # - https://www.example.com/manifest2.yaml + + # # A map of key value pairs that will be added while fetching the extraManifests. + # extraManifestHeaders: + # Token: "1234567" + # X-ExtraInfo: info + + # # A list of inline Kubernetes manifests. + # inlineManifests: + # - name: namespace-ci # Name of the manifest. + # contents: |- # Manifest contents as a string. + # apiVersion: v1 + # kind: Namespace + # metadata: + # name: ci + + # # Settings for admin kubeconfig generation. + # adminKubeconfig: + # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). + + # # Allows running workload on control-plane nodes. + # allowSchedulingOnControlPlanes: true diff --git a/talos/configs/talos-cp1.yaml b/talos/configs/talos-cp1.yaml index 653f1f7..e9427bd 100644 --- a/talos/configs/talos-cp1.yaml +++ b/talos/configs/talos-cp1.yaml @@ -114,7 +114,13 @@ machine: # Configures the node labels for the machine. nodeLabels: node.kubernetes.io/exclude-from-external-load-balancers: "" - + # Configures the machine's time settings. + time: + servers: + - 0.us.pool.ntp.org + - 1.us.pool.ntp.org + - 2.us.pool.ntp.org + # # Provides machine specific control plane configuration options. # # ControlPlane definition example. diff --git a/talos/configs/talos-cp2.yaml b/talos/configs/talos-cp2.yaml index a0dc76f..82a09d0 100644 --- a/talos/configs/talos-cp2.yaml +++ b/talos/configs/talos-cp2.yaml @@ -114,7 +114,13 @@ machine: # Configures the node labels for the machine. nodeLabels: node.kubernetes.io/exclude-from-external-load-balancers: "" - + # Configures the machine's time settings. + time: + servers: + - 0.us.pool.ntp.org + - 1.us.pool.ntp.org + - 2.us.pool.ntp.org + # # Provides machine specific control plane configuration options. # # ControlPlane definition example. diff --git a/talos/configs/talos-cp3.yaml b/talos/configs/talos-cp3.yaml index 2d83faf..35ccd79 100644 --- a/talos/configs/talos-cp3.yaml +++ b/talos/configs/talos-cp3.yaml @@ -114,7 +114,13 @@ machine: # Configures the node labels for the machine. nodeLabels: node.kubernetes.io/exclude-from-external-load-balancers: "" - + # Configures the machine's time settings. + time: + servers: + - 0.us.pool.ntp.org + - 1.us.pool.ntp.org + - 2.us.pool.ntp.org + # # Provides machine specific control plane configuration options. # # ControlPlane definition example. diff --git a/talos/configs/talos-worker1.yaml b/talos/configs/talos-worker1.yaml index 2776d89..17aae86 100644 --- a/talos/configs/talos-worker1.yaml +++ b/talos/configs/talos-worker1.yaml @@ -207,6 +207,13 @@ machine: # soft: 1024 # type: RLIMIT_NOFILE + # Configures the machine's time settings. + time: + servers: + - 0.us.pool.ntp.org + - 1.us.pool.ntp.org + - 2.us.pool.ntp.org + # # Configures the node labels for the machine. # # node labels example. diff --git a/talos/configs/talos-worker2.yaml b/talos/configs/talos-worker2.yaml index 3a08b0d..123cc8d 100644 --- a/talos/configs/talos-worker2.yaml +++ b/talos/configs/talos-worker2.yaml @@ -207,6 +207,13 @@ machine: # soft: 1024 # type: RLIMIT_NOFILE + # Configures the machine's time settings. + time: + servers: + - 0.us.pool.ntp.org + - 1.us.pool.ntp.org + - 2.us.pool.ntp.org + # # Configures the node labels for the machine. # # node labels example. diff --git a/talos/configs/talos-worker3.yaml b/talos/configs/talos-worker3.yaml index 9d7f6c2..83e5287 100644 --- a/talos/configs/talos-worker3.yaml +++ b/talos/configs/talos-worker3.yaml @@ -207,6 +207,13 @@ machine: # soft: 1024 # type: RLIMIT_NOFILE + # Configures the machine's time settings. + time: + servers: + - 0.us.pool.ntp.org + - 1.us.pool.ntp.org + - 2.us.pool.ntp.org + # # Configures the node labels for the machine. # # node labels example. diff --git a/terraform/.sync-conflict-20260129-154537-ZJZJYMM.envrc b/terraform/.sync-conflict-20260129-154537-ZJZJYMM.envrc new file mode 100644 index 0000000..5005926 --- /dev/null +++ b/terraform/.sync-conflict-20260129-154537-ZJZJYMM.envrc @@ -0,0 +1,12 @@ +# OpenTofu CLI arguments +export TF_CLI_ARGS_plan="-parallelism=5" +export TF_CLI_ARGS_apply="-parallelism=5" + +# HTTP Backend configuration (GitLab) +export TF_HTTP_ADDRESS="https://gitlab.com/api/v4/projects/77152227/terraform/state/gitlab" +export TF_HTTP_LOCK_ADDRESS="https://gitlab.com/api/v4/projects/77152227/terraform/state/gitlab/lock" +export TF_HTTP_UNLOCK_ADDRESS="https://gitlab.com/api/v4/projects/77152227/terraform/state/gitlab/lock" +export TF_HTTP_LOCK_METHOD="POST" +export TF_HTTP_UNLOCK_METHOD="DELETE" +export TF_HTTP_USERNAME="graham" +export TF_HTTP_PASSWORD="glpat-sHvHvna6AgdoSiJ-HE7PyW86MQp1OjFmcAk.01.0z0j9iera" diff --git a/terraform/.terraform.lock.sync-conflict-20260129-152957-ZJZJYMM.hcl b/terraform/.terraform.lock.sync-conflict-20260129-152957-ZJZJYMM.hcl new file mode 100644 index 0000000..361726b --- /dev/null +++ b/terraform/.terraform.lock.sync-conflict-20260129-152957-ZJZJYMM.hcl @@ -0,0 +1,128 @@ +# This file is maintained automatically by "tofu init". +# Manual edits may be lost in future updates. + +provider "registry.opentofu.org/cloudflare/cloudflare" { + version = "5.15.0" + constraints = "~> 5.0" + hashes = [ + "h1:EY8mWQO1NTqXuxnZxwVppF7AiLRdx7vRLYk6O7yzgPs=", + "zh:20a72bdbb28435f11d165b367732369e8f8163100a214e89ad720dae03fafa0c", + "zh:2eabd7a51fd7aafcab9861631d85c895914857e4fcd6fe2dd80bac22e74a1f47", + "zh:62828afbc1ba0e0a64bbb7d5d42ae3c2fbbaabb793010b07eba770ba91bae94f", + "zh:6693f1021e52c34a629300fbcd91f8bd4ca386fda3b45aec746b9c200c28a42c", + "zh:6873a15454b289e5baecc1d36ce8997266438761386a320753c63f13407f4a6b", + "zh:afbf4e56b3a5e5950b35b02b553313e4a2008415920b23f536682269c64ca549", + "zh:db367612900bc2e5a01c6a325e4cff9b1b04960ce9de3dd41671dda5a627ca1d", + "zh:eb7365eafc6160c3b304a9ce6a598e5400a2e779e9e2bd27976df244f79f774f", + "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", + ] +} + +provider "registry.opentofu.org/dnsimple/dnsimple" { + version = "2.0.0" + constraints = "~> 2.0" + hashes = [ + "h1:wWsupXlmlShs8m4C2dTaNcYTxFJtDipftKWlXk+jX1U=", + "zh:0fb015799f6d37323cdc2776eed67657721df24311bf5b458f7fcce65ec66dea", + "zh:533cd0f6edd4ed6610b324b39aa3abb5e84293a3aaa176042826f17f10a20557", + "zh:77d13ff083eeeb408822e885934925b9010462ca7601d35f2a1c2b0d5faf2f52", + "zh:9be63f37c98050a30e43066805ac70db3e3ddfcf03607c9c8d8d13ebd3503648", + "zh:a66a61ab90840b5ae9513f302f76e2348acb8bca50cb702e1f6fbcd24b1111fb", + "zh:b65d2f77f20a9587f169aaeccd8e12f07a713294fd687043ff041538c5da5cf9", + "zh:c24faaefb7f87050f1dfbf6c7a9a522df07ab97e9ce73d7fd20bce761d092076", + "zh:d0072167c5f52cd63e245d6b136a8e62979c0b0979fbea5a07015d5bfb6e7191", + "zh:d07dee2322cf12ffc439059f7f3a58a5d740fe7ad934f96b84b0be3257ee31cb", + "zh:d0c898dcc7d51427348d641474a74521c029d2cd9713f262e404f5fb36f4c3a5", + "zh:d9322e1a3dba21316713ada4b8de6c4090ca6b76b418ef55b85dbe7c0a578391", + "zh:e0e0b5f07293ff2c0ddb1c561dcb430924897022995006c4bb71719cf3995d9d", + "zh:e4eb3deac11f7798ea991fd044aec6a23592cbd887a7f3d1d415e8f553ba7b39", + "zh:f1d307fe43f3a8be6a97111dbe025ccd0bb4a5c8dadd54abc48adec8701336b1", + "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", + ] +} + +provider "registry.opentofu.org/hashicorp/null" { + version = "3.2.4" + constraints = "~> 3.0" + hashes = [ + "h1:i+WKhUHL2REY5EGmiHjfUljJB8UKZ9QdhdM5uTeUhC4=", + "zh:1769783386610bed8bb1e861a119fe25058be41895e3996d9216dd6bb8a7aee3", + "zh:32c62a9387ad0b861b5262b41c5e9ed6e940eda729c2a0e58100e6629af27ddb", + "zh:339bf8c2f9733fce068eb6d5612701144c752425cebeafab36563a16be460fb2", + "zh:36731f23343aee12a7e078067a98644c0126714c4fe9ac930eecb0f2361788c4", + "zh:3d106c7e32a929e2843f732625a582e562ff09120021e510a51a6f5d01175b8d", + "zh:74bcb3567708171ad83b234b92c9d63ab441ef882b770b0210c2b14fdbe3b1b6", + "zh:90b55bdbffa35df9204282251059e62c178b0ac7035958b93a647839643c0072", + "zh:ae24c0e5adc692b8f94cb23a000f91a316070fdc19418578dcf2134ff57cf447", + "zh:b5c10d4ad860c4c21273203d1de6d2f0286845edf1c64319fa2362df526b5f58", + "zh:e05bbd88e82e1d6234988c85db62fd66f11502645838fff594a2ec25352ecd80", + ] +} + +provider "registry.opentofu.org/kyswtn/porkbun" { + version = "0.1.3" + constraints = "~> 0.1" + hashes = [ + "h1:9PQILbIAiWdXCl+alkJ66h0uPm8wMgKfFaowJ2W3GB8=", + "zh:162faaf9378691e126a02c913df206a04d9529a24dfb9db8de306932e01666ec", + "zh:2df2181e8011fb2d9f93141e203cd2d7d714b6e5c6eaf8da83315f3fe703559d", + "zh:3dc27db87d20d19595f9c979007f9fc3465c2cd9571d8c09866003b0f54d448a", + "zh:44c71797db99a99a19d0ddafacb8592347cbe46fb4fd67cc2515f75d3e1eab46", + "zh:5ba42ec732375f2f194152927bcd40e9733794c116f1c2df3ad08b370ed45de1", + "zh:6ea5c559d0e88ce70a07c905b7efc570274c3765fb9b6311ad256534b7c1dd36", + "zh:737912274b28ec5090cb7133c6e47b18c164cb399cd976664af3fabc882216fa", + "zh:76166d6ca5f8168ae76360b87bba7c376c2fca459b0643ee8ff191d2feda2cd5", + "zh:764cbe5795c584128f18a19dd445d8c086d7321bcb863bedec70a9bf5110766b", + "zh:78eb37c1e789016fcdab7809d01ef44c9f6e392afa311ca841b92e8c53d5e2fb", + "zh:9ffa835f6173af391a31e103f86e013ff96bc4b7b886e9229a752640dac4be72", + "zh:cd27d4b7c66f251de1e31acfaeb431722e0a00c6620440f535e7e1d202809e08", + "zh:e804ab2f486c9c3650bc25fe7c1a708e779519085badf594f1d8e4c983c80d9f", + "zh:e95ee1f927503684c43ad9ef28f8f4fcab7c92ecba7412dceb6dcb75a32e6b73", + "zh:f362da74b1952a7b92c2114c099471c4dc09991636ac473d9928dd22904018c4", + ] +} + +provider "registry.opentofu.org/pan-net/powerdns" { + version = "1.5.0" + constraints = "~> 1.5" + hashes = [ + "h1:oMzrqQGFY88Cwx06YkFHP6io3jow/22FRZkeK0UZtGY=", + "zh:02d1a87c28635779f66d1dcf165b5f16530f809deb6c71c35c3e58d715a88bf4", + "zh:1285a419c7fd2947f891771bd77d2f6e7dd0cb00621c547b6993947085616009", + "zh:340faecd0a0036e721480564acbad2ba0da6a9c0c0cd633957dcde76a4ba3798", + "zh:5646f78d9980038c4ae70e09828da01c7cc6ba2b3b1e9ea8a1988efafaba1b75", + "zh:66fef65aede775d9972be163a2bd25d8fda5a8ad2235ceef30d515bf35e2e5d4", + "zh:7130faa5dd892b1d41b9b3ebd1b2d7854bf780193073de58806e088311bb554c", + "zh:9f47b66ce7f4b23d25c4a726ffc5e504f797f247912cfa5dff23b3da0ba18982", + "zh:ada63a886bc5d7980eeb22b59b166713617847626627007d2e8429eeb4346327", + "zh:c853237b7831942d3d0f0f7a7a334e8f9df8a12f217c5680a76db256e368230d", + "zh:d2e8827d9d8662a892dbd1df6155823c8167db6f6762f38885037c7da87612b1", + "zh:d6e1069bb9d9f368e5d55a8bdf55de23636a586d698515f0075733499d6b9ccc", + "zh:dd224d521af2f72bfdc3498c5ccd54b09844cfaa347b3008f61faad465cc9769", + "zh:e02960d79ccfeeaea64c07aa1ad88cdd3688f49b670c9b607ea188283cd519d6", + ] +} + +provider "registry.opentofu.org/vultr/vultr" { + version = "2.28.0" + constraints = "~> 2.28" + hashes = [ + "h1:YLj0Kd8/HXNJJWMJ2Uq46r97SePDlGsLjor3Giqr3l0=", + "zh:081b2517a23293849982d756200ccc5e3e6414b13364ff69433cfc9231f512c5", + "zh:1c347a05b0be1b6756a8c2e166520fb39eaa2c3f44e57c2702aa58bd8b65bcef", + "zh:204eb6826ae12b56991cab3731ba08e13d87c7fe31e246df59342570fb616df0", + "zh:60fccc6b46623eb4c4f27590dcc12874ca50cbcc6d73d7c117ef54a1e8de5cb2", + "zh:623fccedab77a40ea1e48ab90dc13edb85d0e57c12ebb2dda63e7454fd08dd81", + "zh:6cb057b6829f9654a77f5f4e9c97193180ca956d0f8760b3d484f521701aa814", + "zh:8c7192c66096b895a944913d7414f541cd0b300052df86856ce408d50bec3f68", + "zh:97f8cc46937237a3272aa30799ddab9972cae804ec8e7fcc850f0b2dd7ab2884", + "zh:9848294291468e520a0a8032079afd747ea7157eba614b3b18c89f226a25f93f", + "zh:a2f971d3a30d7e3952f8439a94f880f739b03645bc617d7e3acc3771da426148", + "zh:ad5d4fd1f24d23f51c8bd1f45d0be9edefba9175702bccff5fa9007247c6e48f", + "zh:b65aedaaaf75898d61e2c7d6909011103d716f7df5da13d355033f749626f03c", + "zh:d9f9bd59d911bc7eb2a08bbeb5f4a04db1e7afcf0ebf18fab16a9c8a6133af16", + "zh:e3a1cd0022c4d48706ee2c5cf4d88f1d7684b24070225fbb1b21e61ae19dcf54", + "zh:f1bbef24eb56b38f3f54673087dd2de10ca871df1f8752e7630bbd11bb00dcc8", + "zh:f6559ec45a1aee36f431e1f42a09fe7a6b0751c4c1036fe56edfc174478548da", + ] +} diff --git a/terraform/dns_aprs.tf b/terraform/dns_aprs.tf new file mode 100644 index 0000000..5557cd1 --- /dev/null +++ b/terraform/dns_aprs.tf @@ -0,0 +1,39 @@ +# DNS configuration for aprs.me domain +# Points to Traefik ingress on k3s cluster for APRS application + +resource "powerdns_record" "aprs_me_soa" { + depends_on = [powerdns_zone.aprs_me] + zone = "aprs.me." + name = "aprs.me." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +resource "powerdns_record" "aprs_me_root" { + depends_on = [powerdns_zone.aprs_me] + zone = "aprs.me." + name = "aprs.me." + type = "A" + ttl = 3600 + records = ["204.110.191.195"] # Traefik ingress on k3s cluster +} + +resource "powerdns_record" "aprs_me_www" { + depends_on = [powerdns_zone.aprs_me] + zone = "aprs.me." + name = "www.aprs.me." + type = "A" + ttl = 3600 + records = ["204.110.191.195"] # Traefik ingress on k3s cluster +} + +# CAA record for Let's Encrypt SSL certificates +resource "powerdns_record" "aprs_me_caa" { + depends_on = [powerdns_zone.aprs_me] + zone = "aprs.me." + name = "aprs.me." + type = "CAA" + ttl = 3600 + records = ["0 issue \"letsencrypt.org\""] +} diff --git a/terraform/dns_manero.tf b/terraform/dns_manero.tf new file mode 100644 index 0000000..d02f8b3 --- /dev/null +++ b/terraform/dns_manero.tf @@ -0,0 +1,80 @@ +# PowerDNS records for manero.org +# Zone defined in dns_powerdns_zones.tf + +resource "powerdns_record" "manero_soa" { + depends_on = [powerdns_zone.manero_org] + zone = "manero.org." + name = "manero.org." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +# Root A records (GitHub Pages) +resource "powerdns_record" "manero_root_a" { + depends_on = [powerdns_zone.manero_org] + zone = "manero.org." + name = "manero.org." + type = "A" + ttl = 3600 + records = [ + "185.199.108.153", + "185.199.109.153", + "185.199.110.153", + "185.199.111.153" + ] +} + +resource "powerdns_record" "manero_irc_a" { + depends_on = [powerdns_zone.manero_org] + zone = "manero.org." + name = "irc.manero.org." + type = "A" + ttl = 3600 + records = ["149.28.242.178"] +} + +resource "powerdns_record" "manero_us_a" { + depends_on = [powerdns_zone.manero_org] + zone = "manero.org." + name = "us.manero.org." + type = "A" + ttl = 3600 + records = ["149.28.242.178"] +} + +resource "powerdns_record" "manero_us_aaaa" { + depends_on = [powerdns_zone.manero_org] + zone = "manero.org." + name = "us.manero.org." + type = "AAAA" + ttl = 3600 + records = ["2001:19f0:6401:19e6:5400:5ff:fe45:5701"] +} + +resource "powerdns_record" "manero_ca_a" { + depends_on = [powerdns_zone.manero_org] + zone = "manero.org." + name = "ca.manero.org." + type = "A" + ttl = 3600 + records = ["167.114.209.151"] +} + +resource "powerdns_record" "manero_tankfox_a" { + depends_on = [powerdns_zone.manero_org] + zone = "manero.org." + name = "tankfox.manero.org." + type = "A" + ttl = 3600 + records = ["137.184.202.89"] +} + +resource "powerdns_record" "manero_404_cname" { + depends_on = [powerdns_zone.manero_org] + zone = "manero.org." + name = "404.manero.org." + type = "CNAME" + ttl = 3600 + records = ["404.al."] +} diff --git a/terraform/dns_mcintire.tf b/terraform/dns_mcintire.tf new file mode 100644 index 0000000..b21315a --- /dev/null +++ b/terraform/dns_mcintire.tf @@ -0,0 +1,100 @@ +resource "powerdns_record" "mcintire_soa" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "mcintire.me." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +# Mailcow MX records (primary and backup) +resource "powerdns_record" "mcintire_mx" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "mcintire.me." + type = "MX" + ttl = 3600 + records = [ + "10 mail.mcintire.me.", + "20 mail.nsnw.ca." + ] +} + +# Mail server +resource "powerdns_record" "mcintire_mail" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "mail.mcintire.me." + type = "A" + ttl = 3600 + records = ["204.110.191.5"] +} + +# Autodiscover for mail clients +resource "powerdns_record" "mcintire_autodiscover" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "autodiscover.mcintire.me." + type = "CNAME" + ttl = 3600 + records = ["mail.w5isp.com."] +} + +# Autodiscover SRV record +resource "powerdns_record" "mcintire_autodiscover_srv" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "_autodiscover._tcp.mcintire.me." + type = "SRV" + ttl = 3600 + records = ["0 0 443 mail.w5isp.com."] +} + +# Autoconfig for mail clients +resource "powerdns_record" "mcintire_autoconfig" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "autoconfig.mcintire.me." + type = "CNAME" + ttl = 3600 + records = ["mail.w5isp.com."] +} + +# SPF record for Mailcow +resource "powerdns_record" "mcintire_spf_mailcow" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "mcintire.me." + type = "TXT" + ttl = 3600 + records = ["\"v=spf1 mx a ip4:204.110.191.5 ~all\""] +} + +# DMARC record for Mailcow +resource "powerdns_record" "mcintire_dmarc_mailcow" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "_dmarc.mcintire.me." + type = "TXT" + ttl = 3600 + records = ["\"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1\""] +} + +# DKIM record from Mailcow +resource "powerdns_record" "mcintire_dkim_mailcow" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "dkim._domainkey.mcintire.me." + type = "TXT" + ttl = 3600 + records = ["\"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB\""] +} + +resource "powerdns_record" "mcintire_photos" { + depends_on = [powerdns_zone.mcintire_me] + zone = "mcintire.me." + name = "photos.mcintire.me." + type = "A" + ttl = 3600 + records = ["204.110.191.8"] +} diff --git a/terraform/dns_ntxarms.tf b/terraform/dns_ntxarms.tf new file mode 100644 index 0000000..c792894 --- /dev/null +++ b/terraform/dns_ntxarms.tf @@ -0,0 +1,80 @@ +# SOA record for ntxarms.com +resource "powerdns_record" "ntxarms_soa" { + depends_on = [powerdns_zone.ntxarms_com] + zone = "ntxarms.com." + name = "ntxarms.com." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +# Root A record +resource "powerdns_record" "ntxarms_root" { + depends_on = [powerdns_zone.ntxarms_com] + zone = "ntxarms.com." + name = "ntxarms.com." + type = "A" + ttl = 3600 + records = ["75.2.60.5"] +} + +# www CNAME to Netlify +resource "powerdns_record" "ntxarms_www" { + depends_on = [powerdns_zone.ntxarms_com] + zone = "ntxarms.com." + name = "www.ntxarms.com." + type = "CNAME" + ttl = 3600 + records = ["ntxarms.netlify.app."] +} + +# Fastmail MX records +resource "powerdns_record" "ntxarms_mx" { + depends_on = [powerdns_zone.ntxarms_com] + zone = "ntxarms.com." + name = "ntxarms.com." + type = "MX" + ttl = 3600 + records = [ + "10 in1-smtp.messagingengine.com.", + "20 in2-smtp.messagingengine.com." + ] +} + +# Fastmail DKIM records +resource "powerdns_record" "ntxarms_dkim_fm1" { + depends_on = [powerdns_zone.ntxarms_com] + zone = "ntxarms.com." + name = "fm1._domainkey.ntxarms.com." + type = "CNAME" + ttl = 3600 + records = ["fm1.ntxarms.com.dkim.fmhosted.com."] +} + +resource "powerdns_record" "ntxarms_dkim_fm2" { + depends_on = [powerdns_zone.ntxarms_com] + zone = "ntxarms.com." + name = "fm2._domainkey.ntxarms.com." + type = "CNAME" + ttl = 3600 + records = ["fm2.ntxarms.com.dkim.fmhosted.com."] +} + +resource "powerdns_record" "ntxarms_dkim_fm3" { + depends_on = [powerdns_zone.ntxarms_com] + zone = "ntxarms.com." + name = "fm3._domainkey.ntxarms.com." + type = "CNAME" + ttl = 3600 + records = ["fm3.ntxarms.com.dkim.fmhosted.com."] +} + +# Fastmail SPF record +resource "powerdns_record" "ntxarms_spf" { + depends_on = [powerdns_zone.ntxarms_com] + zone = "ntxarms.com." + name = "ntxarms.com." + type = "TXT" + ttl = 3600 + records = ["\"v=spf1 include:spf.messagingengine.com ?all\""] +} diff --git a/terraform/dns_powerdns_zones.tf b/terraform/dns_powerdns_zones.tf new file mode 100644 index 0000000..87ec72b --- /dev/null +++ b/terraform/dns_powerdns_zones.tf @@ -0,0 +1,91 @@ +# Vultr PowerDNS Zones +# All zones managed on the Vultr PowerDNS instance +# +# AXFR Configuration: +# AXFR (zone transfers) and notifications are configured globally in the PowerDNS +# ConfigMap (allow-axfr-ips and also-notify settings). These apply to all zones. + +resource "powerdns_zone" "w5isp_com" { + name = "w5isp.com." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "aprs_me" { + name = "aprs.me." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "mcintire_me" { + name = "mcintire.me." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "manero_org" { + name = "manero.org." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "ntxarms_com" { + name = "ntxarms.com." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "towerops_net" { + name = "towerops.net." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "vntx_net" { + name = "vntx.net." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "vntx_org" { + name = "vntx.org." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +# Reverse DNS zones +resource "powerdns_zone" "reverse_188" { + name = "188.110.204.in-addr.arpa." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "reverse_189" { + name = "189.110.204.in-addr.arpa." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "reverse_190" { + name = "190.110.204.in-addr.arpa." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} + +resource "powerdns_zone" "reverse_191" { + name = "191.110.204.in-addr.arpa." + kind = "Primary" + soa_edit_api = "DEFAULT" + nameservers = ["ns1.as393837.net.", "ns-global.kjsl.com."] +} diff --git a/terraform/dns_reverse.tf b/terraform/dns_reverse.tf new file mode 100644 index 0000000..d5fc89d --- /dev/null +++ b/terraform/dns_reverse.tf @@ -0,0 +1,103 @@ +# Reverse DNS zones are defined in dns_powerdns_zones.tf + +# SOA records for reverse zones +resource "powerdns_record" "vntx1_soa" { + depends_on = [powerdns_zone.reverse_188] + zone = "188.110.204.in-addr.arpa." + name = "188.110.204.in-addr.arpa." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +resource "powerdns_record" "vntx2_soa" { + depends_on = [powerdns_zone.reverse_189] + zone = "189.110.204.in-addr.arpa." + name = "189.110.204.in-addr.arpa." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +resource "powerdns_record" "vntx3_soa" { + depends_on = [powerdns_zone.reverse_190] + zone = "190.110.204.in-addr.arpa." + name = "190.110.204.in-addr.arpa." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +resource "powerdns_record" "vntx4_soa" { + depends_on = [powerdns_zone.reverse_191] + zone = "191.110.204.in-addr.arpa." + name = "191.110.204.in-addr.arpa." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +resource "powerdns_record" "ptr_records1" { + depends_on = [powerdns_zone.reverse_188] + for_each = { + for i in range(256) : tostring(i) => { + name = "${i}.188.110.204.in-addr.arpa." + record = "${i}.188.client.vntx.net." + } + } + + zone = "188.110.204.in-addr.arpa." + name = each.value.name + type = "PTR" + ttl = 3600 + records = [each.value.record] +} + +resource "powerdns_record" "ptr_records2" { + depends_on = [powerdns_zone.reverse_189] + for_each = { + for i in range(256) : tostring(i) => { + name = "${i}.189.110.204.in-addr.arpa." + record = "${i}.189.client.vntx.net." + } + } + + zone = "189.110.204.in-addr.arpa." + name = each.value.name + type = "PTR" + ttl = 3600 + records = [each.value.record] +} + +resource "powerdns_record" "ptr_records3" { + depends_on = [powerdns_zone.reverse_190] + for_each = { + for i in range(256) : tostring(i) => { + name = "${i}.190.110.204.in-addr.arpa." + record = "${i}.190.client.vntx.net." + } + if !contains([119, 168], i) + } + + zone = "190.110.204.in-addr.arpa." + name = each.value.name + type = "PTR" + ttl = 3600 + records = [each.value.record] +} + +resource "powerdns_record" "ptr_records4" { + depends_on = [powerdns_zone.reverse_191] + for_each = { + for i in range(256) : tostring(i) => { + name = "${i}.191.110.204.in-addr.arpa." + record = tostring(i) == "5" ? "mail.mcintire.me." : "${i}.191.client.vntx.net." + } + } + + zone = "191.110.204.in-addr.arpa." + name = each.value.name + type = "PTR" + ttl = 3600 + records = [each.value.record] +} diff --git a/terraform/dns_towerops.tf b/terraform/dns_towerops.tf new file mode 100644 index 0000000..94d5303 --- /dev/null +++ b/terraform/dns_towerops.tf @@ -0,0 +1,62 @@ +# PowerDNS records for towerops.net +# SendGrid email authentication records + +# SOA record for towerops.net +resource "powerdns_record" "towerops_soa" { + depends_on = [powerdns_zone.towerops_net] + zone = "towerops.net." + name = "towerops.net." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +# Root A record +resource "powerdns_record" "towerops_root_a" { + depends_on = [powerdns_zone.towerops_net] + zone = "towerops.net." + name = "towerops.net." + type = "A" + ttl = 3600 + records = ["204.110.191.195"] +} + +# SendGrid domain CNAME +resource "powerdns_record" "towerops_sendgrid_domain" { + depends_on = [powerdns_zone.towerops_net] + zone = "towerops.net." + name = "em6505.towerops.net." + type = "CNAME" + ttl = 600 + records = ["u177982.wl233.sendgrid.net."] +} + +# SendGrid DKIM key 1 +resource "powerdns_record" "towerops_sendgrid_dkim1" { + depends_on = [powerdns_zone.towerops_net] + zone = "towerops.net." + name = "s1._domainkey.towerops.net." + type = "CNAME" + ttl = 600 + records = ["s1.domainkey.u177982.wl233.sendgrid.net."] +} + +# SendGrid DKIM key 2 +resource "powerdns_record" "towerops_sendgrid_dkim2" { + depends_on = [powerdns_zone.towerops_net] + zone = "towerops.net." + name = "s2._domainkey.towerops.net." + type = "CNAME" + ttl = 600 + records = ["s2.domainkey.u177982.wl233.sendgrid.net."] +} + +# DMARC policy +resource "powerdns_record" "towerops_dmarc" { + depends_on = [powerdns_zone.towerops_net] + zone = "towerops.net." + name = "_dmarc.towerops.net." + type = "TXT" + ttl = 600 + records = ["\"v=DMARC1; p=none;\""] +} diff --git a/terraform/dns_vntx_net.tf b/terraform/dns_vntx_net.tf new file mode 100644 index 0000000..e178045 --- /dev/null +++ b/terraform/dns_vntx_net.tf @@ -0,0 +1,148 @@ +# SOA record for vntx.net +resource "powerdns_record" "vntx_net_soa" { + depends_on = [powerdns_zone.vntx_net] + zone = "vntx.net." + name = "vntx.net." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +# Generate client IP records dynamically +locals { + # Subnets to create client records for + vntx_subnets = [188, 189, 190, 191] + + # Generate all client IPs dynamically + client_ips = merge([ + for subnet in local.vntx_subnets : { + for i in range(1, 255) : "${i}.${subnet}.client" => "204.110.${subnet}.${i}" + } + ]...) + + # Named hosts with specific IPs + named_hosts = { + "climax" = "204.110.188.62" + "core" = "10.254.254.253" + "culleoka" = "204.110.188.158" + "edge" = "204.110.191.190" + "librenms" = "204.110.191.227" + "logs" = "204.110.191.229" + "monitor" = "204.110.191.241" + "netbox" = "204.110.191.243" + "newhope" = "204.110.188.190" + "ns1" = "204.110.191.249" + "ns2" = "204.110.191.239" + "preseem" = "204.110.191.225" + "resolver-01" = "204.110.191.240" + "resolver-02" = "204.110.191.250" + "resolver1" = "204.110.191.240" + "resolver2" = "204.110.191.250" + "unimus" = "204.110.191.238" + "verona" = "204.110.188.254" + "@" = "198.185.159.144" + "routers" = "155.138.241.157" + "vpn" = "204.110.191.247" + "radius" = "204.110.191.248" + "speedtest" = "204.110.191.228" + "aprs" = "204.110.191.232" + "g2" = "204.110.191.221" + "net" = "104.238.146.79" + "uisp" = "204.110.191.224" + "dns" = "204.110.191.193" + } + + # Merge client IPs and named hosts + all_a_records = merge(local.client_ips, local.named_hosts) +} + +resource "powerdns_record" "vntx_a_records" { + for_each = local.all_a_records + + depends_on = [powerdns_zone.vntx_net] + zone = "vntx.net." + name = each.key == "@" ? "vntx.net." : "${each.key}.vntx.net." + type = "A" + ttl = 3600 + records = [each.value] +} + +# Microsoft 365 MX record +resource "powerdns_record" "vntx_mx" { + depends_on = [powerdns_zone.vntx_net] + zone = "vntx.net." + name = "vntx.net." + type = "MX" + ttl = 3600 + records = ["0 vntx-net.mail.protection.outlook.com."] +} + +resource "powerdns_record" "vntx_txt_records" { + for_each = { + "_twilio" = "twilio-domain-verification=12bf63d61b86412618bdb4ab6c2b287a" + "_dmarc" = "v=DMARC1; p=none" + "_updown" = "updown-page=p/34yuc" + "_github-challenge-vntx" = "34ea2705e4" + "_github-pages-challenge-gmcintire" = "d125f4244edd0120ee0fa073d3acf1" + "krs._domainkey.mg" = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHbWtJ5uPGEOPmJrT36WBXKxVL0b4fqjIM4n6oXK4zaUucqYp7jeoKG+FTO5XEjyja7hsP9WahntUrVb8WI5V6Cj0CznesMrM7oQRntcyuy8mSD1zilmZe4q2Kc65gj2MRrkg3tkJfogXHNz2rxmquNu/DxsFLeQP8a2E5tYXVFwIDAQAB" + "pic._domainkey.mg" = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdv4ZUjhb9l0Nt1aEJMnH/TVNdVn9CEKkb8+RX3qBPMFGmJWrJ3BIFwOSTUBiPeCgd2vc4zOOv7iQhEgNTlIVNT/V1sY70Myo5t+tJCuJQT/G4h5D1u7LZB6YEOKTgd5wF5AoW/nLvKVEPyKl5mThB9KmIGqF5FMm9C9FWP8m6SQIDAQAB" + "s1._domainkey.mg" = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI3w7b9bBNcWzSH8DspZbRNp+9G9pHbCfmHmr3r2JqXh+F8bFlCK6gJqEQW7SIJgYMmSJ5GlYyy4A3VxJJFcWLZb3dxMoWkGjrJ3gEUNQGmG6rnJ7eXJxKb5J2mGgEfQgCgkWXPFRmJhKXPWoZP3RqU2vJZ3t7vJxWHmv0bQPHKQIDAQAB" + "s2._domainkey.mg" = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDc3JXQvGMBl3cW+3N2OPLJwlP4cMvPp9yOQM9X1TLxJWX7Hd7m6rJ1Xf2T3PGP9ZDPfJGXh+PfGPYVJYP2JXGPfP9HPfP3GPfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHGPYVP9fPH+PfP+PfPHQIDAQAB" + "@" = "v=spf1 include:spf.protection.outlook.com include:mailgun.org -all" + } + + depends_on = [powerdns_zone.vntx_net] + zone = "vntx.net." + name = each.key == "@" ? "vntx.net." : "${each.key}.vntx.net." + type = "TXT" + ttl = 3600 + records = ["\"${each.value}\""] +} + +resource "powerdns_record" "vntx_cname_records" { + for_each = { + # Current records + "mg" = "mailgun.org." + "email.mg" = "mailgun.org." + "*.w5isp" = "dokku.w5isp.com." + "mail.speedtest" = "mail.speedtest.vntx.net.s2.mailersendapp.com." + "status" = "stats.uptimerobot.com." + "ntp" = "0.us.pool.ntp.org." + "iptrack" = "dokku.w5isp.com." + + "_4080c249b6e72dd04f2a9508aa1a1b7f.kivrak" = "_de3e5d511f3869bbd271b935a3b4f973.tljzshvwok.acm-validations.aws." + "_83337805c305955c6823504cc5e6ca29" = "_baf97cdcc7b6458fa5719e4261e9932f.sdgjtdhdhz.acm-validations.aws." + "_bc1077259b1fbbb11c1e16756e1883f9.irc" = "793f217a963b25f361ec1975e0fd7d54.dc2ec86a36550aed25a0011c0b2b044b.62f7abe714ec1.comodoca.com." + "177982" = "sendgrid.net." + "4809fce066c3da4d14197c7276ba083f.irc" = "b58bf151af520d34d8fad99d05274cb536893031.comodoca.com." + "9p83fpanfdgs8xdgcnzd" = "verify.squarespace.com." + "activate" = "verona-networks-checkout.gaiia-consumer.com." + "autodiscover.o365" = "autodiscover.outlook.com." + "autodiscover" = "autodiscover.outlook.com." + "em924886" = "return.smtp2go.net." + "em9279" = "u177982.wl233.sendgrid.net." + "email" = "mandrillapp.com." + "enterpriseenrollment.o365" = "enterpriseenrollment.manage.microsoft.com." + "enterpriseregistration.o365" = "enterpriseregistration.windows.net." + "link" = "track.smtp2go.net." + "lyncdiscover.o365" = "webdir.online.lync.com." + "mte1._domainkey" = "dkim1.mandrillapp.com." + "mte2._domainkey" = "dkim2.mandrillapp.com." + "portal" = "verona-networks-clientportal.gaiia-consumer.com." + "s1._domainkey" = "s1.domainkey.u177982.wl233.sendgrid.net." + "s2._domainkey" = "s2.domainkey.u177982.wl233.sendgrid.net." + "s924886._domainkey" = "dkim.smtp2go.net." + "sip.o365" = "sipdir.online.lync.com." + "uptime" = "page.updown.io." + "url62" = "sendgrid.net." + "url9812" = "sendgrid.net." + "www" = "ext-cust.squarespace.com." + } + + depends_on = [powerdns_zone.vntx_net] + zone = "vntx.net." + name = "${each.key}.vntx.net." + type = "CNAME" + ttl = 3600 + records = [each.value] +} diff --git a/terraform/dns_vntx_org.tf b/terraform/dns_vntx_org.tf new file mode 100644 index 0000000..b5ff35a --- /dev/null +++ b/terraform/dns_vntx_org.tf @@ -0,0 +1,12 @@ +# DNS records for vntx.org domain +# Zone defined in dns_powerdns_zones.tf + +# SOA record for vntx.org +resource "powerdns_record" "vntx_org_soa" { + depends_on = [powerdns_zone.vntx_org] + zone = "vntx.org." + name = "vntx.org." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} diff --git a/terraform/dns_w5isp.tf b/terraform/dns_w5isp.tf new file mode 100644 index 0000000..af9b12e --- /dev/null +++ b/terraform/dns_w5isp.tf @@ -0,0 +1,262 @@ +resource "powerdns_record" "w5isp_soa" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "w5isp.com." + type = "SOA" + ttl = 3600 + records = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"] +} + +resource "powerdns_record" "w5isp_root" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.5"] +} + +resource "powerdns_record" "w5isp_git" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "git.w5isp.com." + type = "A" + ttl = 3600 + records = ["66.206.18.163"] +} + +resource "powerdns_record" "w5isp_home" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "home.w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.1"] +} + +resource "powerdns_record" "w5isp_photos" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "photos.w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.8"] +} + +resource "powerdns_record" "w5isp_skippy" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "skippy.w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.8"] +} + +resource "powerdns_record" "w5isp_ha" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "ha.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa."] +} + +resource "powerdns_record" "w5isp_mx1" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "w5isp.com." + type = "MX" + ttl = 3600 + records = ["10 mail.w5isp.com."] +} + +resource "powerdns_record" "w5isp_txt" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "w5isp.com." + type = "TXT" + ttl = 3600 + records = ["\"v=spf1 mx a ip4:204.110.191.5 ~all\""] +} + +# DKIM record +resource "powerdns_record" "w5isp_dkim" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "dkim._domainkey.w5isp.com." + type = "TXT" + ttl = 3600 + records = ["\"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB\""] +} + +resource "powerdns_record" "w5isp_g" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "g.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["mail.mcintire.me."] +} + +resource "powerdns_record" "w5isp_truck" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "truck.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["mail.mcintire.me."] +} + +resource "powerdns_record" "w5isp_sendgrid1" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "em40.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["u177982.wl233.sendgrid.net."] +} + +resource "powerdns_record" "w5isp_sendgrid2" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "s1._domainkey.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["s1.domainkey.u177982.wl233.sendgrid.net."] +} + +resource "powerdns_record" "w5isp_sendgrid3" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "s2._domainkey.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["s2.domainkey.u177982.wl233.sendgrid.net."] +} + +resource "powerdns_record" "w5isp_dmarc" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "_dmarc.w5isp.com." + type = "TXT" + ttl = 3600 + records = ["\"v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1\""] +} + +# Mail server +resource "powerdns_record" "w5isp_mail" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "mail.w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.5"] +} + +resource "powerdns_record" "w5isp_sync" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "sync.w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.216"] +} + +resource "powerdns_record" "w5isp_log" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "log.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["mail.mcintire.me."] +} + +resource "powerdns_record" "w5isp_autodiscover" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "autodiscover.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["mail.w5isp.com."] +} + +resource "powerdns_record" "w5isp_autodiscover_srv" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "_autodiscover._tcp.w5isp.com." + type = "SRV" + ttl = 3600 + records = ["0 0 443 mail.w5isp.com."] +} + +resource "powerdns_record" "w5isp_autoconfig" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "autoconfig.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["mail.w5isp.com."] +} + +resource "powerdns_record" "w5isp_n8n" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "n8n.w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.2"] # Traefik ingress on k3s cluster +} + +resource "powerdns_record" "w5isp_nodered" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "nodered.w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.2"] # Node-RED via Traefik on k3s cluster +} + +resource "powerdns_record" "w5isp_headscale" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "headscale.w5isp.com." + type = "A" + ttl = 3600 + records = ["66.206.18.166"] +} + +resource "powerdns_record" "w5isp_hs" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "hs.w5isp.com." + type = "A" + ttl = 3600 + records = ["66.206.18.166"] +} + +resource "powerdns_record" "w5isp_dokku" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "dokku.w5isp.com." + type = "A" + ttl = 3600 + records = ["204.110.191.218"] +} + +resource "powerdns_record" "w5isp_camper" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "camper.w5isp.com." + type = "CNAME" + ttl = 3600 + records = ["skippy.w5isp.com."] +} + +resource "powerdns_record" "w5isp_wildcard" { + depends_on = [powerdns_zone.w5isp_com] + zone = "w5isp.com." + name = "*.w5isp.com." + type = "A" + ttl = 3600 + records = ["172.245.56.83"] +} diff --git a/terraform/main.sync-conflict-20260129-153613-ZJZJYMM.tf b/terraform/main.sync-conflict-20260129-153613-ZJZJYMM.tf new file mode 100644 index 0000000..e5e7db9 --- /dev/null +++ b/terraform/main.sync-conflict-20260129-153613-ZJZJYMM.tf @@ -0,0 +1,56 @@ +terraform { + required_providers { + dnsimple = { + source = "dnsimple/dnsimple" + version = "~> 2.0" + } + porkbun = { + source = "kyswtn/porkbun" + version = "~> 0.1" + } + powerdns = { + source = "pan-net/powerdns" + version = "~> 1.5" + } + vultr = { + source = "vultr/vultr" + version = "~> 2.28" + } + cloudflare = { + source = "cloudflare/cloudflare" + version = "~> 5.0" + } + null = { + source = "hashicorp/null" + version = "~> 3.0" + } + } +} + +terraform { + backend "http" { + # Backend credentials should be set via environment variables: + # TF_HTTP_ADDRESS, TF_HTTP_LOCK_ADDRESS, TF_HTTP_UNLOCK_ADDRESS + # TF_HTTP_USERNAME, TF_HTTP_PASSWORD + } +} + +provider "dnsimple" { + token = var.dnsimple_token + account = var.dnsimple_account +} + +provider "porkbun" { + api_key = var.porkbun_api_key + secret_api_key = var.porkbun_secret_api_key +} + +provider "powerdns" { + api_key = var.pdns_api_key + server_url = var.pdns_server_url +} + +provider "cloudflare" { + # API token is read from CLOUDFLARE_API_TOKEN environment variable + # No explicit api_token parameter needed - provider automatically reads the env var +} diff --git a/terraform/variables.sync-conflict-20260129-153936-ZJZJYMM.tf b/terraform/variables.sync-conflict-20260129-153936-ZJZJYMM.tf new file mode 100644 index 0000000..c22c5d4 --- /dev/null +++ b/terraform/variables.sync-conflict-20260129-153936-ZJZJYMM.tf @@ -0,0 +1,218 @@ +# Vultr Variables +variable "vultr_api_key" { + description = "Vultr API key" + type = string + sensitive = true + default = "" +} + + +# Proxmox Variables +variable "proxmox_api_url" { + description = "Proxmox API URL" + type = string + default = "https://10.0.16.231:8006" +} + +variable "proxmox_user" { + description = "Proxmox user for authentication" + type = string + default = "root@pam" +} + +variable "proxmox_password" { + description = "Proxmox password" + type = string + sensitive = true +} + +variable "proxmox_tls_insecure" { + description = "Allow insecure TLS connections to Proxmox" + type = bool + default = true +} + +variable "proxmox_nodes" { + description = "List of Proxmox nodes to distribute VMs across" + type = list(string) + default = ["vm2-380"] +} + +variable "cluster_name" { + description = "Name prefix for the K3s cluster nodes" + type = string + default = "home-k3s" +} + +variable "vm_template" { + description = "Name of the VM template to clone" + type = string + default = "debian-13-cloudinit" +} + +variable "storage_pool" { + description = "Storage pool for VM disks" + type = string + default = "ceph" +} + +variable "network_bridge" { + description = "Network bridge to use for VMs" + type = string + default = "vmbr0" +} + +variable "network_cidr" { + description = "Network CIDR for the cluster" + type = string + default = "10.0.16.0/22" +} + +variable "network_gateway" { + description = "Network gateway" + type = string + default = "10.0.19.254" +} + +variable "control_plane_count" { + description = "Number of control plane nodes" + type = number + default = 3 +} + +variable "control_plane_cores" { + description = "Number of CPU cores for control plane nodes" + type = number + default = 2 +} + +variable "control_plane_memory" { + description = "Memory in MB for control plane nodes" + type = number + default = 8192 +} + +variable "control_plane_disk_size" { + description = "Disk size for control plane nodes (in GB)" + type = number + default = 32 +} + +variable "control_plane_ip_start" { + description = "Starting IP offset for control plane nodes" + type = number + default = 868 # 10.0.19.100 = offset 868 from 10.0.16.0 (3*256 + 100) +} + +variable "worker_count" { + description = "Number of worker nodes" + type = number + default = 3 +} + +variable "worker_cores" { + description = "Number of CPU cores for worker nodes" + type = number + default = 4 +} + +variable "worker_memory" { + description = "Memory in MB for worker nodes" + type = number + default = 8192 +} + +variable "worker_disk_size" { + description = "Disk size for worker nodes (in GB)" + type = number + default = 64 +} + +variable "worker_ip_start" { + description = "Starting IP offset for worker nodes" + type = number + default = 878 # 10.0.19.110 = offset 878 from 10.0.16.0 (3*256 + 110) +} + +variable "ssh_user" { + description = "SSH user for the VMs" + type = string + default = "debian" +} + +variable "ssh_public_key" { + description = "SSH public key for access to VMs" + type = string + default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLyVSEEAEbGZZqwPwEup0XrlTpu3x3iF9ExvvQPA4xN graham@mcintire.me" +} + +# DNS Provider Variables +variable "dnsimple_token" { + description = "DNSimple API token" + type = string + sensitive = true +} + +variable "dnsimple_account" { + description = "DNSimple account ID" + type = string + default = "143471" +} + +variable "porkbun_api_key" { + description = "Porkbun API key" + type = string + sensitive = true +} + +variable "porkbun_secret_api_key" { + description = "Porkbun secret API key" + type = string + sensitive = true +} + +variable "proxmox_host" { + description = "Proxmox host for VM deployment" + type = string + default = "vm2-380" +} + +variable "template_name" { + description = "VM template name" + type = string + default = "ubuntu" +} + +variable "nic_name" { + description = "Network interface name" + type = string + default = "vmbr0" +} + +variable "api_url" { + description = "Proxmox API URL (legacy)" + type = string + default = "https://10.0.0.2:8006/api2/json" +} + +variable "token_secret" { + description = "Proxmox token secret" + type = string + sensitive = true +} + +variable "token_id" { + description = "Proxmox token ID" + type = string +} + +variable "pdns_api_key" { + description = "PowerDNS API key" + type = string + sensitive = true +} + +variable "pdns_server_url" { + description = "PowerDNS server URL" + type = string +}