update

ansible/bootstrap.yml

@@ -1,8 +1,54 @@
 ---
-- name: Bootstrap new host
+- name: Bootstrap new host - Setup sudo
   hosts: all
   tags: bootstrap
-  roles:
-    - base
+  remote_user: graham
+  gather_facts: no
+  vars:
+    ansible_user: graham
+  tasks:
+    - name: Install sudo package first (if needed)
+      raw: "which sudo || (apt-get update && apt-get install -y sudo) || (yum install -y sudo)"
+      become: yes
+      become_method: su
+      become_user: root
+      
+    - name: Configure sudo for graham user
+      raw: "echo 'graham     ALL=NOPASSWD: ALL' | tee /etc/sudoers.d/graham && chmod 0440 /etc/sudoers.d/graham"
+      become: yes
+      become_method: su
+      become_user: root
+      
+    - name: Test sudo access
+      raw: "sudo whoami"
+      register: sudo_test
+      changed_when: false
+      
+    - name: Show sudo test result
+      debug:
+        msg: "Sudo test result: {{ sudo_test.stdout }}"
+        
+    - name: Install Python if needed
+      raw: "which python3 || sudo apt-get update && sudo apt-get install -y python3 python3-apt"
+      changed_when: false
+      
+    - name: Find Python interpreter
+      raw: "which python3 || which python"
+      register: python_path
+      changed_when: false
+      
+    - name: Show Python path
+      debug:
+        msg: "Python path: {{ python_path.stdout }}"
+
+- name: Bootstrap new host - Base configuration
+  hosts: all
+  tags: bootstrap
+  remote_user: graham
   become: yes
   become_method: sudo
+  vars:
+    ansible_user: graham
+    ansible_python_interpreter: /usr/bin/python3
+  roles:
+    - base

ansible/host_vars/postgres.yml

@@ -2,7 +2,7 @@
 # Host-specific variables for postgres server (CM3588)
 
 # Python interpreter
-ansible_python_interpreter: /usr/bin/python3.11
+ansible_python_interpreter: /usr/bin/python3
 
 # Override PostgreSQL memory settings if needed
 # postgresql_config:

ansible/hosts

@@ -34,4 +34,4 @@ g.w5isp.com
 g.w5isp.com
 
 [postgresql_servers]
-postgres ansible_host=10.0.19.220
+postgres ansible_host=10.0.19.224

ansible/inventory.yml

@@ -1,11 +1,11 @@
 all:
   hosts:
     postgres:
-      ansible_host: 10.0.19.220
+      ansible_host: 10.0.19.224
       ansible_user: graham
       ansible_become: yes
       ansible_python_interpreter: /usr/bin/python3
   children:
     postgres_servers:
       hosts:
-        postgres:
+        postgres:

ansible/roles/base/tasks/users.yml

@@ -50,6 +50,13 @@
     mode: '0440'
     validate: 'visudo -cf %s'
 
+- name: Configure sudo for graham user
+  template:
+    src: sudoers_graham.j2
+    dest: /etc/sudoers.d/graham
+    mode: '0440'
+    validate: 'visudo -cf %s'
+
 - name: Enable passwordless sudo for %sudo
   lineinfile:
     path: /etc/sudoers

ansible/roles/base/templates/sudoers_graham.j2

@@ -0,0 +1 @@
+graham     ALL=NOPASSWD: ALL

ansible/roles/general/tasks/main.yml

@@ -17,6 +17,12 @@
   tags:
     - network
 
+- import_tasks: udp-gro-fix.yml
+  when: ansible_os_family == "Debian"
+  tags:
+    - network
+    - tailscale
+
 - import_tasks: debian/syslog.yml
   when: ansible_os_family == "Debian"
   tags:

ansible/roles/general/tasks/udp-gro-fix.yml

@@ -0,0 +1,64 @@
+---
+# Fix UDP GRO configuration for Tailscale on bridge interfaces
+# See https://tailscale.com/s/ethtool-config-udp-gro
+
+- name: Check if ethtool is installed
+  package:
+    name: ethtool
+    state: present
+  tags:
+    - network
+    - tailscale
+
+- name: Get list of bridge interfaces
+  shell: "ip link show type bridge | grep -E '^[0-9]+:' | cut -d: -f2 | tr -d ' '"
+  register: bridge_interfaces
+  changed_when: false
+  failed_when: false
+  tags:
+    - network
+    - tailscale
+
+- name: Disable UDP GRO on bridge interfaces
+  command: "ethtool -K {{ item }} rx-udp-gro-forwarding off rx-gro-list off"
+  loop: "{{ bridge_interfaces.stdout_lines }}"
+  when: bridge_interfaces.stdout_lines is defined and bridge_interfaces.stdout_lines | length > 0
+  failed_when: false
+  changed_when: true
+  tags:
+    - network
+    - tailscale
+
+- name: Create systemd service to persist UDP GRO settings
+  copy:
+    dest: /etc/systemd/system/disable-udp-gro@.service
+    content: |
+      [Unit]
+      Description=Disable UDP GRO on %i for Tailscale
+      After=network-online.target
+      
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/sbin/ethtool -K %i rx-udp-gro-forwarding off rx-gro-list off
+      RemainAfterExit=yes
+      
+      [Install]
+      WantedBy=multi-user.target
+    owner: root
+    group: root
+    mode: '0644'
+  tags:
+    - network
+    - tailscale
+
+- name: Enable systemd service for each bridge interface
+  systemd:
+    name: "disable-udp-gro@{{ item }}.service"
+    enabled: yes
+    daemon_reload: yes
+    state: started
+  loop: "{{ bridge_interfaces.stdout_lines }}"
+  when: bridge_interfaces.stdout_lines is defined and bridge_interfaces.stdout_lines | length > 0
+  tags:
+    - network
+    - tailscale

terraform/dns_w5isp.tf

@@ -127,3 +127,35 @@ resource "dnsimple_zone_record" "w5isp_truck" {
   type      = "CNAME"
   ttl       = 3600
 }
+
+resource "dnsimple_zone_record" "w5isp_sendgrid1" {
+  zone_name = "w5isp.com"
+  name      = "em40"
+  value     = "u177982.wl233.sendgrid.net"
+  type      = "CNAME"
+  ttl       = 3600
+}
+
+resource "dnsimple_zone_record" "w5isp_sendgrid2" {
+  zone_name = "w5isp.com"
+  name      = "s1._domainkey"
+  value     = "s1.domainkey.u177982.wl233.sendgrid.net."
+  type      = "CNAME"
+  ttl       = 3600
+}
+
+resource "dnsimple_zone_record" "w5isp_sendgrid3" {
+  zone_name = "w5isp.com"
+  name      = "s2._domainkey"
+  value     = "s2.domainkey.u177982.wl233.sendgrid.net."
+  type      = "CNAME"
+  ttl       = 3600
+}
+
+resource "dnsimple_zone_record" "w5isp_sendgrid4" {
+  zone_name = "w5isp.com"
+  name      = "_dmarc"
+  value     = "v=DMARC1; p=none;"
+  type      = "TXT"
+  ttl       = 36000
+}