updates

ansible/group_vars/resolvers/main.yml

@@ -0,0 +1,8 @@
+---
+firewall_allow_rules:
+  - port: 53
+    proto: udp
+    comment: DNS
+  - port: 53
+    proto: tcp
+    comment: DNS

ansible/host_vars/db.towerops.net.yml

@@ -1,11 +1,20 @@
 ---
 ansible_user: graham
-ansible_host: 10.0.15.20
+ansible_host: 100.108.110.128
 ansible_python_interpreter: /usr/bin/python3
 ansible_ssh_private_key_file: /Users/graham/.ssh/id_ed25519
 ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
 
-firewall_enabled: false
+firewall_trusted_subnets:
+  - subnet: 100.64.0.0/10
+    comment: Tailscale
+  - subnet: 10.0.8.0/21
+    comment: Home cluster network
+
+firewall_allow_rules:
+  - port: 5432
+    proto: tcp
+    comment: PostgreSQL
 
 # Override role defaults - this server uses default Debian paths, not RAID
 postgresql_version: "17"

ansible/hosts

@@ -54,7 +54,7 @@ node2 ansible_host=10.0.15.102
 node3 ansible_host=10.0.15.103
 
 [postgresql_servers]
-db.mcintire.me ansible_host=10.0.15.20
+db.towerops.net ansible_host=100.108.110.128
 db.aprs.me ansible_host=10.0.15.22
 
 [home_cluster:children]

ansible/roles/dokku/defaults/main.yml

@@ -8,6 +8,8 @@ dokku_postgres_plugin_url: https://github.com/dokku/dokku-postgres.git
 dokku_postgres_image: "timescale/timescaledb"
 dokku_postgres_image_version: "latest-pg17"
 dokku_redis_plugin_url: https://github.com/dokku/dokku-redis.git
+dokku_letsencrypt_plugin_url: https://github.com/dokku/dokku-letsencrypt.git
+dokku_letsencrypt_email: graham@mcintire.me
 dokku_redis_image: "valkey/valkey"
 dokku_redis_image_version: "8"
 dokku_apps:

ansible/roles/dokku/tasks/main.yml

@@ -131,6 +131,10 @@
   command: dokku plugin:install {{ dokku_redis_plugin_url }}
   when: "'redis' not in dokku_plugins.stdout"
 
+- name: Install dokku-letsencrypt plugin
+  command: dokku plugin:install {{ dokku_letsencrypt_plugin_url }}
+  when: "'letsencrypt' not in dokku_plugins.stdout"
+
 # Create apps and postgres services
 - name: Check existing apps
   command: dokku apps:list

ansible/roles/resolvers/tasks/main.yml

@@ -48,7 +48,8 @@
     zone: public
     service: dns
     permanent: true
+    immediate: true
     state: enabled
-  when: ansible_facts.services['firewalld.service'] is defined
+  when: ansible_os_family == "RedHat"
   notify:
     - Restart firewalld

ansible/roles/resolvers/templates/unbound.conf.j2

@@ -59,7 +59,6 @@ server:
 	# interface: 2001:DB8::5
 	# interface: eth0@5003
 	interface: 0.0.0.0
-	interface: ::0
 
 	# enable this feature to copy the source address of queries to reply.
 	# Socket options are not supported on all platforms. experimental.
@@ -253,7 +252,7 @@ server:
 	do-ip4: yes
 
 	# Enable IPv6, "yes" or "no".
-	# do-ip6: yes
+	do-ip6: no
 
 	# If running unbound on an IPv6-only host, domains that only have
 	# IPv4 servers would become unresolveable.  If NAT64 is available in

tofu/dns.tf

@@ -18,11 +18,12 @@ locals {
   ]
 
   domains = {
+    "ammocpr.com"       = local.porkbun_ns
     "aprs.me"           = local.cloudflare_ns
     "beanjar.org"       = local.as393837_ns
     "gridmap.org"       = local.cloudflare_ns
     "gunincrements.com" = local.porkbun_ns
-    "manero.org"        = local.as393837_ns
+    "manero.org"        = local.porkbun_ns
     "mcintire.me"       = local.as393837_ns
     "ntxarms.com"       = local.as393837_ns
     "qth.social"        = local.porkbun_ns

tofu/porkbun.tf

@@ -0,0 +1,88 @@
+# =============================================================================
+# Porkbun DNS Records
+# =============================================================================
+
+# =============================================================================
+# ammocpr.com
+# =============================================================================
+
+resource "porkbun_dns_record" "ammocpr_com_a_root" {
+  domain    = "ammocpr.com"
+  subdomain = ""
+  type      = "A"
+  content   = "204.110.191.231"
+}
+
+# =============================================================================
+# manero.org
+# =============================================================================
+
+resource "porkbun_dns_record" "manero_org_a_root_1" {
+  domain    = "manero.org"
+  subdomain = ""
+  type      = "A"
+  content   = "185.199.108.153"
+}
+
+resource "porkbun_dns_record" "manero_org_a_root_2" {
+  domain    = "manero.org"
+  subdomain = ""
+  type      = "A"
+  content   = "185.199.109.153"
+}
+
+resource "porkbun_dns_record" "manero_org_a_root_3" {
+  domain    = "manero.org"
+  subdomain = ""
+  type      = "A"
+  content   = "185.199.110.153"
+}
+
+resource "porkbun_dns_record" "manero_org_a_root_4" {
+  domain    = "manero.org"
+  subdomain = ""
+  type      = "A"
+  content   = "185.199.111.153"
+}
+
+resource "porkbun_dns_record" "manero_org_a_irc" {
+  domain    = "manero.org"
+  subdomain = "irc"
+  type      = "A"
+  content   = "149.28.242.178"
+}
+
+resource "porkbun_dns_record" "manero_org_a_us" {
+  domain    = "manero.org"
+  subdomain = "us"
+  type      = "A"
+  content   = "149.28.242.178"
+}
+
+resource "porkbun_dns_record" "manero_org_aaaa_us" {
+  domain    = "manero.org"
+  subdomain = "us"
+  type      = "AAAA"
+  content   = "2001:19f0:6401:19e6:5400:5ff:fe45:5701"
+}
+
+resource "porkbun_dns_record" "manero_org_a_ca" {
+  domain    = "manero.org"
+  subdomain = "ca"
+  type      = "A"
+  content   = "167.114.209.151"
+}
+
+resource "porkbun_dns_record" "manero_org_a_tankfox" {
+  domain    = "manero.org"
+  subdomain = "tankfox"
+  type      = "A"
+  content   = "137.184.202.89"
+}
+
+resource "porkbun_dns_record" "manero_org_cname_404" {
+  domain    = "manero.org"
+  subdomain = "404"
+  type      = "CNAME"
+  content   = "404.al."
+}