Graham McIntire
6f0d308fea
- Remove forgejo role, play, group, host_vars, and DNS references - Replace hardcoded /Users/graham/.ssh/ paths with env var lookup - Remove broken setup-user Makefile target - Add community.mysql collection to requirements.yml - Add .ansible/ to .gitignore - git rm --cached .DS_Store files and .vscode/settings.json - Update CLAUDE.md and README.md to reflect actual state - Add findings.md with audit results
38 lines
981 B
YAML
38 lines
981 B
YAML
---
|
|
ansible_user: ansible
|
|
ansible_host: 10.0.15.31
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
|
|
|
network:
|
|
skip: true
|
|
|
|
# Open Prometheus stack ports to the home LAN.
|
|
# Trusted subnets (Tailscale, VNTX) are already wide-open via firewall role defaults;
|
|
# this adds the 10.0.15.0/24 home cluster subnet so the k8s nodes can hit node_exporter
|
|
# and so any LAN client can reach the Grafana UI.
|
|
firewall_allow_rules:
|
|
- port: 22
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: SSH from home LAN
|
|
- port: 9090
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Prometheus UI/API
|
|
- port: 9093
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Alertmanager
|
|
- port: 9100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: node_exporter
|
|
- port: 3000
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Grafana UI
|
|
- port: 3100
|
|
proto: tcp
|
|
from_ip: 10.0.0.0/16
|
|
comment: Loki HTTP (push + query)
|