talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Update for rebuild of mrmanager.

Browse Source
This commit is contained in:
Tom Alexander
2026-02-11 19:30:27 -05:00
parent 9bc3aed323
commit d9f6c8da31
19 changed files with 88 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ansible/environments/colo/host_vars/mrmanager
View File

@@ -6,7 +6,6 @@ zfs_snapshot_datasets:
include: false include: false
- path: zdata/k8spersistent - path: zdata/k8spersistent
sshd_enabled: true sshd_enabled: true
loader_conf: "mrmanager_loader.conf"
rc_conf: "mrmanager_rc.conf" rc_conf: "mrmanager_rc.conf"
network_rc: "mrmanager_network.conf" network_rc: "mrmanager_network.conf"
routing_rc: "mrmanager_routing.conf" routing_rc: "mrmanager_routing.conf"
@@ -57,7 +56,3 @@ users:
- yubikey - yubikey
- main_fido - main_fido
- backup_fido - backup_fido
mole:
initialize: true
authorized_keys:
- mole

3
ansible/environments/colo/hosts
View File

@@ -1,2 +1,3 @@
[server] [server]
mrmanager ansible_user=talexander ansible_host=10.217.2.1 #mrmanager ansible_user=talexander ansible_host=10.217.2.1 ansible_become_method=doas
mrmanager ansible_user=talexander ansible_host=74.80.180.138 ansible_become_method=doas

2
ansible/playbook.yaml
View File

@@ -82,7 +82,7 @@
vars: vars:
ansible_become: True ansible_become: True
roles: roles:
- sudo # - sudo
- doas - doas
- users - users
- package_manager - package_manager

6
ansible/roles/base/files/login.conf
View File

@@ -32,7 +32,7 @@ default:\
:cputime=unlimited:\ :cputime=unlimited:\
:datasize=unlimited:\ :datasize=unlimited:\
:stacksize=unlimited:\ :stacksize=unlimited:\
:memorylocked=128M:\ :memorylocked=64K:\
:memoryuse=unlimited:\ :memoryuse=unlimited:\
:filesize=unlimited:\ :filesize=unlimited:\
:coredumpsize=unlimited:\ :coredumpsize=unlimited:\
@@ -46,7 +46,6 @@ default:\
:umtxp=unlimited:\ :umtxp=unlimited:\
:pipebuf=unlimited:\ :pipebuf=unlimited:\
:priority=0:\ :priority=0:\
:ignoretime@:\
:umask=022:\ :umask=022:\
:charset=UTF-8:\ :charset=UTF-8:\
:lang=en_US.UTF-8: :lang=en_US.UTF-8:
@@ -149,7 +148,6 @@ russian|Russian Users Accounts:\
# :requirehome:\ # :requirehome:\
# :passwordtime=90d:\ # :passwordtime=90d:\
# :umask=002:\ # :umask=002:\
# :ignoretime@:\
# :tc=default: # :tc=default:
# #
# #
@@ -174,7 +172,6 @@ russian|Russian Users Accounts:\
## ##
#staff:\ #staff:\
# :ignorenologin:\ # :ignorenologin:\
# :ignoretime:\
# :requirehome@:\ # :requirehome@:\
# :accounted@:\ # :accounted@:\
# :path=~/bin /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin:\ # :path=~/bin /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin:\
@@ -265,7 +262,6 @@ russian|Russian Users Accounts:\
## - no time accounting, restricted to access via dialin lines ## - no time accounting, restricted to access via dialin lines
## ##
#site:\ #site:\
# :ignoretime:\
# :passwordtime@:\ # :passwordtime@:\
# :refreshtime@:\ # :refreshtime@:\
# :refreshperiod@:\ # :refreshperiod@:\

0
ansible/roles/base/files/mrmanager_loader.conf → ansible/roles/base/files/zfs_loader.conf
View File

2
ansible/roles/base/meta/main.yaml
View File

@@ -1,3 +1,3 @@
dependencies: dependencies:
- fstab - fstab
- termcap # - termcap

41
ansible/roles/base/tasks/freebsd.yaml
View File

@@ -77,27 +77,27 @@
owner: root owner: root
group: wheel group: wheel
loop: loop:
- src: bemount.bash # - src: bemount.bash
dest: /usr/local/bin/bemount # dest: /usr/local/bin/bemount
- src: watch_freebsd - src: watch_freebsd
dest: /usr/local/bin/ww dest: /usr/local/bin/ww
- name: Install rc script # - name: Install rc script
copy: # copy:
src: "files/{{ item.src }}" # src: "files/{{ item.src }}"
dest: "/usr/local/etc/rc.d/{{ item.dest|default(item.src) }}" # dest: "/usr/local/etc/rc.d/{{ item.dest|default(item.src) }}"
owner: root # owner: root
group: wheel # group: wheel
mode: 0755 # mode: 0755
loop: # loop:
- src: bemount_rc.sh # - src: bemount_rc.sh
dest: bemount # dest: bemount
- name: Enable bemount # - name: Enable bemount
community.general.sysrc: # community.general.sysrc:
name: bemount_enable # name: bemount_enable
value: "YES" # value: "YES"
path: /etc/rc.conf.d/bemount # path: /etc/rc.conf.d/bemount
- name: Install loader.conf - name: Install loader.conf
copy: copy:
@@ -107,6 +107,7 @@
owner: root owner: root
group: wheel group: wheel
loop: loop:
- zfs
- disk_labels - disk_labels
- name: Configure sysctls - name: Configure sysctls
@@ -127,7 +128,7 @@
blockinfile: blockinfile:
path: "/etc/periodic.conf.local" path: "/etc/periodic.conf.local"
marker: "# {mark} ANSIBLE MANAGED BLOCK log" marker: "# {mark} ANSIBLE MANAGED BLOCK log"
# create: true create: true
mode: 0644 mode: 0644
owner: root owner: root
group: wheel group: wheel
@@ -141,13 +142,13 @@
blockinfile: blockinfile:
path: "/etc/periodic.conf.local" path: "/etc/periodic.conf.local"
marker: "# {mark} ANSIBLE MANAGED BLOCK zfs" marker: "# {mark} ANSIBLE MANAGED BLOCK zfs"
# create: true create: true
mode: 0644 mode: 0644
owner: root owner: root
group: wheel group: wheel
block: | block: |
daily_scrub_zfs_enable="YES" daily_scrub_zfs_enable="YES"
daily_scrub_zfs_default_threshold="7" daily_scrub_zfs_default_threshold="14"
# Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi. # Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi.
- name: Install loader.conf - name: Install loader.conf

1
ansible/roles/cpu/files/aesni_loader.conf
View File

@@ -1 +0,0 @@
aesni_load="YES"

1
ansible/roles/cpu/files/amd_microcode_rc.conf Normal file
View File

@@ -0,0 +1 @@
microcode_update_enable="YES"

1
ansible/roles/cpu/files/cryptodev_loader.conf Normal file
View File

@@ -0,0 +1 @@
cryptodev_load="YES"

18
ansible/roles/cpu/tasks/freebsd_amd.yaml
View File

@@ -1,3 +1,9 @@
- name: Install packages
package:
name:
- cpu-microcode-amd
state: present
- name: Install loader.conf - name: Install loader.conf
copy: copy:
src: "files/{{ item }}_loader.conf" src: "files/{{ item }}_loader.conf"
@@ -17,16 +23,7 @@
group: wheel group: wheel
loop: loop:
- power_profile - power_profile
- amd_microcode
- name: Install loader.conf
copy:
src: "files/{{ item }}_loader.conf"
dest: "/boot/loader.conf.d/{{ item }}.conf"
mode: 0644
owner: root
group: wheel
loop:
- aesni
- name: Install loader.conf - name: Install loader.conf
when: hwpstate is defined and hwpstate when: hwpstate is defined and hwpstate
@@ -38,3 +35,4 @@
group: wheel group: wheel
loop: loop:
- per_core_hwpstate - per_core_hwpstate
- cryptodev

2
ansible/roles/cpu/tasks/freebsd_intel.yaml
View File

@@ -16,7 +16,6 @@
loop: loop:
- coretemp - coretemp
- cpuctl - cpuctl
- aesni
- intel_microcode - intel_microcode
- name: Install service configuration - name: Install service configuration
@@ -79,3 +78,4 @@
group: wheel group: wheel
loop: loop:
- per_core_hwpstate - per_core_hwpstate
- cryptodev

9
ansible/roles/firewall/files/mrmanager_pf.conf
View File

@@ -3,7 +3,7 @@ not_ext_if = "{ !lagg0 }"
jail_nat_v4 = "{ 10.215.1.0/24 }" jail_nat_v4 = "{ 10.215.1.0/24 }"
not_jail_nat_v4 = "{ any, !10.215.1.0/24 }" not_jail_nat_v4 = "{ any, !10.215.1.0/24 }"
# pub_k8s = "{ 74.80.180.136/29, !74.80.180.138 }" # pub_k8s = "{ 74.80.180.136/29, !74.80.180.138 }"
pub_k8s = "{ 74.80.180.137, 74.80.180.139, 74.80.180.140, 74.80.180.141, 74.80.180.142 }" pub_k8s = "{ 74.80.180.137, 74.80.180.139, 74.80.180.140, 74.80.180.141, 74.80.180.142, 2620:11f:7001:7:ffff:dddd::/112 }"
dhcp = "{ bootpc, bootps }" dhcp = "{ bootpc, bootps }"
allow = "{ colo }" allow = "{ colo }"
@@ -35,6 +35,7 @@ scrub in on $ext_if all fragment reassemble
# redirections # redirections
nat on $ext_if inet from ! ($ext_if) to ! ($ext_if) -> ($ext_if) nat on $ext_if inet from ! ($ext_if) to ! ($ext_if) -> ($ext_if)
rdr pass on jail_nat proto {tcp, udp} from any to 10.215.1.1 port 53 tag REDIREXTERNAL -> 1.1.1.1 port 53 rdr pass on jail_nat proto {tcp, udp} from any to 10.215.1.1 port 53 tag REDIREXTERNAL -> 1.1.1.1 port 53
rdr pass on jail_nat proto {tcp, udp} from any to 2620:11f:7001:7:ffff:ffff:0ad7:0101 port 53 tag REDIREXTERNAL -> 2606:4700:4700::1111 port 53
rdr pass on $ext_if proto {tcp, udp} to ($ext_if) port 6443 tag REDIRINTERNAL -> 10.215.1.204 port 6443 rdr pass on $ext_if proto {tcp, udp} to ($ext_if) port 6443 tag REDIRINTERNAL -> 10.215.1.204 port 6443
rdr pass on jail_nat proto {tcp, udp} to ($ext_if) port 6443 tag REDIRINTERNAL -> 10.215.1.204 port 6443 rdr pass on jail_nat proto {tcp, udp} to ($ext_if) port 6443 tag REDIRINTERNAL -> 10.215.1.204 port 6443
@@ -69,8 +70,10 @@ pass quick on $allow
# Single interface kubernetes cluster is working with the following run on mrmanager: # Single interface kubernetes cluster is working with the following run on mrmanager:
# doas route add -host 74.80.180.139 -interface jail_nat # doas route add -host 74.80.180.139 -interface jail_nat
# doas route add -net 10.129.0.0/16 -interface jail_nat # doas route add -net 10.129.0.0/16 -interface jail_nat
# ? doas route -6 add -net '2620:11f:7001:7:ffff:ffff:0ad7:0100/120' -interface jail_nat # doas route -6 add -net '2620:11f:7001:7:ffff:ffff:0ad7:0100/120' -interface jail_nat
# ? doas ifconfig jail_nat inet6 2620:11f:7001:7:ffff:ffff:0ad7:0101/120 # doas route -6 add -net '2620:11f:7001:7:ffff:eeee::/96' -interface jail_nat
# doas route -6 add -net '2620:11f:7001:7:ffff:dddd::/112' -interface jail_nat
# doas ifconfig jail_nat inet6 2620:11f:7001:7:ffff:ffff:0ad7:0101/120
# doas sysctl net.link.ether.inet.proxyall=1 # doas sysctl net.link.ether.inet.proxyall=1
# Plus this in pf.conf: # Plus this in pf.conf:
# pass quick from any to 74.80.180.139 # pass quick from any to 74.80.180.139

4
ansible/roles/ndproxy/files/ndproxy_rc.conf Normal file
View File

@@ -0,0 +1,4 @@
ndproxy_enable="YES"
ndproxy_uplink_interface="lagg0"
ndproxy_downlink_mac_address="3c:ec:ef:bf:41:be" # Mac address of lagg0
ndproxy_uplink_ipv6_addresses="fe80::21c:73ff:fe9d:c083" # uplink router's address (ndp -na) <-- Link-Local address of vtnet0

3
ansible/roles/package_manager/files/FreeBSD-ports.conf Normal file
View File

@@ -0,0 +1,3 @@
FreeBSD-ports: {
url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest"
}

3
ansible/roles/package_manager/files/FreeBSD.conf
View File

@@ -1,3 +0,0 @@
FreeBSD: {
url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest"
}

71
ansible/roles/package_manager/files/pkg.conf
View File

@@ -31,13 +31,12 @@
#PKG_ENABLE_PLUGINS = true; #PKG_ENABLE_PLUGINS = true;
#PLUGINS [ #PLUGINS [
#] #]
PLUGINS [ PLUGINS [ provides ];
"provides"
]
#DEBUG_SCRIPTS = false; #DEBUG_SCRIPTS = false;
#PLUGINS_CONF_DIR = "/usr/local/etc/pkg/"; #PLUGINS_CONF_DIR = "/usr/local/etc/pkg/";
#PERMISSIVE = false; #PERMISSIVE = false;
#REPO_AUTOUPDATE = true; #REPO_AUTOUPDATE = true;
#FORCE_CAN_REMOVE_VITAL = true;
#NAMESERVER = ""; #NAMESERVER = "";
#HTTP_USER_AGENT = "Custom_User_Manager"; #HTTP_USER_AGENT = "Custom_User_Manager";
#EVENT_PIPE = ""; #EVENT_PIPE = "";
@@ -57,35 +56,37 @@ PLUGINS [
#IP_VERSION = 0 #IP_VERSION = 0
# Sample alias settings # Sample alias settings
ALIAS : { ALIAS {
all-depends: query %dn-%dv, all-depends = "query %dn-%dv";
annotations: info -A, annotations = "info -A";
build-depends: info -qd, build-depends = "info -qd";
cinfo: info -Cx, cinfo = "info -Cx";
comment: query -i "%c", comment = "query -i \"%c\"";
csearch: search -Cx, csearch = "search -Cx";
desc: query -i "%e", desc = "query -i \"%e\"";
download: fetch, download = "fetch";
iinfo: info -ix, iinfo = "info -ix";
isearch: search -ix, isearch = "search -ix";
prime-list: "query -e '%a = 0' '%n'", prime-list = "query -e '%a = 0' '%n'";
prime-origins: "query -e '%a = 0' '%o'", prime-origins = "query -e '%a = 0' '%o'";
leaf: "query -e '%#r == 0' '%n-%v'", leaf = "query -e '%#r == 0' '%n-%v'";
list: info -ql, list = "info -ql";
noauto = "query -e '%a == 0' '%n-%v'", noauto = "query -e '%a == 0' '%n-%v'";
options: query -i "%n - %Ok: %Ov", options = "query -i \"%n - %Ok: %Ov\"";
origin: info -qo, origin = "info -qo";
orphans: version -vRl\?, orphans = "version -vRl?";
provided-depends: info -qb, provided-depends = "info -qb";
rall-depends: rquery %dn-%dv, rall-depends = "rquery %dn-%dv";
raw: info -R, raw = "info -R";
rcomment: rquery -i "%c", rcomment = "rquery -i \"%c\"";
rdesc: rquery -i "%e", rdesc = "rquery -i \"%e\"";
required-depends: info -qr, required-depends = "info -qr";
roptions: rquery -i "%n - %Ok: %Ov", roptions = "rquery -i \"%n - %Ok: %Ov\"";
shared-depends: info -qB, sets = "info -d -C -x '^FreeBSD-set-'";
show: info -f -k, shared-depends = "info -qB";
size: info -sq, show = "info -f -k";
unmaintained = "query -e '%m = \"ports@FreeBSD.org\"' '%o (%w)'", size = "info -sq";
runmaintained = "rquery -e '%m = \"ports@FreeBSD.org\"' '%o (%w)'", unmaintained = "query -e '%m = \"ports@FreeBSD.org\"' '%o (%w)'";
} runmaintained = "rquery -e '%m = \"ports@FreeBSD.org\"' '%o (%w)'";
}
BACKUP_LIBRARIES=yes

4
ansible/roles/package_manager/tasks/freebsd.yaml
View File

@@ -36,8 +36,8 @@
owner: root owner: root
group: wheel group: wheel
loop: loop:
- src: FreeBSD.conf - src: FreeBSD-ports.conf
dest: /usr/local/etc/pkg/repos/FreeBSD.conf dest: /usr/local/etc/pkg/repos/FreeBSD-ports.conf
- name: Install Configuration - name: Install Configuration
when: custom_repo is defined when: custom_repo is defined

1
ansible/roles/sshd/files/keys/mole.pub
View File

@@ -1 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINtEizWWTfTdWJ+f6F2ot27V0ktYAxSCVI6d/tpS6ARw mole@maxwell