182 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Ruakij	80658c632f	Add the cilium network plugin to the kubernetes role, disabling servicelb, and collect the disabled k3s components in one disable list	2026-10-09 14:37:29 +00:00
Ruakij	60b67f748e	Install the k3s servers one at a time with retries from the latest channel, enable the service and link the kubeconfig to ~/.kube/config	2026-10-09 14:37:28 +00:00
Ruakij	4a76aa3a2e	Set node-name, node-external-ip and labels_extra in the k3s config and config_extra for agents	2026-10-09 14:37:27 +00:00
Ruakij	e9f1153482	Add clean_resolv_conf to the kubernetes role to give k3s a resolv.conf with only the nameserver lines	2026-10-09 14:37:27 +00:00
Ruakij	ca1fcc16b6	Fall back to the default IPv4 and IPv6 address when the k3s node IP interface has none	2026-10-09 14:37:27 +00:00
Ruakij	fb94fd5997	Deploy the calico operator v3.28.0	2026-10-09 14:37:26 +00:00
Ruakij	713d38d77d	Shrink the default IPv6 cluster CIDR of k3s to fd42::/112	2026-10-09 14:37:26 +00:00
Ruakij	bc71066de1	Run the k3s install of the kubernetes role only on target_host when it is set	2026-10-09 14:37:26 +00:00
Ruakij	5eae9ca348	Drop the docker dependency and the helm install from the kubernetes role	2026-10-09 14:37:25 +00:00
Ruakij	844e017f9e	Add a tuned role that installs tuned and sets the throughput-performance profile	2026-10-09 14:37:25 +00:00
Ruakij	381f3ab7c9	Start the wireguard-ipv6-converter again whenever its bound service starts via a drop-in and always restart it on deploy	2026-10-09 14:37:24 +00:00
Ruakij	6390e6288b	Disable SSH password auth in the common role only when sshd is active	2026-10-09 14:37:24 +00:00
Ruakij	13d60c4f9b	Install nmon and fail2ban and upgrade packages on every distribution in the common role	2026-10-09 14:37:24 +00:00
Ruakij	cb09f77b68	Enable TCP BBR with the fq qdisc on kernels from 4.9 in the common role	2026-10-09 14:37:23 +00:00
Ruakij	84fd52b678	Generate a random IPv6 stable secret once per host for the default interface in the common role	2026-10-09 14:37:23 +00:00
Ruakij	c7eceae087	Ensure the .bashrc exists, expand aliases after sudo and color grep in the common role aliases	2026-10-09 14:37:23 +00:00
Ruakij	23ed82b113	Own the k3s config.yaml in the kubernetes role template, write it only on a semantic change and run the installer only when the pinned k3s version differs	2026-10-09 14:13:21 +00:00
Ruakij	37e21ead36	Expose the etcd metrics on the node IP of the etcd members of k3s	2026-10-09 12:56:24 +00:00
Ruakij	2798853153	Raise the inotify limits of the k3s nodes to 65536 instances and 4194304 watches, except in LXC	2026-10-09 12:55:46 +00:00
Ruakij	e9ba272d70	Manage the kubelet image garbage collection drop-in and its config-dir kubelet-arg in the kubernetes role	2026-10-09 12:54:41 +00:00
Ruakij	b62992f21e	Cap the systemd journal at 512M on disk, 128M in memory and two weeks in the common role	2026-10-09 12:53:44 +00:00
Ruakij	fd73949412	Whitelist the public_ips of every inventory host in crowdsec and keep a LAPI allowlist equal to the whitelist	2026-10-08 09:19:51 +00:00
Ruakij	d345ccf585	Add a pre_command to kopia_backup for host dump scripts and install gpg for the apt key	2026-10-08 08:51:23 +00:00
Ruakij	b45a07da56	Add forward_guard to host_firewall for a forward chain that drops traffic to guarded guests outside the allowed interfaces, ports and ICMP types	2026-10-08 08:48:40 +00:00
Ruakij	9ded6814c3	Pin the fstrim timer and the monthly ZFS trim and scrub per host in the common role to keep them out of the backup window	2026-10-07 22:42:08 +00:00
Ruakij	a9a60e3106	Keep the clock on systemd-timesyncd and the timezone on UTC in the common role	2026-10-07 21:22:01 +00:00
Ruakij	5da89fdf29	Run the kopia_backup timer at 03:30 UTC by default since the hosts run in different timezones	2026-10-07 21:19:09 +00:00
Ruakij	9e2e6cbb99	Add IPv4 port forwards and masquerade to host_firewall in an ip host_nat table	2026-10-07 21:10:35 +00:00
Ruakij	c9d2334906	Add a kopia_backup role for the daily Kopia snapshot script and timer against an existing S3 repository	2026-10-07 21:00:25 +00:00
Ruakij	c87af201aa	Add a crowdsec role for agents and the nftables bouncer against a central LAPI	2026-10-07 11:02:59 +00:00
Ruakij	cfe87002c5	Replace the nftables role with host_firewall, one atomic inet host input table with zones, geo sets and lockout rollback	2026-10-07 11:02:59 +00:00
Ruakij	27e9d4a1ab	Merge branch 'role_nftables'	2023-06-21 17:35:09 +02:00
Ruakij	755f9b2e1a	Initial role	2023-05-21 20:57:43 +02:00
Ruakij	753f456ef3	Merge branch 'role_kubernetes-k3s'	2023-04-14 10:21:06 +02:00
Ruakij	093612f3a7	Change restart-check to started/restarted check	2023-04-14 10:20:16 +02:00
Ruakij	a92409c56f	Add failed_when to deploy calico operator	2023-04-14 10:01:42 +02:00
Ruakij	f50e3ac33c	Use first node's IP for joining cluster	2023-04-14 09:50:39 +02:00
Ruakij	668ff23ee6	Fix service task wrong usage	2023-04-14 09:42:46 +02:00
Ruakij	c2c6a2872f	Fix conditional for changed after install	2023-04-12 23:12:10 +02:00
Ruakij	c1c7ec9e56	Remove workaround as k3s is now at 1.26	2023-04-12 22:39:43 +02:00
Ruakij	550f6868ff	Fix old usage of network_plugin var	2023-04-12 20:49:38 +02:00
Ruakij	3fe288f6a5	Merge branch 'role_wireguard-ipv6-converter'	2023-04-12 20:40:01 +02:00
Ruakij	ab9220d042	Add pause & gather_facts at end when service was started	2023-04-12 20:39:49 +02:00
Ruakij	15ad7920d4	Merge branch 'role_wireguard-ipv6-converter'	2023-04-12 20:24:27 +02:00
Ruakij	7012e1ea2b	Separate enable and re-/start service for fine-control	2023-04-12 20:23:08 +02:00
Ruakij	13ebd48c5d	Add register for task download	2023-04-12 20:22:34 +02:00
Ruakij	1a76b94a46	Add download-version	2023-04-12 14:58:43 +02:00
Ruakij	1b765689e6	Make sure daemon is reloaded before service-start	2023-04-12 14:50:14 +02:00
Ruakij	5b607df2de	Add checks if var is set	2023-04-12 14:47:02 +02:00
Ruakij	521b76453a	Add start to naming	2023-04-12 14:45:55 +02:00