initial commit

2024-07-09 15:23:23 -04:00
14 changed files with 47 additions and 99 deletions
@@ -1,4 +1,3 @@
 vault-pass.gpg-*
 roles/*
 !roles/requirements.yml
-.vscode/
@@ -1,4 +1 @@
-D749E2966193DF63
-EE3E0A7A87192BB7
-3C8D0C7EF49AB5A3
-388DD8D74903017E
+55F7FC933CCA4A47F5AA3C802F84305F02B16995
@@ -1,3 +1,3 @@
 [defaults]
 roles_path = roles:galaxy-roles:git-roles:ansible-roles:~/.ansible/roles
-vault_password_file = .vault/vault-open.sh
+# vault_password_file = .vault/vault-open.sh
@@ -1,19 +1 @@
-$ANSIBLE_VAULT;1.1;AES256
-37633666323130636331326338626330663531323239656265636464376534653664393535323234
-3231316434616366656265373863663431333466323831350a616337336363346163363962643130
-30663862656334303862643333366237376538633937366332333535303264366562336136336363
-6632316663353138620a643230666534653231666534653837333536333930646465623533373639
-65323839643535373666313866373764663832366231333832336135623930306564363930373539
-62376134666332323837396634616465323132643933353738376166313236303063663463646561
-35653738636264653739326132366530663962306133353061653764353261333737666638343039
-34663762636439303530313865366236666131373561323337323539623266666136653232656466
-36383833336235623939653765373331313333623031376539613536663134356632313762616364
-66363036623538663635306438373962323538323234343234623364633165363865396563366339
-37363232313764646237316630643463343561653362373436346663643738356334353431356261
-39383131346237636435303338303462636531376639383765343733303133393731326538363862
-36643831303030656239613938323862323539356339386435633663306430623838653763373337
-38336431303539383831653739313063373539323937353333626235626130613266666230666365
-32326238353439393538353939306235643762646339393362633632663638666564363431663366
-66366435613262356165373538373138353031356365316262343733663763373031623435323366
-63653165386561616562623230376461383936353738313333646335623937353566303462616232
-6533356562323134643839313765393933656537633337363932
+dop_v1_cf3fddc6f6c9e008e62c454a3db645038634c253a526a3bbbcf27618789ae587
@@ -1,15 +1,15 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: pwa.realitynetwork.store
+  name: l.stg.earthball.xyz
  namespace: default
 spec:
-  secretName: pwa.realitynetwork.store
+  secretName: l.stg.earthball.xyz
  issuerRef:
    name: letsencrypt-prod-wild
    kind: ClusterIssuer
    group: cert-manager.io
-  commonName: "*.pwa.realitynetwork.store"
+  commonName: "*.l.stg.earthball.xyz"
  dnsNames:
-    - "pwa.realitynetwork.store"
-    - "*.pwa.realitynetwork.store"
+    - "l.stg.earthball.xyz"
+    - "*.l.stg.earthball.xyz"
@@ -1,7 +1,2 @@
-$ANSIBLE_VAULT;1.1;AES256
-35636534633536663965623866666430613934363036343661343362346534353764326662396365
-3039363533323464353932373436356362353261343836620a616132336266346238336338653434
-35616334333832356134353466623333363235373066396663363839656663326666323164393265
-6338323565323936350a356136353231613765366531366431363864356565653938613963656233
-66613965396531636331353463333436376337363932393033303937383263336637663435373262
-3361356561306233303030313438363637343433356463626536
+---
+support_email: someone@example.com
@@ -0,0 +1,10 @@
+---
+k8s_cluster_token: 18cd2efad6ba0df6cfe1e559ffacb0e2
+
+k8s_secrets:
+  - name: digitalocean-dns
+    type: template
+    namespace: cert-manager
+    secrets:
+      - key: access-token
+        value: dop_v1_cf3fddc6f6c9e008e62c454a3db645038634c253a526a3bbbcf27618789ae587
@@ -1,22 +1,13 @@
 ---
-# default context is used for stack orchestrator deployments, for testing a custom context name can be usefull
-#k8s_cluster_name: rnt-cad-cluster
-k8s_cluster_name: default
-k8s_cluster_url: rnt-cad-cluster-control.realitynetwork.store
+k8s_cluster_name: lx-cad
+k8s_cluster_url: lx-cad-cluster-control.l.stg.earthball.xyz
 k8s_taint_servers: true

 k8s_acme_email: "{{ support_email }}"

-# k3s bundles traefik as the default ingress controller, we will disable it and use nginx instead
 k8s_disable: 
  - traefik

-# secrets can be stored in a file or as a template, the template secrets gets dynamically base64 encoded while file based secrets must be encoded by hand
-k8s_secrets:
-  - name: digitalocean-dns
-    type: file
-    source: secret-digitalocean-dns.yaml
-
 k8s_manifests:
  # ingress controller, replaces traefik which is explicitly disabled
  - name: ingress-nginx
@@ -26,7 +17,7 @@ k8s_manifests:
  # cert-manager, required for letsencrypt
  - name: cert-manager
    type: url
-    source: https://github.com/cert-manager/cert-manager/releases/download/v1.15.1/cert-manager.yaml
+    source: https://github.com/cert-manager/cert-manager/releases/download/v1.15.0/cert-manager.yaml
  
  # issuer for basic http certs
  - name: letsencrypt-prod
@@ -50,6 +41,6 @@ k8s_manifests:
        secret_key: access-token

  # initiate wildcard cert
-  - name: pwa.realitynetwork.store
+  - name: l.stg.earthball.xyz
    type: file
-    source: wildcard-pwa-realitynetwork.yaml
+    source: wildcard-l-earthball.yaml
@@ -1,26 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-61316662343265383362663936373531346563663065646434336239643031356336623230623766
-3135333666356363636536656439363239356232666435370a346232636365616566313331626362
-34303965633863623237333861666564373665623938623164396162323166343337653631333130
-3034333135333535320a646561333736353838356565323737616232373461646531636233363732
-34303463323132313430653733396636313930383364363462636463333139623265636362373438
-65626331386536376666366261633835313334653739643364643639643431353730386662363839
-37636639393530633834623631363765663730383031313138656431633835343263303462313261
-33616366333262643033636563326534653133643232616636353037616261643162386465613134
-39643730666435666165353331653765386539356333623830306239323366363563613639653232
-61373933306531666334306463326161386431326132623238633235623839646236663761386530
-38633963303839343238613164643464356562616334316332366461363963363339343762326535
-66336336393537343762653731306637613030643338616164383435336632313862336464613533
-32653265613262663633623039386337666333336364396435656331376339373938653634336162
-65376433653665373838663261656635623663326433616534653963396163316662613664343561
-39616532386330663337396332316332336537663466636339356463393239356430626266653133
-35623362373030623830303762343830353962353532373638643631636239653338306462343965
-61663031313465343632326664303963623037633639356563646265326233303261663533346632
-65333637613864623237643432613262383632336532316335643938313335306262316561366137
-37303965353065336234303134323631363932613162343337353433373964623565643039636162
-66376236393334613232343434376163613836373565313235323437356463313366646461363537
-32643135636364626533666265393664396538336331663735306433303439356462393532316437
-33613665633538663963633264346461663630623566393233656536323564623361323962303962
-62333736643664343762323433666531333633383563643834346234353736653337326438646530
-66373035336238363635623933663532323362396534653235633535316332393664336164303361
-65643435623334383435666434303465623465653531356465653535633363633036
@@ -2,7 +2,7 @@
 firewalld_add:
  - name: public
    interfaces:
-      - enp9s0
+      - eth0
    services:
      - http
      - https
@@ -13,5 +13,5 @@ firewalld_add:
    sources:
      - 10.42.0.0/16
      - 10.43.0.0/16
-      - 142.93.110.163/32
-      - 147.182.158.116/32
+      - 146.190.250.234/32
+      - 138.197.140.188/32
@@ -2,7 +2,7 @@
 firewalld_add:
  - name: public
    interfaces:
-      - enp9s0
+      - eth0
    services:
      - http
      - https
@@ -11,5 +11,5 @@ firewalld_add:
    sources:
      - 10.42.0.0/16
      - 10.43.0.0/16
-      - 142.93.110.163/32
-      - 147.182.150.60/32
+      - 146.190.250.234/32
+      - 138.197.136.93/32
@@ -2,7 +2,7 @@
 firewalld_add:
  - name: public
    interfaces:
-      - ens3
+      - eth0
    services:
      - http
      - https
@@ -13,5 +13,5 @@ firewalld_add:

  - name: trusted
    sources:
-      - 147.182.150.60/32
-      - 147.182.158.116/32
+      - 138.197.140.188/32
+      - 138.197.136.93/32
@@ -6,16 +6,16 @@ nginx_proxy_send_timeout: 1200
 nginx_proxy_connection_timeout: 75

 nginx_sites:
-  - name: rnt-console
-    url: rnt-console.realitynetwork.store
+  - name: lx-console
+    url: lx-console.l.stg.earthball.xyz
    upstream: http://localhost:8080
    template: basic-proxy
    ssl: true

-  - name: rnt-daemon
-    url: rnt-daemon.realitynetwork.store
+  - name: lx-daemon
+    url: lx-daemon.l.stg.earthball.xyz
    upstream: http://localhost:9473
    configs:
-      - rewrite ^/deployer(/.*)? https://webapp-deployer.pwa.realitynetwork.store permanent
+      - rewrite ^/deployer(/.*)? https://webapp-deployer.l.stg.earthball.xyz permanent
    template: websocket-proxy
    ssl: true
@@ -1,14 +1,14 @@
 [all]
-rnt-daemon ansible_host=142.93.110.163
-rnt-cad-cluster-control ansible_host=147.182.150.60
-rnt-cad-cluster-worker ansible_host=147.182.158.116
+lx-daemon ansible_host=146.190.250.234
+lx-cad-cluster-control ansible_host=138.197.136.93
+lx-cad-cluster-worker ansible_host=138.197.140.188

 [so]
-rnt-daemon
+lx-daemon

-[rnt_cad]
-rnt-cad-cluster-control k8s_node_type=bootstrap
-rnt-cad-cluster-worker k8s_node_type=agent k8s_pod_limit=1024 k8s_external_ip=147.182.158.116
+[lx_cad]
+lx-cad-cluster-control k8s_node_type=bootstrap
+lx-cad-cluster-worker k8s_node_type=agent k8s_pod_limit=1024 k8s_external_ip=138.197.140.188

 [k8s:children]
-rnt_cad
+lx_cad