.gitignore

@@ -1,4 +1,3 @@
 vault-pass.gpg-*
 roles/*
 !roles/requirements.yml
-.vscode/

.vault/vault-keys

@@ -1 +1,4 @@
-88CBCAD842520E46
+D749E2966193DF63
+EE3E0A7A87192BB7
+3C8D0C7EF49AB5A3
+388DD8D74903017E

files/manifests/secret-digitalocean-dns.yaml

@@ -1,19 +1,16 @@
 $ANSIBLE_VAULT;1.1;AES256
-37303132393466333261633739343530323037363563346263393337306262386434616236623830
+32383162626163663734653236646538626464643665323334666363306662363434346133653737
-6439616662356337653935346434323638326432363531660a333235636264313765646330363263
+3766373965626437376630303837663339383664643466300a336463366335636634336437303036
-31616232373735373834393965353930316161393265366431653639646438376534656462326337
+32626138646662633337663037393538336438643363303962326263656636316336346462643937
-3036653763363530330a333461643731636535643532323139393238353431313034323066363635
+6337363463626265630a663964386638633133613465363436376533346336333066663664363062
-31336534383163303233383936383533663437663637323335326335356135653063303133643764
+65333864353338656437333762313937376538376634383438643134313266366236393039376131
-35613638663736636166353734303333666332633434313766346332373565633166356561643030
+35646533353539633436343435316465386534646663316234336263363163343463626632663837
-64626163636562323964346137313238633036396232393766393137663134396663613933646539
+66633432376136323961336437613465303635303966343530383162653766373736333661386163
-63666435333763323862636536313436383133343031363232333433656264386139653030383465
+30303233333939626537303631313532373130363866306165343732653064643866393933323230
-63333137356463303865393939303463333031383563393837623261333734353261326333316461
+31373035653332363961343464613134626464643733313666333861623961373264303462633334
-66343135656631396230303665373033663431356464636163613333643362383162613861393435
+63653638356666656163343266353133396236313231643664313764663761363634643063323466
-32626562653337313638623764646463663034363065306633346365303366643166633436643936
+36623266393166316138343239393663393739666266653730323766643566343936386436666164
-32653865363631623839313533333831386339633837353233313730643939336265343764643131
+30616637656563626634306634336631613564396234613836396537636363643466323762393166
-34363734616237373237303039643261376664376636386164643433366436353162656232336330
+33623534613462306130356631626265373462343065333132666439623333663135336437323536
-39336436353235396633313265353939373262303637373830623439303132386666646130626330
+36303131386135333763356565323962666233353263353331653065333435613138343939393530
-62653462343838303266343830366565666639353362343662653234396365353339343330623039
+633664316538643432303731366233653831
-37653335323564323762653338666634363237303830653736623963306564643831353233663630
-32386131373263613139326534633432666364656561663461643031663230643366363036336631
-3039393835346431346231636665396138393336343963333466

files/manifests/wildcard-pwa-realitynetwork.yaml

@@ -1,15 +1,15 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: pwa.laconic.com
+  name: pwa.realitynetwork.store
   namespace: default
 spec:
-  secretName: pwa.laconic.com
+  secretName: pwa.realitynetwork.store
   issuerRef:
     name: letsencrypt-prod-wild
     kind: ClusterIssuer
     group: cert-manager.io
-  commonName: "*.pwa.laconic.com"
+  commonName: "*.pwa.realitynetwork.store"
   dnsNames:
-    - "pwa.laconic.com"
+    - ".pwa.realitynetwork.store"
-    - "*.pwa.laconic.com"
+    - "*.pwa.realitynetwork.store"

group_vars/all/vault.yml

@@ -1,7 +1,7 @@
 $ANSIBLE_VAULT;1.1;AES256
-37613532616632663366373332616133316237633564386464643032636137356436623331313365
+35636534633536663965623866666430613934363036343661343362346534353764326662396365
-3164613836383930663466306133336263393764306662620a616131366561306334656535663432
+3039363533323464353932373436356362353261343836620a616132336266346238336338653434
-31323566373730353338356365663764386266383831666637646361626433343162313039343964
+35616334333832356134353466623333363235373066396663363839656663326666323164393265
-3837666333343133630a343534366535613765336134623532323038633466666538356235323464
+6338323565323936350a356136353231613765366531366431363864356565653938613963656233
-65326264393765383138393661616537323864333036353130633461383865643030366363623437
+66613965396531636331353463333436376337363932393033303937383263336637663435373262
-6162376537646461343066316234663730663466303931646630
+3361356561306233303030313438363637343433356463626536

group_vars/lcn_cad/k8s-vault.yml

@@ -1,8 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-32623937306230646432336339336134316263616136383264623030623930633664346263643165
-3539396565353163656432303038613736343430643765330a353465613136396436613565396638
-63396333363766353737363438383262623539376666316531303535663832303363356631633735
-6666643461626262350a393136306662666232356532366666323765356330333838363162356330
-61333233666634373666636630623865333838653762393634306464336636633633646266623263
-33373831613266373839383666326264376362646638386566656362656130383861633933666564
-383930616533303265633661363335633064

group_vars/lcn_cad/k8s.yml

@@ -1,55 +0,0 @@
----
-# default context is used for stack orchestrator deployments, for testing a custom context name can be usefull
-#k8s_cluster_name: lcn-cad-cluster
-k8s_cluster_name: default
-k8s_cluster_url: lcn-cad-cluster-control.laconic.com
-k8s_taint_servers: false
-
-k8s_acme_email: "{{ support_email }}"
-
-# k3s bundles traefik as the default ingress controller, we will disable it and use nginx instead
-k8s_disable: 
-  - traefik
-
-# secrets can be stored in a file or as a template, the template secrets gets dynamically base64 encoded while file based secrets must be encoded by hand
-k8s_secrets:
-  - name: digitalocean-dns
-    type: file
-    source: secret-digitalocean-dns.yaml
-
-k8s_manifests:
-  # ingress controller, replaces traefik which is explicitly disabled
-  - name: ingress-nginx
-    type: url
-    source: https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.10.1/deploy/static/provider/cloud/deploy.yaml
-
-  # cert-manager, required for letsencrypt
-  - name: cert-manager
-    type: url
-    source: https://github.com/cert-manager/cert-manager/releases/download/v1.15.1/cert-manager.yaml
-  
-  # issuer for basic http certs
-  - name: letsencrypt-prod
-    type: template
-    source: shared/clusterissuer-acme.yaml
-    server: https://acme-v02.api.letsencrypt.org/directory
-    solvers: 
-      - type: http
-        ingress: nginx
-
-  # issuer for wildcard dns certs
-  - name: letsencrypt-prod-wild
-    type: template
-    source: shared/clusterissuer-acme.yaml
-    server: https://acme-v02.api.letsencrypt.org/directory
-    solvers: 
-      - type: dns
-        provider: digitalocean
-        tokenref: tokenSecretRef
-        secret_name: digitalocean-dns
-        secret_key: access-token
-
-  # initiate wildcard cert
-  - name: pwa.laconic.com
-    type: file
-    source: wildcard-pwa-laconic.yaml

group_vars/rnt_cad/k8s-vault.yml

@@ -0,0 +1,8 @@
+$ANSIBLE_VAULT;1.1;AES256
+39633338616237663666373535663038646563353438346363333632616133353661323532623265
+6464306261363038386234396334363136336435656663390a626133313233396664646130386361
+39326232343834663665376534666230303034303362333265356263336361626362393939623961
+6234393862366365360a353461386639633132633437653832383663303136343761333132333738
+33336131323364333063393732643366666563393839303333303663366334613238626537636530
+64323062353134346431373536623162353731623833623832353636643063646463623833613135
+643430356133643436373339643066613165

group_vars/rnt_cad/k8s.yml

@@ -0,0 +1,37 @@
+---
+k8s_cluster_name: default
+k8s_cluster_url: rnt-cad-cluster-control.realitynetwork.store
+k8s_taint_servers: true
+
+k8s_acme_email: "{{ support_email }}"
+
+k8s_manifests:
+  - name: cert-manager
+    type: url
+    source: https://github.com/cert-manager/cert-manager/releases/download/v1.15.0/cert-manager.yaml
+  
+  # issuer for basic http certs
+  - name: letsencrypt-prod
+    type: template
+    source: shared/clusterissuer-acme.yaml
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers: 
+      - type: http
+        ingress: nginx
+
+  # issuer for wildcard dns certs
+  - name: letsencrypt-prod-wild
+    type: template
+    source: shared/clusterissuer-acme.yaml
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers: 
+      - type: dns
+        provider: digitalocean
+        tokenref: tokenSecretRef
+        secret_name: digitalocean-dns
+        secret_key: access-token
+
+  # initiate wildcard cert
+  - name: pwa.realitynetwork.store
+    type: file
+    source: wildcard-pwa-realitynetwork.yaml

host_vars/rnt-cad-cluster-control/firewalld.yml

@@ -13,4 +13,5 @@ firewalld_add:
     sources:
       - 10.42.0.0/16
       - 10.43.0.0/16
-      - 159.203.31.82/32
+      - 142.93.110.163/32
+      - 147.182.158.116/32

host_vars/rnt-cad-cluster-worker/firewalld.yml

@@ -0,0 +1,15 @@
+---
+firewalld_add:
+  - name: public
+    interfaces:
+      - enp9s0
+    services:
+      - http
+      - https
+
+  - name: trusted
+    sources:
+      - 10.42.0.0/16
+      - 10.43.0.0/16
+      - 142.93.110.163/32
+      - 147.182.150.60/32

host_vars/rnt-daemon/firewalld.yml

@@ -7,10 +7,11 @@ firewalld_add:
       - http
       - https
     ports:
-      - 26657/tcp
+      - 22657/tcp
-      - 26656/tcp
+      - 22656/tcp
       - 1317/tcp
 
   - name: trusted
     sources:
-      - 147.182.144.6/32
+      - 147.182.150.60/32
+      - 147.182.158.116/32

host_vars/rnt-daemon/nginx.yml

@@ -6,16 +6,16 @@ nginx_proxy_send_timeout: 1200
 nginx_proxy_connection_timeout: 75
 
 nginx_sites:
-  - name: lcn-console
+  - name: rnt-console
-    url: lcn-console.laconic.com
+    url: rnt-console.realitynetwork.store
     upstream: http://localhost:8080
     template: basic-proxy
     ssl: true
 
-  - name: lcn-daemon
+  - name: rnt-daemon
-    url: lcn-daemon.laconic.com
+    url: rnt-daemon.realitynetwork.store
     upstream: http://localhost:9473
     configs:
-      - rewrite ^/deployer(/.*)? https://webapp-deployer.pwa.laconic.com permanent
+      - rewrite ^/deployer(/.*)? https://webapp-deployer.pwa.realitynetwork.store permanent
     template: websocket-proxy
     ssl: true

hosts

@@ -1,12 +1,14 @@
 [all]
-lcn-daemon ansible_host=159.203.31.82
+rnt-daemon ansible_host=142.93.110.163
-lcn-cad-cluster-control ansible_host=147.182.144.6
+rnt-cad-cluster-control ansible_host=147.182.150.60
+rnt-cad-cluster-worker ansible_host=147.182.158.116
 
 [so]
-lcn-daemon
+rnt-daemon
 
-[lcn_cad]
+[rnt_cad]
-lcn-cad-cluster-control k8s_node_type=bootstrap k8s_pod_limit=1024 k8s_external_ip=147.182.144.6
+rnt-cad-cluster-control k8s_node_type=bootstrap
+rnt-cad-cluster-worker k8s_node_type=agent k8s_pod_limit=1024 k8s_external_ip=147.182.158.116
 
 [k8s:children]
-lcn_cad
+rnt_cad

roles/requirements.yml

@@ -1,20 +1,20 @@
 ---
 - name: firewalld
   scm: git
-  src: https://git.vdb.to/cerc-io/ansible-role-firewalld
+  src: https://github.com/srwadleigh/ansible-role-firewalld
   version: main
 
 - name: nginx
   scm: git
-  src: https://git.vdb.to/cerc-io/ansible-role-nginx
+  src: https://github.com/srwadleigh/ansible-role-nginx
   version: main
 
 - name: so
   scm: git
-  src: https://git.vdb.to/cerc-io/ansible-role-so
+  src: https://github.com/srwadleigh/ansible-role-so
   version: main
 
 - name: k8s
   scm: git
-  src: https://git.vdb.to/cerc-io/ansible-role-k8s
+  src: https://github.com/srwadleigh/ansible-role-k8s
   version: main