feat(cert-manager): Add Cloudns issuer and DNS-01 challenge support
- Introduced a new Cloudns issuer configuration for cert-manager. - Created separate tasks for DNS-01 and HTTP-01 challenge issuers. - Updated cert-manager tasks to include Cloudns provider and manage secrets. - Refactored existing LetsEncrypt issuer registration to use new task structure. - Added necessary Kubernetes resources for Cloudns integration, including RBAC and certificates. - Updated Terraform configurations to support new DNS records and service changes. - Adjusted deployment strategies for CoreDNS and Open WebUI applications.
This commit is contained in:
@@ -0,0 +1,240 @@
|
||||
hostname: vh-01.lab.alexpires.me
|
||||
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
|
||||
|
||||
# Users
|
||||
login_users:
|
||||
- username: "{{ ansible_user }}"
|
||||
comment: "Managed by Ansible"
|
||||
sudoer: true
|
||||
sudoer_root_only: true
|
||||
sudoer_no_password: true
|
||||
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
|
||||
password_disabled: true
|
||||
- username: operator
|
||||
comment: "Managed by Ansible"
|
||||
sudoer: true
|
||||
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
|
||||
shell: "/bin/zsh"
|
||||
password_expiration: false
|
||||
|
||||
# SSH Connection and security
|
||||
sshd_port: 22
|
||||
ssh_allowed_networks:
|
||||
- "10.5.5.5/32" # Wireguard VPN (Laptop)
|
||||
- "10.19.4.0/24" # local network
|
||||
sshd_admin_net: "10.19.4.0/24" # local network
|
||||
sshd_allow_groups: "{{ ansible_user }} users"
|
||||
sshd_permit_root_login: "no"
|
||||
sshd_password_authentication: "no"
|
||||
sshd_allow_tcp_forwarding: "yes"
|
||||
|
||||
# Due to an issue increase the number of max auth tries
|
||||
sshd_max_auth_tries: 10
|
||||
|
||||
# Firewall ports
|
||||
ufw_enable: true
|
||||
fw_allowed_ports:
|
||||
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
|
||||
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
|
||||
- { rule: "allow", port: "9090", proto: "tcp" }
|
||||
|
||||
ufw_outgoing_traffic:
|
||||
- 22 # SSH
|
||||
- 53 # DNS
|
||||
- 80 # HTTP
|
||||
- 123 # NTP
|
||||
- 443 # HTTPS
|
||||
- 853 # DNS over TLS
|
||||
|
||||
ufw_default_forward_policy: "ACCEPT"
|
||||
|
||||
ipv4_sysctl_settings:
|
||||
net.ipv4.ip_forward: 1
|
||||
|
||||
disable_ipv6: true
|
||||
|
||||
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
|
||||
custom_hosts_acls: true
|
||||
|
||||
# This fixes polkit issues with sudoers file (CIS hardening)
|
||||
hide_pid: 0
|
||||
|
||||
# aide
|
||||
install_aide: false
|
||||
|
||||
# Unattended upgrades
|
||||
unattended_reboot: true
|
||||
unattended_reboot_time: "04:30"
|
||||
|
||||
# Duo Security
|
||||
duo_users: ["*", "!provision"]
|
||||
duo_api_hostname: api-7cda1654.duosecurity.com
|
||||
|
||||
# VMs reserved CPU (for gaming and AI)
|
||||
virt_vm_reserved_cpu: "1-5,7-11"
|
||||
virt_raw_block_devices:
|
||||
- "nvme0n1"
|
||||
- "nvme0n1p1"
|
||||
- "nvme0n1p2"
|
||||
|
||||
virt_extra_grub_args: >
|
||||
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
|
||||
initcall_blacklist=simpledrm_platform_driver_init
|
||||
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
|
||||
|
||||
virt_vfio_ids:
|
||||
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
||||
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
|
||||
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
||||
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
|
||||
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
|
||||
|
||||
virt_blacklist:
|
||||
- noveau
|
||||
- snd_hda_codec_hdmi
|
||||
- i2c_nvidia_gpu
|
||||
- mxm_wmi
|
||||
|
||||
virt_machines:
|
||||
- name: windows-11
|
||||
title: "Microsoft Windows 11"
|
||||
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
|
||||
autostart: true
|
||||
memory: 25165824
|
||||
cores: 4
|
||||
threads: 2
|
||||
physical_cpus: "2-8,3-9,4-10,5-11"
|
||||
reserved_cpus: "0,6"
|
||||
enable_hyperv: true
|
||||
cdrom: true
|
||||
console: false
|
||||
audio: true
|
||||
secure_boot: true
|
||||
tpm: true
|
||||
tablet: true
|
||||
disk_file: "windows-11.qcow2"
|
||||
mac_address: "52:54:00:cd:dd:2d"
|
||||
block_devs:
|
||||
- block_dev: "/dev/nvme0n1"
|
||||
target_dev: "sdb"
|
||||
host_devs:
|
||||
# Intel MDev device for GVT-g
|
||||
- type: "mdev"
|
||||
source:
|
||||
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
|
||||
address:
|
||||
{
|
||||
type: "pci",
|
||||
domain: "0x0000",
|
||||
bus: "0x07",
|
||||
slot: "0x00",
|
||||
function: "0x0",
|
||||
}
|
||||
# Fresco Logic FL1100 USB 3.0 Host Controller
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x06"
|
||||
slot: "0x00"
|
||||
function: "0x0"
|
||||
address:
|
||||
{
|
||||
type: "pci",
|
||||
domain: "0x0000",
|
||||
bus: "0x10",
|
||||
slot: "0x00",
|
||||
function: "0x0",
|
||||
}
|
||||
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x01"
|
||||
slot: "0x00"
|
||||
function: "0x0"
|
||||
address:
|
||||
{
|
||||
type: "pci",
|
||||
domain: "0x0000",
|
||||
bus: "0x0b",
|
||||
slot: "0x00",
|
||||
function: "0x0",
|
||||
}
|
||||
# NVIDIA Corporation GA106 High Definition Audio Controller
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x01"
|
||||
slot: "0x00"
|
||||
function: "0x1"
|
||||
address:
|
||||
{
|
||||
type: "pci",
|
||||
domain: "0x0000",
|
||||
bus: "0x0f",
|
||||
slot: "0x00",
|
||||
function: "0x0",
|
||||
}
|
||||
|
||||
- name: fedora-headless
|
||||
title: "Fedora CUDA headless"
|
||||
uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
|
||||
autostart: true
|
||||
memory: 33554432
|
||||
cores: 1
|
||||
threads: 2
|
||||
physical_cpus: "1-7"
|
||||
reserved_cpus: "0,6"
|
||||
cdrom: false
|
||||
console: true
|
||||
audio: false
|
||||
secure_boot: false
|
||||
tpm: true
|
||||
disk_file: "fedora-headless.qcow2"
|
||||
mac_address: "52:54:00:ae:f3:d0"
|
||||
block_devs:
|
||||
- block_dev: "/dev/nvme0n1"
|
||||
target_dev: "sdb"
|
||||
host_devs:
|
||||
# NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x03"
|
||||
slot: "0x00"
|
||||
function: "0x0"
|
||||
address:
|
||||
{
|
||||
type: "pci",
|
||||
domain: "0x0000",
|
||||
bus: "0x09",
|
||||
slot: "0x00",
|
||||
function: "0x0",
|
||||
}
|
||||
# NVIDIA Corporation GA106 High Definition Audio Controller
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x03"
|
||||
slot: "0x00"
|
||||
function: "0x1"
|
||||
address:
|
||||
{
|
||||
type: "pci",
|
||||
domain: "0x0000",
|
||||
bus: "0x0a",
|
||||
slot: "0x00",
|
||||
function: "0x0",
|
||||
}
|
||||
|
||||
cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
|
||||
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
|
||||
cloudns_nameserver: "109.201.133.111"
|
||||
certbot_email: c.alexandre.pires@alexpires.me
|
||||
certbot_domains:
|
||||
- "vh-01.lab.alexpires.me"
|
||||
Reference in New Issue
Block a user