mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 14:04:31 +00:00
86990af9c8
- New acme role: installs acme.sh, issues certs for myrddin/merlin/gandalf via DNS-01 (name.com API), installs cert files to /etc/ssl/certs/prole/, sets up renewal cron. rc=2 (already valid) treated as ok. - New playbooks/acme.yml: runs acme role on myrddin (issues all 3 host certs) - New playbooks/certmgr.yml: cert-manager and letsencrypt-prod ClusterIssuer (HTTP-01/Traefik) for external endpoints (db/svc/api.prole.org) - Add vault references for name.com API creds to group_vars/all/vars.yml - Add prole_ssl_src_dir and prole_ssl_files to myrddin/merlin/gandalf host_vars Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
40 lines
1014 B
YAML
40 lines
1014 B
YAML
---
|
|
ansible_user: ansible
|
|
ansible_ssh_private_key_file: "~/.ssh/id_ed25519_ansible"
|
|
|
|
ansible_become: true
|
|
ansible_become_method: sudo
|
|
|
|
# DNS topology vars shared across roles
|
|
prole_domain: "prole.org"
|
|
ad_dc_ip: "10.0.0.3"
|
|
lan_reverse_zone: "0.0.10.in-addr.arpa"
|
|
|
|
# k3s default Pod/Service CIDR reverse zones
|
|
k3s_reverse_zones:
|
|
- "42.10.in-addr.arpa"
|
|
- "43.10.in-addr.arpa"
|
|
|
|
# Seed PTRs (adjust octets to match your actual IPs)
|
|
ptr_records:
|
|
- last_octet: "3"
|
|
fqdn: "myrddin.prole.org"
|
|
- last_octet: "4"
|
|
fqdn: "raspberry.prole.org"
|
|
- last_octet: "5"
|
|
fqdn: "pi.prole.org"
|
|
- last_octet: "207"
|
|
fqdn: "retropie.prole.org"
|
|
|
|
rsyslog_server: myrddin.prole.org
|
|
|
|
# name.com API credentials for acme.sh DNS-01 (values from vault)
|
|
acme_namecom_username: "{{ vault_namecom_username }}"
|
|
acme_namecom_token: "{{ vault_namecom_token }}"
|
|
|
|
# Prole management
|
|
prole_home: "/opt/prole"
|
|
prole_repo_url: "https://github.com/prole-org/prole.git"
|
|
prole_version: "main"
|
|
prole_logs_dir: "/opt/prole/logs/chrisfu"
|