mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
abc458260c
Provisions the docker engine on [build_hosts] (gandalf) for the native arm64 daily knoe-db image build → registry.knoe.dev, run via a remote buildx builder. gandalf is also a k3s_agent, so the role holds iptables FORWARD=ACCEPT to protect k3s pod networking (docker's containerd coexists with k3s's on separate sockets). Verified idempotent: --check against gandalf = ok=5, changed=0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
96 lines
2.9 KiB
INI
96 lines
2.9 KiB
INI
[iscsi]
|
|
pi.prole.org
|
|
raspberry.prole.org
|
|
myrddin.prole.org
|
|
retropie.prole.org
|
|
merlin.prole.org
|
|
gandalf.prole.org
|
|
|
|
[pihole]
|
|
pi.prole.org
|
|
raspberry.prole.org
|
|
|
|
[ad_dc]
|
|
myrddin.prole.org
|
|
|
|
[k3s_servers]
|
|
myrddin.prole.org
|
|
|
|
[k3s_agents]
|
|
merlin.prole.org
|
|
gandalf.prole.org
|
|
|
|
[k3s_hosts:children]
|
|
k3s_servers
|
|
k3s_agents
|
|
|
|
# arm64 docker build host(s) for the native daily knoe-db image lane (→ registry.knoe.dev).
|
|
# gandalf is also a k3s_agent; the docker_build_host role keeps FORWARD=ACCEPT so k3s is safe.
|
|
[build_hosts]
|
|
gandalf.prole.org
|
|
|
|
[linux_hosts]
|
|
pi.prole.org
|
|
raspberry.prole.org
|
|
myrddin.prole.org
|
|
retropie.prole.org
|
|
merlin.prole.org
|
|
gandalf.prole.org
|
|
|
|
[ssl_hosts]
|
|
myrddin.prole.org
|
|
|
|
[mariadb_primary]
|
|
merlin.prole.org
|
|
|
|
[mariadb_replica]
|
|
raspberry.prole.org
|
|
|
|
[mariadb:children]
|
|
mariadb_primary
|
|
mariadb_replica
|
|
|
|
[tailscale]
|
|
merlin.prole.org
|
|
gandalf.prole.org
|
|
|
|
[merlin_bootstrap]
|
|
merlin ansible_host=10.0.0.36 ansible_user=ansible
|
|
|
|
# ── Engineer workstations — macOS / Linux ────────────────────────────────────
|
|
# workstation_kerberos.yml targets this group to deploy:
|
|
# - /etc/krb5.conf (or /Library/Preferences/edu.mit.Kerberos on macOS)
|
|
# pointing to myrddin.prole.org PROLE.ORG KDC
|
|
# - Chrome/Edge managed policy (AuthServerAllowlist = *.prole.org)
|
|
# via /Library/Managed Preferences/ (macOS) or
|
|
# /etc/opt/chrome/policies/managed/ (Linux)
|
|
#
|
|
# Ensure the ansible_user has passwordless-sudo or run with --ask-become-pass.
|
|
[workstations]
|
|
morgana.prole.org ansible_user=chrisfu ansible_connection=local
|
|
zinfandel.prole.org ansible_user=chrisfu ansible_ssh_private_key_file=~/.ssh/id_knoe_ed25519
|
|
|
|
# ── Engineer workstations — Windows ──────────────────────────────────────────
|
|
# workstation_kerberos.yml targets this group to deploy Chrome/Edge SPNEGO
|
|
# policy via registry (HKLM\SOFTWARE\Policies\Google\Chrome and
|
|
# HKLM\SOFTWARE\Policies\Microsoft\Edge).
|
|
#
|
|
# Prerequisites:
|
|
# - WinRM enabled: winrm quickconfig (run once as Administrator)
|
|
# - Or OpenSSH: Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
|
|
# - ansible_user must be a local Administrator or domain admin
|
|
#
|
|
# If the machine is joined to the PROLE.ORG Samba AD domain it already has
|
|
# Kerberos via Windows SSPI — no MIT Kerberos client needed.
|
|
# If not joined, add ansible_winrm_transport=kerberos after domain-joining.
|
|
[workstations_windows]
|
|
morgoth.prole.org ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore ansible_winrm_scheme=http ansible_port=5985
|
|
fairyland.prole.org ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore ansible_winrm_scheme=http ansible_port=5985
|
|
|
|
[workstations_windows:vars]
|
|
ansible_become=false
|
|
ansible_become_method=runas
|
|
|
|
[workstations:children]
|
|
workstations_windows
|