mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 08:54:30 +00:00
ca8dd6a525
Secure and configure the SG2428LP managed switch (10.0.0.10) as repeatable Ansible, driven from the control node over SSH by an expect engine. - tplink_switch_harden role (verified JetStream CLI syntax): HTTP off/ HTTPS-only, Telnet off, SSH v2, SNMP off, RSTP + loopback-detection, then copy running-config startup-config (persist). - playbooks/harden_switch.yml + [switches] inventory group; dry by default, -e switch_apply=true to apply, -e switch_apply_network=true for addressing. - Static mgmt IP 10.0.0.10/24 (off DHCP, below the .20-.199 pool), gw 10.0.0.1, hostname sg2428lp. - op -> ansible-vault bridge (etc/set-switch-1password.sh); admin password in group_vars/switches/vault.yml. - DNS: A/PTR sg2428lp.prole.org -> 10.0.0.10 (records added to dns.yml/ptr_records). - Fix: tag the samba_reverse_dns zone-list set_fact so tag-limited runs define samba_reverse_zones. Engine notes (hard-won): forces password-only SSH auth (the switch drops publickey-first logins); always saves config (unsaved changes revert on reboot). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
220 lines
4.1 KiB
YAML
220 lines
4.1 KiB
YAML
---
|
|
prole_domain: prole.org
|
|
|
|
# Source of truth imported from name.com export (A/CNAME/MX/TXT)
|
|
# Notes:
|
|
# - "name: '@'" means the zone apex (prole.org)
|
|
# - no IPv6 records included (per request)
|
|
prole_dns_records:
|
|
- name: aventage
|
|
type: A
|
|
value: 10.0.0.206
|
|
ttl: 300
|
|
|
|
- name: book.svc
|
|
type: A
|
|
value: 185.158.133.1
|
|
ttl: 300
|
|
|
|
- name: fairyland
|
|
type: A
|
|
value: 10.0.0.208
|
|
ttl: 300
|
|
|
|
- name: k8s
|
|
type: CNAME
|
|
value: zinfandel.prole.org
|
|
ttl: 300
|
|
|
|
- name: loghost
|
|
type: A
|
|
value: 10.0.0.3
|
|
ttl: 300
|
|
|
|
- name: mc
|
|
type: A
|
|
value: 73.15.20.166
|
|
ttl: 300
|
|
|
|
- name: gandalf
|
|
type: A
|
|
value: 10.0.0.7
|
|
ttl: 300
|
|
|
|
- name: merlin
|
|
type: A
|
|
value: 10.0.0.6
|
|
ttl: 300
|
|
|
|
- name: morana
|
|
type: A
|
|
value: 10.0.0.66
|
|
ttl: 300
|
|
|
|
- name: morgoth
|
|
type: A
|
|
value: 10.0.0.204
|
|
ttl: 300
|
|
|
|
- name: myrddin
|
|
type: A
|
|
value: 10.0.0.3
|
|
ttl: 300
|
|
|
|
- name: ollama
|
|
type: A
|
|
value: 73.15.20.166
|
|
ttl: 300
|
|
|
|
- name: pi
|
|
type: A
|
|
value: 10.0.0.5
|
|
ttl: 300
|
|
|
|
- name: "@"
|
|
type: MX
|
|
value: alt1.aspmx.l.google.com
|
|
ttl: 3600
|
|
priority: 5
|
|
|
|
- name: "@"
|
|
type: MX
|
|
value: alt2.aspmx.l.google.com
|
|
ttl: 3600
|
|
priority: 5
|
|
|
|
- name: "@"
|
|
type: MX
|
|
value: alt3.aspmx.l.google.com
|
|
ttl: 3600
|
|
priority: 10
|
|
|
|
- name: "@"
|
|
type: MX
|
|
value: alt4.aspmx.l.google.com
|
|
ttl: 3600
|
|
priority: 10
|
|
|
|
- name: "@"
|
|
type: MX
|
|
value: aspmx.l.google.com
|
|
ttl: 3600
|
|
priority: 1
|
|
|
|
- name: raspberry
|
|
type: A
|
|
value: 10.0.0.4
|
|
ttl: 300
|
|
|
|
- name: retropie
|
|
type: A
|
|
value: 10.0.0.207
|
|
ttl: 300
|
|
|
|
- name: git
|
|
type: A
|
|
value: 73.15.20.166
|
|
ttl: 300
|
|
|
|
- name: svc
|
|
type: A
|
|
value: 73.15.20.166
|
|
ttl: 300
|
|
|
|
- name: synology
|
|
type: A
|
|
value: 10.0.0.203
|
|
ttl: 300
|
|
|
|
- name: www
|
|
type: CNAME
|
|
value: ghs.googlehosted.com
|
|
ttl: 300
|
|
|
|
- name: zinfandel
|
|
type: A
|
|
value: 10.0.0.205
|
|
ttl: 300
|
|
|
|
- name: _lovable.book.svc
|
|
type: TXT
|
|
value: lovable_verify=a6369596ca0ae0b00fde155591c566c05a9844302a70727ba69a74b56c58927f
|
|
ttl: 300
|
|
|
|
# Traefik Load Balancer addresses for k3s front-door
|
|
prole_traefik_lb_ips:
|
|
- 10.0.0.3
|
|
- 10.0.0.6
|
|
|
|
# k3s Front Door names (normalized to prole.org)
|
|
prole_k3s_front_door_names:
|
|
- git
|
|
- svc
|
|
- api
|
|
- db
|
|
- supabase
|
|
- registry
|
|
|
|
# Convenience list: internal RFC1918 A records only (useful for Samba AD DNS population)
|
|
prole_internal_a_records:
|
|
- fqdn: aventage.prole.org
|
|
ipv4s: [10.0.0.206]
|
|
- fqdn: fairyland.prole.org
|
|
ipv4s: [10.0.0.208]
|
|
- fqdn: loghost.prole.org
|
|
ipv4s: [10.0.0.3]
|
|
- fqdn: gandalf.prole.org
|
|
ipv4s: [10.0.0.7]
|
|
- fqdn: merlin.prole.org
|
|
ipv4s: [10.0.0.6]
|
|
- fqdn: morana.prole.org
|
|
ipv4s: [10.0.0.66]
|
|
- fqdn: morgoth.prole.org
|
|
ipv4s: [10.0.0.204]
|
|
- fqdn: myrddin.prole.org
|
|
ipv4s: [10.0.0.3]
|
|
- fqdn: pi.prole.org
|
|
ipv4s: [10.0.0.5]
|
|
- fqdn: raspberry.prole.org
|
|
ipv4s: [10.0.0.4]
|
|
- fqdn: retropie.prole.org
|
|
ipv4s: [10.0.0.207]
|
|
- fqdn: sg2428lp.prole.org
|
|
ipv4s: [10.0.0.10]
|
|
- fqdn: synology.prole.org
|
|
ipv4s: [10.0.0.203]
|
|
- fqdn: zinfandel.prole.org
|
|
ipv4s: [10.0.0.205]
|
|
|
|
# k3s front-door records (public and internal.prole.org)
|
|
prole_k3s_dns_records:
|
|
- fqdn: git.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: git.internal.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: svc.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: svc.internal.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: api.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: api.internal.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: db.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: db.internal.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: supabase.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
- fqdn: supabase.internal.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
# Direct postgres access (bypasses Traefik — port 5432 via CNPG ServiceLB)
|
|
- fqdn: pg.prole.org
|
|
ipv4s: [10.0.0.3, 10.0.0.6]
|
|
|
|
prole_k3s_cname_records:
|
|
- fqdn: registry.prole.org
|
|
target: svc.prole.org
|
|
- fqdn: registry.internal.prole.org
|
|
target: svc.internal.prole.org
|