fix(container): update image ghcr.io/goofball222/unifi ( 8.0.24 → 8.0.26 )

| datasource | package                   | from   | to     |
| ---------- | ------------------------- | ------ | ------ |
| docker     | ghcr.io/goofball222/unifi | 8.0.24 | 8.0.26 |

config-parts/container.sh

@@ -3,21 +3,6 @@
 # Container networks
 set container network containers prefix '10.5.0.0/24'
 
-# bind
-set container name bind cap-add 'net-bind-service'
-set container name bind image 'docker.io/internetsystemsconsortium/bind9:9.19'
-set container name bind command '/usr/sbin/named -4 -f -c /etc/bind/named.conf -u bind'
-set container name bind memory '0'
-set container name bind network containers address '10.5.0.3'
-set container name bind restart 'on-failure'
-set container name bind shared-memory '0'
-set container name bind volume config destination '/etc/bind'
-set container name bind volume config source '/config/containers/bind/config'
-set container name bind volume config mode 'ro'
-set container name bind volume cache source '/tmp/bind/cache'
-set container name bind volume cache destination '/var/cache/bind'
-set container name bind volume cache mode 'rw'
-
 # haproxy-k8s-api
 set container name haproxy-k8s-api image 'docker.io/library/haproxy:2.9.0'
 set container name haproxy-k8s-api memory '0'
@@ -28,6 +13,16 @@ set container name haproxy-k8s-api volume config source '/config/containers/hapr
 set container name haproxy-k8s-api volume config destination '/usr/local/etc/haproxy/haproxy.cfg'
 set container name haproxy-k8s-api volume config mode 'ro'
 
+# haproxy-k3s-api
+set container name haproxy-k3s-api image 'docker.io/library/haproxy:2.9.0'
+set container name haproxy-k3s-api memory '0'
+set container name haproxy-k3s-api network containers address '10.5.0.3'
+set container name haproxy-k3s-api restart 'on-failure'
+set container name haproxy-k3s-api shared-memory '0'
+set container name haproxy-k3s-api volume config source '/config/containers/haproxy-k3s/config/haproxy.cfg'
+set container name haproxy-k3s-api volume config destination '/usr/local/etc/haproxy/haproxy.cfg'
+set container name haproxy-k3s-api volume config mode 'ro'
+
 # node-exporter
 set container name node-exporter environment procfs value '/host/proc'
 set container name node-exporter environment rootfs value '/host/rootfs'

config-parts/firewall-ipv4.sh

@@ -413,10 +413,6 @@ set firewall ipv4 name containers-lan rule 999 log
 set firewall ipv4 name containers-local default-action 'drop'
 set firewall ipv4 name containers-local description 'From CONTAINERS to LOCAL'
 set firewall ipv4 name containers-local default-log
-set firewall ipv4 name containers-local rule 40 action 'accept'
-set firewall ipv4 name containers-local rule 40 description 'Rule: accept_dns'
-set firewall ipv4 name containers-local rule 40 destination port 'domain,domain-s'
-set firewall ipv4 name containers-local rule 40 protocol 'tcp_udp'
 set firewall ipv4 name containers-local rule 50 action 'accept'
 set firewall ipv4 name containers-local rule 50 description 'Rule: accept_dhcp'
 set firewall ipv4 name containers-local rule 50 destination port '67,68'

config-parts/service-dhcp_server.sh

@@ -45,7 +45,7 @@ set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-ma
 
 # k8s prod workers
 set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping nenya ip-address '10.1.1.41'
-set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping nenya mac-address '00:a0:98:1a:5e:ed'
+set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping nenya mac-address 'c8:1f:66:10:4d:b9'
 set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping vilya ip-address '10.1.1.42'
 set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping vilya mac-address 'c8:1f:66:10:51:d9'
 set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping gollum ip-address '10.1.1.43'
@@ -65,6 +65,8 @@ set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-ma
 # VMs
 set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping tulkas ip-address '10.1.1.53'
 set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping tulkas mac-address '26:82:2F:16:7A:36'
+set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping qbee ip-address '10.1.1.55'
+set service dhcp-server shared-network-name SERVERS subnet 10.1.1.0/24 static-mapping qbee mac-address '00:a0:98:00:a6:72'
 
 
 # k8s prod masters

containers/.gitignore

@@ -7,5 +7,6 @@
 !/bind/
 !/dnsdist/
 !/haproxy/
+!/haproxy-k3s/
 !/unifi/
 !/vector-agent/

containers/bind/config/zones/db.hsn.dev

@@ -0,0 +1,30 @@
+; Make sure to update the epoch time in the SOA records so coreDNS picks up the changes automatically
+; https://www.epochconverter.com/
+
+; SOA Records
+$TTL 3600
+$ORIGIN hsn.dev.
+@ 3600 IN SOA gateway.jahanson.tech. gateway.jahanson.tech. (
+  1696362449         ; serial number (epoch timestamp)
+  7200               ; refresh period
+  3600               ; retry period
+  1209600            ; expire time
+  3600               ; minimum ttl
+)
+
+; NS Records
+@                          IN  NS gateway.jahanson.tech.
+
+; Containers
+@                          IN  A 104.26.2.197
+@                          IN  A 104.26.3.197
+@                          IN  A 172.67.72.148
+blog                       IN  A 20.64.91.58
+onepassword-connect        IN  A 10.5.0.5
+git                        IN  A 40.124.184.64
+varda                      IN  A 136.243.8.106
+
+; CNAME Records
+s3                         IN  CNAME nas.jahanson.tech.
+minio                      IN  CNAME nas.jahanson.tech.
+vpn                        IN  CNAME gateway.jahanson.tech.

containers/bind/config/zones/db.jahanson.tech

@@ -5,7 +5,7 @@
 $TTL 3600
 $ORIGIN jahanson.tech.
 @ 3600 IN SOA gateway.jahanson.tech. gateway.jahanson.tech. (
-  1705263395         ; serial number (epoch timestamp)
+  1686507728         ; serial number (epoch timestamp)
   7200               ; refresh period
   3600               ; retry period
   1209600            ; expire time
@@ -21,6 +21,31 @@ gateway                    IN  A  10.1.0.1
 ; Servers
 elessar                    IN  A  10.1.1.11
 sting                      IN  A  10.1.1.12
+gandalf                    IN  A  10.1.1.31
+glamdring                  IN  A  10.1.1.32
+shadowfax                  IN  A  10.1.1.33
+nenya                      IN  A  10.1.1.41
+vilya                      IN  A  10.1.1.42
+narya                      IN  A  10.1.1.43
+nahar                      IN  A  10.1.1.44
+thror                      IN  A  10.1.1.45
+thrain                     IN  A  10.1.1.46
+nextcloud                  IN  A  10.1.1.51
+frodo                      IN  A  10.1.1.52
+tulkas                     IN  A  10.1.1.53
+galadriel                  IN  A  10.1.1.61
+elrond                     IN  A  10.1.1.62
+cirdan                     IN  A  10.1.1.63
+
+; IOT
+livingroom-vacuum          IN  A  10.1.3.18
+
+; Video
+driveway-camera            IN  A  10.1.4.12
+
+; Containers
+morgoth                  IN  A  10.5.0.2
 
 ; CNAME records
 nas                        IN  CNAME  elessar.jahanson.tech.
+pikvm                      IN  CNAME  frodo.jahanson.tech.

containers/haproxy-k3s/.gitignore

@@ -0,0 +1,9 @@
+# Ignore everything
+/*
+
+# Track certain files and directories
+!.gitignore
+
+!/config/
+/config/*
+!/config/haproxy.cfg

containers/haproxy-k3s/config/haproxy.cfg

@@ -0,0 +1,48 @@
+#---------------------------------------------------------------------
+# Global settings
+#---------------------------------------------------------------------
+global
+    log /dev/log local0
+    log /dev/log local1 notice
+    daemon
+
+#---------------------------------------------------------------------
+# common defaults that all the 'listen' and 'backend' sections will
+# use if not designated in their block
+#---------------------------------------------------------------------
+defaults
+    mode                    http
+    log                     global
+    option                  httplog
+    option                  dontlognull
+    option                  http-server-close
+    option forwardfor       except 127.0.0.0/8
+    option                  redispatch
+    retries                 3
+    timeout http-request    10s
+    timeout queue           20s
+    timeout connect         10s
+    timeout client          1h
+    timeout server          1h
+    timeout http-keep-alive 10s
+    timeout check           10s
+
+#---------------------------------------------------------------------
+# apiserver frontend which proxys to the control plane nodes          
+#---------------------------------------------------------------------
+frontend k8s_apiserver                                                
+    bind *:6443                                                       
+    mode tcp                                                          
+    option tcplog                                                     
+    default_backend k8s_controlplane                            
+                                                                      
+#---------------------------------------------------------------------
+# round robin balancing for apiserver                                 
+#---------------------------------------------------------------------
+backend k8s_controlplane                                  
+    option httpchk GET /healthz                                       
+    http-check expect status 200                          
+    mode tcp                                              
+    option ssl-hello-chk                                  
+    balance     roundrobin                                
+        server worker2 10.1.1.55:6443 check 

containers/haproxy/config/haproxy.cfg

@@ -34,7 +34,13 @@ frontend k8s_apiserver
     bind *:6443                                                       
     mode tcp                                                          
     option tcplog                                                     
-    default_backend k8s_controlplane                            
+    default_backend k8s_controlplane                                  
+                                                                      
+frontend talos_apiserver                                              
+    bind *:50000                                                      
+    mode tcp                                                          
+    option tcplog                                                     
+    default_backend talos_controlplane                                
                                                                       
 #---------------------------------------------------------------------
 # round robin balancing for apiserver                                 
@@ -47,4 +53,14 @@ backend k8s_controlplane
     balance     roundrobin                                
         server worker1 10.1.1.61:6443 check   
         server worker2 10.1.1.62:6443 check 
-        server worker3 10.1.1.63:6443 check
+        server worker3 10.1.1.63:6443 check    
+                                                          
+backend talos_controlplane                                
+    option httpchk GET /healthz                           
+    http-check expect status 200                          
+    mode tcp                                              
+    option ssl-hello-chk                                  
+    balance     roundrobin                                
+        server worker1 10.1.1.61:50000 check  
+        server worker2 10.1.1.62:50000 check
+        server worker3 10.1.1.63:50000 check