panxiao81andClaude Opus 5.5
094b38b4b5
- Terraform 写 cloud-init.network-config，地址从 records.yml 读取，与 AD DNS 同源 - 撤销 Ansible 直接改 netplan 的做法；镜像模板只在 create/copy 渲染 seed， 故两台空容器已用 -replace 重建 - 固定指纹已从上游 images: 下架，改从 local: 缓存创建 - sshd -t 前预建 /run/sshd：新装 24.04 只有 ssh.socket 运行，目录尚不存在 Co-Authored-By: Claude Opus 5.5 <[email protected]>
87 lines
4.2 KiB
YAML
87 lines
4.2 KiB
YAML
---
|
||
# Homelab DNS desired state. This file is the canonical inventory; individual
|
||
# backends consume only the views they own.
|
||
homelab_dns:
|
||
samba:
|
||
# Samba remains authoritative for the AD zone. Only these explicitly listed
|
||
# RRsets are reconciled; Samba-generated AD/Kerberos records are untouched.
|
||
records:
|
||
- { zone: ad.ddupan.top, name: incus, type: A, values: [192.168.10.127] }
|
||
# Static, outside the NEC IX pool (.128-.250); infrastructure/incus/terraform reads
|
||
# these same values into each container's cloud-init network-config.
|
||
- { zone: ad.ddupan.top, name: ayatori-dev, type: A, values: [192.168.10.11] }
|
||
- { zone: ad.ddupan.top, name: ayatori-prod, type: A, values: [192.168.10.12] }
|
||
- { zone: ad.ddupan.top, name: bao, type: A, values: [192.168.10.8] }
|
||
- { zone: ad.ddupan.top, name: pve1, type: A, values: [192.168.10.4] }
|
||
- { zone: ad.ddupan.top, name: pve2, type: A, values: [192.168.10.7] }
|
||
- { zone: ad.ddupan.top, name: pve3, type: A, values: [192.168.10.9] }
|
||
- { zone: ad.ddupan.top, name: sandbox1, type: A, values: [10.60.0.11] }
|
||
- { zone: ad.ddupan.top, name: sandbox2, type: A, values: [10.60.0.12] }
|
||
- { zone: ad.ddupan.top, name: sandbox-k8s, type: A, values: [10.60.0.13] }
|
||
- { zone: ad.ddupan.top, name: retrolab, type: A, values: [10.60.0.10] }
|
||
- { zone: ad.ddupan.top, name: grafana, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: metrics-write, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: netbox, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: nats, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: nexus, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: s3, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: hydra, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: hydra-login, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: spire-oidc, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: spire-server, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: zot, type: A, values: [192.168.10.127] }
|
||
- { zone: ad.ddupan.top, name: zot-push, type: A, values: [192.168.10.127] }
|
||
|
||
- { zone: ad.ddupan.top, name: pg-prod, type: A, values: [192.168.10.2] }
|
||
- { zone: ad.ddupan.top, name: pg-dev, type: A, values: [192.168.10.127] }
|
||
|
||
split_horizon:
|
||
# backends records the current adoption boundary. obj is deliberately not
|
||
# emitted to CoreDNS yet, preserving the current pod resolver behaviour.
|
||
records:
|
||
- { name: git.ddupan.top, type: A, values: [192.168.10.127], backends: [blocky, coredns] }
|
||
- { name: auth.ddupan.top, type: A, values: [192.168.10.127], backends: [blocky, coredns] }
|
||
- { name: obj.ddupan.top, type: A, values: [192.168.10.127], backends: [blocky] }
|
||
|
||
public:
|
||
# Names expected at Cloudflare. Terraform adoption is a separate change;
|
||
# complete RRsets here make the current ownership gap explicit.
|
||
records:
|
||
- name: auth.ddupan.top
|
||
type: CNAME
|
||
values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
|
||
proxied: true
|
||
terraform:
|
||
managed: true
|
||
resource_name: auth
|
||
- name: git.ddupan.top
|
||
type: CNAME
|
||
values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
|
||
proxied: true
|
||
terraform: { managed: false }
|
||
- name: obj.ddupan.top
|
||
type: CNAME
|
||
values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
|
||
proxied: true
|
||
terraform: { managed: false }
|
||
- name: e5renew.ddupan.top
|
||
type: CNAME
|
||
values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
|
||
proxied: true
|
||
terraform: { managed: false }
|
||
# OCI 主机直接解析公网 IP，SSH 不经过 Cloudflare 代理。
|
||
- name: oci-arm.ddupan.top
|
||
type: A
|
||
values:
|
||
- 129.225.138.179
|
||
proxied: false
|
||
ttl: 300
|
||
terraform: { managed: false }
|
||
- name: oci-amd.ddupan.top
|
||
type: A
|
||
values:
|
||
- 129.225.176.134
|
||
proxied: false
|
||
ttl: 300
|
||
terraform: { managed: false }
|