hosts.yml

---
all:
  hosts:
    dns1:
      ansible_host: 10.7.1.1
      ansible_user: "{{ node_user }}"
      ansible_python_interpreter: /usr/local/bin/python3
      ansible_become_pass: "{{ opnsense_become_pass }}"
      # CoreDNS conf
      corefile_location: /usr/local/etc/coredns/Corefile
    cs1:
      ansible_host: 10.7.3.2
      ansible_user: root
      ansible_python_interpreter: /usr/bin/python3
      node_name: empiricist-cs1
    cs2:
      ansible_host: 10.7.3.3
      ansible_user: root
      ansible_python_interpreter: /usr/bin/python3
      node_name: empiricist-cs2
    cs3:
      ansible_host: 10.7.3.4
      ansible_user: root
      ansible_python_interpreter: /usr/bin/python3
      node_name: empiricist-cs3
    nn1:
      ansible_host: empiricist-nn1
      ansible_user: "{{ node_user }}"
      ansible_python_interpreter: /usr/bin/python3
      ansible_become_pass: "{{ node_become_pass }}"
      nomad_meta_tags:
        host: "nuc7"
        storage: "ssd"
      nomad_memory_override: 17179
      nomad_csi: true
      node_name: empiricist-nn1
    nn2:
      ansible_host: empiricist-nn2
      ansible_user: "{{ node_user }}"
      ansible_python_interpreter: /usr/bin/python3
      ansible_become_pass: "{{ node_become_pass }}"
      nomad_meta_tags:
        host: "ablation"
        storage: "hdd"
        storage_local: true
      # Undersize nn2 on Ablation due to other IO overhead
      nomad_compute_override: 6200
      # VM has 4096 MiB
      nomad_memory_override: 4294
      nomad_csi: true
      node_name: empiricist-nn2
    nn3:
      ansible_host: empiricist-nn3
      ansible_user: "{{ node_user }}"
      ansible_python_interpreter: /usr/bin/python3
      ansible_become_pass: "{{ node_become_pass }}"
      nomad_meta_tags:
        host: "cargocult"
        storage: "ssd"
      # VM has 8192 MiB
      nomad_memory_override: 8589
      nomad_csi: true
      node_name: empiricist-nn3
      # nomad_additional_stanzas:
      #   - |
      #     client {
      #       host_volume "vmrust-volume" {
      #         path      = "/mnt/vmrust"
      #         read_only = false
      #       }
      #     }
  children:
    dns_servers:
      vars:
        consul_dns_servers: ["10.7.3.2", "10.7.3.3", "10.7.3.4"]
        dns_loop1_port: 5371
        dns_loop2_port: 5372
      hosts:
        dns1:
      
    vault_nodes:
      vars:
        vault_local_addr: "http://127.0.0.1:8200"
        vault_token_issuer_url: "http://vault.lb.{{ net_subdomain }}:8200"
        vault_tokens_required: 3
        vault_unseal_url: https://github.com/lrstanley/vault-unseal/releases/download/v0.1.1/vault-unseal_0.1.1_linux_amd64.deb
      hosts:
        cs1:
        cs2:
        cs3:
        
    consul_clients:
      vars:
        consul_dc_name: "{{ dc_name }}"
        consul_gossip_key: "{{ consul_gossip_key }}"
        consul_bind_addr: "{{ '{{' }} GetPrivateInterfaces | include \\\"network\\\" \\\"10.7.0.0/16\\\" | attr \\\"address\\\" {{ '}}' }}"
        consul_retry_join_hosts: ["10.7.3.2", "10.7.3.3", "10.7.3.4"]
        consul_command_server: cs1
      children:
        consul_servers:
        nomad_servers:
        nomad_clients:
    consul_servers:
      vars:
        consul_mode: server
        consul_bootstrap_expect: 3
        consul_ui: true
      hosts:
        cs1:
        cs2:
        cs3:
    nomad_servers:
      hosts:
        cs1:
        cs2:
        cs3:
      vars:
        nomad_dc_name: "{{ dc_name }}"
        nomad_mode: server
        nomad_bootstrap_expect: 3
        nomad_metrics: true
    nomad_clients:
      hosts:
        nn1:
        nn2:
        nn3:
      vars:
        nomad_http_bind_addr: "{{ '{{' }} GetPrivateInterfaces | include \\\"network\\\" \\\"10.7.3.0/24\\\" | attr \\\"address\\\" {{ '}}' }} 127.0.0.1"
        nomad_allow_privileged: true
        nomad_dc_name: "{{ dc_name }}"
        nomad_mode: client
        nomad_metrics: true
        nomad_additional_stanzas:
          # Enable docker privileged items
          - |
            plugin "docker" {
              config {
                allow_privileged = true
                volumes {
                  enabled = true
                }
              }
            }
          # Tag consul instance for traefik routing to nomad UI
          - |
            consul {
              tags = [
                # Note no spaces around equal signs for traefik tags!
                "web",
                "traefik.enable=true",
                "coredns.enabled",
                "coredns.aclignore",
                "coredns.alias=nomad",
                "traefik.http.routers.nomad.tls=true",
                "traefik.http.routers.nomad.tls.certresolver=le",
                "traefik.http.routers.nomad.entrypoints=websecure",
                "traefik.http.routers.nomad.rule=Host(`nomad.{{ net_subdomain }}`)",
                "traefik.http.services.nomad.loadbalancer.server.port=4646",
                "traefik.http.services.nomad.loadbalancer.sticky.cookie=true",
              ]
            }
        # nomad_nfs_mounts:
        #   - path: /mnt/vmrust
        #     src: 10.7.1.9:bunker/vmrust
        #     fstype: nfs
        #     options: rw,soft,timeo=5,retry=5,noatime,fsc