Infra on Alwaldend

Infra

Mon, 01 Jan 0001 00:00:00 +0000

This tree contains infrastructure as code. Tracked source follows the repository’s public-source policy. Infrastructure facts are not confidential merely because they are operational, generated, or live. Reports may include them unless they contain credentials, other secrets, or personal information. Inspect raw state, plans, inventories, and decrypted configuration because those artifacts can contain prohibited content; do not track the artifacts themselves.

Each infrastructure project owns its specifications and maintained changes in <project>/openspec/. Use the pinned OpenSpec workflow with that project selected. These specifications describe checked-in definitions; they do not establish deployed state or authorize infrastructure operations.

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure architecture Specification

Purpose

Describe the maintained infrastructure diagrams owned by infra/arch. The baseline is checked-in source at revision 550d7e79b1f5fdbc2b6017b75178471d6914082f, observed on 2026-09-08. These diagrams describe their source document; they do not establish live inventory, deployment, or health.

Requirements

Requirement: Canonical multi-page architecture source

The project SHALL use arch.drawio as the canonical source for its maintained SVG diagrams and SHALL expose the source through the //infra/arch editor target. The named render mapping SHALL preserve all 15 source pages, including the five pages classified as archives.

Mon, 01 Jan 0001 00:00:00 +0000

Ceph infrastructure specification

Purpose

Describe the single-host Ceph CRUSH map maintained by infra/ceph and its documented operator workflow. This owner contains a map and documentation; its BUILD file exposes documentation, not a Ceph deployment target. The baseline describes checked-in source, not an observed running cluster.

Baseline revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observed: 2026-09-08. Sources: owner README, BUILD, and CRUSH map.

Requirements

Requirement: Single-host CRUSH topology

The maintained CRUSH map SHALL place four HDD devices, osd.0 through osd.3, in the host1 bucket beneath the default root, using the declared device weights and straw2 bucket algorithm.

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure DNS

Purpose

Describe owner-local Terraform DNS declarations and runtime source-ownership validation for global and dc1 records. This contract describes checked-in source; it does not establish live adoption or authorize infrastructure writes.

Sources: component documentation, target definitions, runtime linter, and Terraform root.

Requirements

Requirement: Aggregate records from their owning components

DNS declarations SHALL remain in their owners’ dnsconfig.json files. Runtime inventory SHALL discover all canonical files, including nested modules and empty declarations, without a checked-in ownership registry. The inventory SHALL print a deterministic table of files, DNS names, types and views.

Mon, 01 Jan 0001 00:00:00 +0000

Flux infrastructure specification

Purpose

Describe the Flux management cluster’s VM definition, K3s configuration, and Git reconciliation entry points owned by infra/flux. The tf_setup, ansible, and cl packages implement stages of this owner. This is a checked-in source baseline; no cluster health or successful deployment was observed for this specification.

Baseline revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observed: 2026-09-08. Sources: owner README, BUILD, and the implementation links below.

Requirements

Requirement: Dedicated K3s management host

Terraform setup SHALL declare a Proxmox VM in the src_infra_flux pool with two cores, 4096 MiB memory, and separate 20 GiB boot, K3s data, and K3s storage disks. The deployment playbook SHALL apply the shared host and K3s roles, and the K3s configuration SHALL enable secrets encryption and disable the bundled Traefik component.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define Flux DNS management through the owner’s tf_setup root, including canonical declarations, scoped credentials, and offline source checks before adopting live records.

Requirements

Requirement: Owner-local DNS configuration

Mon, 01 Jan 0001 00:00:00 +0000

Forgejo infrastructure specification

Purpose

Describe the Forgejo service owned by infra/forgejo, including Xen Orchestra provisioning, Ansible service configuration, and Terraform account and repository management. The tf_setup, ansible, and tf packages are implementation stages of this owner. This baseline records source guarantees and prerequisites; it does not verify live service health or restore earlier Forgejo data.

Baseline revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observed: 2026-09-08. Sources: owner README, BUILD, and the implementation links below.

Requirements

Requirement: Scoped Xen Orchestra provisioning and disk checks

Setup SHALL provision Forgejo through Xen Orchestra in the src_infra_dc1_forgejo1 resource set using the owner’s Vault AppRole and packaged XO OIDC login flow. The VM SHALL declare 20 GiB boot, 40 GiB Forgejo, and 5 GiB Traefik disks. Ansible SHALL verify the expected sizes of xvdb and xvdc before applying the service roles that use them.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define Forgejo DNS management through the owner’s tf_setup root, including canonical declarations, scoped credentials, and offline source checks before adopting live records.

Requirements

Requirement: Owner-local DNS configuration

Mon, 01 Jan 0001 00:00:00 +0000

Forgejo runner infrastructure specification

Purpose

Describe the Forgejo Actions runner VM and deployment scaffold owned by infra/forgejo_runner. Its tf_setup and ansible packages are stages of this owner. The runner role is commented out in the baseline playbook; the checked-in configuration therefore does not establish a deployed or registered Actions worker. No live runner state was observed.

Baseline revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observed: 2026-09-08. Sources: owner README, BUILD, and the implementation links below.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define Forgejo Actions runner DNS management through the owner’s tf_setup root, including canonical declarations, scoped execution, adoption of existing records, and offline source checks.

Requirements

Requirement: Owner-local DNS configuration

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure GitHub

Purpose

Describe Terraform ownership of the catalog-defined GitHub organization, repositories, member access, default-branch restrictions, and Pages settings. These requirements describe source guarantees; they do not assert that a plan has been applied or that published sites are healthy.

Sources: component documentation, Terraform workflow, shared catalog, packaged inputs, repository resources, organization access, branch rules, and provider configuration.

Requirements

Requirement: Consume the shared organization and repository catalog

The package SHALL consume organization identity, administrator and developer lists, repository identity, default branches, repository settings, and Pages configuration through infra/repos/tf. It SHALL NOT generate a second inventory from the build-project registry. Its provider instance SHALL require exactly one configured GitHub organization.

Mon, 01 Jan 0001 00:00:00 +0000

Harbor infrastructure specification

Purpose

Describe the Harbor registry infrastructure owned by infra/harbor, spanning Proxmox setup, K3s host configuration, Flux-managed chart declarations, and Harbor service Terraform. The tf_setup, ansible, cl, and tf packages are implementation stages of this owner. This is a checked-in source baseline, without an observation of live registry availability or deployment success.

Baseline revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observed: 2026-09-08. Sources: owner README, BUILD, and the implementation links below.

Requirements

Requirement: Dedicated K3s registry host

Setup SHALL declare a Proxmox VM in the src_infra_harbor pool with two cores, 4096 MiB memory, and 20 GiB boot, 20 GiB K3s data, and 40 GiB K3s storage disks. Ansible SHALL apply the shared host and K3s roles with K3s secrets encryption enabled. Its firewall variables SHALL scope API port 6443 access to the declared Flux host address.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define Harbor DNS management through the owner’s tf_setup root, including canonical declarations, scoped credentials, and offline source checks before adopting live records.

Requirements

Requirement: Owner-local DNS configuration

The tf_setup root SHALL consume this owner’s canonical dnsconfig.json through the shared DNS Terraform module, preserving declared record identities and views. DNS resources SHALL default to disabled before adoption and SHALL default to enabled in the reviewed adoption revision and after adoption. Adoption SHALL import the exact existing provider records and require a scoped no-change import plan before saved-plan apply. Subsequent reconciliation with unchanged root inputs SHALL preserve adopted records, unrelated DNS records, and non-DNS resources in the root.

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure ingress

Purpose

Describe Yandex Cloud ingress provisioning, the RouterOS WireGuard connection, and the Ansible-managed Traefik configuration. The baseline covers checked-in desired state, not a live routing or availability observation.

Baseline source revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observation date: 2026-09-08. Sources are linked in full; no excerpts are used.

Sources: component contract, VM resources, WireGuard resources, deployment playbook, Traefik entry points, and Traefik routes.

Requirements

Requirement: Provision ingress hosts from the declared host map

Terraform SHALL create addresses, encrypted boot disks, and instances for the active local.vpc entries, using the shared cloud-init source. The baseline active map SHALL contain host1 in ru-central1-d; the commented host2 entry SHALL NOT be treated as an enabled resource declaration.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define retained ingress DNS ownership through the owner’s tf root, including canonical declarations, scoped execution, and offline source checks.

Requirements

Requirement: Owner-local DNS configuration

The tf root SHALL consume this owner’s canonical dnsconfig.json through the shared DNS Terraform module, preserving declared record identities and views. DNS resources SHALL default to disabled until the authorized adoption revision and SHALL retain enabled ownership after existing records are imported into the owner’s state. Reconciliation against unchanged declarations and adopted state SHALL propose no record additions, changes, replacements, or deletions.

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure MikroTik

Purpose

Describe the checked-in RouterOS export snapshots and site DNS declarations for the dc1 routers. This package is a documentation and record-input owner: its BUILD file declares no router deployment executable. Export contents are historical source evidence, not a verification of current device configuration.

Baseline source revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observation date: 2026-09-08. Sources are linked in full; no excerpts are used.

Sources: export workflow, package targets, router1 snapshot, router2 snapshot, and DNS declarations.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define MikroTik router DNS management through the owner’s tf root, including canonical declarations, scoped credentials, and offline source checks before adopting live records.

Requirements

Requirement: Owner-local DNS configuration

Mon, 01 Jan 0001 00:00:00 +0000

DNS Terraform

This root packages the owner’s canonical DNS declaration through the shared DNS module and keeps state in the owner AppRole’s Vault HTTP backend. The root contains DNS resources only. dns_enabled defaults to true after verified adoption. Keep it enabled to retain existing records; disabling it would propose deletion.

Use the normal //infra/mikrotik/tf:tf.<operation> wrappers for this DNS-only root. The DNS migration procedure owns credential provisioning, reconciliation, and recovery. The adoption record contains the import and inventory-preservation evidence. The package exposes //infra/mikrotik/tf:tf_tests.fmt_test for offline formatting checks.

Mon, 01 Jan 0001 00:00:00 +0000

NAS infrastructure Specification

Purpose

Describe the TrueNAS-related configuration surface currently owned by infra/nas. The baseline is checked-in source at revision 550d7e79b1f5fdbc2b6017b75178471d6914082f, observed on 2026-09-08. The directory contains an AL configuration, DNS declarations, Vault wrappers, and brief documentation. It does not contain a TrueNAS provisioning playbook or Terraform configuration, and this baseline makes no claim about live NAS configuration or availability.

Source baseline limitation: the owning BUILD file restricts the AL target’s visibility to //infra/harvester:__subpackages__, although infra/harvester does not exist in this revision. This declaration does not establish a working consumer integration.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define NAS DNS management through the owner’s tf root, including canonical declarations, scoped credentials, and offline source checks before adopting live records.

Requirements

Requirement: Owner-local DNS configuration

Mon, 01 Jan 0001 00:00:00 +0000

DNS Terraform

This root packages the owner’s canonical DNS declarations through the shared DNS module and keeps state in the owner AppRole’s Vault HTTP backend. The root contains DNS resources only. dns_enabled defaults to true after verified adoption. Keep it enabled to retain existing records; disabling it would propose deletion.

The DNS migration procedure owns credential provisioning, reconciliation, and recovery. The adoption record contains import and verification evidence. Use the //infra/nas/tf:tf wrappers for operational commands and //infra/nas/tf:tf_tests.fmt_test for offline source validation.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define OpenHands DNS management through the owner’s tf_setup root, including canonical declarations, scoped credentials, and offline source checks before adopting live records.

Requirements

Requirement: Owner-local DNS configuration

The tf_setup root SHALL consume this owner’s canonical dnsconfig.json through the shared DNS Terraform module, preserving declared record identities and views. DNS resources SHALL default to disabled before adoption and SHALL default to enabled in the reviewed adoption revision. Adoption SHALL bind existing records to their exact provider identities and SHALL preserve their declared attributes. Existing-record adoption SHALL contain no DNS record additions, changes, replacements, or deletions. Verified missing declarations MAY be provisioned through an exact additions-only DNS plan that preserves every existing record and excludes non-DNS managed-resource changes. After deployment, default DNS reconciliation SHALL retain the bindings and preserve unrelated provider records.

Mon, 01 Jan 0001 00:00:00 +0000

Proxmox infrastructure Specification

Purpose

Specify the Proxmox cluster configuration, resource pools, and bootstrap test VM owned by infra/pve. The baseline is checked-in source at revision 550d7e79b1f5fdbc2b6017b75178471d6914082f, observed on 2026-09-08. It describes declared infrastructure and packaged operator entry points; deployment and cluster health have not been observed for this baseline.

Requirements

Requirement: AppRole resource pools

The Terraform configuration SHALL resolve the members of Vault’s approles identity group and declare one Proxmox pool per resolved entity, keyed and named by that entity’s name. It SHALL also declare a separate templates pool.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define Proxmox cluster DNS management through the owner’s tf root, including canonical declarations, scoped credentials, and offline source checks before adopting live records.

Requirements

Requirement: Owner-local DNS configuration

Mon, 01 Jan 0001 00:00:00 +0000

repository-catalog Specification

Purpose

Define shared organization, repository identity, naming, and named access configuration for the GitHub, GitLab, and Forgejo infrastructure consumers.

Requirements

Requirement: Authoritative organization and repository inventory

The repository catalog SHALL store shared defaults and schema version at its root, one configuration file per organization, and one configuration file per repository beneath its organization. Those records SHALL own the configured organizations, repositories, named administrators, and named developers. Each forge consumer SHALL use that catalog for its selected repositories and named roles, preserving forge-specific settings without maintaining another copy of the inventory. Authentication and service-specific grants SHALL remain with their existing owners.

Mon, 01 Jan 0001 00:00:00 +0000

Repository evolution

This OpenSpec workspace describes evolution of the alwaldend/src repository itself: its shared structure, build system and development workflows. specs/repository/spec.md records that contract; changes/ records proposed and completed changes to it.

Each component owns a separate OpenSpec workspace beside its source:

projects/<project>/openspec/ holds that project’s specs and changes.
tools/<project>/openspec/ holds that tool project’s specs and changes.
infra/<project>/openspec/ holds that infrastructure project’s specs and changes.
infra/src/openspec/ holds the repository’s own specs and changes.

Select the narrowest owner of the requested behavior. A project change belongs in that project’s workspace, including when it has a standalone Bazel module. Changes to shared repository structure belong here. Work spanning owners keeps each affected contract with its owner and links related changes. Component READMEs and build declarations retain their existing authority.

Mon, 01 Jan 0001 00:00:00 +0000

Goal migration to OpenSpec

On 2026-09-08, all nine tracked maintained project goal records at source commit 550d7e79b1f5fdbc2b6017b75178471d6914082f were migrated into native OpenSpec changes. Each change now lives in its owning project’s openspec/ workspace. Eight completed records are imported as archived history. The Reimu Fumo change remains open with blocked execution and no accepted candidate.

The machine-readable inventory maps all 222 tracked source files (834,320 bytes) to byte-identical provenance snapshots. Test fixtures and ignored task scratch are outside the maintained-record inventory.

Mon, 01 Jan 0001 00:00:00 +0000

go-mod-version Specification

Purpose

Keep tracked go.mod files on the Go version configured for tools/go_mod.

Sources: tool README, tool BUILD, and archive.

Requirements

Requirement: Configured go.mod version

The repository SHALL provide a tools/go_mod command that discovers every tracked go.mod file and sets its go directive to the version configured in the tool’s BUILD file. The command MUST offer an update mode and a check mode.

Scenario: Update module files

WHEN a user runs the update target
THEN every tracked go.mod file whose go directive differs from the configured version is rewritten to that version
AND files already on the configured version remain unchanged

Scenario: Check module files

WHEN the check test runs
THEN it fails if any tracked go.mod file has a go directive different from the configured version
AND it passes when every tracked go.mod file matches

Requirement: Repository quality integration

The go.mod version check MUST run as part of //:repo_quality_test so a version mismatch fails repository quality.

Mon, 01 Jan 0001 00:00:00 +0000

Repository Evolution Specification

Purpose

Define how the alwaldend/src monorepo evolves its shared structure, build system and development workflows. Component behavior is specified in each owner’s local OpenSpec workspace. This baseline was inspected at source revision 550d7e79b1f5fdbc2b6017b75178471d6914082f on 2026-09-08 and incorporates the OpenSpec migration delivered with this specification. Changes in infra/src record repository evolution; they do not collect unrelated component work or claim runtime health or deployed infrastructure.

Sources: repository map, agent policy, root build, project boundary, infrastructure boundary, tool boundary, and OpenSpec workflow.

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure 3x-ui

Purpose

Describe 3x-ui provisioning, host deployment, node routing configuration, and the subscription URL transformer. This baseline describes checked-in source, not verified live node access. The advertised host-only subscription command has a source limitation: sub/main.go also attempts to read sub_file when it is empty, so successful host-only operation is not a baseline guarantee.

Baseline source revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observation date: 2026-09-08. Sources are linked in full; no excerpts are used.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define retained 3x-ui DNS ownership through the owner’s tf_setup root, including canonical declarations, scoped execution, and offline source checks.

Requirements

Requirement: Owner-local DNS configuration

The tf_setup root SHALL consume this owner’s canonical dnsconfig.json through the shared DNS Terraform module, preserving declared record identities and views. DNS resources SHALL default to disabled before the adoption revision and SHALL retain enabled ownership after authorized adoption into the owner’s state. Reconciliation against adopted state and unchanged declarations SHALL propose no record additions, changes, replacements, or deletions.

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure Vault

Purpose

Describe the Vault host configuration, authentication and certificate services, and packaged recovery entry points. This baseline concerns checked-in desired state and supported wrapper structure; it does not establish live unsealed state, successful backups, quorum, or certificate freshness.

Baseline source revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observation date: 2026-09-08. Sources are linked in full; no excerpts are used.

Sources: operator documentation, operational wrappers, Ansible entry points, Vault host template, authentication backends, storage engines, server PKI, client PKI, and public CA outputs.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define Vault service DNS management through the owner’s tf_setup root, including canonical declarations, scoped credentials, and offline source checks before adopting live records.

Requirements

Requirement: Owner-local DNS configuration

The tf_setup root SHALL consume this owner’s canonical dnsconfig.json through the shared DNS Terraform module, preserving declared record identities and views. DNS resources SHALL default to disabled until the authorized adoption revision and SHALL retain enabled ownership after existing records are imported into the owner’s state. Reconciliation against unchanged declarations and adopted state SHALL propose no record additions, changes, replacements, or deletions.

Mon, 01 Jan 0001 00:00:00 +0000

XCP-ng infrastructure Specification

Purpose

Specify Xen Orchestra resource delegation, scoped authentication, and certificate deployment owned by infra/xcp_ng. The baseline is checked-in source at revision 550d7e79b1f5fdbc2b6017b75178471d6914082f, observed on 2026-09-08. Existing operational observations in project documentation are historical context; this baseline does not verify current deployment, edition, identity synchronization, or service health.

Requirements

Requirement: AppRole resource sets with named inventory

Terraform SHALL declare one Xen Orchestra resource set per entity in Vault’s approles group. Each set SHALL contain its explicitly assigned template, storage repository, and network resolved by names within the selected pool; unassigned sets SHALL contain no inventory objects. Each set SHALL have a positive integer CPU quota, defaulting to 32. These resource sets SHALL represent delegation groups rather than new physical host pools.

Mon, 01 Jan 0001 00:00:00 +0000

owned-dns Specification

Purpose

Define XCP-ng infrastructure DNS management through the owner’s tf root, including canonical declarations, scoped execution, and offline source checks through preparation, adoption, and ongoing reconciliation.

Requirements

Requirement: Owner-local DNS configuration

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure Yandex Cloud

Purpose

Describe organization-level Yandex Cloud folder provisioning derived from Vault AppRole identities. The direct infra/yandex_cloud owner currently contains one concrete organization package, org1, covered here. This baseline does not assert that the cloud organization or its folders were inspected live.

Baseline source revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f. Observation date: 2026-09-08. Sources are linked in full; no excerpts are used.

Sources: top-level documentation, organization package, organization targets, Terraform packaging, folder derivation, provider configuration, and credential injection.

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Deploys the OpenHands components. The inventory has three hosts in three groups, and the playbook applies one component role per group:

Group	Host	Component
`openhands_canvas`	`host1.canvas.openhands.alwaldend.com`	Agent Canvas
`openhands_server_secure`	`host1.server.openhands.alwaldend.com`	Agent server (secured)
`openhands_automation`	`host1.automation.openhands.alwaldend.com`	Automation server

The three XCP-ng VMs exist only for the secured agent server and for the components that must not share a trust boundary with host-bot. The secured group sets openhands_server_session_api_key and hands the same value to the automation server so the automation dispatcher can authenticate its dispatched conversations.

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Architecture

Mon, 01 Jan 0001 00:00:00 +0000

These diagrams render every page of the checked-in Drawio source. They describe the source document, not a live inventory or health check. Pages marked Archive retain the source’s historical classification. Open an image for its full-size SVG.

DC1

Vault

Flux

Forgejo

www

Threexui

DNS

Ceph

Mon, 01 Jan 0001 00:00:00 +0000

See current crush map

Go to Nodes -> Host -> Ceph -> Configuration

Crush map update

Ssh to the PVE host and update the map:

sudo ceph osd getcrushmap -o crushmap.cm
sudo crushtool --decompile crushmap.cm -o crushmap.txt
sudo vim crushmap.txt
sudo crushtool --compile crushmap.txt -o new_crushmap.cm
sudo ceph osd setcrushmap -i new_crushmap.cm
sudo ceph -s

cl

Mon, 01 Jan 0001 00:00:00 +0000

cl

Mon, 01 Jan 0001 00:00:00 +0000

Cloud-init

Mon, 01 Jan 0001 00:00:00 +0000

assets/cloud_init.yaml is the canonical configuration moved from PVE. PVE and Yandex Cloud consume it directly. It owns the Ansible sudo user, SSH keys, local TLS root CA, and common bootstrap policy. The Ansible SSH CA is selected by its certificate-authority principal options; user and key ordering do not affect the Xen configuration. Missing or duplicate Ansible users or CA keys fail template rendering. assets/cloud_init_min.yaml is the existing minimal PVE configuration with QEMU guest tools. Both original PVE files retain their contents.

Cloudflare DNS

Mon, 01 Jan 0001 00:00:00 +0000

Every record this repository declares for the public zone, which Cloudflare serves.

This page is generated from the declarations; run bazel run //infra/dns/cmd/dump -- --write after changing them. The authoritative source is each owner’s dnsconfig.json.

Domain	Type	TTL	Value	Declaration
@	A	300	185.199.108.153	infra/dns/dnsconfig.json
@	A	300	185.199.109.153	infra/dns/dnsconfig.json
@	A	300	185.199.110.153	infra/dns/dnsconfig.json
@	A	300	185.199.111.153	infra/dns/dnsconfig.json
@	AAAA	300	2606:50c0:8000::153	infra/dns/dnsconfig.json
@	AAAA	300	2606:50c0:8001::153	infra/dns/dnsconfig.json
@	AAAA	300	2606:50c0:8002::153	infra/dns/dnsconfig.json
@	AAAA	300	2606:50c0:8003::153	infra/dns/dnsconfig.json
@	MX	300	10 mail.protonmail.ch.	infra/dns/dnsconfig.json
@	MX	300	20 mailsec.protonmail.ch.	infra/dns/dnsconfig.json
@	TXT	300	_globalsign-domain-verification=0QBJgVV_uwcFLTi1Rot3bb1LyJ5uW1WD0ygvIS4OM5	infra/dns/dnsconfig.json
@	TXT	300	protonmail-verification=bdcd133d3f472fa17f66328950d02fbeae1bef75	infra/dns/dnsconfig.json
@	TXT	300	v=spf1 include:_spf.protonmail.ch ~all	infra/dns/dnsconfig.json
_dmarc	TXT	300	v=DMARC1; p=quarantine; adkim=s	infra/dns/dnsconfig.json
_dmarc.simplelogin	TXT	10800	v=DMARC1; p=quarantine; pct=100; adkim=s; aspf=s	infra/dns/dnsconfig.json
canvas.openhands	CNAME	default	ingress.alwaldend.com.	infra/openhands/dnsconfig.json
cloud	CNAME	default	ingress.alwaldend.com.	infra/nas/dnsconfig.json
dc1.automation.openhands	A	default	192.168.10.92	infra/openhands/dnsconfig.json
dc1.canvas.openhands	A	default	192.168.10.90	infra/openhands/dnsconfig.json
dc1.cloud	A	default	192.168.1.209	infra/nas/dnsconfig.json
dc1.host-bot.simeonwarren.users	A	default	192.168.1.210	users/simeonwarren/host_bot/dnsconfig.json
dc1.server.openhands	A	default	192.168.10.91	infra/openhands/dnsconfig.json
dc1.t3code.host-bot.simeonwarren.users	A	default	192.168.1.210	users/simeonwarren/host_bot/dnsconfig.json
dkim._domainkey.simplelogin	CNAME	10800	dkim._domainkey.simplelogin.co.	infra/dns/dnsconfig.json
dkim02._domainkey.simplelogin	CNAME	10800	dkim02._domainkey.simplelogin.co.	infra/dns/dnsconfig.json
dkim03._domainkey.simplelogin	CNAME	10800	dkim03._domainkey.simplelogin.co.	infra/dns/dnsconfig.json
forgejo	CNAME	default	ingress.alwaldend.com.	infra/forgejo/dnsconfig.json
git	CNAME	default	ingress.alwaldend.com.	infra/forgejo/dnsconfig.json
host1.ingress	A	default	81.26.185.118	infra/ingress/dnsconfig.json
ingress	A	default	81.26.185.118	infra/ingress/dnsconfig.json
int.forgejo	A	default	192.168.10.40	infra/forgejo/dnsconfig.json
int.vault	A	default	192.168.1.218	infra/vault/dnsconfig.json
mail._domainkey.yandex	TXT	300	v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcYzFVgkeDOhaIIkWM8gNQjxVsv0/aXfU+ax5urB5y6hA6lSjRnjRo6tm0bXbkOJf41GmiwMNgdXpwRtzgzAlX1i2aJbtEr4b9jzibEGLQ7Cvqs44bOYES9f/K3ueQpnvdTOJmFqlRReFL7ZrUyDFCoQ7f4+7h4i8s01cCcRrt5wIDAQAB	infra/dns/dnsconfig.json
njalla1.nodes.threexui	A	default	45.142.141.133	infra/threexui/dnsconfig.json
njalla1.nodes.threexui	AAAA	default	2a0a:3840:8078:141:0:2d8e:8d85:1337	infra/threexui/dnsconfig.json
pages	A	default	185.199.108.153	projects/alwaldend.com/dnsconfig.json
pages	AAAA	default	2606:50c0:8000::153	projects/alwaldend.com/dnsconfig.json
protonmail._domainkey	CNAME	300	protonmail.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch.	infra/dns/dnsconfig.json
protonmail2._domainkey	CNAME	300	protonmail2.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch.	infra/dns/dnsconfig.json
protonmail3._domainkey	CNAME	300	protonmail3.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch.	infra/dns/dnsconfig.json
simplelogin	MX	10800	10 mx1.simplelogin.co.	infra/dns/dnsconfig.json
simplelogin	MX	10800	20 mx2.simplelogin.co.	infra/dns/dnsconfig.json
simplelogin	TXT	10800	sl-verification=bxfzzfjiggzsxyzxhhmkmjqkaskjgy	infra/dns/dnsconfig.json
simplelogin	TXT	10800	v=spf1 include:simplelogin.co ~all	infra/dns/dnsconfig.json
t3code.host-bot.simeonwarren.users	CNAME	default	ingress.alwaldend.com.	users/simeonwarren/host_bot/dnsconfig.json
vault	CNAME	default	ingress.alwaldend.com.	infra/vault/dnsconfig.json
www	CNAME	300	alwaldend.com.	infra/dns/dnsconfig.json
www-staging	CNAME	300	alwaldend.github.io.	infra/dns/dnsconfig.json
yandex	MX	21600	10 mx.yandex.net.	infra/dns/dnsconfig.json
yandex	TXT	300	v=spf1 redirect=_spf.yandex.net	infra/dns/dnsconfig.json
yandex	TXT	300	yandex-verification: b83672f59b3dbe16	infra/dns/dnsconfig.json
yc.threexui	NS	default	ns1.yandexcloud.net.	infra/threexui/dnsconfig.json
yc.threexui	NS	default	ns2.yandexcloud.net.	infra/threexui/dnsconfig.json
yc1.nodes.threexui	CNAME	default	host1.nodes.yc.threexui.alwaldend.com.	infra/threexui/dnsconfig.json

Dns

Mon, 01 Jan 0001 00:00:00 +0000

DNS records live in each owner’s dnsconfig.json. Each owner manages its records through the reusable Terraform DNS module from its designated tf_setup or tf root. This component’s dnsconfig.json owns shared apex and mail records.

Declaration pages

Cloudflare DNS and Mikrotik DNS list the records this repository declares for each destination view, with the owning declaration for every record. They are generated from dnsconfig.json:

bazel_agent bazel run //infra/dns/cmd/dump -- --write

//infra/dns:config_test fails when a checked-in page is out of date, so the pages cannot drift from the declarations they project.

flux

Mon, 01 Jan 0001 00:00:00 +0000

Set up port forwarding

ssh -L 6443:127.0.0.1:6443 -N flux.alwaldend.com

Run flux CLI

bazel run //infra/flux/cl:flux

Show flux status

bazel run infra/flux/cl:flux -- get all -A

Run bootstrap

bazel run //infra/flux/cl:flux.bootstrap

Run flux operator

bazel run //infra/flux/cl:op

Show oidc info

bazel run //infra/flux/cl:oidc

Renew certificate

bazel run //infra/flux/cl:cmctl -- renew traefik-gateway-websecure-tls -n traefik

Update secrets

Generate secret id and the token:

SECRET_ID=$(bazel run //infra/flux/cl:vault.secret_id | jq -r .data.secret_id)
TOKEN=$(echo "${SECRET_ID}" | bazel run //infra/flux/cl:vault.ops_token | jq -r .auth.client_token)
echo "Secret id: ${SECRET_ID}, Token: ${TOKEN}"

Patch secret-id in ./cl/cert-manager/issuer-approle.yaml
Patch token in projects/kustomization/flux-repo/flux-sops-secret.yaml

Encrypt:

bazel run //infra/flux/cl:sops.encrypt infra/flux/cl/cert-manager/issuer-approle.yaml
bazel run //infra/flux/cl:sops.encrypt projects/kustomization/flux-repo/flux-sops-secret.yaml
bazel run //infra/flux/cl:sops.encrypt projects/kustomization/flux-repo/flux-git-src-secret.yaml

forgejo

Mon, 01 Jan 0001 00:00:00 +0000

Repository configuration

Service Terraform consumes the shared repository catalog for organization-owned repositories and named administrator/developer roles. Vault continues to own OIDC login identities and service-specific access. See service Terraform for identity validation, state adoption, and the preserved automation grants.

Deployment

Forgejo is recreated on XCP-ng through Xen Orchestra, using the src_infra_dc1_forgejo1 resource set provisioned by infra/xcp_ng. VM provisioning authenticates to XO through Vault OIDC as Forgejo’s own AppRole. Its exact synchronized user receives the resource-set membership and an explicit administration ACL on the existing Forgejo VM; it does not use the shared infrastructure administrator token. These bindings must be applied by infra/xcp_ng/tf before Forgejo’s setup Terraform runs.

Forgejo runner

Mon, 01 Jan 0001 00:00:00 +0000

Deploy VMs

bazel run //infra/forgejo_runner/tf_setup # Create VMs
bazel run //infra/forgejo_runner/ansible # Configure VMs

GitHub

Mon, 01 Jan 0001 00:00:00 +0000

This project manages the GitHub organization and repositories declared by the shared repository catalog, including existing forks, project landing sites, organization membership, and developer access.

Service Terraform adopts existing resources and preserves their identities. It also manages repository default-branch rules and existing Pages configuration. Site content is published through the owning project deployment targets; this infrastructure package does not publish it.

GitHub Terraform

Mon, 01 Jan 0001 00:00:00 +0000

This package consumes the shared repository catalog through its provider-free Terraform module. The catalog supplies the GitHub owner, repositories, default branches, repository settings, organization administrators, and developers. This root supports one GitHub organization per provider instance and rejects multiple configured owners.

Existing repositories are imported, including forks. The apex site repository keeps its Pages configuration and custom domain. Published repository names and Pages domains come directly from the catalog; they are not regenerated from the current build-project registry.

GitLab

Mon, 01 Jan 0001 00:00:00 +0000

This project owns GitLab groups, memberships, repository imports, and forks through the Terraform module. Organization membership and repository definitions come from the shared repository catalog.

GitLab Terraform

Mon, 01 Jan 0001 00:00:00 +0000

This module manages the GitLab groups, memberships, repository imports, and forks declared in the shared repository catalog. Its catalog module supplies names, source URLs, and repository settings. Provider versions and checksums are recorded in the shared provider declarations.

Catalog administrators receive the Owner role; catalog users receive the Developer role. Group defaults permit Maintainers and Owners to push and merge into default branches, with force pushes and developer initial pushes disabled. Developers can read repositories, create feature branches, and open merge requests. Existing higher direct or inherited grants must be reviewed separately because GitLab retains a user’s highest access level.

harbor

Mon, 01 Jan 0001 00:00:00 +0000

Update secrets

Generate approle secret id:

SECRET_ID=$(bazel run //infra/harbor/cl:vault.secret_id | jq -r .data.secret_id)
echo "Secret id: ${SECRET_ID}"

Patch secret-id in ./cl/cert-manager/issuer-approle.yaml

Encrypt:

bazel run //infra/flux/cl:sops.encrypt infra/harbor/cl/cert-manager/issuer-approle.yaml

ingress

Mon, 01 Jan 0001 00:00:00 +0000

Run ansible

bazel run //infra/ingress/ansible

Services in traefik_services must use a backend target that resolves from the ingress hosts without resolving back to ingress. Define a dedicated site-local address, conventionally prefixed with dc1., in the owning service’s DNS configuration and use that address as the target.

Apply terraform

bazel run //infra/ingress/tf

Update signed image url

Create a signed url: https://yandex.cloud/ru/docs/storage/operations/objects/link-for-download
Update the secret: alwaldend.com/vault1/approles/src_infra_ingress/image

Recreate VMs

bazel run infra/ingress/tf -- -replace 'yandex_compute_disk.vpc["*"]'

Regenerate wireguard keys

Regenerate private and public keys:

wg genkey | tee host1.privatekey.txt | wg pubkey >host1.publickey.txt
wg genkey | tee host2.privatekey.txt | wg pubkey >host2.publickey.txt
wg genkey | tee router.privatekey.txt | wg pubkey >router.publickey.txt
cat - >data.json <<EOF
{
  "wg_public_keys": {
    "host1": "$(cat host1.publickey.txt)",
    "host2": "$(cat host2.publickey.txt)",
    "router": "$(cat router.publickey.txt)"
  },
  "wg_private_keys": {
    "host1": "$(cat host1.privatekey.txt)",
    "host2": "$(cat host2.privatekey.txt)",
    "router": "$(cat router.privatekey.txt)"
  },
  "wg_preshared_keys": {
    "host1": "$(openssl rand 32 | base64)",
    "host2": "$(openssl rand 32 | base64)"
  }
}
EOF
bazel run infra/ingress:vault.kv_put -- -format json alwaldend.com/vault1/approles/src_infra_ingress/wireguard "@${PWD}/data.json"
rm data.json *.privatekey.txt *.publickey.txt

Mikrotik

Mon, 01 Jan 0001 00:00:00 +0000

The Terraform package prepares owner-local DNS management. Router exports remain documentation inputs and are not applied by that package.

Deployment

Open Winbox
Open new terminal
Run /export
Copy output

Exports

Router1

/interface bridge
add admin-mac=78:9A:18:38:6C:CA auto-mac=no comment="bridge1 (wired)" name=bridge1
add comment="bridge2 (wireless)" name=bridge2
/interface wifi
set [ find default-name=wifi1 ] channel.frequency=5000-5400 .skip-dfs-channels=10min-cac comment="wifi1 (5GHz)" configuration.country=Russia .mode=ap .ssid=divinity-5GHz datapath.client-isolation=yes disabled=no security.authentication-types=wpa2-psk,wpa3-psk .connect-priority=0 .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac comment="wifi2 (2GHz)" configuration.country=Russia .mode=ap .ssid=divinity-2GHz datapath.client-isolation=yes disabled=no security.authentication-types=wpa2-psk,wpa3-psk .connect-priority=0 .ft=yes .ft-over-ds=yes
/interface ethernet
set [ find default-name=ether1 ] comment=ether1 l2mtu=1500 mac-address=F4:28:53:7F:A4:59
set [ find default-name=ether2 ] comment=ether2
set [ find default-name=ether3 ] comment=ether3
set [ find default-name=ether4 ] comment=ether4
set [ find default-name=ether5 ] comment=ether5
/interface wireguard
add comment="tf[users/simeonwarren/hermes/tf_setup]" disabled=yes listen-port=13232 mtu=1420 name=hermes-vpc
add comment="tf[infra/ingress/tf]" listen-port=13231 mtu=1420 name=ingress-vpc
/interface ethernet switch
set switch1 cpu-flow-control=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=accept-forward-WAN
add name=accept-input-DNS
add name=accept-input-DHCP-server
add name=accept-input-ICMP
add name=accept-input-winbox
add name=accept-input-web-ui
add name=accept-input-mikrotik-neighbor-discovery
add name=accept-forward-LAN
add name=accept-output-LAN
add name=accept-input-NTP
add name=accept-input-API
/ip pool
add comment=bridge1 name=bridge1 ranges=192.168.1.10-192.168.1.254
add comment=bridge2 name=bridge2 ranges=192.168.2.10-192.168.2.254
/ip dhcp-server
add address-pool=bridge1 comment=bridge1 interface=bridge1 lease-time=10m name=bridge1
add address-pool=bridge2 interface=bridge2 name=bridge2
/ipv6 pool
add name=dc01 prefix=fd2e:546d:5738::/48 prefix-length=64
/user group
add comment=src_infra_dns name=src_infra_dns policy=read,write,api,rest-api,!local,!telnet,!ssh,!ftp,!reboot,!policy,!test,!winbox,!password,!web,!sniff,!sensitive,!romon
add comment=src_infra_ingress name=src_infra_ingress policy=read,write,api,rest-api,!local,!telnet,!ssh,!ftp,!reboot,!policy,!test,!winbox,!password,!web,!sniff,!sensitive,!romon
add comment=users_simeonwarren name=users_simeonwarren policy=read,write,api,rest-api,!local,!telnet,!ssh,!ftp,!reboot,!policy,!test,!winbox,!password,!web,!sniff,!sensitive,!romon
/interface bridge port
add bridge=bridge1 comment=bridge1-ether2 interface=ether2
add bridge=bridge1 comment=bridge1-ether3 interface=ether3
add bridge=bridge1 comment=bridge1-ether4 interface=ether4
add bridge=bridge1 comment=bridge1-ether5 interface=ether5
add bridge=bridge2 comment=bridge2-wifi1 interface=wifi1
add bridge=bridge2 comment=bridge2-wifi2 interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=WAN
/interface list member
add interface=bridge1 list=LAN
add interface=ether1 list=WAN
add interface=bridge2 list=LAN
add interface=bridge2 list=accept-forward-WAN
add interface=bridge1 list=accept-forward-WAN
add interface=bridge1 list=accept-input-DNS
add interface=bridge2 list=accept-input-DNS
add interface=bridge1 list=accept-input-DHCP-server
add interface=bridge2 list=accept-input-DHCP-server
add interface=bridge1 list=accept-input-ICMP
add interface=bridge2 list=accept-input-ICMP
add interface=bridge1 list=accept-input-winbox
add interface=bridge1 list=accept-input-web-ui
add interface=bridge1 list=accept-input-mikrotik-neighbor-discovery
add interface=bridge1 list=accept-forward-LAN
add interface=bridge1 list=accept-output-LAN
add interface=bridge1 list=accept-input-NTP
add interface=bridge1 list=accept-input-API
add comment="tf[infra/ingress/tf]" interface=ingress-vpc list=accept-input-ICMP
add comment="tf[infra/ingress/tf]" interface=ingress-vpc list=LAN
add comment="tf[infra/ingress/tf]" interface=ingress-vpc list=accept-forward-LAN
add comment="tf[users/simeonwarren/hermes/tf_setup]" interface=hermes-vpc list=accept-forward-LAN
add comment="tf[users/simeonwarren/hermes/tf_setup]" interface=hermes-vpc list=accept-input-ICMP
add comment="tf[users/simeonwarren/hermes/tf_setup]" interface=hermes-vpc list=LAN
/interface ovpn-server server
add mac-address=FE:B3:B4:C4:A4:48 name=ovpn-server1
/interface wireguard peers
add allowed-address=10.10.0.2/24 comment=host2 endpoint-address=103.76.53.6 endpoint-port=51820 interface=ingress-vpc name=ingress-vpc-host2 persistent-keepalive=5s public-key="Z2JamOjZYOGaf4tPZzchyHjLw/XlOtUtQObyROEQ9DM="
add allowed-address=10.10.0.1/24 comment=host1 endpoint-address=158.160.196.128 endpoint-port=51820 interface=ingress-vpc name=ingress-vpc-host1 persistent-keepalive=5s public-key="xmyl+frvngmzRB9z5yEURxQj4vTw47tKQV7EZrTAREw="
add allowed-address=10.20.0.1/24 comment=host1 endpoint-address=158.160.220.223 endpoint-port=51820 interface=hermes-vpc name=hermes-vpc-host1 persistent-keepalive=5s public-key="oA4ZpsmrclIOIWh3ECsb4ZFKH1hQMDtuW3xNXat3IyQ="
/ip settings
set send-redirects=no
/ip address
add address=192.168.1.1/24 comment="bridge1 (LAN)" interface=bridge1 network=192.168.1.0
add address=192.168.2.1/24 comment="bridge2 (Wireless)" interface=bridge2 network=192.168.2.0
add address=192.168.10.1/24 comment=host1.pve1.dc1.alwaldend.com interface=bridge1 network=192.168.10.0
add address=10.10.0.0/24 comment="tf[infra/ingress/tf]" interface=ingress-vpc network=10.10.0.0
add address=10.20.0.0/24 comment="tf[users/simeonwarren/hermes/tf_setup]" interface=hermes-vpc network=10.20.0.0
/ip dhcp-client
add comment=defconf interface=ether1 name=ether1 use-peer-dns=no
/ip dhcp-server lease
add address=192.168.1.250 client-id=1:2c:cf:67:67:b5:13 mac-address=2C:CF:67:67:B5:13 server=bridge1
add address=192.168.1.218 client-id=1:e0:be:3:2b:9a:1a mac-address=E0:BE:03:2B:9A:1A server=bridge1
add address=192.168.1.216 client-id=ff:60:8:6d:aa:0:1:0:1:31:93:31:1a:34:5a:60:8:6d:aa mac-address=34:5A:60:08:6D:AA server=bridge1
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.1 gateway=192.168.1.1
add address=192.168.2.0/24 dns-server=192.168.2.1 gateway=192.168.2.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.2,1.0.0.2 use-doh-server=https://odoh.cloudflare-dns.com/dns-query verify-doh-cert=yes
/ip dns static
add address=185.199.108.153 name=alwaldend.com ttl=5m type=A
add address=185.199.109.153 name=alwaldend.com ttl=5m type=A
add address=185.199.110.153 name=alwaldend.com ttl=5m type=A
add address=185.199.111.153 name=alwaldend.com ttl=5m type=A
add address=2606:50c0:8000::153 name=alwaldend.com ttl=5m type=AAAA
add address=2606:50c0:8001::153 name=alwaldend.com ttl=5m type=AAAA
add address=2606:50c0:8002::153 name=alwaldend.com ttl=5m type=AAAA
add address=2606:50c0:8003::153 name=alwaldend.com ttl=5m type=AAAA
add mx-exchange=mail.protonmail.ch mx-preference=10 name=alwaldend.com ttl=5m type=MX
add mx-exchange=mailsec.protonmail.ch mx-preference=20 name=alwaldend.com ttl=5m type=MX
add name=alwaldend.com text="_globalsign-domain-verification=0QBJgVV_uwcFLTi1Rot3bb1LyJ5uW1WD0ygvIS4OM5" ttl=5m type=TXT
add name=alwaldend.com text="protonmail-verification=bdcd133d3f472fa17f66328950d02fbeae1bef75" ttl=5m type=TXT
add name=alwaldend.com text="v=spf1 include:_spf.protonmail.ch ~all" ttl=5m type=TXT
add name=_dmarc.alwaldend.com text="v=DMARC1; p=quarantine; adkim=s" ttl=5m type=TXT
add cname=protonmail.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch name=protonmail._domainkey.alwaldend.com ttl=5m type=CNAME
add cname=protonmail2.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch name=protonmail2._domainkey.alwaldend.com ttl=5m type=CNAME
add cname=protonmail3.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch name=protonmail3._domainkey.alwaldend.com ttl=5m type=CNAME
add address=192.168.1.222 name=bm1.dc1.alwaldend.com ttl=5m type=A
add address=192.168.1.216 name=bm2.dc1.alwaldend.com ttl=5m type=A
add address=fd2e:546d:5738:0:365a:60ff:fe08:6daa name=bm2.dc1.alwaldend.com ttl=10m type=AAAA
add address=192.168.1.218 name=bm3.dc1.alwaldend.com ttl=5m type=A
add address=fd2e:546d:5738:0:e2be:3ff:fe2b:9a1a name=bm3.dc1.alwaldend.com ttl=10m type=AAAA
add cname=bm2.dc1.alwaldend.com name=host1.pve1.dc1.alwaldend.com ttl=10m type=CNAME
add address=192.168.10.10 name=cloudinit-test.vm.pve1.dc1.alwaldend.com ttl=5m type=A
add address=192.168.1.1 name=router1.dc1.alwaldend.com ttl=5m type=A
add address=fd2e:546d:5738::1 name=router1.dc1.alwaldend.com ttl=10m type=AAAA
add address=192.168.1.254 name=switch1.dc1.alwaldend.com ttl=5m type=A
add address=192.168.1.218 name=vault.dc1.alwaldend.com ttl=5m type=A
add mx-exchange=mx1.simplelogin.co mx-preference=10 name=simplelogin.alwaldend.com ttl=3h type=MX
add mx-exchange=mx2.simplelogin.co mx-preference=20 name=simplelogin.alwaldend.com ttl=3h type=MX
add name=simplelogin.alwaldend.com text="sl-verification=bxfzzfjiggzsxyzxhhmkmjqkaskjgy" ttl=3h type=TXT
add name=simplelogin.alwaldend.com text="v=spf1 include:simplelogin.co ~all" ttl=3h type=TXT
add name=_dmarc.simplelogin.alwaldend.com text="v=DMARC1; p=quarantine; pct=100; adkim=s; aspf=s" ttl=3h type=TXT
add cname=dkim._domainkey.simplelogin.co name=dkim._domainkey.simplelogin.alwaldend.com ttl=3h type=CNAME
add cname=dkim02._domainkey.simplelogin.co name=dkim02._domainkey.simplelogin.alwaldend.com ttl=3h type=CNAME
add cname=dkim03._domainkey.simplelogin.co name=dkim03._domainkey.simplelogin.alwaldend.com ttl=3h type=CNAME
add cname=alwaldend.com name=www.alwaldend.com ttl=5m type=CNAME
add mx-exchange=mx.yandex.net mx-preference=10 name=yandex.alwaldend.com ttl=6h type=MX
add name=yandex.alwaldend.com text="v=spf1 redirect=_spf.yandex.net" ttl=5m type=TXT
add name=yandex.alwaldend.com text="yandex-verification: b83672f59b3dbe16" ttl=5m type=TXT
add name=mail._domainkey.yandex.alwaldend.com text="v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcYzFVgkeDOhaIIkWM8gNQjxVsv0/aXfU+ax5urB5y6hA6lSjRnjRo6tm0bXbkOJf41GmiwMNgdXpwRtzgzAlX1i2aJbtEr4b9jzibEGLQ7Cvqs44bOYES9f/K3ueQpnvdTOJmFqlRReFL7ZrUyDFCoQ7f4+7h4i8s01cCcRrt5wIDAQAB" ttl=5m type=TXT
add address=192.168.1.218 name=host1.vault.dc1.alwaldend.com ttl=5m type=A
add address=192.168.10.60 name=flux.alwaldend.com ttl=5m type=A
add address=192.168.10.60 name=host1.flux.alwaldend.com ttl=5m type=A
add cname=flux.alwaldend.com name=openid.flux.alwaldend.com ttl=10m type=CNAME
add cname=flux.alwaldend.com name=operator.flux.alwaldend.com ttl=10m type=CNAME
add address=192.168.10.40 name=forgejo.alwaldend.com ttl=5m type=A
add address=192.168.10.40 name=host1.forgejo.alwaldend.com ttl=5m type=A
add address=192.168.10.50 name=harbor.alwaldend.com ttl=5m type=A
add address=192.168.10.50 name=host1.harbor.alwaldend.com ttl=5m type=A
add address=192.168.1.216 name=pve.alwaldend.com ttl=5m type=A
add address=192.168.10.80 name=threexui.alwaldend.com ttl=5m type=A
add address=192.168.10.80 name=host1.threexui.alwaldend.com ttl=5m type=A
add address=45.142.141.133 name=njalla1.nodes.threexui.alwaldend.com ttl=5m type=A
add address=2a0a:3840:8078:141:0:2d8e:8d85:1337 name=njalla1.nodes.threexui.alwaldend.com ttl=10m type=AAAA
add address=192.168.1.218 name=vault.alwaldend.com ttl=5m type=A
add address=103.76.53.6 name=ingress.alwaldend.com ttl=5m type=A
add address=158.160.196.128 name=ingress.alwaldend.com ttl=5m type=A
add address=158.160.196.128 name=host1.ingress.alwaldend.com ttl=5m type=A
add address=103.76.53.6 name=host2.ingress.alwaldend.com ttl=5m type=A
add name=yc.threexui.alwaldend.com ns=ns1.yandexcloud.net ttl=5m type=NS
add name=yc.threexui.alwaldend.com ns=ns2.yandexcloud.net ttl=5m type=NS
add cname=host1.nodes.yc.threexui.alwaldend.com name=yc1.nodes.threexui.alwaldend.com ttl=10m type=CNAME
add address=192.168.10.100 name=runner1.forgejo-runner.alwaldend.com ttl=5m type=A
add cname=host1.yc.hermes.simeonwarren.users.alwaldend.com name=hermes.simeonwarren.users.alwaldend.com ttl=10m type=CNAME
add cname=host1.yc.hermes.simeonwarren.users.alwaldend.com name=host1.hermes.simeonwarren.users.alwaldend.com ttl=10m type=CNAME
add name=yc.hermes.simeonwarren.users.alwaldend.com ns=ns1.yandexcloud.net ttl=5m type=NS
add name=yc.hermes.simeonwarren.users.alwaldend.com ns=ns2.yandexcloud.net ttl=5m type=NS
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid log-prefix=drop-invalid
add action=accept chain=input comment="defconf: accept ICMP" in-interface-list=accept-input-ICMP protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN log-prefix=drop-not-coming-from-lan
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log-prefix=drop-invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN log-prefix=drop-from-wan-not-dstnated
add action=accept chain=input in-interface-list=WAN protocol=gre
add action=accept chain=forward comment="accept forward WAN" in-interface-list=accept-forward-WAN out-interface-list=WAN
add action=accept chain=forward comment="accept forward LAN" in-interface-list=accept-forward-LAN out-interface-list=LAN
add action=accept chain=input comment="accept input DNS (udp)" dst-port=53 in-interface-list=accept-input-DNS protocol=udp
add action=accept chain=input comment="accept input DNS (tcp)" dst-port=53 in-interface-list=accept-input-DNS protocol=tcp
add action=accept chain=input comment=accept-input-NTP dst-port=123 in-interface-list=accept-input-NTP protocol=udp
add action=accept chain=input comment="accept input DHCP-server" dst-port=67 in-interface-list=accept-input-DHCP-server log-prefix=accept-DHCP protocol=udp
add action=accept chain=input comment="accept input winbox (tcp)" dst-port=8291 in-interface-list=accept-input-winbox protocol=tcp
add action=accept chain=input comment="accept input winbox (udp)" dst-port=20561 in-interface-list=accept-input-winbox protocol=udp
add action=accept chain=input comment="accept input web ui" dst-port=80,443 in-interface-list=accept-input-web-ui protocol=tcp
add action=accept chain=input comment="accept input mikrotik neighbor discovery" dst-port=5678 in-interface-list=accept-input-mikrotik-neighbor-discovery protocol=udp
add action=drop chain=forward comment="drop forward" log=yes log-prefix=drop-forward
add action=drop chain=input comment="drop input" log=yes log-prefix=drop-input
add action=accept chain=output comment=accept-output-LAN out-interface-list=LAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set www-ssl certificate=alwaldend.com_acme disabled=no
set reverse-proxy certificate=alwaldend.com_acme
set api-ssl certificate=alwaldend.com_acme
/ipv6 address
add address=::1 from-pool=dc01 interface=bridge1
add address=::1:0:0:0:1 from-pool=dc01 interface=bridge2
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" in-interface-list=accept-input-ICMP protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" in-interface-list=accept-input-ICMP protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="accept forward WAN" in-interface-list=accept-forward-WAN out-interface-list=WAN
add action=accept chain=forward comment="accept forward LAN" in-interface-list=accept-forward-LAN out-interface-list=LAN
add action=accept chain=input comment="accept input DNS (udp)" dst-port=53 in-interface-list=accept-input-DNS protocol=udp
add action=accept chain=input comment="accept input DNS (tcp)" dst-port=53 in-interface-list=accept-input-DNS protocol=tcp
add action=accept chain=input comment=accept-input-NTP dst-port=123 in-interface-list=accept-input-NTP protocol=udp
add action=accept chain=input comment="accept input winbox (tcp)" dst-port=8291 in-interface-list=accept-input-winbox protocol=tcp
add action=accept chain=input comment="accept input winbox (udp)" dst-port=20561 in-interface-list=accept-input-winbox protocol=udp
add action=accept chain=input comment="accept input web ui" dst-port=80,443 in-interface-list=accept-input-web-ui protocol=tcp
add action=accept chain=input comment="accept input mikrotik neighbor discovery" dst-port=5678 in-interface-list=accept-input-mikrotik-neighbor-discovery protocol=udp
add action=drop chain=forward comment="drop forward" log=yes log-prefix=drop-forward-ipv6
add action=drop chain=input comment="drop input" log=yes log-prefix=drop-input-ipv6
add action=accept chain=output comment=accept-output-LAN out-interface-list=LAN
/ipv6 nd
set [ find default=yes ] advertise-dns=yes interface=bridge1
add advertise-dns=yes interface=bridge2
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=router1.dc1.alwaldend.com
/system ntp server
set enabled=yes
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Router2

# 2025-09-07 11:04:01 by RouterOS 7.19.4
# model = L009UiGS-2HaxD
/interface bridge
add name=bridge01
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge01 interface=ether2
add bridge=bridge01 interface=ether3
add bridge=bridge01 interface=ether4
add bridge=bridge01 interface=ether5
add bridge=bridge01 interface=ether6
add bridge=bridge01 interface=ether7
add bridge=bridge01 interface=ether8
add bridge=bridge01 interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ipv6 settings
set accept-router-advertisements=yes
/ip dhcp-client
add interface=bridge01
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=router02.dc01.alwaldend.com
/system routerboard settings
set enter-setup-on=delete-key

Mikrotik DNS

Mon, 01 Jan 0001 00:00:00 +0000

Every record this repository declares for the internal dc1 view, which RouterOS serves for that network.

This page is generated from the declarations; run bazel run //infra/dns/cmd/dump -- --write after changing them. The authoritative source is each owner’s dnsconfig.json.

Domain	Type	TTL	Value	Declaration
@	A	300	185.199.108.153	infra/dns/dnsconfig.json
@	A	300	185.199.109.153	infra/dns/dnsconfig.json
@	A	300	185.199.110.153	infra/dns/dnsconfig.json
@	A	300	185.199.111.153	infra/dns/dnsconfig.json
@	AAAA	300	2606:50c0:8000::153	infra/dns/dnsconfig.json
@	AAAA	300	2606:50c0:8001::153	infra/dns/dnsconfig.json
@	AAAA	300	2606:50c0:8002::153	infra/dns/dnsconfig.json
@	AAAA	300	2606:50c0:8003::153	infra/dns/dnsconfig.json
@	MX	300	10 mail.protonmail.ch.	infra/dns/dnsconfig.json
@	MX	300	20 mailsec.protonmail.ch.	infra/dns/dnsconfig.json
@	TXT	300	_globalsign-domain-verification=0QBJgVV_uwcFLTi1Rot3bb1LyJ5uW1WD0ygvIS4OM5	infra/dns/dnsconfig.json
@	TXT	300	protonmail-verification=bdcd133d3f472fa17f66328950d02fbeae1bef75	infra/dns/dnsconfig.json
@	TXT	300	v=spf1 include:_spf.protonmail.ch ~all	infra/dns/dnsconfig.json
_dmarc	TXT	300	v=DMARC1; p=quarantine; adkim=s	infra/dns/dnsconfig.json
_dmarc.simplelogin	TXT	10800	v=DMARC1; p=quarantine; pct=100; adkim=s; aspf=s	infra/dns/dnsconfig.json
automation.openhands	A	default	192.168.10.92	infra/openhands/dnsconfig.json
bm1.dc1	A	default	192.168.1.222	infra/mikrotik/dnsconfig.json
bm2.dc1	A	default	192.168.1.216	infra/pve/dnsconfig.json
bm2.dc1	AAAA	default	fd2e:546d:5738:0:365a:60ff:fe08:6daa	infra/pve/dnsconfig.json
bm3.dc1	A	default	192.168.1.218	infra/vault/dnsconfig.json
bm3.dc1	AAAA	default	fd2e:546d:5738:0:e2be:3ff:fe2b:9a1a	infra/vault/dnsconfig.json
canvas.openhands	A	default	192.168.10.90	infra/openhands/dnsconfig.json
cloud	CNAME	default	nas.alwaldend.com.	infra/nas/dnsconfig.json
cloudinit-test.vm.pve1.dc1	A	default	192.168.10.10	infra/pve/dnsconfig.json
dc1.automation.openhands	A	default	192.168.10.92	infra/openhands/dnsconfig.json
dc1.canvas.openhands	A	default	192.168.10.90	infra/openhands/dnsconfig.json
dc1.cloud	A	default	192.168.1.209	infra/nas/dnsconfig.json
dc1.host-bot.simeonwarren.users	A	default	192.168.1.210	users/simeonwarren/host_bot/dnsconfig.json
dc1.server.openhands	A	default	192.168.10.91	infra/openhands/dnsconfig.json
dc1.t3code.host-bot.simeonwarren.users	A	default	192.168.1.210	users/simeonwarren/host_bot/dnsconfig.json
dkim._domainkey.simplelogin	CNAME	10800	dkim._domainkey.simplelogin.co.	infra/dns/dnsconfig.json
dkim02._domainkey.simplelogin	CNAME	10800	dkim02._domainkey.simplelogin.co.	infra/dns/dnsconfig.json
dkim03._domainkey.simplelogin	CNAME	10800	dkim03._domainkey.simplelogin.co.	infra/dns/dnsconfig.json
flux	A	default	192.168.10.60	infra/flux/dnsconfig.json
forgejo	A	default	192.168.10.40	infra/forgejo/dnsconfig.json
git	A	default	192.168.10.40	infra/forgejo/dnsconfig.json
harbor	A	default	192.168.10.50	infra/harbor/dnsconfig.json
host-bot.simeonwarren.users	A	default	192.168.1.210	users/simeonwarren/host_bot/dnsconfig.json
host1.automation.openhands	A	default	192.168.10.92	infra/openhands/dnsconfig.json
host1.canvas.openhands	A	default	192.168.10.90	infra/openhands/dnsconfig.json
host1.cloud	CNAME	default	host1.nas.alwaldend.com.	infra/nas/dnsconfig.json
host1.flux	A	default	192.168.10.60	infra/flux/dnsconfig.json
host1.forgejo	A	default	192.168.10.40	infra/forgejo/dnsconfig.json
host1.harbor	A	default	192.168.10.50	infra/harbor/dnsconfig.json
host1.ingress	A	default	81.26.185.118	infra/ingress/dnsconfig.json
host1.nas	A	default	192.168.1.209	infra/nas/dnsconfig.json
host1.pve1.dc1	CNAME	default	bm2.dc1.alwaldend.com.	infra/pve/dnsconfig.json
host1.server.openhands	A	default	192.168.10.91	infra/openhands/dnsconfig.json
host1.threexui	A	default	192.168.10.80	infra/threexui/dnsconfig.json
host1.vault.dc1	A	default	192.168.1.218	infra/vault/dnsconfig.json
host1.xcp-ng	A	default	192.168.1.213	infra/xcp_ng/dnsconfig.json
host1.xoa.xcp-ng	A	default	192.168.1.206	infra/xcp_ng/dnsconfig.json
ingress	A	default	81.26.185.118	infra/ingress/dnsconfig.json
mail._domainkey.yandex	TXT	300	v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcYzFVgkeDOhaIIkWM8gNQjxVsv0/aXfU+ax5urB5y6hA6lSjRnjRo6tm0bXbkOJf41GmiwMNgdXpwRtzgzAlX1i2aJbtEr4b9jzibEGLQ7Cvqs44bOYES9f/K3ueQpnvdTOJmFqlRReFL7ZrUyDFCoQ7f4+7h4i8s01cCcRrt5wIDAQAB	infra/dns/dnsconfig.json
nas	A	default	192.168.1.209	infra/nas/dnsconfig.json
njalla1.nodes.threexui	A	default	45.142.141.133	infra/threexui/dnsconfig.json
njalla1.nodes.threexui	AAAA	default	2a0a:3840:8078:141:0:2d8e:8d85:1337	infra/threexui/dnsconfig.json
openid.flux	CNAME	default	flux.alwaldend.com.	infra/flux/dnsconfig.json
operator.flux	CNAME	default	flux.alwaldend.com.	infra/flux/dnsconfig.json
protonmail._domainkey	CNAME	300	protonmail.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch.	infra/dns/dnsconfig.json
protonmail2._domainkey	CNAME	300	protonmail2.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch.	infra/dns/dnsconfig.json
protonmail3._domainkey	CNAME	300	protonmail3.domainkey.djgwfzcu5fgjtpoijqqomgifmqj6zeiuwdd4mzim4hrxab3zsgwkq.domains.proton.ch.	infra/dns/dnsconfig.json
pve	A	default	192.168.1.216	infra/pve/dnsconfig.json
router1.dc1	A	default	192.168.1.1	infra/mikrotik/dnsconfig.json
router1.dc1	AAAA	default	fd2e:546d:5738::1	infra/mikrotik/dnsconfig.json
runner1.forgejo-runner	A	default	192.168.10.100	infra/forgejo_runner/dnsconfig.json
server.openhands	A	default	192.168.10.91	infra/openhands/dnsconfig.json
simplelogin	MX	10800	10 mx1.simplelogin.co.	infra/dns/dnsconfig.json
simplelogin	MX	10800	20 mx2.simplelogin.co.	infra/dns/dnsconfig.json
simplelogin	TXT	10800	sl-verification=bxfzzfjiggzsxyzxhhmkmjqkaskjgy	infra/dns/dnsconfig.json
simplelogin	TXT	10800	v=spf1 include:simplelogin.co ~all	infra/dns/dnsconfig.json
switch1.dc1	A	default	192.168.1.254	infra/mikrotik/dnsconfig.json
t3code.host-bot.simeonwarren.users	A	default	192.168.1.210	users/simeonwarren/host_bot/dnsconfig.json
threexui	A	default	192.168.10.80	infra/threexui/dnsconfig.json
vault	A	default	192.168.1.218	infra/vault/dnsconfig.json
vault.dc1	A	default	192.168.1.218	infra/vault/dnsconfig.json
www	CNAME	300	alwaldend.com.	infra/dns/dnsconfig.json
www-staging	CNAME	300	alwaldend.github.io.	infra/dns/dnsconfig.json
xcp-ng	A	default	192.168.1.213	infra/xcp_ng/dnsconfig.json
xoa.xcp-ng	A	default	192.168.1.206	infra/xcp_ng/dnsconfig.json
yandex	MX	21600	10 mx.yandex.net.	infra/dns/dnsconfig.json
yandex	TXT	300	v=spf1 redirect=_spf.yandex.net	infra/dns/dnsconfig.json
yandex	TXT	300	yandex-verification: b83672f59b3dbe16	infra/dns/dnsconfig.json
yc.threexui	NS	default	ns1.yandexcloud.net.	infra/threexui/dnsconfig.json
yc.threexui	NS	default	ns2.yandexcloud.net.	infra/threexui/dnsconfig.json
yc1.nodes.threexui	CNAME	default	host1.nodes.yc.threexui.alwaldend.com.	infra/threexui/dnsconfig.json

Nas

Mon, 01 Jan 0001 00:00:00 +0000

The Terraform package prepares this owner’s DNS records through its dedicated Vault AppRole. NAS service provisioning remains outside that root.

OpenHands

Mon, 01 Jan 0001 00:00:00 +0000

OpenHands deploys as separate components because each owns a distinct responsibility and trust boundary:

Component	Responsibility
Agent Canvas	Browser client for conversations, files, settings, backends, automations
Agent Server	Runs conversations, agents, tools, and workspace operations
Automation Server	Stores schedules and triggers, tracks runs, dispatches conversations

The agent server runs directly on the host with the service account’s permissions. Its workspace is a working directory; operating-system account permissions define its access to the host. Treat the agent server host as trusted infrastructure.

Org1

Mon, 01 Jan 0001 00:00:00 +0000

Output

Mon, 01 Jan 0001 00:00:00 +0000

Pve

Mon, 01 Jan 0001 00:00:00 +0000

Deployment

bazel run //infra/pve/ansible # host setup
bazel run //infra/pve/tf/tf.apply # tf setup

Recreate the test VM

bazel run //infra/pve/tf:tf.apply -- --replace module.vm_cloudinit_test.proxmox_vm_qemu.vm

Cloud-init snippet update

bazel run //infra/pve/ansible -- --tags pve_snippets

Update ACME account

Create an EAB:

bazel run //infra/dc1/vault -- write -f pki/ica_servers/roles/src_infra_dc1_pve1_pki_server/acme/new-eab

Login as root@pam
Go to Datacenter -> ACME

Create a new account with the EAB and a directory:

https://vault.dc1.alwaldend.com:8200/v1/pki/ica_servers/roles/src_infra_dc1_pve1_pki_server/acme/directory

Pve token

Create a token with Privilege Separation
Grant it required roles

Create json:

{
  "token_id": "",
  "token_secret": ""
}

Write the data:

bazel run //infra/pve:vault.kv_put alwaldend.com/vault1/approles/src_infra_dc1_pve1/pve_token @"${PWD}/data.json"

Repositories

Mon, 01 Jan 0001 00:00:00 +0000

This project owns the organization and repository catalog consumed by GitHub, GitLab, and Forgejo. Named organization administrators and developers belong in this catalog. Root configuration owns the schema version and defaults. Each organization owns orgs/<organization>/org.json and one orgs/<organization>/repos/<repository>.json file per repository. Vault continues to own Forgejo login identities and service-specific access.

First-party means owned by us, regardless of forge. Our repositories retain their chosen names across GitHub, GitLab, and Forgejo: alwaldend/src stays alwaldend/src, including when copied or synchronized between those forges.

Repository catalog module

Mon, 01 Jan 0001 00:00:00 +0000

This provider-free Terraform module reads the catalog files, merges forge defaults, and projects organization-owned repository names and settings for each consumer. It creates no resources and uses no credentials.

Fork and mirror names follow the catalog naming contract. Output keys retain the organization and catalog key, independently of the derived destination name. The consumers retain their existing state addresses where resources were already managed.

The catalog test runs without network access or provider initialization:

Shared DNS Terraform

Mon, 01 Jan 0001 00:00:00 +0000

This root consumes the canonical common declarations through the reusable DNS module. It uses the src_infra_dns AppRole and its existing Vault-backed HTTP state. Both Cloudflare and RouterOS credentials are injected through the tf=1 stage label.

Shared apex and mail records were adopted on 2026-09-13. dns_enabled now defaults to true; reconciliation against the adopted state and unchanged declarations must propose no record changes. The adoption evidence records 60 imports and preservation of both complete provider inventories.

Source repository

Mon, 01 Jan 0001 00:00:00 +0000

This project owns the OpenSpec workspace describing evolution of the alwaldend/src monorepo: its shared structure, build system and development workflows. It also retains the index of the goal-to-OpenSpec migration. Individual projects own their own specifications and change history.

The repository root remains the Bazel workspace and owns shared executable configuration. This directory owns repository development specifications; adding or changing them does not provision infrastructure.

Run the pinned CLI from the repository root. It selects this project by default:

sub

Mon, 01 Jan 0001 00:00:00 +0000

Terraform

Mon, 01 Jan 0001 00:00:00 +0000

This configuration manages one Xen Orchestra resource set per Vault AppRole and configures the installed XO OIDC plugin through a packaged JSON-RPC helper. See the project documentation for requirements and checks.

Resource-set subjects reference exact synchronized OIDC users whose OIDC subject identifiers match Vault AppRole entity UUIDs. AppRole groups can include other service entities, so using those groups would grant access across deployments. Bootstrap XO’s OIDC configuration first, then log in through OIDC as each AppRole and run the full Terraform apply. Identity discovery runs at plan time and never creates users. AppRoles that have not logged in are listed in approles_pending_oidc_login; their sets remain without subjects until the next apply after login. Groups remain responsible for login entitlement and administrative access, separately from these per-AppRole grants.

Terraform setup

Mon, 01 Jan 0001 00:00:00 +0000

Use this package’s dns.plan, dns.show, and dns.apply targets for the scoped DNS adoption workflow.

These targets select dns=1 and target module.dns with the existing src_infra_forgejo_runner AppRole and setup backend. Plan declared imports, inspect the saved plan with dns.show, and apply only the reviewed file with dns.apply. Ordinary setup commands retain their tf=setup flow.

dns_enabled defaults to true after verified adoption. Keep it enabled to retain existing records; disabling it would propose deletion. The adoption record contains the import, follow-up plan, inventory, and DNS verification evidence. The shared cutover procedure owns prerequisites and recovery. Scoped DNS checks do not establish VM or runner service health.

Tf

Mon, 01 Jan 0001 00:00:00 +0000

This package configures Forgejo organizations, repositories, and access from the shared repository catalog. The catalog owns named administrators, developers, repository identities, and destination names. Its Terraform module supplies the consumer’s repository projection. First-party names remain stable across forges; external fork and mirror names retain their original upstream identity.

Before applying, provision the Vault OIDC authentication source with Ansible and set TF_VAR_vault_oauth_source_id to its verified positive numeric ID. Obtain the ID from forgejo admin auth list on the instance using the service’s config and work path; confirm that the vault source is active and uses OpenID Connect with the expected Vault issuer. Do not assume source IDs survive instance recreation.

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Use this package’s dns.plan, dns.show, and dns.apply targets for the scoped DNS adoption workflow.

DNS ownership is enabled by default after the verified 2026-09-13 adoption. The adoption evidence records four imports, a no-change follow-up plan, and preserved provider inventories. The DNS wrappers select dns=1 and module.dns within this root and backend; their validation covers DNS and its dependencies. Apply requires a reviewed saved plan, and ordinary ingress service authentication remains separate.

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Use this package’s dns.plan, dns.show, and dns.apply targets for the scoped DNS adoption workflow. They select dns=1 and target module.dns in this root, retaining the src_infra_dc1_pve1 AppRole and existing backend. Use the owner preparation and import procedure for declarative import maps and reviewed saved-plan apply.

dns_enabled defaults to true after the completed adoption. Reconciliation against adopted state and unchanged declarations produces no DNS changes. DNS targeting covers DNS and its dependencies; it does not establish PVE host, API, or service health. Ordinary Terraform commands retain their existing Proxmox authentication.

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

DNS identities

Missing DNS-owner AppRoles compose the existing reusable AppRole module with an owner-specific DNS policy in approles/<name>/. DNS access grants read-only access to the existing provider credentials for the owner’s views. Existing component identities receive these policies through their existing module declarations.

DNS-only group membership adds no policies. These identities retain their own state and named shared-secret access without joining the general infrastructure AppRole group or receiving cloud provisioning, SSH, or PKI permissions.

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

This root owns the Flux DNS declaration. DNS ownership defaults to enabled after verified adoption; keep it enabled to retain the managed records.

Use //infra/flux/tf_setup:dns.plan, :dns.show, and :dns.apply for scoped DNS reconciliation. These targets retain the setup backend and src_infra_flux AppRole, select dns=1, and target module.dns. Apply requires a reviewed saved plan. Reconciliation of unchanged declarations must produce no DNS changes.

The ordinary setup targets retain their service authentication behavior. DNS checks do not establish PVE VM or service health; current aggregate source validation remains part of repository delivery.

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

This package creates a Xen Orchestra VM in the src_infra_dc1_forgejo1 resource set. infra/forgejo/al.lua authenticates with Forgejo’s own Vault AppRole and the packaged XO OIDC login plugin. The plugin supplies a temporary XO token and revokes it on shutdown; no infrastructure administrator token is loaded. The setup HTTP backend remains owned by the same Forgejo config.

Before running this package, bootstrap the AppRole’s XO OIDC user and apply its resource-set membership and existing VM ACL through infra/xcp_ng/tf. Subjects are matched by immutable Vault entity UUID under the configured OIDC issuer, not by login name or AppRole group membership. See XO authentication.

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

This root owns the Harbor DNS declaration. DNS ownership defaults to enabled after verified adoption; keep it enabled to retain the managed records.

Use //infra/harbor/tf_setup:dns.plan, :dns.show, and :dns.apply for scoped DNS reconciliation. These targets retain the setup backend and src_infra_harbor AppRole, select dns=1, and target module.dns. Apply requires a reviewed saved plan. Reconciliation of unchanged declarations must produce no DNS changes.

The ordinary setup targets retain their service authentication behavior. DNS checks do not establish PVE VM or service health; current aggregate source validation remains part of repository delivery.

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

This package creates Xen Orchestra VMs in the src_infra_openhands resource set for the three OpenHands components that run off host-bot: Agent Canvas, the agent server, and the automation server. infra/openhands/al.lua authenticates with OpenHands’ own Vault AppRole and the packaged XO OIDC login plugin. The plugin supplies a temporary XO token and revokes it on shutdown; no infrastructure administrator token is loaded. The setup HTTP backend remains owned by the same OpenHands config.

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Use this package’s dns.plan, dns.show, and dns.apply targets for the scoped DNS adoption workflow.

DNS ownership is enabled by default after the verified 2026-09-13 adoption. The adoption evidence records 12 imports, a no-change follow-up plan, and preserved provider inventories. The DNS wrappers select dns=1 and module.dns within this setup root and backend; their validation covers DNS and its dependencies. Apply requires a reviewed saved plan, and ordinary service authentication remains separate.

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

This root owns Vault’s canonical DNS declaration and retains its existing src_infra_dc1_vault AppRole and setup state backend. Use //infra/vault/tf_setup:dns.plan, dns.show, and dns.apply for the scoped DNS workflow. They select dns=1 and module.dns; apply requires a reviewed saved plan. Ordinary setup and service wrappers retain their existing authentication flow.

dns_enabled defaults to true after verified adoption. Keep it enabled to retain existing records; disabling it would propose deletion. The adoption record contains the import and verification evidence. Targeted DNS checks do not establish the health of other resources in the root.

threexui

Mon, 01 Jan 0001 00:00:00 +0000

Fetch and fix subs for a particular subscription id

bazel run //infra/threexui:fix_subs -- --hosts njalla1.nodes.threexui.alwaldend.com,yc1.nodes.threexui.alwaldend.com --sub_id subid

Fix subs from a local file

bazel run //infra/threexui:fix_subs -- --sub_file path_to_file

Vault

Mon, 01 Jan 0001 00:00:00 +0000

Deployment

bazel run //infra/vault/tf_setup:tf.apply # Create VMs (requires an active Vault host)
bazel run //infra/vault/ansible # Set up hosts (BM and VMs)
bazel run //infra/vault/tf:tf.apply # Configure vault

Backup

bazel run //infra/vault:backup

Unseal

With a working Vault:

bazel run //infra/vault:unseal

Without a working Vault:

bazel run //infra/vault:unseal_standalone

Fix quorum

bazel run //infra/vault/ansible:fix_quorum

Set up only VMs

bazel run //infra/vault/ansible:ansible.vm # Set up only VMs

Set up only bare metal

bazel run //infra/vault/ansible:ansible.bm # Set up only bare metal

Tf

Plan:

XCP-ng

Mon, 01 Jan 0001 00:00:00 +0000

Terraform in tf manages a Xen Orchestra resource set for every entity in Vault’s approles group, following infra/pve/tf. Resource sets are the XO grouping and delegation mechanism; XCP-ng host pools represent physical clusters and are not created per AppRole.

resource_set_inventory assigns a pool, template, storage repository and network by name to each AppRole. Native provider lookups resolve their IDs and reject ambiguous matches. Forgejo and OpenHands have assignments by default; other sets remain empty. Subjects are the exact synchronized OIDC users selected by Vault issuer and immutable AppRole entity UUID. Bootstrap has synchronized the 18 AppRole users; new AppRoles need their first OIDC login before Terraform can bind their sets. resource_set_cpu_limit defaults to 32 CPUs per set. Creating a set does not allocate CPUs or storage.

Xen Orchestra certificates

Mon, 01 Jan 0001 00:00:00 +0000

This playbook installs Debian’s Certbot package and obtains a certificate for xoa.xcp-ng.alwaldend.com and host1.xoa.xcp-ng.alwaldend.com from the Vault src_infra_xcp_ng_pki_server ACME role. The XCP-ng AppRole creates the external account binding; its registration file is removed after issuance.

The target injects xoa_ssh_password from secrets/alwaldend.com/vault1/approles/src_infra_xcp_ng/xoa for the appliance’s xoa SSH account and sudo. Ansible uses its sshpass password mechanism; the controller must provide sshpass and a verified SSH host key. Passwords are runtime environment inputs and are not stored in inventory.

Yandex Cloud

Mon, 01 Jan 0001 00:00:00 +0000